The 72-Hour Window: Critical Supply Chain and Edge Device Threats Demand Immediate State Government Action

Public Sector

Published on

March 31, 2026

Table of Contents

Threat Assessment Level: HIGH Changed from ELEVATED-HIGH (March 30). Justification: The Axios npm supply chain compromise — affecting ~80% of cloud environments with 100 million weekly downloads — represents a new, high-severity initial access vector that compounds the already-active exploitation of CVE-2025-53521 (F5 BIG-IP) and CVE-2026-3055 (Citrix NetScaler). The emergence of AI-powered credential theft malware (DeepLoad) adds a third concurrent attack surface. Three simultaneous, actively exploited threat vectors targeting infrastructure common in state government environments warrants escalation to HIGH. <h2>Executive Summary</h2> State government IT leaders face a convergence of three actively exploited threat vectors this week that demand coordinated, urgent response. A supply chain compromise in one of the most widely used JavaScript libraries in the world — Axios — was discovered hours ago and may already be executing in state DevOps pipelines. Simultaneously, critical vulnerabilities in F5 BIG-IP and Citrix NetScaler appliances are being weaponized in the wild, and a new AI-obfuscated credential stealer called DeepLoad is bypassing traditional endpoint detection. Meanwhile, Iranian state actors continue retaliatory cyber operations against U.S. government targets, and the Tycoon2FA phishing platform has fully reconstituted after its March 4 takedown. This is not a theoretical risk landscape. These are active campaigns hitting government infrastructure now. <h2>What Changed in the Last 24 Hours</h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> Axios npm library trojanized (v1.14.1, v0.30.4) — RAT deployed via malicious dependency </td> <td> Axios is embedded in virtually every Node.js application. State web portals, citizen-facing apps, and internal DevOps pipelines likely consume it. If any build ran npm install in the last 48 hours, it may be compromised. </td> </tr> <tr> <td> F5 BIG-IP CVE-2025-53521 reclassified from DoS to RCE (CVSS 9.8) — webshells actively deployed </td> <td> F5 BIG-IP is a core load balancer and application delivery controller in state data centers. Attackers are disabling SELinux and deploying webshells through the iControl REST API. CISA's KEV deadline was March 30 — any unpatched device should be assumed compromised. </td> </tr> <tr> <td> Citrix NetScaler CVE-2026-3055 (CVSS 9.3) — public PoC available since March 24; ransomware weaponization window closing </td> <td> Citrix NetScaler is the primary remote access gateway for many state agencies. Ransomware groups Qilin, Play, and Akira have historically weaponized Citrix vulnerabilities within 7–14 days of PoC release. That window is nearly closed. </td> </tr> <tr> <td> Iranian retaliatory operations escalating — Handala/Void Manticore breached FBI Director's personal email (March 27) following DOJ infrastructure seizure (March 19) </td> <td> State agencies — particularly law enforcement, courts, and elections — are within the targeting aperture of Iranian retaliatory operations. Individual government officials are being targeted by name, not just government systems. </td> </tr> <tr> <td> TeamPCP supply chain campaign expands to ninth ecosystem (Telnyx Python SDK); 1,900+ compromised packages total </td> <td> Both npm and PyPI are actively hostile environments. State DevOps teams pulling open-source dependencies without integrity verification face compounding supply chain risk alongside the Axios compromise. </td> </tr> <tr> <td> DeepLoad malware discovered — AI-generated obfuscation + WMI persistence </td> <td> Uses ClickFix social engineering (fake browser/software update prompts) to deliver credential-stealing malware that persists through WMI event subscriptions, surviving standard remediation playbooks. </td> </tr> <tr> <td> NCSC (UK) issues emergency F5 patching guidance (March 31) </td> <td> International validation of the severity — this is not a U.S.-only concern. Exploitation is global and accelerating. </td> </tr> <tr> <td> Tycoon2FA phishing platform fully operational (continued from March 30) </td> <td> The adversary-in-the-middle phishing kit that bypasses MFA is back online after its March 4 takedown, targeting Microsoft 365 and Entra ID — the identity backbone of most state governments. </td> </tr> </tbody> </table> <h2>Threat Timeline: March 2026</h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Severity </th> </tr> </thead> <tbody> <tr> <td> March 4 </td> <td> Tycoon2FA adversary-in-the-middle phishing platform taken down by law enforcement </td> <td> — </td> </tr> <tr> <td> March 19 </td> <td> DOJ seizes Iranian cyber infrastructure </td> <td> HIGH </td> </tr> <tr> <td> March 24 </td> <td> CVE-2026-3055 (Citrix NetScaler, CVSS 9.3) — public proof-of-concept code released </td> <td> CRITICAL </td> </tr> <tr> <td> March 27 </td> <td> Iranian actor Handala/Void Manticore (IRGC-affiliated) breaches FBI Director's personal email in retaliation for March 19 seizure </td> <td> HIGH </td> </tr> <tr> <td> March 28 </td> <td> CISA adds CVE-2025-53521 (F5 BIG-IP, CVSS 9.8) to Known Exploited Vulnerabilities catalog; KEV deadline set for March 30 </td> <td> CRITICAL </td> </tr> <tr> <td> March 28 </td> <td> TeamPCP supply chain campaign expands to ninth ecosystem (Telnyx Python SDK); 1,900+ compromised packages total </td> <td> HIGH </td> </tr> <tr> <td> March 30 </td> <td> F5 reclassifies