Russian Intelligence Services Actively Scanning Government Networks: What State CISOs Must Do This Week

Public Sector

Published on

July 13, 2026

Table of Contents

Threat Assessment Level: ELEVATED Today marks a watershed moment in the attribution of Russian state-sponsored cyber operations against government and critical infrastructure networks. The European Union and United Kingdom jointly sanctioned 24+ individuals and entities tied to Russia's FSB Center 16 — the intelligence unit behind the Turla hacking group — while a 12-nation coalition issued an advisory confirming active, global scanning of government routers for exploitation. Simultaneously, Adobe ColdFusion is under active exploitation via a CVSS 10.0 vulnerability, APT28 has produced fresh government-targeting malware, and ransomware groups continue their drumbeat against public sector targets. For state government IT leaders, this is not a theoretical briefing. Your Cisco routers, your legacy ColdFusion portals, and your Joomla-based public websites are in the crosshairs right now . This post breaks down what changed, what's coming, and what your teams need to do today. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Date </th> <th> Why It Matters </th> </tr> </thead> <tbody> <tr> <td> EU/UK sanction FSB Center 16 (Turla/Berserk Bear) for December 2025 Poland energy grid attack </td> <td> 2026-07-13 </td> <td> Formal attribution confirms this unit actively targets government networks and critical infrastructure globally </td> </tr> <tr> <td> 12-nation joint advisory: FSB Center 16 scanning for routers with weak SNMP community strings </td> <td> 2026-07-13 </td> <td> State government network devices are explicitly in the target set — CVE-2018-0171 (Cisco Smart Install) being exploited </td> </tr> <tr> <td> UK sanctions Lumma Stealer operators </td> <td> 2026-07-13 </td> <td> 2,100+ UK victims in 6 months; credential theft at industrial scale </td> </tr> <tr> <td> APT28 (GRU Unit 26165) — 4 new government-targeting malware samples ingested </td> <td> 2026-07-12/13 </td> <td> Sustained Russian espionage pressure against government sector </td> </tr> <tr> <td> TA505 activates new government-targeting C2 infrastructure </td> <td> 2026-07-12 </td> <td> Fresh IP (confidence 95) signals imminent phishing/ransomware campaign against government </td> </tr> <tr> <td> CVE-2026-48282 (Adobe ColdFusion, CVSS 10.0) — confirmed active exploitation </td> <td> 2026-07-07 (KEV) </td> <td> Exploited within 2 hours of disclosure; any unpatched ColdFusion portal is compromised or will be </td> </tr> <tr> <td> CVE-2026-48939 (iCagenda for Joomla, CVSS 9.8) — added to KEV </td> <td> 2026-07-10 </td> <td> Second Joomla extension on KEV in three weeks; systematic exploitation of Joomla ecosystem </td> </tr> <tr> <td> Schneider Electric Easergy MiCOM Px40 advisory (substation protection relays) </td> <td> 2026-07-09 </td> <td> Direct relevance to state-managed electrical infrastructure </td> </tr> <tr> <td> Deadlock, Akira, BITWISE SPIDER, WARLOCK SPIDER — all updated with government targeting </td> <td> 2026-07-10–13 </td> <td> Four ransomware operations simultaneously active against government sector </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor/CVE </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> 2025-12-XX </td> <td> Poland energy grid attack (could have cut power to ~500K people) </td> <td> FSB Center 16 / DynoWiper </td> <td> Destructive — formally attributed Jul 13 </td> </tr> <tr> <td> 2026-06-12 </td> <td> California water utility destructive breach </td> <td> VOID MANTICORE (Iran/IRGC) </td> <td> Confirmed destructive attack on U.S. critical infrastructure </td> </tr> <tr> <td> 2026-07-07 </td> <td> ColdFusion CVE-2026-48282 added to CISA KEV; exploitation within 2 hours </td> <td> Unknown actors </td> <td> RCE on citizen-facing portals </td> </tr> <tr> <td> 2026-07-09 </td> <td> Schneider Electric ICS advisories (PowerChute, Easergy MiCOM