Ransomware Goes Professional: Code-Signing-as-a-Service, Cloud Identity Persistence, and a Wave of ICS Vulnerabilities Threaten State Government Networks

Public Sector

Published on

May 21, 2026

Table of Contents

Threat Assessment Level: ELEVATED (unchanged from prior cycle; trending toward HIGH) The ransomware ecosystem is industrializing its supply chain. A shared code-signing service now enables at least five ransomware families to bypass endpoint defenses with validly signed binaries — while a newly documented AWS persistence technique renders standard incident response containment ineffective. State government IT leaders must act this week. <h2> Executive Summary </h2> Today's intelligence reveals three converging threats to state government networks: <ul> <li> A Malware-Signing-as-a-Service (MSaaS) ecosystem is providing valid code-signing certificates to Qilin, Akira, BlackByte, Rhysida, and INC ransomware operators — all of which have documented government targeting. </li> </ul> <ul> <li> AWS federation persistence allows adversaries to maintain access even after security teams deactivate compromised credentials — a direct challenge to cloud incident response playbooks. </li> </ul> <ul> <li> Five ICS/OT advisories in 24 hours — including unauthenticated remote code execution in SCADA systems and browser takeover in building automation controllers used in government facilities. </li> </ul> Meanwhile, Russian nation-state actors (APT28 and APT29) remain postured against government targets, and China-nexus ValleyRAT command-and-control infrastructure was confirmed active today. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> signspace[.]cloud MSaaS infrastructure identified serving 5+ ransomware families </td> <td> Signed malware bypasses EDR trust policies; state endpoints may execute ransomware without triggering alerts </td> </tr> <tr> <td> AWS sts:GetFederationToken persistence documented by CrowdStrike </td> <td> Disabling API keys does NOT revoke attacker access — standard IR playbooks are broken for AWS </td> </tr> <tr> <td> ScadaBR unauthenticated RCE (ICSA-26-139-03) </td> <td> Open-source SCADA system used in smaller utility/building deployments — no authentication required for exploitation </td> </tr> <tr> <td> Kieback & Peter DDC building controller XSS (ICSA-26-139-05) </td> <td> Browser takeover of building automation management — directly relevant to state government facilities </td> </tr> <tr> <td> APT28 (GRU) phishing domain registered 2026-05-17 tagged for government targeting </td> <td> Active Russian credential harvesting infrastructure aimed at state government employees </td> </tr> <tr> <td> APT29 (SVR/Midnight Blizzard) ATI-Agent malware indicators refreshed 2026-05-20 </td> <td> Russian intelligence service maintaining active capability against government and defense targets </td> </tr> <tr> <td> ValleyRAT/Winos C2 domains active (China-nexus) </td> <td> Fresh command-and-control infrastructure confirmed beaconing; China-nexus actors continue pre-positioning </td> </tr> <tr> <td> Non-human identity theft flagged as fastest-growing underground category (SpyCloud 2026) </td> <td> AI agents, service accounts, and automation principals are now primary targets — most state agencies lack NHI governance </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Relevance </th> </tr> </thead> <tbody> <tr> <td> 2026-05-13 </td> <td> Abyss Locker ransomware exploits CVE-2021-20038 (SonicWall SMA 100) with full kill chain including Veeam credential theft </td> <td> VPN appliance exploitation → ransomware deployment against government </td> </tr> <tr> <td> 2026-05-17 </td> <td> APT28 (GRU) registers phishing domain syd.clarionquestgroup[.]cfd tagged for government targeting </td> <td> Active Russian credential harvesting infrastructure aimed at government </td> </tr> <tr> <td> 2026-05-19 </td> <td> CISA publishes ICS advisories for ScadaBR, Siemens RUGGEDCOM, ABB CoreSense, Kieback & Peter DDC, ZKTeco </td> <td> Batch of critical infrastructure vulnerabilities affecting state facilities </td> </tr> <tr> <td> 2026-05-20 </td> <td> CISA adds 7 vulnerabilities to Known Exploited Vulnerabilities (KEV) catalog — largest single-day batch in weeks </td> <td> Active exploitation confirmed; emergency patching likely required </td> </tr> <tr> <td> 2026-05-20 </td> <td> APT29 (SVR/Midnight Blizzard) refreshes ATI-Agent malware indicators with government/defense targeting </td> <td> Russian intelligence service maintaining active capability against government </td> </tr> <tr> <td> 2026-05-21 </td> <td> MSaaS infrastructure (signspace[.]cloud) identified serving Qilin, Akira, BlackByte, Rhysida, INC ransomware </td> <td> Shared ransomware enabler ecosystem with valid code signatures </td> </tr> <tr> <td> 2026-05-21 </td> <td> CrowdStrike documents AWS federation persistence bypassing credential deactivation </td> <td> Cloud IR containment gap affecting any state agency using AWS </td> </tr> <tr> <td> 2026-05-21 </td> <td> ValleyRAT/Winos C2 domains zzlkkghnmh[.]cn and 1112.688608[.]xyz confirmed active </td> <td> China-nexus RAT infrastructure operational </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Ransomware Supply Chain Professionalization — MSaaS </h3> The discovery of signspace[.]cloud as a shared malware-signing service represents a maturation of the ransomware ecosystem. Rather than each ransomware group independently procuring code-signing certificates, a centralized service now provides this capability to multiple operators simultaneously. Families served: Qilin (REVENANT SPIDER/Agenda), Akira, BlackByte, Rhysida, INC Also distributes: Lumma Stealer, Vidar infostealer, Oyster backdoor Infrastructure: Azure-hosted, abusing legitimate cloud services for certificate procurement Why this matters: State government endpoint protection solutions maintain trust lists for signed binaries. When ransomware arrives bearing a valid code signature, initial detection rates drop substantially. This is not a theoretical concern — Qilin and Akira have both demonstrated government targeting in 2025-2026 campaigns. Strategic implication: Blocking one ransomware group no longer eliminates the threat. The signing service persists and serves the next affiliate. Detection must shift upstream to the enabler layer. <h3> 2. AWS Federation Persistence — IR Playbook Failure </h3> CrowdStrike's incident response teams documented adversaries using sts:GetFederationToken to create federated sessions that survive standard containment actions . The attack chain: <ul> <li> Adversary compromises IAM user credentials </li> </ul> <ul> <li> Calls sts:GetFederationToken to create a federated session </li> </ul> <ul> <li> Federated session inherits all permissions from the base IAM user </li> </ul> <ul> <li> Security team detects compromise and deactivates API keys </li> </ul> <ul> <li> Federated session remains valid — adversary retains full access </li> </ul> <ul> <li> Adversary escalates via AWS Console even without IAM user password </li> </ul> For state agencies using AWS: If your incident response playbook relies on credential deactivation as a containment step, it is insufficient. You must attach explicit deny-all policies to compromised users AND revoke all active sessions. <h3> 3. Identity as the Primary Attack Surface </h3> Multiple intelligence sources converge on a single conclusion: identity is now the dominant attack vector. Key data points: <ul> <li> Identity weaknesses present in ~90% of incident response investigations in 2025 </li> <li> Stolen credentials are the second most common initial access vector (32% of cases) </li> <li> A single cached AWS access key on one endpoint reached 98% of a company's cloud environment </li> <li> Non-human identity theft (AI agents, service accounts) is the fastest-growing category in criminal markets </li> </ul> For state government — with hybrid Active Directory environments, growing cloud adoption, and expanding AI/automation deployments — this represents an existential risk to the entire technology stack. <h3> 4. ICS/OT Vulnerability Surge </h3> Five ICS advisories in 24 hours affecting systems present in state government facilities: <table> <thead> <tr> <th> Advisory </th> <th> System </th> <th> Impact </th> <th> State Gov Relevance </th> </tr> </thead> <tbody> <tr> <td> ICSA-26-139-03 </td> <td> ScadaBR </td> <td> Unauthenticated RCE </td> <td> Water/wastewater, building management </td> </tr> <tr> <td> ICSA-26-139-02 </td> <td> Siemens RUGGEDCOM APE1808 </td> <td> Buffer overflow (PAN-OS) </td> <td> Industrial network appliances </td> </tr> <tr> <td> ICSA-26-139-01 </td> <td> ABB CoreSense HM/M10 </td> <td> Path traversal </td> <td> Motor monitoring in facilities </td> </tr> <tr> <td> ICSA-26-139-05 </td> <td> Kieback & Peter DDC </td> <td> Browser takeover (XSS) </td> <td> Building automation controllers </td> </tr> <tr> <td> ICSA-26-139-04 </td> <td> ZKTeco CCTV </td> <td> Credential disclosure </td> <td> Physical security cameras </td> </tr> </tbody> </table> The Kieback & Peter DDC advisory is particularly concerning for state government: these building automation controllers manage HVAC, lighting, and access systems in government office buildings. The XSS vulnerability allows an attacker to take over an administrator's browser session — potentially gaining control of building systems. <h3> 5. Nation-State Persistent Posture </h3> Russia (APT28/Fancy Bear — GRU): Phishing infrastructure registered May 17 explicitly tagged for government targeting remains active. APT28's ThreatStream model was updated May 21. Russia (APT29/COZY BEAR/Midnight Blizzard — SVR): ATI-Agent malware indicators refreshed May 20 with confirmed government and defense targeting. China-nexus (ValleyRAT/Winos): Two C2 domains confirmed active May 21 (zzlkkghnmh[.]cn, 1112.688608[.]xyz). While ValleyRAT historically targets Chinese-speaking victims, its infrastructure expansion warrants monitoring. China-nexus (Volt Typhoon/Salt Typhoon): No new indicators detected — but for actors known to pre-position in critical infrastructure for months or years before activation, silence is not reassurance. These actors specialize in living-off-the-land techniques that evade traditional detection. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional KEV details require emergency patching of network infrastructure or web application vulnerabilities within 7 days </td> <td> HIGH (>70%) </td> <td> 7-CVE batch from May 20 follows recent pattern of network device and web app vulns; state agencies likely run affected products </td> </tr> <tr> <td> CORNFLAKE fake browser update campaign produces IOCs relevant to state employee endpoints this week </td> <td> MODERATE (40-60%) </td> <td> Campaign model updated today with government targeting tag; delivery mechanism (fake browser updates) is effective against end users </td> </tr> <tr> <td> MSaaS-signed ransomware (Qilin or Akira) successfully encrypts a U.S. state/local government entity within 30 days </td> <td> MODERATE (40-60%) </td> <td> Code-signed binaries reduce detection; both families actively target government; RaaS affiliate model ensures continuous operations </td> </tr> <tr> <td> AWS federation persistence technique used against state government cloud accounts within 60 days </td> <td> MODERATE (30-50%) </td> <td> Technique now publicly documented (CrowdStrike); state agencies with IAM users and limited CloudTrail monitoring are exposed </td> </tr> <tr> <td> Volt Typhoon/Salt Typhoon pre-positioned access in state network infrastructure activated in conjunction with geopolitical escalation </td> <td> LOW but catastrophic (<20%) </td> <td> Absence of signals does not reduce risk; these actors are designed to remain dormant until strategic activation </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> What to Monitor </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> T1553.002 (Code Signing) </td> <td> Execution of binaries signed by unfamiliar or recently-issued certificates </td> <td> Alert on process execution where signer is not in approved publisher list; correlate with signspace[.]cloud DNS queries </td> </tr> <tr> <td> T1078.004 (Cloud Accounts) </td> <td> AWS sts:GetFederationToken API calls </td> <td> CloudTrail query: eventName = GetFederationToken → correlate with subsequent signin.aws.amazon.com/federation requests </td> </tr> <tr> <td> T1098 (Account Manipulation) </td> <td> Federated session creation from IAM users without historical baseline </td> <td> Baseline normal federation patterns; alert on first-time federation from any IAM user </td> </tr> <tr> <td> T1190 (Exploit Public-Facing App) </td> <td> Exploitation attempts against ScadaBR, SonicWall SMA, building controllers </td> <td> IDS signatures for ScadaBR RCE; monitor for unauthenticated API calls to SCADA management interfaces </td> </tr> <tr> <td> T1071.001 (Web Protocols) </td> <td> C2 beaconing to known ValleyRAT/APT28 infrastructure </td> <td> DNS/proxy logs for IOC domains; HTTP beacon pattern analysis for unknown C2 </td> </tr> <tr> <td> T1189 (Drive-by Compromise) </td> <td> Fake browser update prompts (CORNFLAKE campaign) </td> <td> Web proxy alerts for known fake-update redirect patterns; user reports of unexpected update prompts </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ul> <li> Hypothesis: MSaaS-signed binaries present on endpoints. Hunt for recently executed binaries where the code-signing certificate was issued within the last 90 days by a CA not in your baseline. Cross-reference signer thumbprints against threat feeds. </li> </ul> <ul> <li> Hypothesis: AWS federation persistence already established. Query CloudTrail for all GetFederationToken events in the past 90 days. Identify any that were not generated by known automation or expected workflows. Investigate the source IAM user for signs of compromise. </li> </ul> <ul> <li> Hypothesis: Volt Typhoon living-off-the-land in network edge devices. Review Fortinet/Palo Alto/Cisco edge device logs for anomalous administrative sessions, unexpected configuration changes, or outbound connections to residential IP ranges (known Volt Typhoon SOHO router infrastructure). </li> </ul> <ul> <li> Hypothesis: Building automation controllers exposed to internet. Scan for Kieback & Peter DDC, ScadaBR, and ZKTeco management interfaces accessible from