Ransomware Groups Are Buying Zero-Days, ClickFix Is the New Macro, and Federal Cyber Support Is Eroding — What State CISOs Must Do This Week

Public Sector

Published on

March 19, 2026

Table of Contents

The week of March 10–18, 2026 delivered a series of developments that, taken individually, would each warrant a security advisory. Taken together, they represent a structural shift in the threat landscape facing U.S. state and local government IT organizations. A ransomware gang exploited a CVSS 10.0 zero-day in Cisco firewall management infrastructure for over a month before anyone noticed. A social engineering technique called “ClickFix” has been adopted by at least four unrelated threat groups — including nation-state operators — and now functions as a universal initial access method that bypasses email security entirely. Iran’s retaliatory cyber campaign continues to escalate with a 200,000-device wiper attack on a major U.S. corporation. And the federal agencies that state governments have historically relied on for cyber support are losing staff, delaying regulations, and letting intelligence-sharing authorities lapse — eight months before the 2026 midterm elections. This is not a drill. This is the new operating environment. <h2> What Changed This Week </h2> Six developments demand immediate attention from state IT leadership: <ol> <li> Interlock ransomware exploited a Cisco Secure Firewall Management Center zero-day (CVE-2026-20131, CVSS 10.0) for 36 days before disclosure — and has already hit a U.S. municipal government. This is the first confirmed case of a ransomware group operationalizing a true zero-day in critical network infrastructure.</li> <li> ConnectWise ScreenConnect disclosed a critical session hijacking vulnerability (CVE-2026-3564, CVSS 9.0) that allows attackers to forge admin sessions using extracted cryptographic keys. On-premises instances require manual patching — cloud instances were auto-updated.</li> <li> ClickFix social engineering has been adopted by four or more distinct threat groups , including the LeakNet and Interlock ransomware gangs, the Termite/Velvet Tempest ransomware operation, and Russia’s APT28 (Fancy Bear). The technique tricks users into pasting malicious commands from websites into Windows Terminal — completely bypassing email-based security controls.</li> <li> Iran-linked Handala (UNC5203) continues its post-Operation Epic Fury retaliation campaign. The Stryker wiper attack — claiming 200,000 devices destroyed — has generated class action lawsuits as of March 18, while the company still works to restore global IT systems.</li> <li> CISA workforce reductions, CIRCIA regulatory delays, and the pending expiration of the 2015 cyber threat intelligence sharing framework (September 2026) are eroding the federal support structure that state governments depend on for election security, incident response, and threat intelligence.</li> <li> Critical perimeter vulnerabilities across Fortinet and Cisco products are under active exploitation. FortiGate CVE-2025-59718 (CVSS 9.8) is being used to create rogue admin accounts in the wild, FortiVoice/Mail/NDR CVE-2025-32756 (CVSS 9.8) enables unauthenticated RCE, and Trane Tracer BMS vulnerabilities (CVE-2026-28252 through CVE-2026-28256) expose building management systems via hardcoded credentials and authentication bypass.</li> </ol> <h2> Threat Timeline: Key Events (January – March 2026) </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> Jan 26 </td> <td> Interlock begins exploiting CVE-2026-20131 (Cisco FMC) </td> <td> Zero-day exploitation begins — 36 days before public disclosure </td> </tr> <tr> <td> Feb 2 </td> <td> Qilin ransomware claims Tulsa airport breach </td> <td> Continued municipal government targeting by established ransomware group </td> </tr> <tr> <td> Feb 25 </td> <td> Cisco discloses CVE-2026-20127 (SD-WAN Manager, CVSS 10.0) </td> <td> Added to CISA KEV; second critical Cisco infrastructure vulnerability in weeks </td> </tr> <tr> <td> Mar 4 </td> <td> Cisco patches CVE-2026-20131 (FMC) </td> <td> Disclosure ends Interlock’s zero-day window — but damage already done </td> </tr> <tr> <td> Mar 4–5 </td> <td> Europol/Microsoft take down Tycoon2FA PhaaS platform </td> <td> Major AiTM phishing-as-a-service