Software Supply Chain Attacks Hit Developer Tools as Russian APT28 Expands Domestic Infrastructure

Public Sector

Published on

June 1, 2026

Table of Contents

Threat Assessment Level: ELEVATED Maintained from prior cycle. APT28 active C2 infrastructure now includes US-hosted nodes, CISA has issued a formal supply chain compromise alert targeting developer ecosystems, and building automation vulnerabilities affect state facilities. No escalation to HIGH warranted absent confirmed exploitation of state systems, but the convergence of supply chain, nation-state, and OT threats demands immediate defensive action. <h2> Introduction </h2> State government IT leaders face an uncomfortable reality this week: the tools your developers trust are being weaponized against you, Russian military intelligence is hosting command-and-control servers on American soil, and the building automation systems keeping your facilities running have unpatched vulnerabilities with no established remediation timeline. On May 28, CISA issued a priority alert on software supply chain intrusions targeting CI/CD pipelines and developer tooling — specifically VS Code extensions and npm packages. Simultaneously, a live campaign is stealing AI coding tool credentials through a poisoned npm package downloaded 29,000+ times per week. For state agencies accelerating AI adoption in development workflows, this is not a theoretical risk — it is an active operation. This brief provides the intelligence your SOC, DevOps, and facilities teams need to act today. <h2> What Changed (Past 72 Hours) </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> May 28, 2026 </td> <td> CISA issues supply chain alert: Nx Console VS Code extension compromised, GitHub repository intrusions confirmed </td> <td> State developer environments using VS Code and npm are directly exposed </td> </tr> <tr> <td> May 28, 2026 </td> <td> CISA publishes 7 ICS advisories including ABB EIBPORT and Schneider Electric EcoStruxure HVAC </td> <td> State building automation systems require firmware updates </td> </tr> <tr> <td> May 29, 2026 </td> <td> CISA adds new entry to Known Exploited Vulnerabilities (KEV) catalog </td> <td> Mandatory patching timeline triggered for FCEB; state agencies should mirror </td> </tr> <tr> <td> May 31, 2026 </td> <td> CHATTY SPIDER physical in-person pretexting confirmed </td> <td> All-technical-controls bypass via social engineering; front-line staff briefing required </td> </tr> <tr> <td> May 31, 2026 – June 1, 2026 </td> <td> 73 GlassWorm sleeper extensions confirmed on OpenVSX marketplace; 6 have activated malicious payloads </td> <td> Time-bomb approach defeats point-in-time scanning; developer extension inventories require immediate audit </td> </tr> <tr> <td> June 1, 2026 </td> <td> APT28 (Russian GRU) C2 infrastructure refreshed — 3 new high-confidence IPs including one US-hosted </td> <td> Domestic hosting defeats geographic filtering; behavioral detection required </td> </tr> <tr> <td> June 1, 2026 </td> <td> Aikido Security confirms active npm token theft campaign via codexui-android package </td> <td> AI coding tool credentials (OpenAI Codex) exfiltrated with non-expiring refresh tokens </td> </tr> <tr> <td> June 1, 2026 </td> <td> Microsoft resolves KB5089549 installation failure — fleet patching unblocked </td> <td> Windows 11 devices that failed patching can now proceed </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Timeframe </th> <th> Actor / Campaign </th> <th> Activity </th> <th> Impact to State Government </th> </tr> </thead> <tbody> <tr> <td> April 12, 2026 </td> <td> Unknown (BrutalStrike) </td> <td> Registration of anyclaw[.]store C2 domain </td> <td> Infrastructure staging for developer tool credential theft </td> </tr> <tr> <td> May 17–21, 2026 </td> <td> Unknown </td> <td> CVE-2026-0257 (Palo Alto GlobalProtect VPN) mass exploitation </td> <td> State VPN infrastructure at risk; patch verification required </td> </tr> <tr> <td> May 28, 2026 </td> <td> Unknown </td> <td> Nx Console VS Code extension compromised </td> <td> Developer workstations executing malicious JavaScript </td> </tr> <tr> <td> May 29, 2026 </td> <td> CISA </td> <td> KEV catalog update </td> <td> Patching clock starts for affected systems </td> </tr> <tr> <td> May 31, 2026 </td> <td> APT28 (Russia/GRU) </td> <td> Fresh C2 at 103.213.112[.]252 activated (97% confidence) </td> <td> Government network targeting infrastructure live </td> </tr> <tr> <td> May 31, 2026 </td> <td> CHATTY SPIDER </td> <td> Physical in-person pretexting confirmed </td> <td> All-technical-controls bypass via social engineering </td> </tr> <tr> <td> June 1, 2026 </td> <td> APT28 (Russia/GRU) </td> <td> 3 additional C2 IPs activated including US-based node </td> <td> Domestic infrastructure evades geo-based detection </td> </tr> <tr> <td> June 1, 2026 </td> <td> Unknown (BrutalStrike) </td> <td> codexui-android npm package actively exfiltrating Codex tokens </td> <td> State developers using AI tools face credential compromise </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Developer Tooling Supply Chain Under Coordinated Attack </h3> Three distinct but converging campaigns are targeting the software development ecosystem: Campaign A — Nx Console VS Code Extension Compromise CISA's May 28 alert confirms that the popular Nx Console extension for VS Code has been compromised, enabling attackers to execute malicious JavaScript on developer workstations and pivot into GitHub repositories. This is a trusted-relationship attack (ATT&CK T1199) — developers install extensions expecting them to be safe. Campaign B — codexui-android npm Token Theft A malicious npm package (codexui-android) with 29,000+ weekly downloads is exfiltrating OpenAI Codex authentication tokens — including refresh tokens that never expire. Stolen tokens are sent to sentry.anyclaw[.]store, a domain masquerading as the legitimate Sentry error-tracking service. The credential cache at ~/.codex/auth.json is the target file. Campaign C — GlassWorm Sleeper Extensions 73 extensions on the OpenVSX marketplace are confirmed "sleepers" — benign at installation, they activate malicious payloads only after a subsequent update. Six have already activated. This time-bomb approach defeats point-in-time security scanning. Why this matters for state government: Any agency with development teams using VS Code, npm packages, or AI coding assistants (Codex, Copilot, or similar) is in the blast radius. Stolen tokens provide persistent, silent access to connected code repositories, internal documentation, and any service authenticated through the compromised identity. <h3> 2. APT28 (Russian GRU) — US-Hosted Command and Control </h3> APT28 (also known as Fancy Bear, Forest Blizzard, Sofacy) has refreshed its command-and-control infrastructure with three new high-confidence indicators, including a node hosted within the United States at 143.20.185[.]242. Why domestic hosting matters: Most state network security architectures include geographic filtering that flags or blocks connections to known adversary-hosting countries. A US-based C2 server bypasses this entirely. Connections from state endpoints to this IP would appear as normal domestic traffic. Detection must shift from IP reputation to behavioral analysis — specifically monitoring for application-layer protocol abuse (T1071) and non-standard port usage (T1571). An additional hash (cb23dbc0a61019d3e1c8a5c3d07a3a09) carries dual attribution to both APT28 and APT27 (China), suggesting possible shared tooling or deliberate false-flag operations. Both attributions are preserved pending further evidence. <h3> 3. Building Automation Vulnerabilities — ABB and Schneider Electric </h3> CISA published ICS advisories on May 28 affecting systems commonly deployed in state government facilities: <ul> <li> ABB EIBPORT (ICSA-26-148-03): Building automation controller — firmware update required </li> <li> Schneider Electric EcoStruxure Machine Expert HVAC (ICSA-26-148-07): HVAC management platform vulnerability </li> <li> ABB Busch-Welcome 2 Wire Door Opener Actuator (ICSA-26-148-04): Physical access control vulnerability </li> </ul> No confirmed exploitation exists, but these systems typically lack established patch cycles in state facilities. An attacker exploiting these vulnerabilities could