Russian Intelligence Services and Ransomware Operators Converge on State Government VPN Infrastructure

Public Sector

Published on

May 20, 2026

Table of Contents

Threat Assessment Level: ELEVATED (unchanged from prior cycle; trending toward HIGH) State government networks face a dangerous convergence: Russian intelligence services are actively building phishing infrastructure targeting government entities while ransomware operators exploit the same VPN appliances that state agencies depend on for remote access. This dual-threat to remote access infrastructure demands immediate action from state IT leadership. The combination of APT28 and APT29 refreshing government-targeting capabilities alongside Abyss Locker ransomware actively exploiting SonicWall VPN vulnerabilities creates a scenario where a single unpatched appliance can serve as the entry point for either espionage or destructive ransomware — or both in sequence. <h2> What Changed </h2> The past week brought five significant developments that directly affect state government networks: <ol> <li> Abyss Locker Ransomware Reveals Full Attack Playbook Against Government-Relevant Infrastructure </li> </ol> Incident response analysis published this week documents Abyss Locker's complete attack chain: exploitation of unpatched SonicWall VPN appliances (CVE-2021-20038), followed by targeted credential theft from Veeam backup systems, EDR evasion via Bring-Your-Own-Vulnerable-Driver (BYOVD), and SSH tunneling through ESXi hosts for persistent command-and-control. This playbook maps directly to common state government infrastructure. <ol start="2"> <li> Russian Intelligence Services Refresh Government-Targeting Infrastructure </li> </ol> APT28 (Fancy Bear) registered new phishing infrastructure specifically tagged for government targeting, while APT29 (COZY BEAR / Midnight Blizzard) refreshed high-confidence malware indicators associated with their ATI-Agent tooling — both updated as of May 2026. These are not historical indicators; they represent active operational preparation. <ol start="3"> <li> CISA Publishes Five ICS Advisories Including Building Automation Controllers </li> </ol> New vulnerabilities in Kieback & Peter DDC building controllers — widely deployed in government facilities for HVAC, lighting, and access control — allow browser takeover attacks. Combined with ongoing Siemens and ABB advisories, state facility OT networks face expanding risk. <ol start="4"> <li> ClickFix/InstallFix Social Engineering Infrastructure Remains Active </li> </ol> C2 infrastructure supporting ClickFix/InstallFix campaigns continues to operate, targeting government users with fake browser update prompts and software installation dialogs that bypass traditional email security controls by inducing users to manually execute malicious PowerShell payloads. <ol start="5"> <li> Supply Chain Threats Expand via npm Ecosystem and VS Code Extensions </li> </ol> A third wave of the Mini Shai-Hulud npm worm compromised hundreds of packages, and the Nx Console VS Code extension (2.2 million installs) was found compromised — creating CI/CD pipeline risk for any state agency using Node.js-based development tooling or modern developer environments. <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Relevance to State Government </th> </tr> </thead> <tbody> <tr> <td> May 13 </td> <td> Abyss Locker campaign documented exploiting CVE-2021-20038 </td> <td> SonicWall SMA 100 appliances common in state remote access </td> </tr> <tr> <td> May 15 </td> <td> Salt Typhoon (China) last IOC refresh — then silence </td> <td> Possible retooling; does NOT indicate reduced risk </td> </tr> <tr> <td> May 17 </td> <td> APT28 phishing domain syd.clarionquestgroup[.]cfd registered </td> <td> Explicitly tagged for government targeting </td> </tr> <tr> <td> May 18 </td> <td> Nx Console VS Code extension compromise (2.2M installs) </td> <td> Supply chain risk to developer environments </td> </tr> <tr> <td> May 19 </td> <td> Mini Shai-Hulud npm worm Wave 3 — hundreds of packages compromised </td> <td> CI/CD pipeline risk for agencies using Node.js </td> </tr> <tr> <td> May 19 </td> <td> Poland abandons Signal for government comms (Russian APT QR-code attacks) </td> <td> Validates messaging platform