disrupted; successor “Starkiller” already identified </td> </tr> <tr> <td> Mar 7 </td> <td> Termite/Velvet Tempest adopts ClickFix + CastleRAT </td> <td> Second ransomware group adopts ClickFix for initial access </td> </tr> <tr> <td> Mar 10 </td> <td> SentinelOne reports FortiGate SSO bypass exploitation (CVE-2025-59718) </td> <td> Rogue admin accounts being created on FortiGate firewalls in the wild </td> </tr> <tr> <td> Mar 11–13 </td> <td> Handala claims Stryker wiper attack; 200K devices reported wiped </td> <td> Largest Iranian destructive cyber operation against a U.S. company to date </td> </tr> <tr> <td> Mar 13 </td> <td> Chrome 146 emergency patches for two zero-days </td> <td> Active exploitation in the wild; enterprise browser fleets at risk </td> </tr> <tr> <td> Mar 16 </td> <td> CNAS reports: Congress has twice let cyber intel sharing authority lapse </td> <td> CISA 2015 voluntary sharing framework expires September 2026 </td> </tr> <tr> <td> Mar 17 </td> <td> LeakNet ransomware debuts with ClickFix + Deno in-memory loader </td> <td> New ransomware actor; third group to adopt ClickFix in two weeks </td> </tr> <tr> <td> Mar 17 </td> <td> Reporting confirms CISA election security staff and programs “hollowed out” </td> <td> State governments losing federal cyber support ahead of 2026 midterms </td> </tr> <tr> <td> Mar 17 </td> <td> Trane Tracer BMS vulnerabilities disclosed (CVE-2026-28252 through CVE-2026-28256) </td> <td> Hardcoded credentials and auth bypass in building management systems </td> </tr> <tr> <td> Mar 18 </td> <td> Amazon reveals Interlock’s 36-day Cisco FMC zero-day exploitation; city of Saint Paul named as victim </td> <td> Ransomware-as-zero-day confirmed; government targeting confirmed </td> </tr> <tr> <td> Mar 18 </td> <td> ConnectWise discloses CVE-2026-3564 (ScreenConnect, CVSS 9.0) </td> <td> Critical supply chain risk for any agency using on-premises ScreenConnect </td> </tr> </tbody> </table> <h2> Threat Analysis </h2> <h3> 1. Interlock Ransomware and the Cisco FMC Zero-Day: A New Paradigm </h3> The most consequential development this week is not just another vulnerability — it is a capability shift. The Interlock ransomware gang possessed and operationalized a zero-day exploit in Cisco Secure Firewall Management Center (CVE-2026-20131) for 36 days before Cisco’s March 4 patch. Amazon’s threat intelligence team confirmed exploitation dating to January 26, 2026. This matters because ransomware groups have historically been “N-day” operators — they exploit known vulnerabilities after patches are released, targeting organizations that are slow to update. A financially motivated criminal group acquiring and deploying a zero-day in critical network management infrastructure was, until now, a capability associated exclusively with nation-state actors. CVE-2026-20131 is a Java deserialization vulnerability in the Cisco FMC web management interface that allows unauthenticated remote code execution as root. CVSS score: 10.0 — the maximum possible severity. Interlock’s post-exploitation toolkit included NodeSnake RAT (a JavaScript-based remote access trojan using WebSocket C2 with RC4 encryption), Slopoly (an AI-generated backdoor that evades signature-based detection), and the ClickFix social engineering technique for additional access vectors. Confirmed victims include the city of Saint Paul (municipal government), Texas Tech University System, DaVita, and Kettering Health. Given the 36-day exploitation window, additional victims — potentially including state agencies — may not yet be publicly known. The bottom line for state CISOs: If your organization operates Cisco Secure Firewall Management Center, treat this as a confirmed breach scenario until you can verify patch status and complete a threat hunt. The exploitation window was long enough that patching alone is insufficient — you need to look for evidence of compromise. <h3> 2. ClickFix: The New Macro </h3> Between March 7 and March 18, the ClickFix social engineering technique was adopted by at least four distinct, unrelated threat groups: <ul> <li> LeakNet ransomware (ClickFix via compromised WordPress sites → Deno in-memory loader → ransomware)</li> <li> Interlock ransomware (ClickFix as an auxiliary initial access vector alongside the Cisco