manipulate building controls (T0831), modify operational parameters (T0836), or send unauthorized commands (T0855) — with potential impacts ranging from HVAC disruption to physical access control bypass. <h3> 4. Persistent Threats — Unchanged but Active </h3> The following threats from prior cycles remain active and require continued vigilance: <table> <thead> <tr> <th> Actor </th> <th> Origin </th> <th> Status </th> </tr> </thead> <tbody> <tr> <td> APT28 </td> <td> Russia/GRU </td> <td> Active C2 expansion (this cycle) </td> </tr> <tr> <td> APT42 </td> <td> Iran/IRGC-IO </td> <td> Active; no new state gov indicators </td> </tr> <tr> <td> Kimsuky/APT43 </td> <td> DPRK </td> <td> Active; VS Code tunneling TTP previously detected </td> </tr> <tr> <td> Void Blizzard/COZY BEAR </td> <td> Russia/SVR </td> <td> Active; government targeting continues </td> </tr> <tr> <td> PUNK SPIDER (Akira) </td> <td> Criminal </td> <td> Updated today; no new state/local victims </td> </tr> <tr> <td> ROYAL SPIDER (BlackSuit) </td> <td> Criminal </td> <td> Updated today; no new state/local victims </td> </tr> <tr> <td> CHATTY SPIDER (Silent Ransom) </td> <td> Criminal </td> <td> Physical pretexting confirmed May 31 </td> </tr> <tr> <td> DragonForce </td> <td> Criminal </td> <td> Active </td> </tr> <tr> <td> TEMP.Hex </td> <td> Unknown </td> <td> Tracked </td> </tr> </tbody> </table> Notable absence: Volt Typhoon and Salt Typhoon (China) have produced zero indicators across multiple collection cycles. Given their documented focus on US critical infrastructure pre-positioning, operational silence is consistent with long-dwell operations rather than inactivity. This warrants proactive hunting, not complacency. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional supply chain attacks targeting developer tooling (VS Code, npm, AI assistants) </td> <td> 70% (HIGH) </td> <td> 7 days </td> <td> Three concurrent campaigns indicate coordinated ecosystem targeting; low barrier to entry for copycat attacks </td> </tr> <tr> <td> APT28 uses US-hosted infrastructure for phishing or credential harvesting against government targets </td> <td> 50% (MODERATE) </td> <td> 14 days </td> <td> Domestic hosting reduces detection; historical pattern of government targeting </td> </tr> <tr> <td> Ransomware group (Akira or BlackSuit) hits a state/local government entity </td> <td> 45% (MODERATE) </td> <td> 14 days </td> <td> Both groups updated today with active operations; state/local gov is a documented target vertical </td> </tr> <tr> <td> CHATTY SPIDER physical pretexting attempt against a state agency </td> <td> 35% (MODERATE) </td> <td> 30 days </td> <td> Technique confirmed May 31; state agencies with public-facing offices are accessible targets </td> </tr> <tr> <td> Volt Typhoon/Salt Typhoon indicators surface revealing pre-positioned access in US infrastructure </td> <td> 20% (LOW) </td> <td> 30 days </td> <td> Operational silence consistent with long-dwell; detection depends on network anomaly hunting </td> </tr> <tr> <td> Exploitation of ABB/Schneider building automation vulnerabilities in state facilities </td> <td> 15% (LOW) </td> <td> 30 days </td> <td> No confirmed exploitation; requires network access to OT segment </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> Hunt Hypothesis 1: Developer Workstation Compromise via Supply Chain <ul> <li> What to look for: Outbound connections from developer workstations to sentry.anyclaw[.]store or any *.anyclaw[.]store subdomain. File access to ~/.codex/auth.json by non-Codex processes. Installation of npm package codexui-android. </li> <li> ATT&CK techniques: T1195.002 (Supply Chain Compromise), T1528 (Steal Application Access Token), T1567.002 (Exfiltration to Cloud Storage), T1059.007 (JavaScript Execution) </li> <li> Detection logic: DNS queries or proxy logs for anyclaw[.]store; EDR file access telemetry for auth.json in user home directories; npm audit logs showing codexui-android in any package-lock.json </li> </ul> Hunt Hypothesis 2: APT28 C2 Communication <ul> <li> What to look for: Any network connection (inbound or outbound) to 45.71.14[.]204, 209.99.185[.]239, or 143.20.185[.]242. Particular