risks for state officials </td> </tr> <tr> <td> May 19 </td> <td> CISA publishes 5 ICS advisories (Kieback & Peter, Siemens, ABB, ScadaBR, ZKTeco) </td> <td> Building automation and SCADA in state facilities </td> </tr> <tr> <td> May 20 </td> <td> COZY BEAR (APT29) IOCs refreshed — government/defense targeting confirmed </td> <td> Active campaign preparation against .gov entities </td> </tr> <tr> <td> May 20 </td> <td> CHATTY SPIDER (Luna Moth) actor profile updated </td> <td> Callback phishing threat to state employees persists </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> Russian Intelligence Services: Dual-Axis Government Targeting </h3> APT28 (Fancy Bear / Forest Blizzard) has established new phishing infrastructure on the domain syd.clarionquestgroup[.]cfd, tagged with government targeting indicators. APT28's established playbook involves credential harvesting via convincing login portals, followed by persistent access to email systems and document repositories. State government email systems (particularly M365 environments) are prime targets. APT29 (COZY BEAR / Midnight Blizzard) refreshed malware indicators for their ATI-Agent tooling with explicit government and defense targeting tags. The indicators carry very-high severity ratings and are associated with spearphishing delivery mechanisms. APT29 historically targets government networks for long-term intelligence collection, with particular interest in policy communications and inter-agency coordination. Key ATT&CK Techniques: T1566.001 (Spearphishing Attachment), T1566.002 (Spearphishing Link), T1078 (Valid Accounts), T1041 (Exfiltration Over C2) <h3> Abyss Locker: The VPN-to-Ransomware Kill Chain </h3> Abyss Locker represents an immediate, concrete threat to any state agency running unpatched SonicWall SMA 100 appliances. Their documented attack chain: <ul> <li> Initial Access: Exploit CVE-2021-20038 (SonicWall SMA 100 stack-based buffer overflow) </li> </ul> <ul> <li> Credential Theft: Deploy veeam11.ps1 — a weaponized variant of Veeam credential harvesting scripts that extracts domain credentials stored in Veeam Backup & Replication </li> </ul> <ul> <li> Defense Evasion: BYOVD using UpdateDrv.sys (Zemana), ped.sys (Process Explorer), and 3ware.sys to disable EDR </li> </ul> <ul> <li> Persistence: Install WMI Helper Agent service with wmihelper.exe </li> </ul> <ul> <li> Lateral Movement: SSH tunneling via Chisel through ESXi hosts (ports on 64.95.12[.]57 and 64.95.12[.]70) </li> </ul> <ul> <li> Exfiltration: Rclone to AWS S3 and BackBlaze before encryption </li> </ul> <ul> <li> Impact: File encryption with .Abyss and .crypt extensions </li> </ul> The targeting of Veeam backup credentials is particularly concerning: successful extraction gives attackers both domain-level access AND the ability to destroy backup integrity before deploying ransomware. Key ATT&CK Techniques: T1190 (Exploit Public-Facing Application), T1003.002 (SAM Registry), T1562.001 (Disable Security Tools), T1068 (BYOVD), T1572 (Protocol Tunneling), T1567.002 (Exfiltration to Cloud Storage), T1486 (Data Encrypted for Impact) <h3> ClickFix/InstallFix: Social Engineering Targeting Government Users </h3> The C2 infrastructure at 77.91.97[.]244 (ASN 205775, Georgia) continues to support social engineering campaigns that trick users into executing malicious PowerShell commands. These campaigns use fake browser update prompts and software installation dialogs — techniques that bypass traditional email security controls because the user manually executes the payload. Key ATT&CK Techniques: T1204.002 (User Execution: Malicious File), T1059.001 (PowerShell), T1548.002 (Bypass UAC) <h3> Building Automation: The Expanding OT Attack Surface </h3> CISA's advisory on Kieback & Peter DDC building controllers reveals browser takeover vulnerabilities in systems commonly deployed in government facilities. These controllers manage HVAC, lighting, and physical access control. When connected to corporate networks (as is common in state facilities), they represent an unmonitored lateral movement path from OT to IT — or vice versa. This joins a growing pattern: Siemens RUGGEDCOM, ABB CoreSense, and ScadaBR (unauthenticated RCE) advisories all published in the same window. Key ATT&CK