non-management VLANs or the internet. Any exposure is an immediate finding. </li> </ul> <h3> Blocking Actions </h3> Block the following at DNS resolvers, web proxies, and EDR: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> signspace[.]cloud </td> <td> MSaaS ransomware enabler infrastructure </td> </tr> <tr> <td> Domain </td> <td> zzlkkghnmh[.]cn </td> <td> ValleyRAT/Winos C2 </td> </tr> <tr> <td> Domain </td> <td> 1112.688608[.]xyz </td> <td> ValleyRAT/Winos C2 </td> </tr> <tr> <td> SHA-256 </td> <td> f0a6b89ec7eee83274cd484cea526b970a3ef28038799b0a5774bb33c5793b55 </td> <td> MSaaS-signed malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> f0668ce925f36ff7f3359b0ea47e3fa243af13cd6ad9661dfccc9ff79fb4f1cc </td> <td> MSaaS-signed malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> 11af4566539ad3224e968194c7a9ad7b596460d8f6e423fc62d1ea5fc0724326 </td> <td> MSaaS-signed malware sample </td> </tr> <tr> <td> SHA-256 </td> <td> d1498ce1ecf8c3ea50dce4b99dd829353ac407cd5fbafe7c1ae02e09ead104b7 </td> <td> ValleyRAT/Winos sample </td> </tr> <tr> <td> SHA-256 </td> <td> 3683d673395b2ef445ea80d604af15a7d05c5d21cdcbbb02fc933298ba9b9862 </td> <td> ValleyRAT/Winos sample </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream and partner feeds. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Tax Systems) </h3> <ul> <li> Primary threat: Ransomware (Qilin/Akira) targeting financial data with MSaaS-signed binaries bypassing endpoint trust </li> <li> Action: Review code-signing trust policies on systems processing tax/revenue data; ensure offline backups of financial databases are tested and current </li> <li> Identity focus: Audit service accounts connecting treasury systems to banking partners; rotate credentials for any account with sts:GetFederationToken permissions </li> </ul> <h3> Energy (State-Managed Utilities, Grid Coordination) </h3> <ul> <li> Primary threat: ScadaBR unauthenticated RCE in SCADA deployments; Volt Typhoon pre-positioning in OT networks </li> <li> Action: Immediately identify any ScadaBR instances in utility environments and isolate from network; conduct configuration audit of Fortinet/Palo Alto edge devices at energy facilities for signs of unauthorized access </li> <li> Hunt priority: Living-off-the-land binaries (LOLBins) executing on OT network jump hosts </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware encryption of health records (Rhysida has documented healthcare targeting); identity-based access to Medicaid databases </li> <li> Action: Verify that Medicaid/HHS systems with citizen PII have network segmentation preventing lateral movement from compromised endpoints; validate that backup systems for health data are not accessible via the same credentials as production </li> <li> Identity focus: Non-human identities connecting EHR systems to state portals — inventory and apply least-privilege </li> </ul> <h3> Government (Executive Branch Agencies, Administrative Systems) </h3> <ul> <li> Primary threat: APT28/APT29 credential phishing targeting state employees; CORNFLAKE fake browser update campaign; AWS federation persistence </li> <li> Action: Brief agency security liaisons on fake browser update indicators; implement conditional access policies requiring compliant devices for cloud resource access; audit AWS IAM users across all state accounts </li> <li> Identity focus: Cached credentials on endpoints — scan for stored AWS keys, Azure tokens, and service account passwords in user profiles </li> </ul> <h3> Aviation/Logistics (State DOT, Port Authorities, Airport Systems) </h3> <ul> <li> Primary threat: ICS/OT vulnerabilities in transportation management systems; Siemens RUGGEDCOM buffer overflow affecting industrial network appliances </li> <li> Action: Identify RUGGEDCOM APE1808 appliances in transportation networks and apply Siemens patches; review network segmentation between IT and OT in traffic management centers </li> <li> Building systems: Kieback & Peter DDC controllers managing HVAC/access in transportation facilities — restrict management interfaces to dedicated management VLAN </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Block signspace[.]cloud at all DNS resolvers and web proxies; add all five SHA-256 hashes above to EDR blocklists </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Block ValleyRAT C2 domains (zzlkkghnmh[.]cn, 1112.688608[.]xyz) and associated hashes at perimeter </td> </tr> <tr> <td> 3 </td> <td> Cloud/DevOps </td> <td> Audit all AWS IAM users with sts:GetFederationToken permission; attach explicit deny-all policy to any user suspected of compromise — credential deactivation alone is insufficient </td> </tr> <tr> <td> 4 </td> <td> Facilities / IT Ops </td> <td> Verify Kieback & Peter DDC building controller management interfaces are not