Silent Escalation: Exchange Hybrid Vulnerability Creates Invisible Path to Total Cloud Compromise for State Government

Public Sector

Published on

June 29, 2026

Table of Contents

Threat Assessment Level: ELEVATED ↑ (Elevated from ELEVATED-STABLE. Escalation to HIGH possible within 72 hours pending Exchange hybrid exploitation confirmation or state-sector ransomware incident.) <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demands immediate attention. A newly cataloged Exchange hybrid vulnerability allows attackers to silently escalate from a compromised on-premises server to full Microsoft 365 tenant ownership — with zero cloud-side audit trail . Meanwhile, Russian intelligence services continue harvesting government officials' messaging credentials, a new ransomware group is weaponizing EDR vendor binaries to bypass endpoint protection, and seven ICS advisories in a single day signal an expanding attack surface across state-managed infrastructure. For CIOs and CISOs managing hybrid Exchange environments — which describes the vast majority of state government IT architectures — the window for action is narrow. Fiscal year-end distractions compound the risk. <h2> What Changed This Week </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> CVE-2025-53786 — Exchange hybrid privilege escalation disclosed; CISA warns of "total domain compromise" </td> <td> Most state governments run hybrid Exchange with Entra Connect. A compromised on-prem server = silent cloud takeover with no M365 audit logs. </td> </tr> <tr> <td> CVE-2026-12569 added to CISA KEV (CVSS 9.8) </td> <td> PTC Windchill/FlexPLM critical RCE — mandatory remediation timeline triggered for any state agency using PLM for asset lifecycle management. </td> </tr> <tr> <td> CISA/FBI PSA — Russian Intelligence Services (APT29/SVR, GRU) actively phishing Signal, WhatsApp, Telegram </td> <td> Government officials using commercial messaging apps for work communications are actively targeted for credential harvesting. </td> </tr> <tr> <td> Cephalus ransomware emerges with SentinelOne DLL sideloading technique </td> <td> New ransomware group weaponizes legitimate EDR executables — if your state uses SentinelOne, the trusted binary is already on every endpoint. </td> </tr> <tr> <td> 7 ICS/medical advisories including Schneider Electric PowerLogic P7, Daktronics controllers, EVoke charging stations </td> <td> Directly relevant to state-regulated power infrastructure, highway signage, government buildings, and fleet electrification programs. </td> </tr> <tr> <td> DragonForce updated targeting (27 Jun) — government/public services confirmed </td> <td> Ransomware group explicitly adding government to target verticals alongside existing state-sector threats from Akira and AiLock. </td> </tr> <tr> <td> China-nexus actors (Salt Typhoon, Genesis Panda) expanding CVE-2025-53770 SharePoint exploitation — 4 government-targeted campaigns observed 22–24 Jun </td> <td> Unpatched SharePoint instances in state government remain under active, multi-campaign exploitation by Chinese intelligence-linked actors. </td> </tr> <tr> <td> TA444/Bluenoroff (DPRK) active IOC infrastructure detected this cycle targeting financial systems </td> <td> State treasury, revenue, and comptroller offices share IT maturity and exposure profiles with TA444's confirmed victim set. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor/Source </th> <th> State Gov Impact </th> </tr> </thead> <tbody> <tr> <td> 12 Jun 2026 </td> <td> California water utility breach confirmed </td> <td> VOID MANTICORE (Iran/IRGC) </td> <td> Validates Iranian offensive capability against U.S. critical infrastructure </td> </tr> <tr> <td> 22–24 Jun 2026 </td> <td> SharePoint CVE-2025-53770 exploitation expanded to 4 campaigns targeting government </td> <td> China-nexus actors </td> <td> Unpatched SharePoint instances remain under active exploitation </td> </tr> <tr> <td> 25 Jun 2026 </td> <td> CVE-2026-12569 added to CISA KEV </td> <td> CISA </td> <td> Mandatory remediation timeline for PTC Windchill (CVSS 9.8) </td> </tr> <tr> <td> 25 Jun 2026 </td> <td> 7 ICS/medical advisories published </td> <td> CISA </td> <td> Schneider Electric, Daktronics, EVoke, H.VIEW cameras — all state-relevant </td> </tr> <tr> <td> 26 Jun 2026 </td> <td> RIS messaging app phishing PSA updated </td> <td> CISA/FBI </td> <td> APT29/SVR + GRU targeting government officials' Signal/WhatsApp/Telegram </td> </tr> <tr> <td> 27 Jun 2026 </td> <td> DragonForce targeting update — gov/public services added </td> <td> ThreatStream Next-Gen </td> <td> Explicit government targeting by active ransomware operator </td> </tr> <tr> <td> 29 Jun 2026 </td> <td> CVE-2025-53786 Exchange hybrid escalation disclosed </td> <td> Microsoft/CISA </td> <td> Silent privilege escalation from on-prem to M365 — no audit trail </td> </tr> <tr> <td> 29 Jun 2026 </td> <td> Cephalus ransomware SentinelOne sideloading documented </td> <td> Industry reporting </td> <td> EDR vendor binary weaponization — new evasion class </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Exchange Hybrid: The Silent Takeover (CVE-2025-53786) </h3> This is the most consequential finding of this cycle for state government. Microsoft disclosed a privilege escalation vulnerability in Exchange Server hybrid deployments (Exchange 2016, 2019, and Subscription Edition). An attacker with on-premises Exchange admin access can forge service-to-service (S2S) tokens to escalate privileges into Exchange Online — without generating any M365 audit log entries . The implications are severe: <ul> <li> Attack path: Compromise on-prem Exchange → forge delegation token → access any mailbox in Exchange Online → read executive/legal/CISO email → no detection </li> <li> Audit blindness: The escalation bypasses M365's audit logging entirely. Your cloud SIEM sees nothing. </li> <li> State government exposure: Hybrid Exchange with Entra Connect is the standard architecture for state agencies migrating to M365. The shared service principal between on-prem and cloud is the vulnerability. </li> </ul> Microsoft tagged this "Exploitation More Likely." Combined with the Black Hat research demonstrating Entra Connect certificate theft for token forging, state hybrid identity infrastructure is under multi-vector pressure. Associated ATT&CK Techniques: T1078.004 (Valid Accounts: Cloud), T1550.001 (Application Access Token), T1114.002 (Remote Email Collection), T1070 (Indicator Removal) <h3> 2. Russian Intelligence Services — Messaging App Credential Harvesting </h3> CISA and FBI updated their joint advisory confirming that Russian Intelligence Services — specifically APT29/SVR and GRU-linked units — continue active phishing campaigns targeting Signal, WhatsApp, and Telegram users. The primary targets are government officials and political figures. For state government, this means: <ul> <li> Any official using commercial messaging apps for work-related communication is a target </li> <li> The attack uses spearphishing links (T1566.002) to steal web session cookies (T1539) </li> <li> Once compromised, attackers can modify authentication processes for persistent access (T1556) </li> </ul> This campaign has been tracked for over 120 days with consistent activity. The threat is not theoretical — it is ongoing and confirmed by the nation's top law enforcement and intelligence agencies. <h3> 3. Cephalus Ransomware — When Your EDR Becomes the Weapon </h3> A new ransomware group called Cephalus (emerged June 2025) has introduced a technique that should concern every CISO: abusing the legitimate SentinelOne executable SentinelBrowserNativeHost.exe for DLL sideloading to deploy ransomware. How it works: <ol> <li> Initial access via RDP with compromised credentials (no MFA) </li> <li> Drop malicious SentinelAgentCore.dll alongside the legitimate SentinelBrowserNativeHost.exe </li> <li> The trusted executable loads the malicious DLL — bypassing allowlisting and potentially EDR self-protection </li> <li> Payload (data.bin) executes: disables Windows Defender, deletes shadow copies, encrypts files </li> <li> Exfiltration to MEGA cloud storage before encryption (double extortion) </li> </ol> Why this matters for state agencies: <ul> <li> If your state uses SentinelOne, the legitimate executable is already present and trusted on every endpoint </li> <li> Application allowlisting policies would permit its execution </li> <li> This represents a broader trend: both Cephalus and the previously tracked "Gentlemen" group are weaponizing EDR binaries rather than simply disabling them </li> </ul> Named victims so far include U.S. law firms and architecture firms — sectors with similar IT maturity and budget constraints to