FMC exploit)</li> <li> Termite / Velvet Tempest ransomware (ClickFix → CastleRAT + DonutLoader → ransomware)</li> <li> APT28 / Fancy Bear (Russia — ClickFix via fake reCAPTCHA pages for credential theft)</li> </ul> Additionally, multiple infostealer campaigns are using ClickFix across 250+ compromised WordPress sites, and at least one compromised U.S. Senate candidate’s official website was observed serving ClickFix lures. How ClickFix works: Victims visit a compromised or malicious website that displays a fake error message — often mimicking a browser update, CAPTCHA verification, or document viewer. The page instructs the user to “fix” the error by copying a command and pasting it into Windows Terminal, the Run dialog, or PowerShell. The pasted command downloads and executes malware. The technique is devastatingly simple and effective because it exploits user trust and bypasses every email-based security control state agencies have invested in. Why this matters for state government: State employees routinely visit external websites — news outlets, vendor portals, legislative reference sites, constituent service platforms. Any of these could be compromised to serve ClickFix lures. The technique requires no email delivery, no attachment, and no exploit — just a user following instructions on a webpage. <h3> 3. Iranian Cyber Retaliation: Escalating and Expanding </h3> The post-Operation Epic Fury Iranian cyber retaliation campaign continues to escalate. The Handala group (also tracked as UNC5203 and Cotton Sandstorm by Microsoft) claimed responsibility for a wiper attack on Stryker, a major U.S. medical device manufacturer, asserting that 200,000 devices were destroyed. As of March 18, class action lawsuits are accumulating while Stryker continues restoration efforts. Handala/UNC5203 is assessed to be linked to Iran’s Islamic Revolutionary Guard Corps (IRGC) . Their targeting profile includes U.S. government, energy, financial services, and technology sectors. Separately, MuddyWater — a distinct Iranian threat group affiliated with Iran’s Ministry of Intelligence and Security (MOIS) — continues operations using the Dindoor backdoor, and broader Iranian cyber activity remains at elevated tempo. For state government: Iran’s retaliatory operations have explicitly targeted U.S. government entities. State agencies — particularly those managing critical infrastructure (water, energy, transportation) — are within the target set. The Stryker attack demonstrated that Iranian actors are willing and capable of deploying destructive wiper malware at scale against U.S. organizations. <h3> 4. The Federal Support Gap: CISA Erosion and Regulatory Uncertainty </h3> State governments have historically relied on CISA for election security support, incident response assistance, and threat intelligence sharing. Three concurrent developments are undermining that support structure: <ul> <li> Workforce reductions have “hollowed out key staff and programs” that helped states safeguard voting systems, per multiple reports from March 17.</li> <li> CIRCIA (Cyber Incident Reporting for Critical Infrastructure Act) implementation has been delayed — DHS shutdown postponed town halls, and the final rule timeline has slipped.</li> <li> The CISA 2015 voluntary cyber threat intelligence sharing framework expires in September 2026. Congress has already twice allowed related cyber threat intelligence sharing authorization to lapse in the past five months.</li> </ul> This creates a compounding problem: the threat environment is intensifying (ransomware zero-days, Iranian retaliation, ClickFix proliferation) at the exact moment that federal support capacity is diminishing. State CISOs who have relied on federal partnerships must now build or strengthen organic capabilities and peer-to-peer sharing networks. <h3> 5. Supply Chain and Perimeter Vulnerabilities: Cisco, Fortinet, ConnectWise </h3> State government IT infrastructure faces simultaneous critical vulnerabilities across three major vendors: <table> <thead> <tr> <th> Vendor / Product </th> <th> CVE </th> <th> CVSS </th> <th> Status </th> <th> Risk to State IT </th> </tr> </thead> <tbody> <tr> <td> Cisco Secure FMC </td> <td> CVE-2026-20131 </td> <td> 10.0 </td> <td> Active zero-day exploitation (since