Techniques: T1189 (Drive-by Compromise), T0831 (Manipulation of Control), T0855 (Unauthorized Command Message) <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability (72h) </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> APT28/APT29 spearphishing campaign against state .gov email addresses </td> <td> HIGH (70-80%) </td> <td> Fresh infrastructure + refreshed malware = active campaign preparation </td> </tr> <tr> <td> Abyss Locker expands targeting to state/local government VPN appliances </td> <td> MODERATE-HIGH (55-65%) </td> <td> TTP alignment with state infrastructure; sector expansion is typical ransomware maturation </td> </tr> <tr> <td> COZY BEAR credential harvesting campaign against state policy officials </td> <td> MODERATE (45-55%) </td> <td> ATI-Agent refresh with gov targeting; APT29 historically targets policy communications </td> </tr> <tr> <td> Supply chain compromise affecting state CI/CD pipelines (npm/GitHub Actions) </td> <td> MODERATE (40-50%) </td> <td> Active npm worm campaigns; state agencies increasingly use modern development tooling </td> </tr> <tr> <td> Exploitation of Kieback & Peter DDC controllers in state facilities </td> <td> LOW (15-25%) </td> <td> No evidence of active exploitation yet; advisory-only </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> Hunt Hypothesis 1: SonicWall VPN Exploitation (Abyss Locker Initial Access) <ul> <li> Monitor SonicWall SMA 100 appliance logs for anomalous authentication patterns, unexpected administrative sessions, or crash/restart events </li> <li> Hunt for: PowerShell execution on systems immediately following VPN authentication from unusual source IPs </li> <li> ATT&CK: T1190 , T1059.001 </li> <li> Detection: Alert on powershell.exe spawned by VPN-related service processes </li> </ul> Hunt Hypothesis 2: Veeam Credential Harvesting <ul> <li> Monitor for: PowerShell scripts accessing Veeam credential stores, execution of scripts matching *Veeam*Cred* naming patterns, or connections to Veeam SQL databases from non-Veeam processes </li> <li> ATT&CK: T1003.002 </li> <li> Detection: File creation monitoring for veeam*.ps1 in temp directories; SQL queries against VeeamBackup database from unexpected sources </li> <li> Registry: Alert on HKLM\SOFTWARE\Policies\Microsoft\Windows Defender\DisableAntiSpyware being set to 1 </li> </ul> Hunt Hypothesis 3: BYOVD EDR Evasion <ul> <li> Monitor for: Loading of known vulnerable drivers (UpdateDrv.sys, ped.sys, 3ware.sys) </li> <li> ATT&CK: T1068 , T1562.001 </li> <li> Detection: Driver load events (Sysmon Event ID 6) for unsigned or known-vulnerable drivers; EDR agent health monitoring for unexpected termination </li> </ul> Hunt Hypothesis 4: APT28/APT29 Spearphishing Delivery <ul> <li> Monitor for: DNS queries or proxy connections to syd.clarionquestgroup[.]cfd </li> <li> Monitor for: Email attachments delivering ATI-Agent (SHA256: 30c69d91247f8a72a69e4d7c4bce3eafba40975e5890c23dc4dbe7c9a11afa73) </li> <li> ATT&CK: T1566.001 , T1566.002 </li> <li> Detection: Email gateway rules for .cfd TLD domains in links; EDR hash-based blocking </li> </ul> Hunt Hypothesis 5: ESXi SSH Tunneling (Lateral Movement/C2) <ul> <li> Monitor for: SSH being enabled on ESXi hosts (normally disabled); outbound connections from ESXi management interfaces to external IPs </li> <li> ATT&CK: T1572 , T1021.004 </li> <li> Detection: Alert on ESXi SSH service state changes; network monitoring for outbound SSH from hypervisor management VLANs </li> </ul> <h3> IOC Blocking Table </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 77.91.97[.]244 </td> <td> ClickFix/InstallFix C2 (ASN 205775, Georgia) </td> <td> Block at firewall + proxy </td> </tr> <tr> <td> IPv4 </td> <td> 64.95.12[.]57 </td> <td> Abyss Locker C2 / SSH reverse tunnel </td> <td> Block at firewall </td> </tr> <tr> <td> IPv4 </td> <td> 64.95.12[.]70 </td> <td> Abyss Locker ESXi SSH tunnel </td> <td> Block at firewall </td> </tr> <tr> <td> Domain </td> <td> syd.clarionquestgroup[.]cfd </td> <td> APT28 phishing infrastructure (gov-targeting) </td> <td> Block at DNS + proxy </td> </tr> <tr> <td> SHA-256 </td> <td> 30c69d91247f8a72a69e4d7c4bce3eafba40975e5890c23dc4dbe7c9a11afa73 </td> <td> COZY BEAR ATI-Agent malware </td> <td> Block at EDR + email gateway </td> </tr> <tr> <td> SHA-1 </td> <td> c3d8a548fa0525e1e55aa592e14303fc6964d28d </td> <td> COZY BEAR ATI-Agent (delivery) </td> <td> Block at EDR + email gateway </td> </tr> <tr> <td> File </td> <td> UpdateDrv.sys / ped.sys / 3ware.sys </td> <td> BYOVD drivers (Abyss Locker EDR evasion) </td> <td> Block driver loading via WDAC policy </td> </tr> <tr> <td> File </td> <td> wmihelper.exe </td> <td> Abyss Locker persistence agent </td> <td> Block at EDR </td> </tr> <tr> <td> Registry </td> <td> DisableAntiSpyware = 1 </td> <td> Defender tampering indicator </td> <td> Alert (do not block — investigate) </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits Systems) </h3> <ul> <li> Primary threat: Abyss Locker ransomware targeting financial data exfiltration before encryption; APT29 targeting fiscal policy communications </li> <li> Priority action: Audit VPN access to financial systems (ERP, tax processing, benefits disbursement); ensure Veeam backups of financial databases use isolated service accounts with MFA </li> <li> Detection focus: Monitor for Rclone or similar sync tools ( T1567.002 ) executing in financial system segments; alert on bulk data access patterns outside business hours </li> </ul> <h3> Energy (State-Operated Utilities, Grid Coordination) </h3> <ul> <li> Primary threat: ICS/SCADA vulnerabilities (ABB CoreSense, Siemens RUGGEDCOM); Abyss Locker explicitly targets energy/utilities sector </li> <li> Priority action: Verify network segmentation between IT and OT; confirm no building automation controllers (Kieback & Peter DDC) bridge IT/OT boundaries; patch or isolate ScadaBR instances </li> <li> Detection focus: Monitor for unauthorized connections crossing IT/OT boundaries; alert on new SSH sessions to SCADA management interfaces </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware targeting PII/PHI for double-extortion; credential theft from health information exchanges </li> <li> Priority action: Verify backup integrity for Medicaid claims systems and health registries; ensure Veeam service accounts cannot access clinical data stores directly </li> <li> Detection focus: Monitor for bulk PHI access or export; alert on PowerShell execution in healthcare application server segments </li> </ul> <h3> Government (Executive Agencies, Legislative Systems, Elections) </h3> <ul> <li> Primary threat: APT28 and APT29 credential harvesting targeting policy officials and inter-agency communications; ClickFix social engineering against government employees </li> <li> Priority action: Enforce phishing-resistant MFA (FIDO2/hardware keys) for senior officials and policy staff; block .cfd TLD at DNS for all government users; brief staff on ClickFix/fake update social engineering </li> <li> Detection focus: Monitor for device code authentication flows ( T1078 ); alert on OAuth consent grants to unfamiliar applications; hunt for PowerShell execution following browser processes </li> </ul> <h3> Aviation / Logistics (State DOT, Port Authorities, Transit Systems) </h3> <ul> <li> Primary threat: Supply chain compromise via development tooling (npm worm, VS Code extensions); ICS vulnerabilities in transit SCADA and traffic management </li> <li> Priority action: Audit CI/CD pipelines for pinned dependencies; verify no Kieback & Peter DDC controllers manage transit facility access control; segment traffic management systems from corporate IT </li> <li> Detection focus: Monitor for unexpected npm package installations in build environments; alert on outbound connections from build servers to unknown domains </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops / Network </td> <td> Verify SonicWall SMA 100 patch status against CVE-2021-20038 across ALL state VPN appliances. This is the #1 confirmed exploitation vector for Abyss Locker ransomware. Any unpatched appliance is an open door. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Block IOCs listed in the table above at perimeter firewall, DNS resolver, web proxy, email gateway, and EDR platforms. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Deploy COZY BEAR hash detections — add SHA-256 30c69d91... and SHA-1 c3d8a548... to all endpoint detection platforms and email attachment scanning. </td> </tr> <tr> <td> 4 </td> <td> IT Ops </td> <td> Audit Veeam Backup & Replication service account permissions — confirm accounts use least-privilege, cannot be used for interactive logon, and are not domain admin equivalent. </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> IT Ops </td> <td> Enable MFA on Veeam console access and restrict management interface to jump server only. Monitor for PowerShell scripts matching *Veeam*Cred* patterns. </td> </tr> <tr> <td> 6 </td> <td> SOC </td> <td> Create detection rules for APT28 domain syd.clarionquestgroup[.]cfd in DNS and proxy logs. Alert on any resolution attempt. </td> </tr> <tr> <td> 7 </td> <td> Facilities / OT </td> <td> Inventory all Kieback & Peter DDC building controllers on state networks. Verify firmware versions and segment from corporate IT pending vendor patch. </td> </tr> <tr> <td> 8 </td> <td> SOC </td> <td> Implement BYOVD detection — alert on loading of UpdateDrv.sys, ped.sys, or 3ware.sys via Sysmon driver load events or Windows Defender Application Control (WDAC) policies. </td> </tr> <tr> <td> 9 </td> <td> IT Ops </td> <td> Audit ESXi SSH configuration — ensure SSH is disabled by default on all hypervisor hosts; create alerts for SSH service enablement or outbound SSH from management VLANs. </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 10 </td> <td> CISO </td> <td> Commission red team assessment of VPN-to-domain-admin attack path, specifically testing Veeam credential harvesting and BYOVD EDR evasion scenarios. </td> </tr> <tr> <td> 11 </td> <td> CISO </td> <td> Implement phishing-resistant MFA (FIDO2) for all senior officials, policy staff, and IT administrators — APT28/APT29 credential harvesting defeats SMS and app-based MFA. </td> </tr> <tr> <td> 12 </td> <td> CISO / Procurement </td> <td> Evaluate backup OSINT intelligence source — 7-day degradation of primary OSINT collection creates unacceptable corroboration gaps for threat intelligence operations. </td> </tr> <tr> <td> 13 </td> <td> IT Ops / Facilities </td> <td> Develop OT/IT segmentation plan for building automation systems — Kieback & Peter, Siemens, and ABB advisories indicate expanding attack surface that is currently unmonitored. </td> </tr> <tr> <td> 14 </td> <td> CISO / IR </td> <td> Update incident response playbooks to include Abyss Locker-specific scenarios: VPN exploitation → Veeam credential theft → backup destruction → ESXi encryption. Tabletop exercise recommended within 30 days. </td> </tr> </tbody> </table> <h2> The Bottom Line </h2> State government networks sit at the intersection of two converging threats: nation-state intelligence services building infrastructure to harvest government credentials, and ransomware operators perfecting attack chains against the exact VPN and backup technologies state agencies rely on. The single highest-leverage action available today is confirming that SonicWall VPN appliances are patched against CVE-2021-20038. This one vulnerability is the confirmed entry point for a ransomware group whose entire playbook — from initial access through backup destruction to encryption — maps to standard state government infrastructure. The second priority is treating backup infrastructure as a crown jewel. Abyss Locker's targeted Veeam credential harvesting demonstrates that attackers understand backup systems are the last line of defense — and they are specifically designed to eliminate that defense before striking. Russian intelligence services (APT28 and APT29) refreshing government-targeting infrastructure in the same window adds urgency: a state agency compromised via VPN exploitation today could face ransomware deployment tomorrow AND long-term espionage access simultaneously. Act now. Verify your VPN patches. Harden your backups. Block the indicators. Brief your teams. Published 20 May 2026 by Anomali CTI Desk

FEATURED RESOURCES

May 20, 2026

Anomali Cyber Watch

The Silent Countdown: Iran's Cyber Operations Enter a Dangerous Steady State While Critical Blind Spots Grow

May 20, 2026

Anomali Cyber Watch

Public Sector

Russian Intelligence Services and Ransomware Operators Converge on State Government VPN Infrastructure

May 19, 2026

Anomali Cyber Watch

Iran's Cyber Offensive Hits U.S. Fuel Infrastructure: What CISOs Must Know Now

Explore All