Salt Typhoon Resurfaces, Fortinet Credentials Remain Exposed, and a 3-Million-Record Vendor Breach Hits Texas: What State IT Leaders Must Do Today

Public Sector

Published on

June 23, 2026

Table of Contents

Threat Assessment Level: ELEVATED Unchanged from the prior cycle. The convergence of actively exploited Fortinet vulnerabilities, confirmed Chinese state-sponsored targeting of U.S. government networks, and a massive third-party vendor breach affecting state citizen data sustains this posture. Escalation to HIGH is possible within 72 hours if Fortinet credential exploitation against state agencies is confirmed. <h2> Introduction </h2> State government IT leaders face a threat environment where three distinct attack vectors are converging simultaneously: nation-state espionage actors are actively targeting government networks with fresh malware, a critical mass of stolen Fortinet credentials remains available to adversaries, and third-party vendors handling millions of citizen records are being breached at scale. This is not a theoretical risk briefing. CISA updated its Fortinet hardening directive on June 22. A Chinese state-sponsored group refreshed its malware infrastructure targeting U.S. government on June 23. And Texas just disclosed that 3 million citizens had their driver's license and passport data exposed through a state licensing vendor. If your agency operates Fortinet perimeter devices, relies on third-party vendors for citizen services, or has not validated its endpoint detection resilience against kernel-level attacks — this report requires your immediate attention. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Date </th> <th> Why It Matters </th> </tr> </thead> <tbody> <tr> <td> CISA updates Fortinet credential exposure guidance </td> <td> Jun 22 </td> <td> Government explicitly named as targeted sector; credential rotation now mandatory, not advisory </td> </tr> <tr> <td> Salt Typhoon (China) deploys fresh SNAPPYBEE loader targeting U.S. government </td> <td> Jun 23 </td> <td> Active espionage campaign with IOC updated today — this group previously compromised major U.S. telecoms </td> </tr> <tr> <td> Texas Parks & Wildlife vendor breach exposes 3M citizen records </td> <td> Jun 23 </td> <td> Driver's licenses, passports, addresses exposed via unnamed third-party licensing vendor </td> </tr> <tr> <td> Dual-RMM phishing campaigns deliver ConnectWise + MSP360 </td> <td> Jun 23 </td> <td> Legitimate remote management tools weaponized — blends with normal state IT operations </td> </tr> <tr> <td> "Gentlemen" ransomware group reveals GentleKiller EDR-killing framework </td> <td> Jun 23 </td> <td> Operator-maintained EDR defeat capability with rapid BYOVD weaponization; top-5 most active RaaS in Q1 2026 </td> </tr> <tr> <td> 7 new ICS advisories from CISA </td> <td> Jun 18–23 </td> <td> Mitsubishi, Schneider Electric, Rockwell systems used in state water/energy infrastructure affected </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor/Source </th> <th> Impact to State Government </th> </tr> </thead> <tbody> <tr> <td> Jun 12 </td> <td> VOID MANTICORE breaches California water utility </td> <td> IRGC-affiliated (Iran) </td> <td> Demonstrates active targeting of U.S. water infrastructure </td> </tr> <tr> <td> Jun 17–18 </td> <td> 73,932 FortiGate admin credentials published (FortiBleed / CVE-2026-25815) </td> <td> UNC5435 (Russia-nexus) </td> <td> Government entities identified in criminal sales catalogs </td> </tr> <tr> <td> Jun 18 </td> <td> CISA issues initial Fortinet hardening directive </td> <td> CISA </td> <td> Mandatory action for all federal/state Fortinet operators </td> </tr> <tr> <td> Jun 21 </td> <td> SLICKDEMON supply chain malware targets government in 7 countries </td> <td> China-nexus (unattributed) </td> <td> State agencies using DAEMON Tools potentially exposed </td> </tr> <tr> <td> Jun 22 </td> <td> CISA updates Fortinet guidance with latest Fortinet remediation steps </td> <td> CISA </td> <td> Confirms ongoing exploitation; raises urgency for credential rotation </td> </tr> <tr> <td> Jun 23 </td> <td> Salt Typhoon SNAPPYBEE loader IOC refreshed — U.S. government targeted </td> <td> Salt Typhoon / Earth Estries (China) </td> <td> Direct espionage threat to state government networks </td> </tr> <tr> <td> Jun 23 </td> <td> Texas TPWD vendor breach — 3,087,721 