Px40, OpenPLC) </td> <td> N/A (vendor disclosure) </td> <td> Substation relay and UPS vulnerabilities </td> </tr> <tr> <td> 2026-07-10 </td> <td> iCagenda CVE-2026-48939 added to CISA KEV </td> <td> Unknown actors </td> <td> Unauthenticated RCE via Joomla extension </td> </tr> <tr> <td> 2026-07-10 </td> <td> Akira ransomware actor model updated — government targeting </td> <td> Akira </td> <td> Active ransomware threat </td> </tr> <tr> <td> 2026-07-12 </td> <td> TA505 new C2 IP activated (government-targeting, confidence 95) </td> <td> TA505 / WARLOCK SPIDER </td> <td> Phishing infrastructure staged for campaign </td> </tr> <tr> <td> 2026-07-12 </td> <td> APT28 — 4 fresh MD5 samples tagged government/public-services </td> <td> APT28 (GRU Unit 26165) </td> <td> Espionage tooling refresh </td> </tr> <tr> <td> 2026-07-12 </td> <td> Deadlock ransomware updated; BITWISE SPIDER updated Jul 13 </td> <td> Deadlock, BITWISE SPIDER </td> <td> Government-targeting ransomware </td> </tr> <tr> <td> 2026-07-13 </td> <td> EU/UK sanctions + 12-nation advisory on FSB Center 16 router scanning </td> <td> FSB Center 16 (Turla) </td> <td> Active scanning of government routers worldwide </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. FSB Center 16 (Turla / Berserk Bear) — Active Router Exploitation Campaign </h3> What they are: Russia's FSB 16th Centre, now formally linked to the Turla hacking group (also known as Berserk Bear, Energetic Bear, Crouching Yeti, DragonFly, Ghost Blizzard). This unit has targeted government networks across Europe since 2010 and was responsible for the December 2025 destructive attack on Poland's energy grid using DynoWiper malware. What they're doing now: Actively scanning globally for network devices with weak SNMP community strings and exploiting CVE-2018-0171 (Cisco Smart Install, CVSS 9.8). Once inside a router, they exfiltrate configurations via TFTP and establish persistent access for espionage or pre-positioning for destructive operations. Why state government is at risk: State agencies operate extensive Cisco networking infrastructure. Many legacy devices still run SNMPv1/v2 with default or weak community strings. Smart Install may remain enabled on switches that were deployed years ago and never hardened. Techniques: T1078 (Valid Accounts), T1557 (Adversary-in-the-Middle), T1048 (Exfiltration Over Alternative Protocol), T1485 (Data Destruction) <h3> 2. APT28 (Fancy Bear / GRU Unit 26165) — Sustained Government Espionage </h3> Four new malware samples explicitly tagged for government and public services targeting were ingested this cycle. The samples use Expiro file infector techniques combined with PowerShell-based loaders — a combination that enables persistence and lateral movement while evading signature-based detection. Techniques: T1059 (Command and Scripting Interpreter), T1105 (Ingress Tool Transfer), T1195.002 (Supply Chain Compromise), T1203 (Exploitation for Client Execution), T1204.002 (User Execution: Malicious File), T1553.002 (Subvert Trust Controls: Code Signing) <h3> 3. TA505 / WARLOCK SPIDER — Government-Targeting C2 Infrastructure Refresh </h3> TA505 is a financially motivated, Russia-nexus cybercriminal group historically associated with Clop ransomware, FlawedAmmyy RAT, and ServHelper. A new command-and-control IP was activated on July 12 with explicit government sector targeting at confidence level 95. This group's operational pattern — infrastructure staging followed by mass phishing campaigns — suggests an imminent campaign within days. <h3> 4. Adobe ColdFusion CVE-2026-48282 — The 2-Hour Exploitation Benchmark </h3> This CVSS 10.0 path traversal to arbitrary code execution vulnerability was exploited in the wild within 2 hours of public disclosure. It affects ColdFusion 2025.9, 2023.20, and all earlier versions. State government agencies are known to operate legacy ColdFusion applications for citizen-facing portals (benefits applications, permit systems, public records). Any