Silent Escalation: Exchange Hybrid Vulnerability Creates Invisible Path to Total Cloud Compromise for State Government

Public Sector

Published on

June 29, 2026

Table of Contents

Threat Assessment Level: ELEVATED ↑ (Elevated from ELEVATED-STABLE. Escalation to HIGH possible within 72 hours pending Exchange hybrid exploitation confirmation or state-sector ransomware incident.) <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demands immediate attention. A newly cataloged Exchange hybrid vulnerability allows attackers to silently escalate from a compromised on-premises server to full Microsoft 365 tenant ownership — with zero cloud-side audit trail . Meanwhile, Russian intelligence services continue harvesting government officials' messaging credentials, a new ransomware group is weaponizing EDR vendor binaries to bypass endpoint protection, and seven ICS advisories in a single day signal an expanding attack surface across state-managed infrastructure. For CIOs and CISOs managing hybrid Exchange environments — which describes the vast majority of state government IT architectures — the window for action is narrow. Fiscal year-end distractions compound the risk. <h2> What Changed This Week </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> CVE-2025-53786 — Exchange hybrid privilege escalation disclosed; CISA warns of "total domain compromise" </td> <td> Most state governments run hybrid Exchange with Entra Connect. A compromised on-prem server = silent cloud takeover with no M365 audit logs. </td> </tr> <tr> <td> CVE-2026-12569 added to CISA KEV (CVSS 9.8) </td> <td> PTC Windchill/FlexPLM critical RCE — mandatory remediation timeline triggered for any state agency using PLM for asset lifecycle management. </td> </tr> <tr> <td> CISA/FBI PSA — Russian Intelligence Services (APT29/SVR, GRU) actively phishing Signal, WhatsApp, Telegram </td> <td> Government officials using commercial messaging apps for work communications are actively targeted for credential harvesting. </td> </tr> <tr> <td> Cephalus ransomware emerges with SentinelOne DLL sideloading technique </td> <td> New ransomware group weaponizes legitimate EDR executables — if your state uses SentinelOne, the trusted binary is already on every endpoint. </td> </tr> <tr> <td> 7 ICS/medical advisories including Schneider Electric PowerLogic P7, Daktronics controllers, EVoke charging stations </td> <td> Directly relevant to state-regulated power infrastructure, highway signage, government buildings, and fleet electrification programs. </td> </tr> <tr> <td> DragonForce updated targeting (27 Jun) — government/public services confirmed </td> <td> Ransomware group explicitly adding government to target verticals alongside existing state-sector threats from Akira and AiLock. </td> </tr> <tr> <td> China-nexus actors (Salt Typhoon, Genesis Panda) expanding CVE-2025-53770 SharePoint exploitation — 4 government-targeted campaigns observed 22–24 Jun </td> <td> Unpatched SharePoint instances in state government remain under active, multi-campaign exploitation by Chinese intelligence-linked actors. </td> </tr> <tr> <td> TA444/Bluenoroff (DPRK) active IOC infrastructure detected this cycle targeting financial systems </td> <td> State treasury, revenue, and comptroller offices share IT maturity and exposure profiles with TA444's confirmed victim set. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor/Source </th> <th> State Gov Impact </th> </tr> </thead> <tbody> <tr> <td> 12 Jun 2026 </td> <td> California water utility breach confirmed </td> <td> VOID MANTICORE (Iran/IRGC) </td> <td> Validates Iranian offensive capability against U.S. critical infrastructure </td> </tr> <tr> <td> 22–24 Jun 2026 </td> <td> SharePoint CVE-2025-53770 exploitation expanded to 4 campaigns targeting government </td> <td> China-nexus actors </td> <td> Unpatched SharePoint instances remain under active exploitation </td> </tr> <tr> <td> 25 Jun 2026 </td> <td> CVE-2026-12569 added to CISA KEV </td> <td> CISA </td> <td> Mandatory remediation timeline for PTC Windchill (CVSS 9.8) </td> </tr> <tr> <td> 25 Jun 2026 </td> <td> 7 ICS/medical advisories published </td> <td> CISA </td> <td> Schneider Electric, Daktronics, EVoke, H.VIEW cameras — all state-relevant </td> </tr> <tr> <td> 