state government. <h3> 4. ICS/OT: The Expanding Perimeter </h3> Seven ICS and medical device advisories in a single day reflect the reality that "critical infrastructure" for state government now extends far beyond traditional SCADA systems: <table> <thead> <tr> <th> System </th> <th> Relevance to State Government </th> </tr> </thead> <tbody> <tr> <td> Schneider Electric PowerLogic P7 </td> <td> Power grid protection/control — state-regulated utilities </td> </tr> <tr> <td> Daktronics Controller Firmware </td> <td> Highway message signs, building displays, public venues — unauthenticated root access </td> </tr> <tr> <td> EVoke Charging Station Management </td> <td> State fleet electrification programs — unauthorized admin control </td> </tr> <tr> <td> H.VIEW HV-500S6 IP Camera </td> <td> Physical security systems in state buildings — arbitrary code execution </td> </tr> <tr> <td> Delta Electronics DTM Soft </td> <td> Industrial automation in state-managed facilities </td> </tr> <tr> <td> OHIF/pydicom Medical Imaging </td> <td> State health agency DICOM systems — patient data exposure </td> </tr> </tbody> </table> The Daktronics vulnerability is particularly noteworthy: unauthenticated root-level access to controllers that manage highway signs and public displays across state infrastructure. <h3> 5. Nation-State Convergence: China, Russia, Iran </h3> Three nation-state adversaries maintained active operations against U.S. government targets this cycle: <ul> <li> China (Salt Typhoon, Genesis Panda, Glacial Panda): Continued exploitation of cloud and telecom infrastructure; SharePoint CVE-2025-53770 campaigns explicitly targeting government; TWOPIPE campaign active </li> <li> Russia (APT29/SVR, GRU): Messaging app credential harvesting against government officials; ANGRYSIGN/BEACON campaign infrastructure active </li> <li> Iran (VOID MANTICORE/IRGC): Confirmed breach of California water utility (12 Jun) — validates capability against U.S. critical infrastructure </li> </ul> Volt Typhoon absence noted: No new indicators this cycle, but this does not indicate reduced threat. CISA warnings about pre-positioning in U.S. critical infrastructure remain active. Absence of detection ≠ absence of activity. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> CVE-2025-53786 PoC code published; exploitation attempts against state Exchange servers increase </td> <td> 75% </td> <td> 72 hours </td> <td> Microsoft tagged "Exploitation More Likely"; security researcher interest is high </td> </tr> <tr> <td> Ransomware incident targeting state/local government (fiscal year-end exploitation) </td> <td> 50% </td> <td> 48–72 hours </td> <td> DragonForce, Akira, AiLock all actively targeting government; fiscal year-end (30 Jun) creates IT staff distraction </td> </tr> <tr> <td> Cephalus ransomware expands targeting to government sector </td> <td> 30% </td> <td> 30 days </td> <td> RDP + no-MFA attack pattern aligns with common state agency exposure; group is in growth phase </td> </tr> <tr> <td> Additional Exchange hybrid exploitation details emerge from APT groups (Silk Typhoon/Hafnium historical precedent) </td> <td> 60% </td> <td> 14 days </td> <td> Hafnium previously exploited Exchange vulnerabilities at scale; hybrid escalation is high-value for espionage </td> </tr> <tr> <td> Chinese actors leverage CVE-2025-53786 for government email collection </td> <td> 40% </td> <td> 30 days </td> <td> Consistent with Salt Typhoon and Silk Typhoon operational patterns targeting government communications </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Priority Detection Rules </h3> <ol> <li> Exchange Hybrid Token Abuse (CVE-2025-53786) </li> </ol> <ul> <li> Hunt Hypothesis: Attacker with on-prem Exchange admin access is forging S2S tokens to access Exchange Online mailboxes without triggering M365 Unified Audit Log. </li> <li> What to monitor: </li> <ul> <li> On-premises Exchange server logs for unusual trustedForDelegation token requests (T1550.001) </li> <li> Entra Connect synchronization server for unauthorized certificate exports or new certificate enrollments </li> <li> Azure AD sign-in logs for service principal authentications from unexpected source IPs </li> <li> Exchange Online mailbox access patterns that do NOT have corresponding Unified Audit Log entries (the absence IS the indicator) </li> </ul> <li> Detection