unpatched instance should be presumed compromised. <h3> 5. Joomla Extension Ecosystem Under Systematic Attack </h3> Two Joomla extensions are now on CISA's Known Exploited Vulnerabilities catalog: <ul> <li> CVE-2026-48939 (iCagenda, CVSS 9.8) — unauthenticated file upload → RCE </li> <li> CVE-2026-48908 (SP Page Builder, CVSS 9.8) — unauthenticated file upload → RCE </li> </ul> State agencies commonly use Joomla for public-facing websites. The pattern of systematic Joomla extension exploitation suggests attackers are specifically targeting this CMS ecosystem. <h3> 6. Ransomware Convergence on Government </h3> Four distinct ransomware operations showed fresh activity against the government sector between July 10–13: <ul> <li> Deadlock (updated Jul 12) </li> <li> Akira (updated Jul 10) </li> <li> BITWISE SPIDER (updated Jul 13) </li> <li> WARLOCK SPIDER / TA505 (updated Jul 13) </li> </ul> This convergence, combined with TA505's fresh C2 infrastructure, represents the highest ransomware pressure on state/local government observed in recent cycles. <h3> 7. ICS/OT Threats — Schneider Electric Substation Relays </h3> The Schneider Electric Easergy MiCOM Px40 advisory affects protection relays used in electrical substations. Combined with the formal attribution of FSB Center 16's destructive attack on Poland's energy grid, state agencies managing electrical infrastructure face a dual threat: known vulnerabilities in deployed equipment and a confirmed adversary with destructive intent. <h2> Predictive Analysis — Next 7 Days </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional exploitation attempts against ColdFusion (CVE-2026-48282) and Joomla KEV vulnerabilities on state-hosted web applications </td> <td> HIGH (>75%) </td> <td> Active exploitation confirmed; state agencies known to run these platforms; automated scanning is trivial </td> </tr> <tr> <td> FSB Center 16 router scanning yields compromised devices in U.S. government networks </td> <td> MODERATE (40–60%) </td> <td> 12-nation advisory is a leading indicator; scanning is confirmed active; many state devices likely have weak SNMP </td> </tr> <tr> <td> Ransomware group (Akira or Deadlock) claims a U.S. state/local government victim </td> <td> MODERATE (40–60%) </td> <td> Four groups simultaneously active against government; TA505 C2 infrastructure freshly staged; historical tempo supports this </td> </tr> <tr> <td> TA505 launches phishing campaign against government targets using 80.87.206[.]239 infrastructure </td> <td> MODERATE (40–60%) </td> <td> Infrastructure staging pattern historically precedes campaign launch by 3–7 days </td> </tr> <tr> <td> Direct APT28 intrusion attempt against state government infrastructure </td> <td> LOW (<25%) </td> <td> APT28 primarily targets federal/defense; spillover possible but not primary targeting </td> </tr> <tr> <td> Destructive attack on U.S. water/energy infrastructure (VOID MANTICORE or FSB Center 16 pattern) </td> <td> LOW (<25%) </td> <td> Capability confirmed (California water utility Jun 12, Poland grid Dec 2025); but escalation threshold remains high absent geopolitical trigger </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> Hunt for FSB Center 16 Router Compromise ( T1557 , T1048 , T1078 ) <ul> <li> Query all Cisco device logs for Smart Install protocol activity (TCP/4786) </li> <li> Alert on any TFTP configuration exfiltration from network devices </li> <li> Hunt for SNMP authentication failures followed by successful authentication (brute-force pattern) </li> <li> Baseline SNMP community strings — any device still on SNMPv1/v2 with "public" or "private" strings is presumed targeted </li> <li> Monitor for unexpected configuration changes on routers/switches (T1601.001 — Modify System Image) </li> </ul> Hunt for APT28 Expiro/PowerShell Loaders ( T1059.001 , T1105 , T1204.002 ) <ul> <li> Deploy hash-based detection for: </li> <ul> <li> 89618515b9522c0ae1914dd8b4147ac5 </li> <li> 5e8bf20650411220c6514dff67f2e2b6 </li> <li> c2b3338ee82496f8c6154f2f560e59b7 </li> <li> 176b0e6caed3ee017e138d5f6454aab7 </li> </ul> <li> Hunt for PowerShell execution with encoded commands spawned from Office applications or PDF readers </li> <li> Alert on powershell.exe with -enc or -encodedcommand flags launched by non-admin users </li> <li> Monitor for file infector behavior: unexpected modification of legitimate executables (Expiro signature) </li> </ul> Block TA505 C2 Infrastructure ( T1071 , T1571 ) <ul> <li> Block 80.87.206[.]239 at all perimeter firewalls, proxy servers, and DNS sinkholes </li> <li> Hunt historical netflow for any prior connections to this IP </li> <li> Monitor for connections to OVHcloud (ASN 16276) IP ranges from internal systems — while OVHcloud is legitimate, unusual outbound connections to Russian-geolocated OVHcloud IPs warrant investigation </li> </ul> Hunt for ColdFusion Exploitation ( T1190 , T1059 , T1083 ) <ul> <li> If ColdFusion is deployed: review web server logs for path traversal patterns (../, ..%2f, %252e%252e) </li> <li> Alert on new file creation in ColdFusion web roots (webshell deployment) </li> <li> Monitor for cmd.exe or powershell.exe spawned by ColdFusion service processes </li> <li> Check for unexpected outbound connections from ColdFusion servers </li> </ul> Hunt for Joomla Extension Exploitation ( T1190 ) <ul> <li> Review web logs for POST requests to iCagenda or SP Page Builder upload endpoints </li> <li> Alert on new PHP/JSP files created in Joomla upload directories </li> <li> Monitor for web shells: unusual HTTP response sizes from upload directories </li> </ul> <h3> Hunting Hypotheses </h3> <ol> <li> "An attacker has already compromised a router via weak SNMP and is exfiltrating configurations." — Search for: TFTP transfers from network devices to unknown destinations; SNMP SET operations from non-management IPs; router configuration files appearing in unexpected locations. </li> <li> "A ColdFusion portal has been backdoored and is being used for initial access." — Search for: new files in ColdFusion directories created after July 7; ColdFusion processes spawning shells; outbound connections from ColdFusion servers to non-standard ports. </li> <li> "TA505 phishing has already delivered initial access and a beacon is calling home." — Search for: DNS queries or connections to 80.87.206[.]239; new scheduled tasks or services created in the last 72 hours; unusual PowerShell or WMI activity on workstations. </li> <li> "A developer workstation has been infected with Siggen via a poisoned Visual Studio project." — Search for: unexpected pre-build commands in .vcxproj or .csproj files; Visual Studio processes making network connections to Steam or GitHub for C2 resolution; modifications to Windows SDK header files. </li> </ol> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Tax Systems) </h3> <ul> <li> Primary threat: TA505 phishing → Clop ransomware targeting financial data; Lumma Stealer credential harvesting </li> <li> Priority action: Enforce phishing-resistant MFA on all treasury and revenue system access; block 80.87.206[.]239; hunt for Lumma Stealer artifacts (browser credential store access, exfiltration to Telegram/Discord) </li> <li> Monitoring focus: Unusual bulk data access patterns in tax/revenue databases; credential stuffing against citizen-facing tax portals </li> </ul> <h3> Energy (State-Managed Utilities, Grid Interconnects) </h3> <ul> <li> Primary threat: FSB Center 16 destructive capability (DynoWiper precedent); Schneider Electric Easergy MiCOM Px40 vulnerability in substation relays </li> <li> Priority action: Audit all Schneider Electric protection relays for firmware currency; segment OT networks from IT; validate SNMP hardening on all SCADA-adjacent network devices </li> <li> Monitoring focus: Unexpected commands to protection relays; TFTP transfers from OT network segments; any IT-to-OT lateral movement </li> </ul> <h3> Healthcare (Health & Human