26 Jun 2026 </td> <td> RIS messaging app phishing PSA updated </td> <td> CISA/FBI </td> <td> APT29/SVR + GRU targeting government officials' Signal/WhatsApp/Telegram </td> </tr> <tr> <td> 27 Jun 2026 </td> <td> DragonForce targeting update — gov/public services added </td> <td> ThreatStream Next-Gen </td> <td> Explicit government targeting by active ransomware operator </td> </tr> <tr> <td> 29 Jun 2026 </td> <td> CVE-2025-53786 Exchange hybrid escalation disclosed </td> <td> Microsoft/CISA </td> <td> Silent privilege escalation from on-prem to M365 — no audit trail </td> </tr> <tr> <td> 29 Jun 2026 </td> <td> Cephalus ransomware SentinelOne sideloading documented </td> <td> Industry reporting </td> <td> EDR vendor binary weaponization — new evasion class </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Exchange Hybrid: The Silent Takeover (CVE-2025-53786) </h3> This is the most consequential finding of this cycle for state government. Microsoft disclosed a privilege escalation vulnerability in Exchange Server hybrid deployments (Exchange 2016, 2019, and Subscription Edition). An attacker with on-premises Exchange admin access can forge service-to-service (S2S) tokens to escalate privileges into Exchange Online — without generating any M365 audit log entries . The implications are severe: <ul> <li> Attack path: Compromise on-prem Exchange → forge delegation token → access any mailbox in Exchange Online → read executive/legal/CISO email → no detection </li> <li> Audit blindness: The escalation bypasses M365's audit logging entirely. Your cloud SIEM sees nothing. </li> <li> State government exposure: Hybrid Exchange with Entra Connect is the standard architecture for state agencies migrating to M365. The shared service principal between on-prem and cloud is the vulnerability. </li> </ul> Microsoft tagged this "Exploitation More Likely." Combined with the Black Hat research demonstrating Entra Connect certificate theft for token forging, state hybrid identity infrastructure is under multi-vector pressure. Associated ATT&CK Techniques: T1078.004 (Valid Accounts: Cloud), T1550.001 (Application Access Token), T1114.002 (Remote Email Collection), T1070 (Indicator Removal) <h3> 2. Russian Intelligence Services — Messaging App Credential Harvesting </h3> CISA and FBI updated their joint advisory confirming that Russian Intelligence Services — specifically APT29/SVR and GRU-linked units — continue active phishing campaigns targeting Signal, WhatsApp, and Telegram users. The primary targets are government officials and political figures. For state government, this means: <ul> <li> Any official using commercial messaging apps for work-related communication is a target </li> <li> The attack uses spearphishing links (T1566.002) to steal web session cookies (T1539) </li> <li> Once compromised, attackers can modify authentication processes for persistent access (T1556) </li> </ul> This campaign has been tracked for over 120 days with consistent activity. The threat is not theoretical — it is ongoing and confirmed by the nation's top law enforcement and intelligence agencies. <h3> 3. Cephalus Ransomware — When Your EDR Becomes the Weapon </h3> A new ransomware group called Cephalus (emerged June 2025) has introduced a technique that should concern every CISO: abusing the legitimate SentinelOne executable SentinelBrowserNativeHost.exe for DLL sideloading to deploy ransomware. How it works: <ol> <li> Initial access via RDP with compromised credentials (no MFA) </li> <li> Drop malicious SentinelAgentCore.dll alongside the legitimate SentinelBrowserNativeHost.exe </li> <li> The trusted executable loads the malicious DLL — bypassing allowlisting and potentially EDR self-protection </li> <li> Payload (data.bin) executes: disables Windows Defender, deletes shadow copies, encrypts files </li> <li> Exfiltration to MEGA cloud storage before encryption (double extortion) </li> </ol> Why this matters for state agencies: <ul> <li> If your state uses SentinelOne, the legitimate executable is already present and trusted on every endpoint </li> <li> Application allowlisting policies would permit its execution </li> <li> This represents a broader trend: both Cephalus and the previously tracked "Gentlemen" group are