attention to the US-based IP which will not trigger geo-anomaly alerts. </li> <li> ATT&CK techniques: T1071 (Application Layer Protocol), T1571 (Non-Standard Port) </li> <li> Detection logic: Firewall/proxy logs for connections to listed IPs on any port. EDR process-to-network correlation for any process communicating with these IPs. Alert on non-standard port usage (anything other than 80/443) to the US-based IP specifically. </li> </ul> Hunt Hypothesis 3: VS Code Extension Abuse <ul> <li> What to look for: VS Code extensions sourced from OpenVSX (not Microsoft Marketplace). Extensions with recent updates that added network communication capabilities. VS Code Remote Tunnels being used as C2 channels (previously observed with Kimsuky). </li> <li> ATT&CK techniques: T1195.002 (Supply Chain Compromise), T1059.007 (JavaScript), T1572 (Protocol Tunneling) </li> <li> Detection logic: Enumerate installed extensions across developer fleet; flag any from OpenVSX. Monitor for code tunnel process spawning or VS Code establishing persistent outbound WebSocket connections to non-Microsoft domains. </li> </ul> <h3> Blocking Actions </h3> <table> <thead> <tr> <th> IOC Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 45.71.14[.]204 </td> <td> APT28 C2 — confidence 91% </td> </tr> <tr> <td> IPv4 </td> <td> 209.99.185[.]239 </td> <td> APT28 C2 — confidence 98% </td> </tr> <tr> <td> IPv4 </td> <td> 143.20.185[.]242 </td> <td> APT28 C2 (US-hosted) — confidence 98% </td> </tr> <tr> <td> Domain </td> <td> sentry.anyclaw[.]store </td> <td> npm token exfiltration C2 </td> </tr> <tr> <td> Domain </td> <td> anyclaw[.]store </td> <td> Parent domain for token theft infrastructure </td> </tr> <tr> <td> MD5 </td> <td> cb23dbc0a61019d3e1c8a5c3d07a3a09 </td> <td> APT28/APT27 dual-attributed malware </td> </tr> </tbody> </table> Additional IOCs — including file hashes associated with the campaigns described in this report — are available through Anomali ThreatStream Next-Gen and partner feeds. Query ThreatStream Next-Gen for APT28, BrutalStrike, and GlassWorm indicator sets. <h3> Monitoring Adjustments </h3> <ol> <li> Increase logging verbosity on developer workstations for npm install/update operations and VS Code extension lifecycle events </li> <li> Enable DNS query logging if not already active — critical for detecting C2 callbacks to anyclaw[.]store variants </li> <li> Review geo-based alerting rules — confirm that behavioral detection (non-standard ports, unusual process-to-network mappings) supplements IP reputation for domestic-hosted threats </li> <li> OT/BAS network monitoring — confirm segmentation between IT and building automation networks; alert on any cross-segment traffic to ABB or Schneider controllers </li> </ol> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits Processing) </h3> <ul> <li> Primary threat: Credential theft via supply chain (codexui-android) could compromise developer access to financial transaction systems </li> <li> Action: Audit any development teams building or maintaining benefits processing, tax filing, or payment systems for npm dependency hygiene. Ensure service accounts for financial APIs use hardware-bound credentials (FIDO2/WebAuthn) rather than bearer tokens </li> <li> Monitor: Unusual API call patterns to financial SaaS platforms (Salesforce, ServiceNow) that could indicate stolen token reuse </li> </ul> <h3> Energy & Utilities (Water/Wastewater SCADA, Building Automation) </h3> <ul> <li> Primary threat: ABB EIBPORT and Schneider Electric EcoStruxure vulnerabilities (ICSA-26-148-03, ICSA-26-148-07) directly affect operational technology </li> <li> Action: Verify network segmentation between IT and OT/BAS networks. Confirm that building automation controllers are not internet-accessible. Schedule firmware updates within 7 days for affected ABB and Schneider systems </li> <li> Monitor: Any new connections to building automation controller IP ranges from IT network segments; unauthorized parameter changes in HVAC or water treatment systems </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware groups (Akira, BlackSuit) actively target healthcare; CHATTY SPIDER physical