Stealthy Linux Backdoors, Critical MDM Exploits, and ICS Vulnerabilities Converge on Government Networks

Public Sector

Published on

June 10, 2026

Table of Contents

Threat Assessment Level: ELEVATED The threat level remains ELEVATED, unchanged from the prior cycle. Two high-priority findings — active exploitation of mobile device management infrastructure and the discovery of a years-long undetected Linux backdoor in government networks — demand immediate leadership attention alongside an accelerating cadence of industrial control system advisories. <h2> Introduction </h2> State government IT leaders face a compounding threat picture this week. A critical unauthenticated remote code execution campaign is actively targeting government mobile device management platforms. Simultaneously, researchers have disclosed a sophisticated Linux backdoor that operated undetected inside government IT infrastructure for over six years — masquerading as the very monitoring tools defenders rely on. And five new industrial control system advisories affect equipment commonly deployed in state-overseen utilities. This is not a theoretical risk briefing. These are active campaigns with confirmed government targeting. The window for defensive action is measured in days, not weeks. <h2> What Changed </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> 2026-06-10 </td> <td> FAMOUS CHOLLIMA (DPRK) refreshes C2 infrastructure via verceljs-kappa.vercel[.]app </td> <td> Active espionage infrastructure targeting government; abuse of legitimate hosting platforms complicates blocking </td> </tr> <tr> <td> 2026-06-09 </td> <td> Ivanti EPMM exploitation campaign updated — CVE-2026-1281 & CVE-2026-1340 (CVSS 9.8) confirmed targeting government </td> <td> Unauthenticated RCE against mobile device management; no credentials required for exploitation </td> </tr> <tr> <td> 2026-06-09 </td> <td> CISA adds CVE-2026-7473 (Arista EOS) to KEV catalog </td> <td> Network infrastructure tunnel bypass vulnerability now confirmed exploited in the wild </td> </tr> <tr> <td> 2026-06-09 </td> <td> Schneider Electric EcoStruxure Panel Server & Modicon switch advisories published </td> <td> Credential derivation and authentication bypass in building automation/industrial equipment </td> </tr> <tr> <td> 2026-06-08 </td> <td> Solar 4RAYS publishes GoblinRAT analysis — Golang backdoor in government infrastructure since 2020 </td> <td> Unattributed, nation-state-caliber Linux implant masquerading as Zabbix and other monitoring services </td> </tr> <tr> <td> 2026-06-04–09 </td> <td> Hitachi Energy RTU500, ITT600, MACH HiDraw & Siemens KACO advisories </td> <td> Substation RTUs and solar inverters vulnerable to remote exploitation </td> </tr> <tr> <td> 2026-06-08 </td> <td> CVE-2026-42271 (LiteLLM AI gateway, CVSS 8.8) remains on CISA KEV </td> <td> First AI infrastructure zero-day in KEV; relevant to agencies deploying AI services </td> </tr> </tbody> </table> Continuity from prior cycle: UNC5475 (China-nexus) Cisco zero-day exploitation (last confirmed activity 2026-05-21), REVENANT SPIDER/Qilin ransomware operations (active, 90+ countries), and APT42/Charming Kitten OAuth phishing campaigns all remain active threats with no change in status. Their operational quiet is assessed as potential pre-positioning, not cessation. <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Actor / Campaign </th> <th> Target </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 2020–2026 </td> <td> GoblinRAT (Unattributed, nation-state caliber) </td> <td> Government IT service providers (Linux) </td> <td> Persistent backdoor discovered after 6+ years of undetected operation </td> </tr> <tr> <td> 2026-05-21 </td> <td> UNC5475 (China-nexus) </td> <td> Government & critical infrastructure (Cisco devices) </td> <td> Last confirmed zero-day exploitation; 20-day silence is concerning </td> </tr> <tr> <td> 2026-06-04 </td> <td> Hitachi Energy </td> <td> Energy