weaponizing EDR binaries rather than simply disabling them </li> </ul> Named victims so far include U.S. law firms and architecture firms — sectors with similar IT maturity and budget constraints to state government. <h3> 4. ICS/OT: The Expanding Perimeter </h3> Seven ICS and medical device advisories in a single day reflect the reality that "critical infrastructure" for state government now extends far beyond traditional SCADA systems: <table> <thead> <tr> <th> System </th> <th> Relevance to State Government </th> </tr> </thead> <tbody> <tr> <td> Schneider Electric PowerLogic P7 </td> <td> Power grid protection/control — state-regulated utilities </td> </tr> <tr> <td> Daktronics Controller Firmware </td> <td> Highway message signs, building displays, public venues — unauthenticated root access </td> </tr> <tr> <td> EVoke Charging Station Management </td> <td> State fleet electrification programs — unauthorized admin control </td> </tr> <tr> <td> H.VIEW HV-500S6 IP Camera </td> <td> Physical security systems in state buildings — arbitrary code execution </td> </tr> <tr> <td> Delta Electronics DTM Soft </td> <td> Industrial automation in state-managed facilities </td> </tr> <tr> <td> OHIF/pydicom Medical Imaging </td> <td> State health agency DICOM systems — patient data exposure </td> </tr> </tbody> </table> The Daktronics vulnerability is particularly noteworthy: unauthenticated root-level access to controllers that manage highway signs and public displays across state infrastructure. <h3> 5. Nation-State Convergence: China, Russia, Iran </h3> Three nation-state adversaries maintained active operations against U.S. government targets this cycle: <ul> <li> China (Salt Typhoon, Genesis Panda, Glacial Panda): Continued exploitation of cloud and telecom infrastructure; SharePoint CVE-2025-53770 campaigns explicitly targeting government; TWOPIPE campaign active </li> <li> Russia (APT29/SVR, GRU): Messaging app credential harvesting against government officials; ANGRYSIGN/BEACON campaign infrastructure active </li> <li> Iran (VOID MANTICORE/IRGC): Confirmed breach of California water utility (12 Jun) — validates capability against U.S. critical infrastructure </li> </ul> Volt Typhoon absence noted: No new indicators this cycle, but this does not indicate reduced threat. CISA warnings about pre-positioning in U.S. critical infrastructure remain active. Absence of detection ≠ absence of activity. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> CVE-2025-53786 PoC code published; exploitation attempts against state Exchange servers increase </td> <td> 75% </td> <td> 72 hours </td> <td> Microsoft tagged "Exploitation More Likely"; security researcher interest is high </td> </tr> <tr> <td> Ransomware incident targeting state/local government (fiscal year-end exploitation) </td> <td> 50% </td> <td> 48–72 hours </td> <td> DragonForce, Akira, AiLock all actively targeting government; fiscal year-end (30 Jun) creates IT staff distraction </td> </tr> <tr> <td> Cephalus ransomware expands targeting to government sector </td> <td> 30% </td> <td> 30 days </td> <td> RDP + no-MFA attack pattern aligns with common state agency exposure; group is in growth phase </td> </tr> <tr> <td> Additional Exchange hybrid exploitation details emerge from APT groups (Silk Typhoon/Hafnium historical precedent) </td> <td> 60% </td> <td> 14 days </td> <td> Hafnium previously exploited Exchange vulnerabilities at scale; hybrid escalation is high-value for espionage </td> </tr> <tr> <td> Chinese actors leverage CVE-2025-53786 for government email collection </td> <td> 40% </td> <td> 30 days </td> <td> Consistent with Salt Typhoon and Silk Typhoon operational patterns targeting government communications </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Priority Detection Rules </h3> <ol> <li> Exchange Hybrid Token Abuse (CVE-2025-53786) </li> </ol> <ul> <li> Hunt Hypothesis: Attacker with on-prem Exchange admin access is forging S2S tokens to access Exchange Online mailboxes without triggering M365 Unified Audit Log. </li> <li> What to monitor: </li> <ul> <li> On-premises Exchange server logs for unusual trustedForDelegation token requests (T1550.001) </li> <li> Entra Connect synchronization server for unauthorized certificate exports