gap: M365 audit logs will NOT capture this activity. Detection must occur on-premises or at the Entra Connect layer. </li> <li> ATT&CK: T1078.004, T1550.001, T1114.002, T1070 </li> </ul> <ol start="2"> <li> Cephalus Ransomware — SentinelOne Sideloading </li> </ol> <ul> <li> Hunt Hypothesis: Attacker accessed environment via RDP, dropped malicious DLL alongside legitimate SentinelOne binary, and is preparing for encryption. </li> <li> What to monitor: </li> <ul> <li> SentinelBrowserNativeHost.exe spawning cmd.exe or powershell.exe child processes (T1574.002) </li> <li> Commands: vssadmin delete shadows, wmic shadowcopy delete, Add-MpPreference -ExclusionPath (T1490, T1562.001) </li> <li> SentinelAgentCore.dll loaded from non-standard paths (not the legitimate SentinelOne installation directory) </li> <li> MEGA upload traffic from endpoints (T1567.002) — monitor for mega.nz or MEGA client connections </li> <li> RDP authentication from external IPs without MFA challenge (T1021.001) </li> </ul> <li> ATT&CK: T1021.001, T1574.002, T1562.001, T1490, T1486, T1567.002 </li> </ul> <ol start="3"> <li> Russian Messaging App Credential Theft </li> </ol> <ul> <li> Hunt Hypothesis: Government officials received spearphishing links targeting Signal/WhatsApp/Telegram web sessions. </li> <li> What to monitor: </li> <ul> <li> Email gateway logs for links to domains mimicking Signal/WhatsApp/Telegram login pages (T1566.002) </li> <li> DNS queries for typosquatted messaging app domains </li> <li> Unusual browser session cookie exports or web session token reuse from new devices (T1539) </li> <li> Officials reporting "re-authentication" prompts on messaging apps they didn't initiate </li> </ul> <li> ATT&CK: T1566.002, T1539, T1556, T1071.001 </li> </ul> <ol start="4"> <li> AD/Entra ID Hybrid Soft-Matching Attack </li> </ol> <ul> <li> Hunt Hypothesis: Attacker is exploiting Entra Connect certificate trust to forge tokens and escalate cloud-only accounts to hybrid with elevated privileges. </li> <li> What to monitor: </li> <ul> <li> Entra Connect audit logs for new synchronization rule creation </li> <li> Certificate store changes on the Entra Connect server (new certs, private key exports) </li> <li> Cloud-only accounts suddenly appearing as "hybrid" (directory sync enabled) without change management ticket </li> <li> Directory.ReadWrite.All permission grants to unexpected applications </li> </ul> <li> ATT&CK: T1078.004, T1556, T1550.001 </li> </ul> <h3> Hunting Priorities This Week </h3> <table> <thead> <tr> <th> Priority </th> <th> Hunt </th> <th> Data Source </th> <th> Timeframe </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Exchange S2S token issuance anomalies </td> <td> On-prem Exchange logs, Entra ID sign-in logs </td> <td> Last 30 days </td> </tr> <tr> <td> 2 </td> <td> SentinelOne binary execution from non-standard paths </td> <td> EDR telemetry, Sysmon Event ID 7 (DLL load) </td> <td> Last 14 days </td> </tr> <tr> <td> 3 </td> <td> RDP access without MFA from external IPs </td> <td> VPN/firewall logs, Azure AD Conditional Access logs </td> <td> Last 7 days </td> </tr> <tr> <td> 4 </td> <td> MEGA cloud storage connections from endpoints </td> <td> Proxy/firewall logs, DNS logs </td> <td> Last 14 days </td> </tr> <tr> <td> 5 </td> <td> Entra Connect certificate store modifications </td> <td> Windows Security Event Log (4662, 4663), Entra Connect audit </td> <td> Last 30 days </td> </tr> </tbody> </table> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Comptroller) </h3> <ul> <li> Primary threat: Exchange hybrid escalation (CVE-2025-53786) enabling silent access to financial communications and wire transfer approvals </li> <li> Secondary threat: TA444/Bluenoroff (DPRK) targeting financial systems — active IOC infrastructure detected this cycle </li> <li> Action: Audit Exchange Online mailbox delegation rules for treasury/comptroller accounts; verify no unauthorized forwarding rules exist; implement Privileged Access Workstations for financial transaction approval </li> </ul> <h3> Energy (Public Utility Commissions, State Energy Offices) </h3> <ul> <li> Primary threat: Schneider Electric PowerLogic P7 vulnerability in state-regulated power infrastructure; Volt Typhoon pre-positioning (absence noted but threat persists) </li> <li> Secondary threat: VOID MANTICORE (Iran) demonstrated capability