sector (substations) </td> <td> RTU500/ITT600/MACH HiDraw advisories published </td> </tr> <tr> <td> 2026-06-08 </td> <td> GoblinRAT disclosure </td> <td> Government Linux infrastructure </td> <td> Solar 4RAYS publishes full technical analysis </td> </tr> <tr> <td> 2026-06-08 </td> <td> LiteLLM CVE-2026-42271 </td> <td> AI infrastructure </td> <td> CISA KEV addition confirmed </td> </tr> <tr> <td> 2026-06-09 </td> <td> Unknown actor(s) </td> <td> Government, financial, transportation (6 countries) </td> <td> Ivanti EPMM active exploitation campaign </td> </tr> <tr> <td> 2026-06-09 </td> <td> CISA </td> <td> Network infrastructure </td> <td> CVE-2026-7473 Arista EOS added to KEV </td> </tr> <tr> <td> 2026-06-09 </td> <td> Schneider Electric </td> <td> Building automation / industrial </td> <td> EcoStruxure & Modicon advisories </td> </tr> <tr> <td> 2026-06-09 </td> <td> REVENANT SPIDER / Qilin </td> <td> Government (90+ countries) </td> <td> Operational indicators refreshed; no new victims disclosed </td> </tr> <tr> <td> 2026-06-10 </td> <td> FAMOUS CHOLLIMA (DPRK) </td> <td> Government / espionage targets </td> <td> New C2 domain activated </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Ivanti EPMM: Your MDM Platform Is Now a Front Door </h3> CVE-2026-1281 and CVE-2026-1340 are both scored CVSS 9.8 — the maximum practical severity. They allow unauthenticated remote code execution against Ivanti Endpoint Manager Mobile (EPMM), the platform many state agencies use to manage government mobile devices. An active exploitation campaign confirmed by Google Threat Intelligence is targeting government, financial services, manufacturing, and transportation sectors across at least six countries. No credentials are required. If your EPMM instance is internet-facing and unpatched, assume it is being probed. Why this matters for state government: MDM platforms hold device certificates, VPN configurations, email credentials, and network access policies. Compromising EPMM gives an attacker a blueprint of your mobile fleet and potentially direct access to internal networks. ATT&CK Techniques: T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter), T1078 (Valid Accounts) <h3> 2. GoblinRAT: Six Years Undetected in Government Networks </h3> A Golang-based Linux backdoor dubbed GoblinRAT was discovered operating inside at least four government-serving IT infrastructure providers — with evidence of activity dating back to 2020. This implant represents a masterclass in evasion: <ul> <li> Masquerades as trusted monitoring tools — Zabbix agent, rhsmcertd, memcached, chronyd </li> <li> Per-host unique persistence — no two deployments use the same file names or service configurations, defeating signature-based detection </li> <li> RAM-only staging — operates from /dev/shm, leaving no disk artifacts </li> <li> Anti-forensic capabilities — uses shred to destroy logs, hooks authentication functions </li> <li> Compromised legitimate websites for C2 — defeats domain reputation blocking </li> </ul> No attribution has been established, but the sophistication level — particularly the per-host customization and six-year operational lifespan — is consistent with nation-state tradecraft. Why this matters for state government: State agencies commonly run RHEL/CentOS Linux servers with Zabbix or similar monitoring tools. GoblinRAT specifically targets this exact configuration. If you trust your monitoring infrastructure implicitly, you may be trusting the adversary's persistence mechanism. ATT&CK Techniques: T1036.004 (Masquerade Task or Service), T1070.002 (Clear Linux System Logs), T1543.002 (Systemd Service), T1071.001 (Web Protocols C2), T1055 (Process Injection) <h3> 3. ICS/OT Advisory Surge: Five Advisories in One Week </h3> Five industrial control system advisories were published between June 4–9 affecting vendors commonly deployed in state-overseen utility infrastructure: <table> <thead> <tr> <th> Vendor </th> <th> Product </th> <th> Risk </th> <th> Advisory </th> </tr> </thead> <tbody> <tr> <td> Schneider Electric </td> <td> EcoStruxure Panel Server </td> <td> Credential derivation in edge gateways </td> <td> ICSA-26-160-03 </td> </tr> <tr> <td> Schneider Electric </td> <td> Modicon Network Managed Switches </td> <td> RADIUS authentication bypass </td> <td> ICSA-26-160-01 </td> </tr> <tr> <td> Hitachi Energy </td> <td> RTU500 </td> <td> Remote exploitation of substation RTUs </td> <td> ICSA-26-155-04 </td> </tr> <tr> <td> Hitachi Energy </td> <td> ITT600 Explorer </td> <td> SCADA engineering tool compromise </td> <td> ICSA-26-155-02 </td> </tr> <tr> <td> Siemens </td> <td> KACO Blueplanet Inverters </td> <td> Credential derivation in solar inverters </td> <td> ICSA-26-160-02 </td> </tr> </tbody> </table> The Hitachi Energy RTU500 is particularly concerning — these remote terminal units are deployed in electrical substations and water treatment facilities. Exploitation could enable manipulation of physical processes. ATT&CK Techniques: T0831 (Manipulation of Control), T0836 (Modify Parameter), T1552.001 (Credentials in Files), T1556 (Modify Authentication Process) <h3> 4. Nation-State Activity: Quiet Periods Are Not Safe Periods </h3> UNC5475 (China-nexus): Last confirmed activity exploiting Cisco ASA/FTD zero-days was May 21 — a 20-day silence. This actor targets government and critical infrastructure networks globally. Their operational pause likely indicates retooling or successful establishment of persistent access that no longer generates detectable traffic. State agencies running Cisco edge appliances should assume they are targets. FAMOUS CHOLLIMA (DPRK): Refreshed C2 infrastructure today via verceljs-kappa.vercel[.]app. This actor conducts espionage operations using fake job recruitment lures and the InvisibleFerret RAT. Their abuse of legitimate hosting platforms (Vercel) makes network-level blocking challenging. APT42 / Charming Kitten (Iran/IRGC-IO): Continues OAuth consent phishing campaigns against government, energy, and healthcare cloud environments. Current quiet period assessed as potential pre-positioning rather than cessation. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Probability </th> <th> Assessment </th> </tr> </thead> <tbody> <tr> <td> 70% </td> <td> Additional Ivanti EPMM exploitation reports will emerge within 7 days as the campaign expands. Unpatched government instances face near-certain targeting. </td> </tr> <tr> <td> 50% </td> <td> GoblinRAT variants or similar Linux backdoors will be reported by additional security vendors now that indicators are public. Expect copycat adoption of monitoring-tool masquerade techniques. </td> </tr> <tr> <td> 40% </td> <td> CISA will add Ivanti EPMM CVEs (CVE-2026-1281, CVE-2026-1340) to the KEV catalog within 7 days given active exploitation and CVSS 9.8 severity. </td> </tr> <tr> <td> 35% </td> <td> A state or local government ransomware incident will be disclosed within 14 days. REVENANT SPIDER/Qilin's operational tempo and confirmed government targeting make this a persistent risk. </td> </tr> <tr> <td> 30% </td> <td> UNC5475 will resurface with new Cisco zero-day exploitation. Their operational tempo suggests retooling, not retirement. </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> Hunt for GoblinRAT (CLU-207) <table> <thead> <tr> <th> Detection Type </th> <th> Guidance </th> <th> ATT&CK </th> </tr> </thead> <tbody> <tr> <td> Network blocking </td> <td> Alert/block connections to 37.120.247[.]182, 5.63.154[.]23, qfilling[.]instanthq[.]com, chronyd[.]tftpd[.]net </td> <td> T1071.001 </td> </tr> <tr> <td> Process anomaly </td> <td> Hunt for processes named zabbix_agent (note: legitimate is zabbix_agentd with trailing 'd') </td> <td> T1036.004 </td> </tr> <tr> <td> Systemd audit </td> <td> Review /usr/lib/systemd/system/ for services mimicking monitoring tools where ExecStart binary path doesn't match