or new certificate enrollments </li> <li> Azure AD sign-in logs for service principal authentications from unexpected source IPs </li> <li> Exchange Online mailbox access patterns that do NOT have corresponding Unified Audit Log entries (the absence IS the indicator) </li> </ul> <li> Detection gap: M365 audit logs will NOT capture this activity. Detection must occur on-premises or at the Entra Connect layer. </li> <li> ATT&CK: T1078.004, T1550.001, T1114.002, T1070 </li> </ul> <ol start="2"> <li> Cephalus Ransomware — SentinelOne Sideloading </li> </ol> <ul> <li> Hunt Hypothesis: Attacker accessed environment via RDP, dropped malicious DLL alongside legitimate SentinelOne binary, and is preparing for encryption. </li> <li> What to monitor: </li> <ul> <li> SentinelBrowserNativeHost.exe spawning cmd.exe or powershell.exe child processes (T1574.002) </li> <li> Commands: vssadmin delete shadows, wmic shadowcopy delete, Add-MpPreference -ExclusionPath (T1490, T1562.001) </li> <li> SentinelAgentCore.dll loaded from non-standard paths (not the legitimate SentinelOne installation directory) </li> <li> MEGA upload traffic from endpoints (T1567.002) — monitor for mega.nz or MEGA client connections </li> <li> RDP authentication from external IPs without MFA challenge (T1021.001) </li> </ul> <li> ATT&CK: T1021.001, T1574.002, T1562.001, T1490, T1486, T1567.002 </li> </ul> <ol start="3"> <li> Russian Messaging App Credential Theft </li> </ol> <ul> <li> Hunt Hypothesis: Government officials received spearphishing links targeting Signal/WhatsApp/Telegram web sessions. </li> <li> What to monitor: </li> <ul> <li> Email gateway logs for links to domains mimicking Signal/WhatsApp/Telegram login pages (T1566.002) </li> <li> DNS queries for typosquatted messaging app domains </li> <li> Unusual browser session cookie exports or web session token reuse from new devices (T1539) </li> <li> Officials reporting "re-authentication" prompts on messaging apps they didn't initiate </li> </ul> <li> ATT&CK: T1566.002, T1539, T1556, T1071.001 </li> </ul> <ol start="4"> <li> AD/Entra ID Hybrid Soft-Matching Attack </li> </ol> <ul> <li> Hunt Hypothesis: Attacker is exploiting Entra Connect certificate trust to forge tokens and escalate cloud-only accounts to hybrid with elevated privileges. </li> <li> What to monitor: </li> <ul> <li> Entra Connect audit logs for new synchronization rule creation </li> <li> Certificate store changes on the Entra Connect server (new certs, private key exports) </li> <li> Cloud-only accounts suddenly appearing as "hybrid" (directory sync enabled) without change management ticket </li> <li> Directory.ReadWrite.All permission grants to unexpected applications </li> </ul> <li> ATT&CK: T1078.004, T1556, T1550.001 </li> </ul> <h3> Hunting Priorities This Week </h3> <table> <thead> <tr> <th> Priority </th> <th> Hunt </th> <th> Data Source </th> <th> Timeframe </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Exchange S2S token issuance anomalies </td> <td> On-prem Exchange logs, Entra ID sign-in logs </td> <td> Last 30 days </td> </tr> <tr> <td> 2 </td> <td> SentinelOne binary execution from non-standard paths </td> <td> EDR telemetry, Sysmon Event ID 7 (DLL load) </td> <td> Last 14 days </td> </tr> <tr> <td> 3 </td> <td> RDP access without MFA from external IPs </td> <td> VPN/firewall logs, Azure AD Conditional Access logs </td> <td> Last 7 days </td> </tr> <tr> <td> 4 </td> <td> MEGA cloud storage connections from endpoints </td> <td> Proxy/firewall logs, DNS logs </td> <td> Last 14 days </td> </tr> <tr> <td> 5 </td> <td> Entra Connect certificate store modifications </td> <td> Windows Security Event Log (4662, 4663), Entra Connect audit </td> <td> Last 30 days </td> </tr> </tbody> </table> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Comptroller) </h3> <ul> <li> Primary threat: Exchange hybrid escalation (CVE-2025-53786) enabling silent access to financial communications and wire transfer approvals </li> <li> Secondary threat: TA444/Bluenoroff (DPRK) targeting financial systems — active IOC infrastructure detected this cycle </li> <li> Action: Audit Exchange Online mailbox delegation rules for treasury/comptroller accounts; verify no unauthorized forwarding rules exist; implement Privileged