records exposed </td> <td> Unknown actor </td> <td> Licensing/permitting vendors confirmed as high-value targets </td> </tr> <tr> <td> Jun 23 </td> <td> Adobe-spoofing phishing delivers ConnectWise ScreenConnect RAT </td> <td> Unattributed </td> <td> State employees targeted with legitimate-looking RMM tools </td> </tr> <tr> <td> Jun 23 </td> <td> Document-themed phishing delivers MSP360 RMM </td> <td> Unattributed </td> <td> Second RMM delivery campaign same day — suggests coordinated operation </td> </tr> <tr> <td> Jun 23 </td> <td> Gentlemen RaaS GentleKiller EDR-killing framework disclosed </td> <td> Gentlemen (RaaS) </td> <td> Advanced EDR defeat capability; geographic expansion to U.S. probable </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Salt Typhoon Returns with Active Government Targeting </h3> Actor: Salt Typhoon (aliases: Earth Estries, FamousSparrow, GhostEmperor, UNC2286) Origin: China (state-sponsored) Malware: SNAPPYBEE loader (DgApi.dll) Salt Typhoon — the group responsible for the 2024–2025 compromise of major U.S. telecommunications providers — has refreshed its operational infrastructure with indicators specifically targeting U.S. government and telecommunications networks. The SNAPPYBEE loader uses DLL search order hijacking (DgApi.dll sideloading) to establish persistent access, a technique consistent with this group's established tradecraft. Why this matters for state government: Salt Typhoon's previous telecom compromises gave them access to communications metadata and potentially wiretap systems. Their pivot to direct government targeting suggests they are expanding collection beyond telecom intermediaries to government endpoints themselves. State agencies that share network infrastructure with telecom providers or use state-managed telecom services face elevated risk. <h3> 2. Fortinet Credential Exposure — The Clock Is Running </h3> Actor: UNC5435 (Russia-nexus) CVE: CVE-2026-25815 (FortiBleed) Scope: 73,932 FortiGate administrator credentials published CISA's June 22 update to its Fortinet hardening directive is not routine maintenance — it reflects ongoing, confirmed exploitation of stolen credentials against government networks. The original credential dump from June 17–18 explicitly included government entities in criminal sales catalogs. Any state agency operating internet-accessible FortiGate devices that has not completed full credential rotation must assume those credentials are in adversary hands. Probability assessment: We assess a 75–85% probability that ransomware operators will deploy against state infrastructure within 7–14 days using these stolen credentials, targeting organizations that have not completed rotation. This estimate is based on the historical time-to-exploitation pattern following major credential dumps and the confirmed presence of government entities in the data. <h3> 3. Third-Party Vendor Breach at Scale — Texas as Warning </h3> Victim: Texas Parks and Wildlife Department (via unnamed vendor) Records exposed: 3,087,721 Data types: Driver's license numbers, passport numbers, email addresses, phone numbers, residential addresses This breach demonstrates a systemic vulnerability in state government: citizen-facing licensing and permitting systems are frequently operated by third-party vendors whose security posture the state does not directly control. The vendor remains unnamed, breach notifications contained conflicting information about SSN exposure, and no technical indicators have been published — all signs of an immature vendor incident response capability. Every state agency using external vendors for hunting/fishing licenses, DMV processing, professional licensing, or benefits administration carries this identical risk profile. <h3> 4. Dual-RMM Phishing — Hiding in Plain Sight </h3> Two parallel phishing campaigns detected on June 23 deliver legitimate remote management tools — ConnectWise ScreenConnect and MSP360 — as initial access vectors. The ConnectWise campaign uses Adobe-themed lures with a kill chain of batch file → PowerShell → MSI installer, communicating with C2 at pulsegrid365[.]site. The MSP360 campaign uses document-themed lures delivering via docum[.]info. The detection challenge: State agencies that legitimately use MSPs (and their associated RMM tools) cannot simply block these applications at the network level. ConnectWise