against U.S. water utilities — energy sector shares similar ICS/SCADA exposure </li> <li> Action: Inventory PowerLogic P7 devices in regulated utilities; verify network segmentation between IT and OT; confirm CISA Shields Up posture for all energy-sector oversight systems; apply patches per ICSA-26-176-07 </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: OHIF/pydicom DICOM viewer vulnerabilities (ICSMA-26-176-01, -02) enabling patient data exposure in state health imaging systems </li> <li> Secondary threat: Ransomware groups (DragonForce, Akira) targeting healthcare for double extortion leverage </li> <li> Action: Inventory DICOM/medical imaging systems; verify segmentation from administrative networks; confirm backup integrity for Medicaid claims processing systems; validate that medical device firmware is current </li> </ul> <h3> Government (All Executive Branch Agencies) </h3> <ul> <li> Primary threat: Exchange hybrid silent escalation (CVE-2025-53786) — near-certain exposure given standard state architecture </li> <li> Secondary threat: Russian messaging credential harvesting targeting officials; Cephalus ransomware via RDP </li> <li> Action: Emergency Exchange hybrid patching; mandatory MFA audit for all remote access (especially RDP); brief senior officials on messaging app phishing threat; verify that helpdesk cannot be socially engineered to reset MFA (CHATTY SPIDER/Luna Moth TTP — quiet but not gone) </li> </ul> <h3> Aviation/Logistics (State DOT, Airport Authorities, Fleet Management) </h3> <ul> <li> Primary threat: Daktronics controller firmware vulnerability — unauthenticated root access to highway message signs and transportation displays </li> <li> Secondary threat: EVoke charging station management vulnerability — unauthorized admin control of state EV fleet charging infrastructure </li> <li> Action: Inventory all Daktronics controllers on state highways and in transportation facilities; apply firmware updates per ICSA-26-176-04; segment EV charging management systems from enterprise network; verify that transportation SCADA systems are not accessible from compromised IT networks </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops / Exchange Admins </td> <td> Verify Exchange hybrid deployment patch status. Confirm whether Entra Connect service principal has been updated per Microsoft's hotfix for CVE-2025-53786. If unpatched, initiate emergency change window. This is the highest-priority action this cycle. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy detection for SentinelOne binary abuse. Create alert for SentinelBrowserNativeHost.exe spawning cmd.exe or powershell.exe executing vssadmin, wmic shadowcopy, or Add-MpPreference commands. </td> </tr> <tr> <td> 3 </td> <td> IT Ops / Identity Team </td> <td> Audit Entra Connect synchronization server. Verify certificate store integrity, check for unauthorized private key exports, enable hardware-backed key storage if not configured. </td> </tr> <tr> <td> 4 </td> <td> CISO </td> <td> Confirm EDR vendor across all agencies. If SentinelOne is deployed, initiate vendor engagement regarding Cephalus mitigation guidance and binary integrity monitoring. </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> SOC </td> <td> Implement monitoring for Exchange S2S token issuance from on-premises servers to Exchange Online. Deploy custom detection for trustedForDelegation claims in token requests. </td> </tr> <tr> <td> 6 </td> <td> IT Ops </td> <td> Review ALL RDP-exposed services across state agencies. Confirm MFA enforcement on every remote access path. Disable RDP where not business-critical. </td> </tr> <tr> <td> 7 </td> <td> OT/Facilities </td> <td> Inventory Schneider Electric PowerLogic P7 devices in state-regulated power infrastructure and Daktronics controllers in state buildings/highway signage. Apply vendor patches per ICSA-26-176-07 and ICSA-26-176-04. </td> </tr> <tr> <td> 8 </td> <td> Communications / HR </td> <td> Brief senior officials and executive staff on Russian messaging app phishing campaign. Provide specific guidance: do not click re-authentication links in Signal/WhatsApp/Telegram; report to SOC immediately. </td> </tr> <tr> <td> 9 </td> <td> IT Ops </td> <td> Inventory and segment EVoke (or equivalent) EV charging station management systems from enterprise IT networks. </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 