Jan 26) </td> <td> Critical — firewall management compromise enables full network access </td> </tr> <tr> <td> Cisco SD-WAN Manager </td> <td> CVE-2026-20127 </td> <td> 10.0 </td> <td> CISA KEV; active exploitation confirmed </td> <td> Critical — inter-agency WAN fabric at risk </td> </tr> <tr> <td> Fortinet FortiGate </td> <td> CVE-2025-59718 </td> <td> 9.8 </td> <td> Active exploitation; rogue admin accounts observed </td> <td> High — perimeter firewall compromise; credential and config theft </td> </tr> <tr> <td> Fortinet FortiVoice/Mail/NDR </td> <td> CVE-2025-32756 </td> <td> 9.8 </td> <td> Active exploitation </td> <td> High — RCE via crafted HTTP cookie across multiple Fortinet products </td> </tr> <tr> <td> ConnectWise ScreenConnect </td> <td> CVE-2026-3564 </td> <td> 9.0 </td> <td> Exploitation attempts observed; on-prem requires manual patch </td> <td> High — IT support tool compromise = full remote access to endpoints </td> </tr> <tr> <td> Trane Tracer BMS </td> <td> CVE-2026-28252 – 28256 </td> <td> Varies </td> <td> Disclosed; patches available </td> <td> Medium-High — hardcoded credentials and auth bypass in building management </td> </tr> </tbody> </table> <h2> Predictive Analysis: What Comes Next </h2> Based on the intelligence collected through March 18, 2026, we assess the following probabilities for the next 7–30 days: <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional ClickFix-based ransomware campaigns emerge targeting government </td> <td> High (75%) </td> <td> Four groups adopted the technique in two weeks; it is trivially replicable and bypasses email security </td> </tr> <tr> <td> Interlock claims additional government/education/healthcare victims from the Jan 26 – Mar 4 exploitation window </td> <td> Moderate-High (60%) </td> <td> 36-day zero-day window against internet-facing management consoles; victim discovery typically lags exploitation by weeks </td> </tr> <tr> <td> Iranian cyber operations expand to additional U.S. critical infrastructure or government targets </td> <td> Moderate (45%) </td> <td> Handala/UNC5203 and MuddyWater remain active; post-Operation Epic Fury retaliation tempo has not decreased </td> </tr> <tr> <td> A U.S. state or local government entity is publicly named as a ransomware victim </td> <td> Moderate (40%) </td> <td> Elevated activity across Interlock, Qilin, and LeakNet; municipal government is a confirmed target for multiple groups </td> </tr> <tr> <td> CVE-2026-3564 (ScreenConnect) is exploited in the wild against MSP/government targets </td> <td> Moderate (40%) </td> <td> Exploitation attempts already observed; ScreenConnect is widely deployed in government IT support </td> </tr> <tr> <td> Successor AiTM phishing platforms (Starkiller) reach operational scale, targeting M365 GCC tenants </td> <td> Low-Moderate (30%) </td> <td> Tycoon2FA takedown created a temporary gap; criminal ecosystem historically reconstitutes within 4–6 weeks </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> ClickFix Execution Chain — The highest-priority detection gap for most state SOCs today. <ul> <li> Hunt Hypothesis: State employees visiting compromised websites are being instructed to paste malicious commands into Windows Terminal, PowerShell, or the Run dialog. Look for command-line processes spawned from unusual parent processes.</li> <li> Detection Logic: </li> </ul> <ul> <li>PowerShell or cmd.exe spawned by Windows Terminal (WindowsTerminal.exe) with Base64-encoded arguments — T1059.001 (PowerShell), T1204.001 (User Execution: Malicious Link) </li> <li>mshta.exe or wscript.exe invocations originating from explorer.exe clipboard operations — T1218.005 (Mshta) </li> <li>Any execution of deno.exe on state endpoints (Deno runtime should not exist in standard government builds) — T1059.007 (JavaScript), T1620 (Reflective Code Loading) </li> <li>curl.exe or Invoke-WebRequest commands executed interactively (not from scheduled tasks or known automation) — T1105 (Ingress Tool Transfer) </li> </ul> Cisco FMC Compromise Indicators <ul> <li> Hunt Hypothesis: If your organization runs Cisco Secure FMC, the 36-day exploitation window (Jan 26 – Mar 4) may have been used to establish persistent access.