and MSP360 traffic from an unauthorized installation looks identical to traffic from a legitimate one. Detection must be behavioral — which user installed it, on which endpoint, at what time, and was it authorized? <h3> 5. Gentlemen Ransomware — EDR Is No Longer Your Safety Net </h3> Actor: Gentlemen (RaaS operation) Tool: GentleKiller (8 variants), plus HexKiller, ThrottleBlood, HavocKiller Capability: Operator-maintained EDR-killing framework with rapid BYOVD weaponization The Gentlemen ransomware group has emerged as a top-5 most active RaaS operation in Q1 2026, distinguished by a critical capability: the operators (not affiliates) maintain a dedicated EDR-killing toolset that incorporates new Bring Your Own Vulnerable Driver (BYOVD) exploits within days of public proof-of-concept release. Their 90% affiliate revenue share is aggressively recruiting operators from other groups. Current targeting: Southeast Asia, South America, Western Europe (Thailand, Brazil, France). Not currently U.S.-focused — but the low barrier to affiliate entry and operator-provided EDR defeat tools make geographic expansion to U.S. state government a matter of when, not if. Probability assessment: We assess a 40–55% probability of Gentlemen affiliates targeting U.S. state/local government within 60 days, based on the group's aggressive recruitment, high affiliate share, and the historical pattern of RaaS operations expanding to U.S. government targets once they achieve operational maturity. <h3> 6. ICS/SCADA Advisories — Water and Energy Infrastructure </h3> CISA issued seven ICS advisories (June 18–23) affecting systems commonly deployed in state-managed critical infrastructure: <ul> <li> Mitsubishi MELSEC iQ-F (2 advisories) — used in water treatment automation </li> <li> Schneider Electric Easergy, PowerLogic, Saitel — power distribution and grid monitoring </li> <li> Rockwell FactoryTalk Historian — industrial data historian used across water/energy </li> <li> AzeoTech DAQFactory — data acquisition in utility SCADA environments </li> </ul> These advisories arrive in the context of confirmed Iranian targeting of U.S. water infrastructure (VOID MANTICORE, June 12) and ongoing Chinese pre-positioning concerns (Volt Typhoon). <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Ransomware deployment against state agencies via stolen Fortinet credentials </td> <td> 75–85% </td> <td> 7–14 days </td> <td> Historical time-to-exploitation after credential dumps; government entities confirmed in data </td> </tr> <tr> <td> Salt Typhoon follow-on activity with additional IOCs targeting government </td> <td> 70–80% </td> <td> 48–72 hours </td> <td> IOC freshness (updated Jun 23) indicates active campaign infrastructure </td> </tr> <tr> <td> Additional state vendor breaches in licensing/permitting systems </td> <td> 60–70% </td> <td> 30 days </td> <td> Texas breach demonstrates systemic vendor security gaps across states </td> </tr> <tr> <td> Gentlemen RaaS expansion to U.S. government targets </td> <td> 40–55% </td> <td> 60 days </td> <td> Aggressive affiliate recruitment; EDR-killing capability removes key defensive barrier </td> </tr> <tr> <td> Exploitation of unpatched ICS systems in state water/energy infrastructure </td> <td> 50–60% </td> <td> 30 days </td> <td> VOID MANTICORE precedent + fresh CISA ICS advisories + known scanning activity </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> Hunt for Salt Typhoon SNAPPYBEE Loader: <ul> <li> Search all endpoints for SHA256: 25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b </li> <li> Alert on DgApi.dll loaded from non-standard paths (T1574.001 — DLL Search Order Hijacking) </li> <li> Hunting hypothesis: If Salt Typhoon has established persistence, look for DLL sideloading in directories where legitimate applications reside but where DgApi.dll is not a standard component </li> </ul> Block RMM Phishing Infrastructure: <ul> <li> Block at DNS/proxy: pulsegrid365[.]site, zonedocshring[.]it[.]com, docum[.]info, hokkien[.]org[.]my </li> <li> Alert on file hashes: </li> <ul> <li> MD5 cbb11db5f8fed9168ed620ecc4fed3b0 (malicious batch installer) </li> <li> MD5 f862f698aeb77f05795f1ade8722d0ce (PowerShell loader) </li> <li> MD5 87174fdc992ba9b5186de223703754cd (ScreenConnect MSI) </li> <li> MD5 386529af136fe96a23da6aaa39711e2b (MSP360 RMM installer) </li> </ul> <li> Monitor