expected installation directory </td> <td> T1543.002 </td> </tr> <tr> <td> Memory forensics </td> <td> Check /dev/shm on Linux servers for unexpected executables or shared memory segments </td> <td> T1055 </td> </tr> <tr> <td> DNS monitoring </td> <td> Alert on queries to instanthq[.]com and tftpd[.]net subdomains </td> <td> T1071.001 </td> </tr> </tbody> </table> Hunting Hypothesis: If GoblinRAT or a similar implant is present in our Linux monitoring infrastructure, we would observe: (a) systemd services with names matching monitoring tools but binary paths in non-standard locations; (b) processes with manipulated argv[0] strings; (c) outbound HTTPS connections from monitoring servers to domains not in our approved monitoring vendor list. Hunt for UNC5475 Cisco Persistence <table> <thead> <tr> <th> Detection Type </th> <th> Guidance </th> <th> ATT&CK </th> </tr> </thead> <tbody> <tr> <td> AAA audit </td> <td> Check for unauthorized modifications to AAA configurations on all Cisco ASA/FTD </td> <td> T1556 </td> </tr> <tr> <td> Syslog integrity </td> <td> Verify syslog forwarding is active and unmodified; disabled syslog is a key UNC5475 indicator </td> <td> T1562.001 </td> </tr> <tr> <td> Crash analysis </td> <td> Review crash dump behavior — anomalous crashes may indicate exploitation attempts </td> <td> T1190 </td> </tr> </tbody> </table> Hunting Hypothesis: If UNC5475 has established persistence on our Cisco edge appliances, we would observe: (a) AAA configuration changes not matching change management records; (b) gaps in syslog forwarding; (c) unexpected process restarts or crash dumps on ASA/FTD devices. Monitor for Ivanti EPMM Exploitation <table> <thead> <tr> <th> Detection Type </th> <th> Guidance </th> <th> ATT&CK </th> </tr> </thead> <tbody> <tr> <td> Exposure verification </td> <td> Confirm whether Ivanti EPMM is deployed; if yes, verify patch status immediately </td> <td> T1190 </td> </tr> <tr> <td> Web logs </td> <td> Review EPMM access logs for anomalous unauthenticated API calls or unexpected administrative actions </td> <td> T1190 </td> </tr> <tr> <td> Post-compromise </td> <td> If EPMM was unpatched and internet-facing, assume compromise — hunt for credential harvesting and lateral movement </td> <td> T1078 </td> </tr> </tbody> </table> FAMOUS CHOLLIMA C2 Monitoring <table> <thead> <tr> <th> Detection Type </th> <th> Guidance </th> <th> ATT&CK </th> </tr> </thead> <tbody> <tr> <td> DNS/proxy </td> <td> Alert on connections to verceljs-kappa.vercel[.]app </td> <td> T1583.001 </td> </tr> <tr> <td> Email/HR </td> <td> Brief recruiting teams on fake job interview lures — verify all coding challenge repositories before execution </td> <td> T1566.003 </td> </tr> </tbody> </table> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Retirement Systems) </h3> <ul> <li> Priority 1: Ivanti EPMM patch verification — financial agencies managing mobile access to payment systems and taxpayer data are high-value targets in the confirmed campaign </li> <li> Priority 2: Review OAuth consent grants in M365/Azure AD for anomalous application permissions (APT42 technique) </li> <li> Priority 3: Ensure SWIFT/ACH transaction monitoring is not dependent on Linux servers running Zabbix without EDR coverage </li> </ul> <h3> Energy (State Energy Office, Utility Coordination) </h3> <ul> <li> Priority 1: Inventory all Hitachi Energy RTU500 units in state-overseen substations and coordinate vendor patching per ICSA-26-155-04 </li> <li> Priority 2: Assess Schneider Electric EcoStruxure Panel Server and Modicon switch deployments in building automation and grid coordination systems </li> <li> Priority 3: Verify network segmentation between IT and OT — credential derivation vulnerabilities in OT equipment mean IT-side credential theft could pivot to physical process control </li> <li> Priority 4: Audit Siemens KACO Blueplanet solar inverter installations for default or derivable credentials </li> </ul> <h3> Healthcare (Health & Human Services, Medicaid Systems) </h3> <ul> <li> Priority 1: Ivanti EPMM is widely deployed in healthcare for clinician mobile device management — verify patch status with extreme urgency </li> <li> Priority 2: Linux servers hosting health information exchanges (HIEs) and Medicaid Management Information Systems (MMIS) should be included in GoblinRAT hunting scope </li> <li> Priority 3: APT42 OAuth phishing specifically targets healthcare cloud environments — enforce conditional access policies requiring compliant devices for all clinical application access </li> </ul> <h3> Government (All Executive Branch Agencies) </h3> <ul> <li> Priority 1: Conduct enterprise-wide inventory of Ivanti EPMM deployments across all agencies within 24 hours </li> <li> Priority 2: Authorize and execute Linux threat hunt on all RHEL/CentOS servers, prioritizing those running Zabbix, Nagios, or similar monitoring platforms </li> <li> Priority 3: Validate Cisco ASA/FTD configurations against known-good baselines — any deviation requires forensic investigation </li> <li> Priority 4: Review systemd service inventory on all Linux hosts for unauthorized or suspicious service definitions </li> </ul> <h3> Aviation / Logistics (DOT, Airport Authorities, Port Systems) </h3> <ul> <li> Priority 1: Transportation SCADA systems may use Hitachi Energy or Schneider Electric components — coordinate with OT teams on advisory applicability </li> <li> Priority 2: Ivanti EPMM exploitation campaign explicitly targets transportation sector — verify MDM patch status for field worker mobile devices </li> <li> Priority 3: FAMOUS CHOLLIMA has historically targeted logistics and transportation for revenue generation — monitor for fake job lures targeting IT staff </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> IT Ops </td> <td> Verify whether Ivanti EPMM is deployed anywhere in the state environment. If yes, apply emergency patch for CVE-2026-1281 and CVE-2026-1340 (CVSS 9.8, active exploitation, government targeting confirmed). If patching is not immediately possible, restrict internet-facing access to EPMM administrative interfaces. </td> </tr> <tr> <td> CRITICAL </td> <td> SOC </td> <td> Deploy GoblinRAT network IOCs to all detection platforms: block/alert on 37.120.247[.]182, 5.63.154[.]23, qfilling[.]instanthq[.]com, chronyd[.]tftpd[.]net. Add verceljs-kappa.vercel[.]app (FAMOUS CHOLLIMA C2) to watchlist. </td> </tr> <tr> <td> HIGH </td> <td> SOC </td> <td> Initiate Linux threat hunt on all monitoring servers — search for processes named zabbix_agent (without trailing 'd'), unexpected services in /usr/lib/systemd/system/, and executables in /dev/shm. </td> </tr> <tr> <td> HIGH </td> <td> CISO </td> <td> Brief agency CIOs on Ivanti EPMM risk — any agency running unpatched EPMM with internet exposure should treat this as a potential compromise, not just a vulnerability. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> HIGH </td> <td> SOC </td> <td> Conduct proactive threat hunt on all Cisco ASA/FTD appliances for UNC5475 persistence indicators: unauthorized AAA modifications, disabled syslog forwarding, anomalous crash dumps. Reference CVE-2025-20333, CVE-2025-20362, CVE-2025-20363. </td> </tr> <tr> <td> HIGH </td> <td> IT Ops / OT </td> <td> Inventory all Schneider Electric EcoStruxure Panel Servers, Modicon switches, and Hitachi Energy RTU500 units in state-overseen utility infrastructure. Coordinate vendor patching per ICSA-26-160-01, ICSA-26-160-03, ICSA-26-155-04. </td> </tr> <tr> <td> HIGH </td> <td> SOC </td> <td> Deploy Sigma detection rule for Linux process masquerading: alert when argv[0] contains known service names (zabbix_agentd, memcached, rhsmcertd, vmtoolsd) but the binary path does not match the expected installation directory. </td> </tr> <tr> <td> MEDIUM </td> <td> IT Ops </td> <td> Audit Arista EOS switches for tunnel decapsulation configurations (VXLAN, GRE). If decap-groups are configured, apply vendor patch per CVE-2026-7473 KEV listing. </td> </tr> <tr> <td> MEDIUM </td> <td> IR Team </td> <td> Update incident response playbooks to include Linux-specific forensic procedures — current playbooks likely assume Windows-centric compromise scenarios. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> HIGH </td> <td> CISO </td> <td> Evaluate procurement of additional open-source intelligence feeds to restore corroboration capability. Current single-source dependency has degraded threat validation for 12 consecutive days. </td> </tr> <tr> <td> MEDIUM </td> <td> CISO </td> <td> Commission assessment of Linux endpoint detection coverage across the enterprise. GoblinRAT demonstrates that Windows-focused EDR strategies leave Linux infrastructure as a blind spot. </td> </tr> <tr> <td> MEDIUM </td> <td> IT Ops </td> <td> Evaluate adding Microsoft Defender for Cloud Apps telemetry or equivalent cloud-native detection to address persistent gap in cloud/SaaS threat visibility. </td> </tr> <tr> <td> MEDIUM </td> <td> CISO </td> <td> Initiate tabletop exercise simulating a combined MDM compromise (Ivanti EPMM) and Linux persistence scenario — test whether current IR procedures can detect and contain both simultaneously. </td> </tr> <tr> <td> MEDIUM </td> <td> IT Ops </td> <td> Review all SolarWinds Serv-U legacy deployments — while no new vulnerability was disclosed this cycle, the platform remains in the technology stack and has a history of exploitation. </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> The following indicators should be added to network detection and blocking platforms immediately: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Attribution </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 37.120.247[.]182 </td> <td> GoblinRAT (Unattributed) </td> <td> C2 server, port 443 </td> </tr> <tr> <td> IPv4 </td> <td> 5.63.154[.]23 </td> <td> GoblinRAT (Unattributed) </td> <td> Resolved from C2 domain </td> </tr> <tr> <td> Domain </td> <td> qfilling[.]instanthq[.]com </td> <td> GoblinRAT (Unattributed) </td> <td> C2, port 443 </td> </tr> <tr> <td> Domain </td> <td> chronyd[.]tftpd[.]net </td> <td> GoblinRAT (Unattributed) </td> <td> C2 </td> </tr> <tr> <td> Domain </td> <td> test[.]pink-apple[.]ru </td> <td> GoblinRAT (Unattributed) </td> <td> PassiveDNS association </td> </tr> <tr> <td> Domain </td> <td> verceljs-kappa.vercel[.]app </td> <td> FAMOUS CHOLLIMA (DPRK) </td> <td> Active C2, espionage </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> Bottom Line </h2> The threat landscape facing state government IT this week is defined by a dangerous convergence: critical vulnerabilities in the platforms we use to manage devices (Ivanti EPMM), sophisticated implants hiding inside the tools we use to monitor our own infrastructure (GoblinRAT), and a steady drumbeat of ICS advisories affecting the physical systems our agencies oversee. The adversary's playbook is clear — target trust. Trust in your MDM platform. Trust in your monitoring tools. Trust in your network edge appliances. Each of these trust relationships is under active assault. The 24-hour actions in this report are not optional. Verify your Ivanti EPMM exposure. Hunt your Linux monitoring servers. Validate your Cisco edge configurations. The actors behind these campaigns have demonstrated patience measured in years. Our response window is measured in days. Anomali CTI Desk | 2026-06-10 For questions or additional IOC feeds, contact your Anomali account team.

FEATURED RESOURCES

June 10, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Sustained Pre-Positioning Phase: What CISOs Must Know Now

June 10, 2026

Anomali Cyber Watch

Public Sector

Stealthy Linux Backdoors, Critical MDM Exploits, and ICS Vulnerabilities Converge on Government Networks

June 9, 2026

Anomali Cyber Watch

Iran's Cyber Apparatus Shifts to Active Preparation: What CISOs Must Know Now

Explore All