</li> <li> Detection Logic: </li> </ul> <ul> <li>Unexpected Java process execution on FMC appliances — T1190 (Exploit Public-Facing Application) </li> <li>WebSocket connections from FMC to external IPs (NodeSnake RAT C2 uses WebSocket with RC4 encryption) — T1071.001 (Web Protocols) </li> <li>New or modified user accounts on FMC that were not created through change management — T1136 (Create Account) </li> <li>SSH lateral movement from FMC to internal Linux hosts — T1021.004 (SSH) </li> </ul> FortiGate Rogue Account Detection <ul> <li> Hunt Hypothesis: Attackers exploiting CVE-2025-59718 are creating unauthorized admin accounts and exfiltrating firewall configurations.</li> <li> Detection Logic: </li> </ul> <ul> <li>Audit all FortiGate admin accounts against authorized personnel lists — T1078 (Valid Accounts) </li> <li>Review Sieve mail forwarding rules for unauthorized entries — T1114.003 (Email Forwarding Rule) </li> <li>Check for configuration exports or SNMP community string changes — T1005 (Data from Local System) </li> </ul> ConnectWise ScreenConnect Session Hijacking <ul> <li> Hunt Hypothesis: Attackers with access to ScreenConnect server cryptographic material can forge admin sessions.</li> <li> Detection Logic: </li> </ul> <ul> <li>Monitor for ScreenConnect admin sessions originating from unexpected IP ranges — T1219 (Remote Access Software) </li> <li>Audit ScreenConnect server access logs for access to configs, backups, logs, and extensions directories — T1078 (Valid Accounts), T1068 (Exploitation for Privilege Escalation) </li> </ul> Iranian Wiper Preparedness <ul> <li> Hunt Hypothesis: Iranian threat actors (Handala/UNC5203, IRGC-affiliated) may target state government systems with destructive wiper malware, potentially leveraging compromised identity infrastructure (Active Directory, Intune/SCCM).</li> <li> Detection Logic: </li> </ul> <ul> <li>Mass file deletion or overwrite operations across multiple systems simultaneously — T1485 (Data Destruction) </li> <li>Unexpected service stops across critical infrastructure — T1489 (Service Stop) </li> <li>Anomalous Intune/SCCM policy deployments outside change windows — T1072 (Software Deployment Tools) </li> </ul> <h3> Blocking Guidance </h3> Specific IOCs (IP addresses, domains, and file hashes) for the campaigns discussed in this report are available through Anomali ThreatStream and partner feeds. State SOC teams should ensure the following threat intelligence feeds are active and ingesting: <ul> <li>Amazon AWS Security Blog IOCs (Interlock/Cisco FMC campaign)</li> <li>CISA KEV catalog (CVE-2026-20127, CVE-2026-20131)</li> <li>MS-ISAC advisories for state/local government</li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> State Government Agencies (Executive, Legislative, Judicial) </h3> <ul> <li> Priority 1: Verify Cisco Secure FMC and SD-WAN Manager patch status across all agencies. Conduct threat hunt on FMC appliances for the Jan 26 – Mar 4 exploitation window.</li> <li> Priority 2: Issue ClickFix awareness alert to all state employees with visual examples of the fake error messages. Emphasize: never paste commands from websites into any command prompt or terminal.</li> <li> Priority 3: Audit ConnectWise ScreenConnect instances used by IT help desks. Confirm on-premises instances are updated to version 26.1.</li> <li> Priority 4: Begin contingency planning for reduced CISA support. Engage MS-ISAC and state CISO council for alternative threat intelligence sharing.</li> </ul> <h3> Financial Services (State Treasury, Revenue, Payment Processing) </h3> <ul> <li> Priority 1: Review third-party payment processor security posture. The ScreenConnect vulnerability creates supply chain risk for vendors providing citizen payment portal support.</li> <li> Priority 2: Strengthen AiTM phishing defenses for financial systems. The Starkiller PhaaS successor to Tycoon2FA specifically targets M365 credentials — enforce hardware token MFA and conditional access policies requiring compliant devices.</li> <li> Priority 3: Iranian threat actors (Handala/UNC5203 and MuddyWater) explicitly target financial services. Ensure wire transfer and payment authorization systems have out-of-band verification procedures.