for Telegram bot communications: bot6724358070:AAHKifpAmQc04JM0HtznvefY-CqavBsKwWU (T1071 — Application Layer Protocol) </li> </ul> Fortinet Credential Abuse Detection: <ul> <li> Monitor FortiGate authentication logs for logins from unusual source IPs or at unusual times (T1078 — Valid Accounts) </li> <li> Alert on new VPN sessions from geographic locations inconsistent with your workforce (T1133 — External Remote Services) </li> <li> Hunt for configuration changes on FortiGate devices made outside change windows </li> </ul> <h3> ATT&CK-Mapped Detection Matrix </h3> <table> <thead> <tr> <th> Technique </th> <th> ID </th> <th> What to Monitor </th> <th> Tool/Log Source </th> </tr> </thead> <tbody> <tr> <td> DLL Search Order Hijacking </td> <td> T1574.001 </td> <td> DgApi.dll in non-standard paths </td> <td> EDR (Sysmon Event 7) </td> </tr> <tr> <td> Valid Accounts </td> <td> T1078 </td> <td> Anomalous FortiGate/VPN logins </td> <td> FortiGate logs, SIEM </td> </tr> <tr> <td> External Remote Services </td> <td> T1133 </td> <td> New VPN sessions, geo-impossible travel </td> <td> VPN logs, UEBA </td> </tr> <tr> <td> Remote Access Software </td> <td> T1219 </td> <td> Unauthorized RMM installations </td> <td> EDR, software inventory </td> </tr> <tr> <td> Phishing: Spearphishing Link </td> <td> T1566.002 </td> <td> Adobe/document-themed emails with R2.dev URLs </td> <td> Email gateway </td> </tr> <tr> <td> PowerShell Execution </td> <td> T1059.001 </td> <td> sc_hidden_install.ps1 or similar hidden install scripts </td> <td> Script block logging </td> </tr> <tr> <td> Impair Defenses </td> <td> T1562.001 </td> <td> EDR service stops, driver loads from temp paths </td> <td> EDR tamper protection alerts </td> </tr> <tr> <td> Exploitation for Privilege Escalation </td> <td> T1068 </td> <td> Unsigned/revoked driver loads (BYOVD) </td> <td> Driver load monitoring </td> </tr> <tr> <td> Data Encrypted for Impact </td> <td> T1486 </td> <td> Mass file modification, encryption artifacts </td> <td> EDR, file integrity monitoring </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> "Has Salt Typhoon already established persistence?" — Search for any DLL sideloading activity in the past 30 days where the loaded DLL was not part of the original application package. Focus on government workstations with access to sensitive data or telecom-adjacent systems. </li> <li> "Are stolen Fortinet credentials being used against us?" — Correlate FortiGate successful authentications against the known credential dump timeline (Jun 17+). Any new VPN session established after Jun 17 from an IP not previously seen in your environment warrants investigation. </li> <li> "Do we have unauthorized RMM tools in our environment?" — Run a full software inventory scan for ConnectWise ScreenConnect, MSP360, AnyDesk, TeamViewer, and MeshCentral installations. Compare against your authorized RMM allowlist. Any discrepancy is a potential compromise indicator. </li> <li> "Is our EDR resilient to kernel-level attacks?" — Review EDR tamper protection logs for the past 14 days. Any alerts about service interruption, driver load failures, or protection downgrades should be treated as potential GentleKiller-style reconnaissance. </li> </ol> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Tax Systems) </h3> <ul> <li> Primary threat: Credential theft via Fortinet exploitation leading to access to financial transaction systems </li> <li> Action: Ensure all state financial systems behind FortiGate devices have completed credential rotation. Implement transaction anomaly detection for any financial system accessed via VPN in the past 7 days. </li> <li> Vendor risk: Review any third-party payment processors or tax filing vendors for security posture — the Texas breach pattern applies to financial data vendors equally. </li> </ul> <h3> Energy (State-Managed Utilities, Grid Oversight) </h3> <ul> <li> Primary threat: ICS exploitation via Schneider Electric Easergy/PowerLogic/Saitel vulnerabilities; Iranian actor precedent (VOID MANTICORE) </li> <li> Action: Prioritize patching Schneider Electric systems per CISA advisories. Verify network segmentation between IT and OT environments. Confirm that no ICS/SCADA systems are reachable from FortiGate VPN segments with potentially compromised credentials. </li> <li> Monitoring: Alert on any IT-to-OT lateral movement