Services, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware (Akira, Deadlock) targeting healthcare data for double extortion; ColdFusion exploitation of benefits portals </li> <li> Priority action: Confirm ColdFusion patch status on all HHS portals; validate offline backup integrity for Medicaid/benefits databases; ensure incident response playbook covers PHI breach notification timelines </li> <li> Monitoring focus: Bulk PII/PHI exfiltration patterns; encryption of database files; lateral movement from DMZ web servers to backend databases </li> </ul> <h3> Government (Courts, Elections, Public Safety, DMV) </h3> <ul> <li> Primary threat: APT28 espionage targeting government PII; ransomware disruption of public services; FSB Center 16 router compromise for persistent access </li> <li> Priority action: Deploy APT28 IOC hashes across all endpoints; audit Cisco Smart Install on all network devices; ensure elections infrastructure is segmented and monitored independently </li> <li> Monitoring focus: Unusual access to voter registration databases; PowerShell execution on domain controllers; configuration changes on network devices outside maintenance windows </li> </ul> <h3> Aviation / Logistics (State DOT, Port Authorities, Transit) </h3> <ul> <li> Primary threat: Supply chain compromise via developer tooling (Siggen backdoor); ICS vulnerabilities in transit SCADA systems </li> <li> Priority action: Brief development teams on Siggen Visual Studio infection vector; audit OpenPLC deployments in transit control systems; validate network segmentation between corporate IT and operational transit systems </li> <li> Monitoring focus: Unexpected modifications to source code repositories; OpenPLC authenticated access from unusual accounts; lateral movement from corporate to OT segments </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Audit ALL Cisco devices for Smart Install feature (TCP/4786) — disable Smart Install or confirm CVE-2018-0171 patch applied. FSB Center 16 is actively scanning for this globally. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Confirm Adobe ColdFusion instances patched beyond versions 2025.9/2023.20. CVE-2026-48282 (CVSS 10.0) is actively exploited. Any unpatched portal should be taken offline pending patching. </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Block IP 80.87.206[.]239 at all perimeter firewalls, proxies, and DNS. TA505 government-targeting C2, confidence 95. </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Deploy hash-based detection for APT28 samples: 89618515b9522c0ae1914dd8b4147ac5, 5e8bf20650411220c6514dff67f2e2b6, c2b3338ee82496f8c6154f2f560e59b7, 176b0e6caed3ee017e138d5f6454aab7 </td> </tr> <tr> <td> IMMEDIATE </td> <td> CISO </td> <td> Brief executive leadership: Russian cyber operations under international sanctions today — elevated risk of retaliatory or accelerated operations against Western government targets in near term. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 7-DAY </td> <td> IT Ops </td> <td> Migrate ALL network devices from SNMPv1/v2 to SNMPv3 with authentication and encryption. Any device with plaintext community strings is a confirmed FSB Center 16 target. </td> </tr> <tr> <td> 7-DAY </td> <td> IT Ops </td> <td> Inventory all Joomla instances — identify and patch or decommission any running iCagenda (CVE-2026-48939) or SP Page Builder (CVE-2026-48908). Both are CVSS 9.8, both on KEV, both allow unauthenticated RCE. </td> </tr> <tr> <td> 7-DAY </td> <td> DevOps </td> <td> Brief development teams on Siggen backdoor infection vector — inspect Visual Studio .vcxproj/.csproj files for unexpected pre-build commands; scan externally-sourced code projects before opening. </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Conduct threat hunt for historical connections to 80.87.206[.]239 and for Smart Install protocol activity (TCP/4786) in netflow data from the past 90 days. </td> </tr> <tr> <td> 7-DAY </td> <td> IR </td> <td> Update ransomware incident response playbook to account for four simultaneously active government-targeting groups (Deadlock, Akira, BITWISE SPIDER, WARLOCK SPIDER). Validate backup restoration procedures. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Commission assessment of all Schneider Electric Easergy MiCOM Px40 protection relays in state-managed electrical infrastructure — confirm firmware patched per ICSA-26-190-03. </td> </tr> <tr> <td> 30-DAY </td> <td> IT Ops </td> <td> Conduct comprehensive Joomla extension audit across all state web properties — the pattern of systematic Joomla extension exploitation (3 extensions in 3 weeks) indicates broader ecosystem risk beyond the two current KEVs. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Evaluate network architecture for router compromise resilience — implement out-of-band management for critical network devices; deploy configuration integrity monitoring (detect unauthorized changes). </td> </tr> <tr> <td> 30-DAY </td> <td> IR </td> <td> Conduct tabletop exercise simulating simultaneous ransomware attack on citizen services AND router compromise discovery — test coordination between SOC, IT Ops, and executive leadership under dual-incident pressure. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Review and update cyber insurance policy coverage in light of nation-state attribution (FSB Center 16, APT28) — confirm war exclusion clauses do not create coverage gaps for state-sponsored criminal operations. </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Attribution </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 80.87.206[.]239 </td> <td> TA505 government-targeting C2 (confidence 95) </td> <td> Block at perimeter </td> </tr> <tr> <td> MD5 </td> <td> 89618515b9522c0ae1914dd8b4147ac5 </td> <td> APT28 / Expiro loader </td> <td> Alert + investigate </td> </tr> <tr> <td> MD5 </td> <td> 5e8bf20650411220c6514dff67f2e2b6 </td> <td> APT28 / PowerShell loader </td> <td> Alert + investigate </td> </tr> <tr> <td> MD5 </td> <td> c2b3338ee82496f8c6154f2f560e59b7 </td> <td> APT28 / PowerShell loader </td> <td> Alert + investigate </td> </tr> <tr> <td> MD5 </td> <td> 176b0e6caed3ee017e138d5f6454aab7 </td> <td> APT28 / PowerShell loader </td> <td> Alert + investigate </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> The Bottom Line </h2> Today's EU/UK sanctions and 12-nation advisory are not just diplomatic signals — they are intelligence confirmations. FSB Center 16 is actively scanning your routers. APT28 is actively producing malware targeting your sector. TA505 has staged infrastructure for an imminent campaign against government. And four ransomware groups are simultaneously hunting in your space. The sanctions may provoke acceleration, not deterrence. When threat actors are publicly exposed, the historical pattern is intensified operations in the short term — either to demonstrate capability or to exploit access before it's burned. Your 24-hour priorities are clear: disable Cisco Smart Install, patch ColdFusion, block the TA505 C2 IP, and hunt for APT28 hashes. Your 7-day priority is SNMP hardening across your entire network device fleet. Everything else flows from whether those routers are already compromised. The adversary is not waiting. Neither should you. Anomali CTI Desk | 2026-07-13 | TLP:GREEN This intelligence is derived from ThreatStream Next-Gen, CISA advisories, and allied government joint advisories. Distribution within the government community and peer organizations is encouraged.

FEATURED RESOURCES

July 13, 2026

Anomali Cyber Watch

Iranian Cyber Operations Intensify: New Backdoor, Ransomware Pipelines, and the Silence Before the Storm

July 13, 2026

Anomali Cyber Watch

Public Sector

Russian Intelligence Services Actively Scanning Government Networks: What State CISOs Must Do This Week

July 10, 2026

Anomali Cyber Watch

Iranian Cyber Operations Reach Inflection Point: FortiBleed Pipeline Weaponized, Multi-Actor Convergence Accelerates

Explore All