</li> </ul> <h3> Energy and Water (State-Regulated Utilities, OT/ICS) </h3> <ul> <li> Priority 1: Assess Trane Tracer BMS exposure in state-managed facilities. CVE-2026-28252 through CVE-2026-28256 include hardcoded credentials and authentication bypass vulnerabilities enabling root access. Patch to Tracer SC+ v6.30.2313.</li> <li> Priority 2: Segment OT/SCADA networks from enterprise IT. Iranian threat actors have demonstrated willingness to target critical infrastructure, and the Dragos OT threat report (March 2026) warns of state-affiliated actors pre-positioning for OT attacks that operators may not detect.</li> <li> Priority 3: Ensure Cisco SD-WAN infrastructure connecting utility control centers is patched against CVE-2026-20127 (CVSS 10.0, CISA KEV).</li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Priority 1: The Stryker wiper attack demonstrates that healthcare-adjacent organizations are active Iranian targets. Review backup and recovery procedures for health information systems.</li> <li> Priority 2: Interlock ransomware has confirmed healthcare victims (DaVita, Kettering Health). Ensure healthcare data systems have network segmentation, offline backups, and tested restoration procedures.</li> <li> Priority 3: Qilin ransomware continues to target government and healthcare globally. Monitor for Qilin indicators via MS-ISAC and sector ISACs.</li> </ul> <h3> Aviation and Transportation / Logistics </h3> <ul> <li> Priority 1: Qilin ransomware claimed the Tulsa airport breach (February 2026). State-managed airports and transportation authorities should verify ransomware resilience — particularly backup integrity and network segmentation of operational technology.</li> <li> Priority 2: Cisco SD-WAN infrastructure connecting transportation management centers is at risk from CVE-2026-20127. Verify patch status.</li> <li> Priority 3: Supply chain risk from compromised MSP tools (ScreenConnect) extends to transportation logistics vendors. Audit vendor remote access tools.</li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> Immediate (24–48 Hours) </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Verify Cisco Secure FMC patch status against CVE-2026-20131 (CVSS 10.0). If unpatched, initiate emergency patching and threat hunt for indicators of compromise from the Jan 26 – Mar 4 exploitation window. </td> <td> Network Security </td> </tr> <tr> <td> 2 </td> <td> Verify ConnectWise ScreenConnect on-premises instances are updated to version 26.1. Restrict access to server configuration and backup directories. </td> <td> IT Support / Endpoint Management </td> </tr> <tr> <td> 3 </td> <td> Push Chrome 146.0.7680.75+ to all managed endpoints via enterprise browser management. Two zero-days are under active exploitation. </td> <td> Endpoint Management </td> </tr> <tr> <td> 4 </td> <td> Issue ClickFix awareness communication to all state employees. Include visual examples of fake error messages. Key message: Never copy and paste commands from a website into any command prompt, terminal, or Run dialog. </td> <td> CISO Office / Security Awareness </td> </tr> <tr> <td> 5 </td> <td> Brief executive leadership on the Interlock zero-day, Iranian wiper escalation, and CISA support erosion. Frame as a risk posture change requiring sustained attention, not a single incident. </td> <td> CISO </td> </tr> </tbody> </table> <h3> 7-Day Actions </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 6 </td> <td> Audit all FortiGate firewall admin accounts against authorized personnel lists. Check for rogue accounts, unauthorized Sieve forwarding rules, and configuration exports. Verify patch status against CVE-2025-59718 (CVSS 9.8). </td> <td> Network Security </td> </tr> <tr> <td> 7 </td> <td> Inventory Trane Tracer BMS systems across all state-managed facilities. Schedule patching to Tracer SC+ v6.30.2313 for CVE-2026-28252 through CVE-2026-28256. </td> <td> Facilities / OT Security </td> </tr> <tr> <td> 8 </td> <td> Verify Cisco SD-WAN Manager instances are at release 20.18+ per CISA KEV for CVE-2026-20127 (CVSS 10.0). </td> <td> Network Security </td> </tr> <tr> <td> 9 </td> <td> Engage MS-ISAC and state CISO council to identify alternative threat intelligence sharing mechanisms in anticipation of the CISA 2015 framework expiration (September 2026). </td> <td> CISO Office / Policy </td> </tr> <tr> <td> 10 </td> <td> Review M365 conditional access policies. Enforce