pretexting could target facilities with public waiting areas </li> <li> Action: Verify offline backup integrity for Medicaid enrollment and claims processing systems. Brief front-desk and reception staff on social engineering pretexting scenarios — attackers posing as IT support or vendor representatives </li> <li> Monitor: Unusual after-hours RDP/VPN connections to systems containing PHI; callback phishing attempts (voicemail-themed emails directing staff to call attacker-controlled numbers) </li> </ul> <h3> Government (Executive Branch Agencies, Elections) </h3> <ul> <li> Primary threat: APT28 (Russia/GRU) active C2 expansion with US-hosted infrastructure; nation-state espionage targeting government credentials </li> <li> Action: Block all three APT28 IPs immediately. Review Azure AD/Entra ID sign-in logs for any authentication from the listed IP ranges. Confirm MFA enforcement on all privileged accounts with no exceptions </li> <li> Monitor: Impossible-travel alerts in identity provider; service principal credential usage outside normal automation windows; any connection to APT28 infrastructure from state network ranges </li> </ul> <h3> Aviation & Logistics (State DOT, Airport Authorities, Fleet Management) </h3> <ul> <li> Primary threat: Supply chain compromise of CI/CD pipelines could affect transportation management systems; ICS vulnerabilities in traffic management controllers </li> <li> Action: Audit GitHub Actions workflows for any use of mutable version tags (use commit SHA pinning instead). Review network segmentation for traffic management and fleet tracking systems </li> <li> Monitor: Unusual commits or workflow runs in transportation system repositories; any lateral movement from IT networks toward traffic management or fleet GPS systems </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🔴 </td> <td> SOC </td> <td> Block APT28 C2 IPs at perimeter firewall, proxy, and EDR: 45.71.14[.]204, 209.99.185[.]239, 143.20.185[.]242. Deploy hash block for cb23dbc0a61019d3e1c8a5c3d07a3a09 (MD5). Retrieve additional file hashes from ThreatStream Next-Gen APT28 indicator set </td> </tr> <tr> <td> 🔴 </td> <td> SOC </td> <td> Block DNS resolution for sentry.anyclaw[.]store and anyclaw[.]store at DNS resolver and web proxy </td> </tr> <tr> <td> 🔴 </td> <td> DevOps </td> <td> Scan all developer workstations and CI/CD pipelines for npm package codexui-android. If found: isolate machine, revoke all associated tokens, rotate credentials </td> </tr> <tr> <td> 🔴 </td> <td> DevOps </td> <td> Check for ~/.codex/auth.json on developer machines — if any OpenAI/Codex tokens exist, revoke and reissue immediately </td> </tr> <tr> <td> 🔴 </td> <td> IT Security </td> <td> Brief help desk and reception staff on CHATTY SPIDER physical pretexting: attackers arriving in person posing as IT vendors or support staff to gain physical access </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟠 </td> <td> DevOps </td> <td> Implement VS Code extension allowlisting — restrict to Microsoft Marketplace verified publishers only. Remove any extensions sourced from OpenVSX pending security review </td> </tr> <tr> <td> 🟠 </td> <td> DevOps </td> <td> Pin all npm dependencies to exact versions with integrity hashes (npm shrinkwrap or lockfile-lint). Enable npm audit in CI/CD pipelines as a blocking gate </td> </tr> <tr> <td> 🟠 </td> <td> Facilities IT </td> <td> Deploy firmware updates for ABB EIBPORT controllers (ICSA-26-148-03), Schneider Electric EcoStruxure HVAC (ICSA-26-148-07), and ABB Busch-Welcome door actuators (ICSA-26-148-04) </td> </tr> <tr> <td> 🟠 </td> <td> IT Ops </td> <td> Deploy KB5089573 to Windows 11 fleet. Identify devices with ≤10MB free EFI System Partition space that may have failed KB5089549 and remain unpatched </td> </tr> <tr> <td> 🟠 </td> <td> SOC </td> <td> Implement behavioral detection for non-standard port communication (T1571) to US-based IP ranges — geo-filtering alone is insufficient for domestically-hosted APT28 infrastructure </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟡 </td> <td> CISO </td> <td> Commission assessment of AI coding tool adoption across all state agencies. Establish