Access Workstations for financial transaction approval </li> </ul> <h3> Energy (Public Utility Commissions, State Energy Offices) </h3> <ul> <li> Primary threat: Schneider Electric PowerLogic P7 vulnerability in state-regulated power infrastructure; Volt Typhoon pre-positioning (absence noted but threat persists) </li> <li> Secondary threat: VOID MANTICORE (Iran) demonstrated capability against U.S. water utilities — energy sector shares similar ICS/SCADA exposure </li> <li> Action: Inventory PowerLogic P7 devices in regulated utilities; verify network segmentation between IT and OT; confirm CISA Shields Up posture for all energy-sector oversight systems; apply patches per ICSA-26-176-07 </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: OHIF/pydicom DICOM viewer vulnerabilities (ICSMA-26-176-01, -02) enabling patient data exposure in state health imaging systems </li> <li> Secondary threat: Ransomware groups (DragonForce, Akira) targeting healthcare for double extortion leverage </li> <li> Action: Inventory DICOM/medical imaging systems; verify segmentation from administrative networks; confirm backup integrity for Medicaid claims processing systems; validate that medical device firmware is current </li> </ul> <h3> Government (All Executive Branch Agencies) </h3> <ul> <li> Primary threat: Exchange hybrid silent escalation (CVE-2025-53786) — near-certain exposure given standard state architecture </li> <li> Secondary threat: Russian messaging credential harvesting targeting officials; Cephalus ransomware via RDP </li> <li> Action: Emergency Exchange hybrid patching; mandatory MFA audit for all remote access (especially RDP); brief senior officials on messaging app phishing threat; verify that helpdesk cannot be socially engineered to reset MFA (CHATTY SPIDER/Luna Moth TTP — quiet but not gone) </li> </ul> <h3> Aviation/Logistics (State DOT, Airport Authorities, Fleet Management) </h3> <ul> <li> Primary threat: Daktronics controller firmware vulnerability — unauthenticated root access to highway message signs and transportation displays </li> <li> Secondary threat: EVoke charging station management vulnerability — unauthorized admin control of state EV fleet charging infrastructure </li> <li> Action: Inventory all Daktronics controllers on state highways and in transportation facilities; apply firmware updates per ICSA-26-176-04; segment EV charging management systems from enterprise network; verify that transportation SCADA systems are not accessible from compromised IT networks </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops / Exchange Admins </td> <td> Verify Exchange hybrid deployment patch status. Confirm whether Entra Connect service principal has been updated per Microsoft's hotfix for CVE-2025-53786. If unpatched, initiate emergency change window. This is the highest-priority action this cycle. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy detection for SentinelOne binary abuse. Create alert for SentinelBrowserNativeHost.exe spawning cmd.exe or powershell.exe executing vssadmin, wmic shadowcopy, or Add-MpPreference commands. </td> </tr> <tr> <td> 3 </td> <td> IT Ops / Identity Team </td> <td> Audit Entra Connect synchronization server. Verify certificate store integrity, check for unauthorized private key exports, enable hardware-backed key storage if not configured. </td> </tr> <tr> <td> 4 </td> <td> CISO </td> <td> Confirm EDR vendor across all agencies. If SentinelOne is deployed, initiate vendor engagement regarding Cephalus mitigation guidance and binary integrity monitoring. </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> SOC </td> <td> Implement monitoring for Exchange S2S token issuance from on-premises servers to Exchange Online. Deploy custom detection for trustedForDelegation claims in token requests. </td> </tr> <tr> <td> 6 </td> <td> IT Ops </td> <td> Review ALL RDP-exposed services across state agencies. Confirm MFA enforcement on every remote access path. Disable RDP where not business-critical. </td> </tr> <tr> <td> 7 </td> <td> OT/Facilities </td> <td> Inventory Schneider Electric PowerLogic P7 devices in state-regulated power infrastructure and Daktronics controllers in state buildings/highway signage. Apply vendor patches per ICSA-26-176-07 