attempts, particularly from VPN-connected sessions. </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware via stolen Fortinet credentials targeting systems containing protected health information (PHI) </li> <li> Action: Validate backup integrity for all Medicaid and health information exchange systems. Ensure offline/immutable backups exist and have been tested within the past 30 days. </li> <li> Vendor risk: Health IT vendors processing PHI face the same third-party breach risk demonstrated in Texas. Confirm BAA breach notification SLAs are ≤72 hours. </li> </ul> <h3> Government (Executive Branch Agencies, Citizen Services) </h3> <ul> <li> Primary threat: Multi-vector — Salt Typhoon espionage, ransomware via Fortinet credentials, vendor breaches exposing citizen PII </li> <li> Action: Immediate Fortinet credential rotation verification. Conduct emergency vendor security review for all citizen-facing licensing/permitting systems. Deploy Salt Typhoon IOCs across all agency endpoints. </li> <li> Identity: Implement conditional access policies requiring MFA for all VPN and remote access — even for accounts with valid credentials. </li> </ul> <h3> Aviation / Logistics (State DOT, Port Authorities, Transit) </h3> <ul> <li> Primary threat: Salt Typhoon targeting transportation sector; ICS vulnerabilities in traffic management and transit SCADA </li> <li> Action: Hunt for SNAPPYBEE indicators on transportation management systems. Review Rockwell FactoryTalk Historian deployments in transit/traffic infrastructure for patch status. </li> <li> Monitoring: Alert on unusual data exfiltration patterns from transportation planning systems — Salt Typhoon's intelligence collection objectives include infrastructure mapping. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Operations </td> <td> Confirm Fortinet credential rotation is COMPLETE on all FortiGate devices per CISA June 22 guidance. Any device not rotated must be assumed compromised. Report compliance to CISO by end of day. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy Salt Typhoon IOC (SHA256: 25b9fdef...b409b / DgApi.dll) to all EDR platforms. Hunt retroactively for 30 days. Alert on DLL sideloading from non-standard paths. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Block phishing infrastructure at DNS and web proxy: pulsegrid365[.]site, zonedocshring[.]it[.]com, docum[.]info, hokkien[.]org[.]my. Deploy file hash alerts for all four MD5 indicators listed above. </td> </tr> <tr> <td> 4 </td> <td> SOC </td> <td> Verify no internet-exposed FortiGate management interfaces remain accessible. Scan external attack surface for TCP/443 and TCP/8443 on FortiGate devices. </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> IT Operations </td> <td> Audit all RMM tools across state agencies. Create a definitive allowlist of authorized remote management software. Configure EDR to alert on any RMM installation not on the allowlist (ConnectWise, MSP360, AnyDesk, TeamViewer, MeshCentral). </td> </tr> <tr> <td> 6 </td> <td> CISO / Procurement </td> <td> Initiate emergency vendor security review for all third-party vendors operating citizen-facing licensing, permitting, and benefits systems. Confirm breach notification SLAs, data minimization practices, and encryption-at-rest requirements. </td> </tr> <tr> <td> 7 </td> <td> SOC </td> <td> Deploy BYOVD detection rules — monitor for unsigned or revoked driver loads, known vulnerable driver hashes, and EDR service interruptions. The Gentlemen RaaS group weaponizes new BYOVD exploits within days of public PoC release. </td> </tr> <tr> <td> 8 </td> <td> IT Operations </td> <td> Implement conditional access policies requiring hardware MFA token or FIDO2 for all VPN and remote access sessions — even for accounts with valid passwords. This neutralizes stolen credential value. </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 9 </td> <td> CISO </td> <td> Commission purple team exercise simulating GentleKiller-style EDR defeat (certificate impersonation + BYOVD + EDR process termination). Validate that compensating controls (network detection, identity anomalies, immutable backups) function when EDR is disabled. </td> </tr> <tr> <td> 10 </td> <td> OT/ICS Team </td> <td> Patch ICS systems per CISA advisories: Mitsubishi MELSEC iQ-F, Schneider Electric PowerChute/Easergy/Saitel, Rockwell FactoryTalk