10 </td> <td> CISO </td> <td> Commission strategic assessment of Exchange hybrid architecture. Evaluate feasibility of application splitting and migration timeline to Exchange Online-only or Exchange Subscription Edition to eliminate the hybrid attack surface. </td> </tr> <tr> <td> 11 </td> <td> CISO </td> <td> Initiate Q3 strategic review of hybrid identity architecture viability. Three independent attack vectors targeting AD/Entra ID hybrid this cycle signals a structural, not tactical, problem. </td> </tr> <tr> <td> 12 </td> <td> CISO / CIO </td> <td> Evaluate defense-in-depth posture assuming EDR bypass. If ransomware operators can weaponize EDR binaries, what compensating controls exist? (Network segmentation, immutable backups, application control beyond allowlisting) </td> </tr> <tr> <td> 13 </td> <td> IT Ops / Facilities </td> <td> Assess network segmentation for all ICS/OT systems including non-traditional assets: EV charging, digital signage, IP cameras, medical imaging. </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Timeframe </th> </tr> </thead> <tbody> <tr> <td> Validate incident response playbook for "silent cloud compromise" scenario — attacker in M365 with no audit trail </td> <td> CISO / IR Team </td> <td> 7 days </td> </tr> <tr> <td> Confirm ransomware response readiness for fiscal year-end weekend (30 Jun) — verify backup integrity, IR retainer availability, communication plan </td> <td> CISO / CIO </td> <td> Immediate </td> </tr> <tr> <td> Brief Governor's office / agency heads on Russian messaging threat — non-technical, actionable guidance </td> <td> CISO / Communications </td> <td> 7 days </td> </tr> <tr> <td> Tabletop exercise: Exchange hybrid compromise → cloud tenant takeover → data exfiltration with no cloud logs </td> <td> CISO / IR Team </td> <td> 30 days </td> </tr> </tbody> </table> <h2> IOC Blocking Guidance </h2> The following indicators were collected from active campaigns relevant to state government infrastructure. Validate against your environment before blocking. <h3> Network Indicators </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 45.63.85[.]74 </td> <td> APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 69.61.36[.]170 </td> <td> APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 162.0.235[.]21 </td> <td> APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 104.168.249[.]10 </td> <td> APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 104.168.174[.]80 </td> <td> APT infrastructure </td> </tr> <tr> <td> Domain </td> <td> docs.nynovation[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> download.romeropizza[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> publication.garyjobeferguson[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> images.therunningink[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> trust.scriptobject[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> source.scriptsafedata[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> mgmt.studerandson[.]us </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> virtual.urban-orthodontics[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> billing.roofnrack[.]us </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> customer.thewayofmoney[.]us </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> searchgear[.]pro </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> rapiddevapi[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> cp.envisionfonddulac[.]biz </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> s3wct4p1.viewdns[.]net </td> <td> Dynamic DNS — C2 </td> </tr> <tr> <td> Domain </td> <td> doinamagicclasses[.]com </td> <td> Malicious infrastructure </td> </tr> <tr> <td> Domain </td> <td> cloud.tptf[.]ltd </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> globiscapital[.]co </td> <td> Spoofed financial domain (TA444/Bluenoroff) </td> </tr> <tr> <td> Domain </td> <td> archax[.]co </td> <td> Spoofed financial domain (TA444/Bluenoroff) </td> </tr> </tbody> </table> <h3> File Indicators (SHA-256) </h3> <table> <thead> <tr> <th> Hash </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> c825119392361b939764435bc23fbf7f0e9f808a59273d59b2389095e0f8ef81 </td> <td> Malware sample </td> </tr> <tr> <td> 230991626dd5d40c095c08f6bcee2c0d615f9875e5ea348ec20bde5ed4d61528 </td> <td> Malware sample </td> </tr> <tr> <td> d7a26dedd2d0e4974e48fb5ffd83b00a980788d3ea83a15b93833b6b9b6a12b4 </td> <td> Malware sample </td> </tr> <tr> <td> 9cbcd2e13845b07d35428dee93e110d3afe855dc92b8f18e1d974007b647f554 </td> <td> Malware sample </td> </tr> <tr> <td> 8e65e1db8dbe2dbe1522081b6618b2790c068ef6232df90164873e7a046521f2 </td> <td> Malware sample </td> </tr> <tr> <td> e2ea4800b60202d99f1446ec6170a30b774c14ddb427b62daaf63ec1f2f35f25 </td> <td> Malware sample </td> </tr> <tr> <td> 0a526f3c1dc8e67da88c14daab20c45594baef3e63f7cc03ec0ad7aee0afa53e </td> <td> Malware sample </td> </tr> <tr> <td> 0ff5fb56258d36693d2f6d2cd932a2e0016ef55778316500c6da7a7320f19ec9 </td> <td> Malware sample </td> </tr> <tr> <td> 9381b03de271d1dd35480de3bd2d1ae15afcea485dc82135584e24b976673817 </td> <td> Malware sample </td> </tr> <tr> <td> df9e0583b687095a5a587d6922901f86e6788f285874fcbeb015632bc40f8df9 </td> <td> Malware sample </td> </tr> <tr> <td> 80bfbbbdce8bf083c61bd6380b2d69d61a6ecdddbb6f3e26344ba8d6f5a6e83e </td> <td> Malware sample </td> </tr> <tr> <td> 3b66cd66065d05bf024eb8c73860d8d537ef0e1bd66b27fb7b77510b0b31b68b </td> <td> Malware sample </td> </tr> <tr> <td> 06090af988079ad6c10c8f110b39b67a115d043ec59e7adc10bcf059e7d3c8d9 </td> <td> Malware sample </td> </tr> <tr> <td> c28af20a3d8ccbe0529a130c091da5efe2e7269b1883d9162f7058940ca597f7 </td> <td> Malware sample </td> </tr> <tr> <td> eec62239300741bc71e5ed083386e6c5e44a31e90064d63664bd95b656a10aa3 </td> <td> Malware sample </td> </tr> <tr> <td> 25f90700d8c663550f5b2c8488c131ccf97c0ee972db0f6fb87ca8cceacd7ee9 </td> <td> Malware sample </td> </tr> <tr> <td> 1ae2a81d2761c6aece751a238daf81f29bf28ac5537ab2b987e58fd65b2c9bd9 </td> <td> Malware sample </td> </tr> <tr> <td> 42a840a79b9d722fed5fb589f035b5206542b1308b2836195b678310d276ad2f </td> <td> Malware sample </td> </tr> <tr> <td> 5b2b90f47686b8fc13a322371349d8d71d16698e6e11672b9f218b777f13eb98 </td> <td> Malware sample </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds. <h2> Closing </h2> Tomorrow is June 30 — fiscal year-end. Historically, ransomware operators exploit periods when IT teams are distracted by administrative deadlines. DragonForce, Akira, and AiLock have all confirmed government as a target vertical. Cephalus has demonstrated the ability to bypass EDR. The Exchange hybrid vulnerability means a single compromised on-premises server could give an attacker silent, undetectable access to your entire M365 environment. The convergence is real: nation-states are in your messaging apps, ransomware operators are weaponizing your security tools, and your hybrid identity architecture has become the primary attack surface — not the perimeter. Three decisions needed today: <ol> <li> Patch Exchange hybrid infrastructure (CVE-2025-53786). If you cannot patch within 24 hours, implement compensating controls on the Entra Connect server and begin monitoring for S2S token anomalies. </li> <li> Confirm your EDR posture. If you run SentinelOne, engage your vendor on Cephalus mitigation immediately. Regardless of vendor, assume EDR can be bypassed and validate your defense-in-depth. </li> <li> Ensure ransomware readiness for the fiscal year-end weekend. Verify backup integrity, confirm IR retainer availability, and ensure your communication plan doesn't depend on systems that could be encrypted. </li> </ol> The threat actors are not taking the holiday weekend off. Neither should your defenses. Published 29 June 2026 | Anomali CTI Desk For questions or additional context, contact your Anomali intelligence team. IOC feeds updated in Anomali ThreatStream Next-Gen — automated blocking available for integrated customers.

FEATURED RESOURCES

December 24, 2025

Anomali Cyber Watch

Anomali Cyber Watch: LockBit 5.0, Chrome Zero-Day CVE-2026-2441, Infostealer Targets OpenClaw, and more Copy

LockBit 5.0 Ransomware Targets Windows, Linux, and VMware ESXi in Active Campaigns. Google Patches Actively Exploited Chrome Zero-Day CVE-2026-2441. Infostealer Targets OpenClaw Configuration Files to Capture Credentials and User Context. And more...

June 29, 2026

Anomali Cyber Watch

Iranian Cyber Retaliation Window Open: What CISOs Must Do in the Next 72 Hours

June 29, 2026

Anomali Cyber Watch

Public Sector

Silent Escalation: Exchange Hybrid Vulnerability Creates Invisible Path to Total Cloud Compromise for State Government

Explore All