accessible from general network; restrict to isolated management VLAN </td> </tr> <tr> <td> 5 </td> <td> IR Team </td> <td> Update AWS incident response playbook: add "revoke all active sessions" and "attach deny-all policy" steps — deactivating API keys does NOT contain federation-based persistence </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Deploy CloudTrail detection for GetFederationToken → signin.aws.amazon.com/federation sequences; alert on any federated session from IAM users without established baseline </td> </tr> <tr> <td> 2 </td> <td> CISO </td> <td> Commission inventory of all non-human identities (service accounts, AI agents, automation principals) across Azure AD and AWS; flag any with admin-equivalent permissions </td> </tr> <tr> <td> 3 </td> <td> IT Ops </td> <td> Identify any ScadaBR deployments in water/wastewater or building management systems; if present, isolate from internet immediately (unauthenticated RCE confirmed) </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Implement code-signing anomaly detection: alert on execution of binaries signed by certificates issued within last 90 days by CAs not in approved baseline </td> </tr> <tr> <td> 5 </td> <td> Security Awareness </td> <td> Brief agency IT liaisons on CORNFLAKE fake browser update campaign targeting government; provide indicators for user reporting </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> CISO </td> <td> Establish non-human identity (NHI) governance policy covering AI agents, MCP servers, and service principals; include credential rotation schedules and least-privilege enforcement </td> </tr> <tr> <td> 2 </td> <td> IT Ops </td> <td> Review and restrict code-signing trust policies in endpoint protection platforms; evaluate reducing trusted publisher lists to minimize MSaaS-signed malware risk </td> </tr> <tr> <td> 3 </td> <td> CISO </td> <td> Establish formal ICS advisory distribution channel to facilities management and maintenance teams — current advisories are not reaching building system operators </td> </tr> <tr> <td> 4 </td> <td> CISO/CIO </td> <td> Conduct tabletop exercise simulating ransomware deployment via MSaaS-signed binary that bypasses EDR — test detection gaps and IR response when initial execution is trusted </td> </tr> <tr> <td> 5 </td> <td> IT Ops </td> <td> Proactive hunt for Volt Typhoon/Salt Typhoon indicators on all Fortinet, Palo Alto, and Cisco edge devices — focus on unauthorized admin sessions, unexpected firmware modifications, and outbound connections to residential IP space </td> </tr> </tbody> </table> <h2> Bottom Line </h2> The ransomware threat to state government is no longer just about individual criminal groups — it's about the ecosystem services that enable them. When a single infrastructure provides valid code signatures to five ransomware families simultaneously, blocking one group is insufficient. Detection must move upstream. Simultaneously, identity has become the decisive terrain. A single cached credential can unlock 98% of a cloud environment. AWS federation persistence survives your current containment playbooks. Non-human identities — the service accounts and AI agents proliferating across state systems — are the fastest-growing target category in criminal markets, and most state agencies have no inventory of them. The ICS/OT advisory pace is not slowing. Building automation controllers, SCADA systems, and industrial network appliances in state facilities have vulnerabilities that facilities teams don't know about because the advisory distribution channel doesn't reach them. Three decisions for this week: <ul> <li> Confirm your AWS incident response playbook addresses federation persistence — test it </li> </ul> <ul> <li> Start the non-human identity inventory before your AI deployments outpace your governance </li> </ul> <ul> <li> Get ICS advisories in front of the people who actually manage building systems </li> </ul> The threat level remains ELEVATED. The professionalization of ransomware supply chains and the identity attack surface convergence are pushing toward HIGH. Act now while the window for proactive defense remains open. Published 2026-05-21 | Anomali CTI Desk For IOC feeds and detailed technical indicators, contact your Anomali ThreatStream representative.

FEATURED RESOURCES

May 21, 2026

Anomali Cyber Watch

Iranian Cyber Operations Escalate to Military Psychological Warfare as Ceasefire Talks Stall

May 21, 2026

Anomali Cyber Watch

Public Sector

Ransomware Goes Professional: Code-Signing-as-a-Service, Cloud Identity Persistence, and a Wave of ICS Vulnerabilities Threaten State Government Networks

May 20, 2026

Anomali Cyber Watch

The Silent Countdown: Iran's Cyber Operations Enter a Dangerous Steady State While Critical Blind Spots Grow

Explore All