approved tools list, mandate OS credential store over plaintext file caching, and define token rotation policy (maximum 90-day lifetime for refresh tokens) </td> </tr> <tr> <td> 🟡 </td> <td> CISO </td> <td> Establish OT/BAS patch management SLA (recommend 30-day maximum for critical ICS advisories). Formalize coordination between IT security and facilities management for building automation patching </td> </tr> <tr> <td> 🟡 </td> <td> CISO </td> <td> Procure supplementary OSINT intelligence feed to restore multi-source corroboration capability. Current single-source dependency on one commercial feed degrades confidence in threat assessments. Budget estimate: $15–40K/year </td> </tr> <tr> <td> 🟡 </td> <td> IR Team </td> <td> Conduct tabletop exercise simulating supply chain compromise of a developer tool leading to code repository access and lateral movement to production systems </td> </tr> <tr> <td> 🟡 </td> <td> SOC </td> <td> Initiate proactive threat hunt for Volt Typhoon / Salt Typhoon indicators across state network infrastructure — focus on living-off-the-land techniques in network edge devices (routers, VPN concentrators, firewalls) </td> </tr> </tbody> </table> <h2> Executive Preparedness Checklist </h2> For CIOs and CISOs — actions that require leadership decision-making: <ul> <li> [ ] Budget decision: Approve OSINT feed procurement ($15–40K/year) to restore intelligence corroboration capability — degraded for 3 consecutive cycles </li> <li> [ ] Policy decision: Establish AI coding tool governance policy before adoption outpaces security controls </li> <li> [ ] Organizational decision: Define OT/BAS security ownership — who is responsible for patching building automation systems? </li> <li> [ ] Risk acceptance decision: Document and accept (or mitigate) the risk of developer workstations with unmanaged npm dependencies and VS Code extensions </li> <li> [ ] Communication decision: Determine whether physical social engineering advisory (CHATTY SPIDER) requires all-staff communication or targeted briefing to front-line personnel </li> </ul> <h2> Bottom Line </h2> Three converging threat vectors define this cycle: a coordinated supply chain assault on developer tooling (Nx Console, GlassWorm sleepers, codexui-android), Russian GRU infrastructure expansion onto US soil that defeats geographic filtering, and unpatched building automation systems with no established remediation SLA. Each vector is independently actionable today. The APT28 IPs can be blocked in minutes. The malicious npm package can be detected with a single audit command. The ICS firmware updates are available now. Inaction converts intelligence into an incident report. <h2> Closing </h2> The convergence of supply chain attacks on developer tooling, nation-state infrastructure expansion onto US soil, and unpatched building automation systems creates a threat environment where traditional perimeter defenses are insufficient. Your developers' npm packages are being weaponized. Your geographic filtering rules are being bypassed. Your building controllers have no patch SLA. The good news: every threat identified today has a concrete, actionable defensive response. The APT28 IPs can be blocked in minutes. The malicious npm package can be detected with a single audit command. The ICS patches are available now. The question is not whether your state has the capability to defend against these threats — it is whether you will act on this intelligence before it becomes an incident report. Block the IOCs. Audit the developers. Patch the buildings. Brief the staff. Anomali CTI Desk | Published June 1, 2026 Intelligence sources: CISA Advisories, Anomali ThreatStream, Aikido Security, Microsoft Security Response Center Next update: June 2, 2026

FEATURED RESOURCES

June 1, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Critical Window as Kinetic Conflict Reaches Day 94

June 1, 2026

Anomali Cyber Watch

Public Sector

Software Supply Chain Attacks Hit Developer Tools as Russian APT28 Expands Domestic Infrastructure

May 29, 2026

Anomali Cyber Watch

Iran's Cyber Paradox: Degraded APTs, Empowered Proxies, and the Rise of Bootkit Wipers

Explore All