and ICSA-26-176-04. </td> </tr> <tr> <td> 8 </td> <td> Communications / HR </td> <td> Brief senior officials and executive staff on Russian messaging app phishing campaign. Provide specific guidance: do not click re-authentication links in Signal/WhatsApp/Telegram; report to SOC immediately. </td> </tr> <tr> <td> 9 </td> <td> IT Ops </td> <td> Inventory and segment EVoke (or equivalent) EV charging station management systems from enterprise IT networks. </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 10 </td> <td> CISO </td> <td> Commission strategic assessment of Exchange hybrid architecture. Evaluate feasibility of application splitting and migration timeline to Exchange Online-only or Exchange Subscription Edition to eliminate the hybrid attack surface. </td> </tr> <tr> <td> 11 </td> <td> CISO </td> <td> Initiate Q3 strategic review of hybrid identity architecture viability. Three independent attack vectors targeting AD/Entra ID hybrid this cycle signals a structural, not tactical, problem. </td> </tr> <tr> <td> 12 </td> <td> CISO / CIO </td> <td> Evaluate defense-in-depth posture assuming EDR bypass. If ransomware operators can weaponize EDR binaries, what compensating controls exist? (Network segmentation, immutable backups, application control beyond allowlisting) </td> </tr> <tr> <td> 13 </td> <td> IT Ops / Facilities </td> <td> Assess network segmentation for all ICS/OT systems including non-traditional assets: EV charging, digital signage, IP cameras, medical imaging. </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Timeframe </th> </tr> </thead> <tbody> <tr> <td> Validate incident response playbook for "silent cloud compromise" scenario — attacker in M365 with no audit trail </td> <td> CISO / IR Team </td> <td> 7 days </td> </tr> <tr> <td> Confirm ransomware response readiness for fiscal year-end weekend (30 Jun) — verify backup integrity, IR retainer availability, communication plan </td> <td> CISO / CIO </td> <td> Immediate </td> </tr> <tr> <td> Brief Governor's office / agency heads on Russian messaging threat — non-technical, actionable guidance </td> <td> CISO / Communications </td> <td> 7 days </td> </tr> <tr> <td> Tabletop exercise: Exchange hybrid compromise → cloud tenant takeover → data exfiltration with no cloud logs </td> <td> CISO / IR Team </td> <td> 30 days </td> </tr> </tbody> </table> <h2> IOC Blocking Guidance </h2> The following indicators were collected from active campaigns relevant to state government infrastructure. Validate against your environment before blocking. <h3> Network Indicators </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 45.63.85[.]74 </td> <td> APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 69.61.36[.]170 </td> <td> APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 162.0.235[.]21 </td> <td> APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 104.168.249[.]10 </td> <td> APT infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 104.168.174[.]80 </td> <td> APT infrastructure </td> </tr> <tr> <td> Domain </td> <td> docs.nynovation[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> download.romeropizza[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> publication.garyjobeferguson[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> images.therunningink[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> trust.scriptobject[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> source.scriptsafedata[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> mgmt.studerandson[.]us </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> virtual.urban-orthodontics[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> billing.roofnrack[.]us </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> customer.thewayofmoney[.]us </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> searchgear[.]pro </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> rapiddevapi[.]com </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> cp.envisionfonddulac[.]biz </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> s3wct4p1.viewdns[.]net </td> <td> Dynamic DNS — C2 </td> </tr> <tr> <td> Domain </td> <td> doinamagicclasses[.]com </td> <td> Malicious infrastructure </td> </tr> <tr> <td> Domain </td> <td> cloud.tptf[.]ltd </td> <td> C2/staging infrastructure </td> </tr> <tr> <td> Domain </td> <td> globiscapital[.]co </td> <td> Spoofed financial domain (TA444/Bluenoroff) </td> </tr> <tr> <td> Domain </td> <td> archax[.]co </td> <td> Spoofed financial domain (TA444/Bluenoroff) </td> </tr> </tbody> </table> <h3> File Indicators (SHA-256) </h3> <table> <thead> <tr> <th> Hash </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> c825119392361b939764435bc23fbf7f0e9f808a59273d59b2389095e0f8ef81 </td> <td> Malware sample </td> </tr> <tr> <td> 230991626dd5d40c095c08f6bcee2c0d615f9875e5ea348ec20bde5ed4d61528 </td> <td> Malware sample </td> </tr> <tr> <td> d7a26dedd2d0e4974e48fb5ffd83b00a980788d3ea83a15b93833b6b9b6a12b4 </td> <td> Malware sample </td> </tr> <tr> <td> 9cbcd2e13845b07d35428dee93e110d3afe855dc92b8f18e1d974007b647f554 </td> <td> Malware sample </td> </tr> <tr> <td> 8e65e1db8dbe2dbe1522081b6618b2790c068ef6232df90164873e7a046521f2 </td> <td> Malware sample </td> </tr> <tr> <td> e2ea4800b60202d99f1446ec6170a30b774c14ddb427b62daaf63ec1f2f35f25 </td> <td> Malware sample </td> </tr> <tr> <td> 0a526f3c1dc8e67da88c14daab20c45594baef3e63f7cc03ec0ad7aee0afa53e </td> <td> Malware sample </td> </tr> <tr> <td> 0ff5fb56258d36693d2f6d2cd932a2e0016ef55778316500c6da7a7320f19ec9 </td> <td> Malware sample </td> </tr> <tr> <td> 9381b03de271d1dd35480de3bd2d1ae15afcea485dc82135584e24b976673817 </td> <td> Malware sample </td> </tr> <tr> <td> df9e0583b687095a5a587d6922901f86e6788f285874fcbeb015632bc40f8df9 </td> <td> Malware sample </td> </tr> <tr> <td> 80bfbbbdce8bf083c61bd6380b2d69d61a6ecdddbb6f3e26344ba8d6f5a6e83e </td> <td> Malware sample </td> </tr> <tr> <td> 3b66cd66065d05bf024eb8c73860d8d537ef0e1bd66b27fb7b77510b0b31b68b </td> <td> Malware sample </td> </tr> <tr> <td> 06090af988079ad6c10c8f110b39b67a115d043ec59e7adc10bcf059e7d3c8d9 </td> <td> Malware sample </td> </tr> <tr> <td> c28af20a3d8ccbe0529a130c091da5efe2e7269b1883d9162f7058940ca597f7 </td> <td> Malware sample </td> </tr> <tr> <td> eec62239300741bc71e5ed083386e6c5e44a31e90064d63664bd95b656a10aa3 </td> <td> Malware sample </td> </tr> <tr> <td> 25f90700d8c663550f5b2c8488c131ccf97c0ee972db0f6fb87ca8cceacd7ee9 </td> <td> Malware sample </td> </tr> <tr> <td> 1ae2a81d2761c6aece751a238daf81f29bf28ac5537ab2b987e58fd65b2c9bd9 </td> <td> Malware sample </td> </tr> <tr> <td> 42a840a79b9d722fed5fb589f035b5206542b1308b2836195b678310d276ad2f </td> <td> Malware sample </td> </tr> <tr> <td> 5b2b90f47686b8fc13a322371349d8d71d16698e6e11672b9f218b777f13eb98 </td> <td> Malware sample </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds. <h2> Closing </h2> Tomorrow is June 30 — fiscal year-end. Historically, ransomware operators exploit periods when IT teams are distracted by administrative deadlines. DragonForce, Akira, and AiLock have all confirmed government as a target vertical. Cephalus has demonstrated the ability to bypass EDR. The Exchange hybrid vulnerability means a single compromised on-premises server could give an attacker silent, undetectable access to your entire M365 environment. The convergence is real: nation-states are in your messaging apps, ransomware operators are weaponizing your security tools, and your hybrid identity architecture has become the primary attack surface — not the perimeter. Three decisions needed today: <ol> <li> Patch Exchange hybrid infrastructure (CVE-2025-53786). If you cannot patch within 24 hours, implement compensating controls on the Entra Connect server and begin monitoring for S2S token anomalies. </li> <li> Confirm your EDR posture. If you run SentinelOne, engage your vendor on Cephalus mitigation immediately. Regardless of vendor, assume EDR can be bypassed and validate your defense-in-depth. </li> <li> Ensure ransomware readiness for the fiscal year-end weekend. Verify backup integrity, confirm IR retainer availability, and ensure your communication plan doesn't depend on systems that could be encrypted. </li> </ol> The threat actors are not taking the holiday weekend off. Neither should your defenses. Published 29 June 2026 | Anomali CTI Desk For questions or additional context, contact your Anomali intelligence team. IOC feeds updated in Anomali ThreatStream Next-Gen — automated blocking available for integrated customers.