Historian, AzeoTech DAQFactory. Coordinate maintenance windows with operations. </td> </tr> <tr> <td> 11 </td> <td> CISO / Legal </td> <td> Review and update incident response plans for third-party vendor breach scenarios. Ensure plans address conflicting vendor notifications, citizen notification timelines, and credit monitoring activation — all issues demonstrated in the Texas breach. </td> </tr> <tr> <td> 12 </td> <td> CISO </td> <td> Establish vendor security scoring program with continuous monitoring for all vendors handling >100,000 citizen records. Require annual penetration testing evidence and real-time breach notification capabilities. </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <ul> <li> Tabletop exercise recommendation: Within 14 days, conduct a ransomware tabletop exercise using the specific scenario of "Fortinet credential compromise → lateral movement → EDR disabled via BYOVD → ransomware deployment." This is not hypothetical — every component of this kill chain is confirmed active. </li> <li> Board communication: The Texas vendor breach and Fortinet credential exposure together represent material cyber risk to citizen data and state operations. Prepare a board-level briefing on third-party vendor risk posture and credential exposure remediation status. </li> </ul> <h2> IOC Blocking Table </h2> The following indicators are confirmed from intelligence collection and should be deployed to defensive systems immediately: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> pulsegrid365[.]site </td> <td> ConnectWise ScreenConnect C2 </td> </tr> <tr> <td> Domain </td> <td> zonedocshring[.]it[.]com </td> <td> Phishing delivery infrastructure </td> </tr> <tr> <td> Domain </td> <td> docum[.]info </td> <td> MSP360 RMM phishing delivery </td> </tr> <tr> <td> Domain </td> <td> hokkien[.]org[.]my </td> <td> Phishing staging (compromised site) </td> </tr> <tr> <td> SHA-256 </td> <td> 25b9fdef3061c7dfea744830774ca0e289dba7c14be85f0d4695d382763b409b </td> <td> Salt Typhoon SNAPPYBEE loader </td> </tr> <tr> <td> MD5 </td> <td> cbb11db5f8fed9168ed620ecc4fed3b0 </td> <td> Malicious Adobe_Installer.bat </td> </tr> <tr> <td> MD5 </td> <td> f862f698aeb77f05795f1ade8722d0ce </td> <td> PowerShell loader (sc_hidden_install.ps1) </td> </tr> <tr> <td> MD5 </td> <td> 87174fdc992ba9b5186de223703754cd </td> <td> Weaponized ScreenConnect MSI </td> </tr> <tr> <td> MD5 </td> <td> 386529af136fe96a23da6aaa39711e2b </td> <td> Weaponized MSP360 RMM installer </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> Bottom Line </h2> The threat environment facing state government has not escalated to CRITICAL today — but the margin is thin. Three conditions would trigger that escalation: confirmed ransomware deployment against a state agency using Fortinet credentials, Salt Typhoon lateral movement detected in a government network, or a second state vendor breach of comparable scale. Two of those three conditions have confirmed precursors already in motion. The actions in this report are not aspirational security improvements — they are responses to confirmed, active threats with known timelines. Fortinet credential rotation that isn't complete today is a breach waiting to happen. Vendor security reviews that wait for the next budget cycle are accepting the Texas outcome as your own. EDR that hasn't been tested against kernel-level attacks is providing false confidence. The adversaries targeting state government — Salt Typhoon, UNC5435, VOID MANTICORE, and an expanding ransomware ecosystem — are operating on timelines measured in days, not quarters. Your defensive response must match that tempo. Anomali CTI Desk — June 23, 2026 For questions or additional context on any finding in this report, contact your Anomali intelligence team.

FEATURED RESOURCES

July 24, 2026

Anomali Cyber Watch

Iranian Cyber Retaliation Is No Longer Theoretical — It's Happening Now

December 24, 2025

Anomali Cyber Watch

Anomali Cyber Watch: Sample

LockBit 5.0 Ransomware Targets Windows, Linux, and VMware ESXi in Active Campaigns. Google Patches Actively Exploited Chrome Zero-Day CVE-2026-2441. Infostealer Targets OpenClaw Configuration Files to Capture Credentials and User Context. And more...

July 14, 2026

Anomali Cyber Watch

The Silence Before the Storm: Iranian Cyber Retaliation Is Imminent — What CISOs Must Do Now

Explore All