compliant device requirements and implement token binding where available to counter AiTM/Starkiller phishing. </td> <td> IAM / Cloud Security </td> </tr> </tbody> </table> <h3> 30-Day Actions </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 11 </td> <td> Deploy ClickFix detection rules in EDR/SIEM: clipboard-paste execution via Windows Terminal, PowerShell with encoded commands spawned from explorer.exe, Deno runtime execution on any endpoint. </td> <td> Detection Engineering </td> </tr> <tr> <td> 12 </td> <td> Conduct Iranian wiper tabletop exercise. Scenario: Handala/UNC5203 (IRGC-affiliated) deploys destructive malware via compromised identity infrastructure (AD/Intune). Test backup restoration for Active Directory, M365, and critical agency systems. Validate that recovery time objectives are achievable. </td> <td> CISO Office / IR Team </td> </tr> <tr> <td> 13 </td> <td> Perform Cisco product inventory across all agencies. Two independent CVSS 10.0 exploitation campaigns targeting different Cisco products in the same quarter represents systemic vendor concentration risk. Establish a unified Cisco vulnerability response process. </td> <td> Enterprise Architecture / Network Security </td> </tr> <tr> <td> 14 </td> <td> Evaluate browser isolation solutions to address the ClickFix gap. Current security architecture is optimized for email-borne threats; ClickFix operates entirely through web browsing and bypasses that investment. </td> <td> Security Architecture </td> </tr> <tr> <td> 15 </td> <td> Review and update election security incident response plans for 2026 midterms, accounting for reduced CISA support capacity. Identify state-level resources and mutual aid agreements that can fill the gap. </td> <td> CISO Office / Elections IT </td> </tr> </tbody> </table> <h2> Bottom Line                                </h2> Three structural shifts are converging to create the most challenging threat environment state government CISOs have faced: First, the capability gap between nation-states and criminal groups is closing. Interlock’s use of a zero-day in Cisco FMC — a capability that would have been remarkable for a nation-state five years ago — signals that the ransomware ecosystem has matured to the point where criminal operators can acquire or develop zero-day exploits for critical infrastructure. The deployment of AI-generated malware (Slopoly) in the same campaign further demonstrates that criminal groups are adopting advanced techniques at an accelerating pace. Second, initial access techniques are evolving faster than defenses. State governments invested heavily in email security — and those investments still matter. But ClickFix renders them partially irrelevant by moving the initial access vector to the web browser. Four unrelated threat groups adopted the same technique within two weeks. This is the kind of rapid, cross-ecosystem adoption that characterized macro-enabled document attacks in the 2018–2022 era. The defense community is behind the curve. Third, the federal safety net is fraying. CISA workforce reductions, CIRCIA implementation delays, and the pending expiration of intelligence sharing authorities are not abstract policy concerns — they directly affect the threat intelligence, incident response support, and election security assistance that state governments receive. State CISOs who have relied on federal partnerships must now build or strengthen organic capabilities and peer-to-peer sharing networks. None of these shifts will reverse themselves. The question is not whether state government will face a major cyber incident in 2026 — it is whether your organization will be prepared when it happens. Patch the Cisco FMC. Update ScreenConnect. Warn your employees about ClickFix. Hunt your networks. Test your backups. And start planning for a world where you may need to stand on your own.

FEATURED RESOURCES

March 19, 2026

Anomali Cyber Watch

Daily CTI Cycle: Geopolitical/Military on Iran

March 19, 2026

Public Sector

Anomali Cyber Watch

Ransomware Groups Are Buying Zero-Days, ClickFix Is the New Macro, and Federal Cyber Support Is Eroding — What State CISOs Must Do This Week

March 18, 2026

Anomali Cyber Watch

Iran's Cyber War Enters a Dangerous New Phase: What CISOs Must Do Now

Explore All