FEATURED RESOURCES

September 9, 2026

No items found.

Shadow AI in the Enterprise: Why Unapproved AI Tool Adoption Is Becoming a Systemic Data Governance Crisis

Most employees already paste company data into AI tools they were never approved to use. See what shadow AI exposes and where DLP and policy fall short.

September 8, 2026

Anomali Cyber Watch

Privilege Escalation in CrowdStrike. TerminalFix, ClickFix Lure, Steganography, Reverse Tunnel. REVSTEALER Disable Windows Update and Defender.Langflow and Ruby on Rails Vulnerabilities. Microsoft Teams, Spring Ring Intrusion. Chrome Zero-Day.... and more

Researcher Releases FalconFlank Proof-of-Concept Demonstrating Privilege Escalation in CrowdStrike Falcon. TerminalFix Campaign Combines ClickFix Lure, Steganography, and Reverse Tunnel for Network Access. Four REVSTEALER-Linked Modules Disable Windows Update and Defender to Run a Crypto Miner. Critical Langflow and Ruby on Rails Vulnerabilities Under Active Exploitation. Fake Help Desk Calls on Microsoft Teams Fuel the Spring Ring Intrusion Campaign. Chrome Zero-Day Traced to Flawed Array-Sort Optimization in V8.

September 7, 2026

Agentic SOC

Pourquoi un SOC agentique commence par des données à haute fidélité

Pourquoi un SOC agentique commence par des données à haute fidélité. Les défis liés aux données. Les options pour les résoudre.

Explore All