CVE-2025-53521 from denial-of-service to remote code execution; active webshell deployment confirmed </td> <td> CRITICAL </td> </tr> <tr> <td> March 30 </td> <td> DeepLoad malware discovered — AI-obfuscated credential stealer with WMI persistence </td> <td> HIGH </td> </tr> <tr> <td> March 30 </td> <td> Tycoon2FA phishing platform confirmed fully reconstituted </td> <td> HIGH </td> </tr> <tr> <td> March 31 </td> <td> Axios npm supply chain compromise discovered — trojanized versions v1.14.1 and v0.30.4 deploying cross-platform RATs </td> <td> CRITICAL </td> </tr> <tr> <td> March 31 </td> <td> NCSC (UK) issues emergency F5 BIG-IP patching guidance </td> <td> HIGH </td> </tr> </tbody> </table> <h2>Key Threat Analysis                </h2> <h3>1. Axios Supply Chain Compromise — The Blast Radius Problem</h3> An unknown threat actor compromised the npm account of an Axios maintainer and published two malicious package versions introducing a trojanized dependency. Axios is downloaded approximately 100 million times per week and is present in roughly 80% of cloud environments. Wiz confirmed execution in 3% of affected environments before the malicious versions were removed. What happens on infection: A dropper script fetches platform-specific remote access trojans (RATs) from a command-and-control server. On Windows, it establishes persistence via a registry run key disguised as "MicrosoftUpdate." On macOS, it masquerades as an Apple system process. On Linux, it deploys a Python-based implant. All variants beacon to the C2 server every 60 seconds. State government exposure: Any agency running Node.js applications — citizen portals, internal tools, API gateways, CI/CD pipelines — that pulled Axios dependencies in the last 48 hours is potentially affected. The shared-services model means a single compromised build pipeline could cascade across multiple agencies. Key ATT&CK techniques: T1195.002 (Supply Chain Compromise), T1059.001 (PowerShell), T1547.001 (Registry Run Keys), T1071.001 (Web Protocols for C2) <h3>2. F5 BIG-IP APM CVE-2025-53521 — From DoS to Full RCE</h3> What was initially classified as a denial-of-service vulnerability has been reclassified as critical remote code execution (CVSS 9.8). Attackers are exploiting the iControl REST API to execute arbitrary commands, disable SELinux, and deploy webshells for persistent access. The CISA KEV compliance deadline was March 30 — any unpatched F5 BIG-IP device should now be treated as potentially compromised, not merely vulnerable. Key ATT&CK techniques: T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1562.001 (Disable or Modify Tools) <h3>3. Citrix NetScaler CVE-2026-3055 — Ransomware Weaponization Imminent</h3> With a CVSS score of 9.3 and public proof-of-concept code available since March 24, this vulnerability is on a well-established trajectory toward ransomware weaponization. Citrix NetScaler is the primary remote access gateway for many state agencies. Ransomware groups including Qilin, Play, and Akira — all of which actively target government — have historically weaponized Citrix vulnerabilities within 7–14 days of PoC availability. That window is closing. <h3>4. Iranian Retaliatory Operations — Escalation Trajectory</h3> Two Iranian state-sponsored groups are conducting active operations against U.S. government targets: <ul> <li>Handala/Void Manticore (IRGC-affiliated): Conducted a retaliatory breach of the FBI Director's personal email on March 27, publishing personal data and photographs. This followed the DOJ's March 19 seizure of Iranian cyber infrastructure. This group conducts destructive and doxing operations and has demonstrated willingness to target individual government officials.</li> <li>MuddyWater (MOIS): Continues espionage operations targeting government networks, with a focus on credential harvesting and lateral movement.</li> </ul> State government agencies — particularly those involved in law enforcement, courts, and elections — should consider themselves within the targeting aperture of Iranian retaliatory operations, especially given CISA's current reactive-only operational posture. <h3>5. Credential Theft Ecosystem — Tycoon2FA and DeepLoad</h3> The Tycoon2FA adversary-in-the-middle phishing platform has fully reconstituted after its March 4 takedown. This kit specifically targets Microsoft 365 and Entra ID authentication flows, intercepting session tokens to bypass MFA. For state governments running Microsoft 365 as their collaboration backbone, this is a direct threat to identity infrastructure. DeepLoad adds a new dimension: AI-generated code obfuscation that evades signature-based detection, combined with WMI event subscription persistence (T1546.003) that survives standard endpoint remediation. Delivered via ClickFix social engineering — fake browser update prompts — it targets credentials and session tokens. <h3>6. Supply Chain Cascade — TeamPCP Continues Expanding</h3> The TeamPCP campaign has now compromised over 1,900 packages across nine ecosystems, most recently the Telnyx Python SDK. This is a separate campaign from the Axios compromise — different actors, different infrastructure, different techniques — but the combined effect is that both npm and PyPI are actively hostile environments for state DevOps teams pulling open-source dependencies without integrity verification. <h2>Predictive Analysis                      </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Ransomware group weaponizes CVE-2026-3055 (Citrix NetScaler) for initial access </td> <td> 85% </td> <td> 7–14 days </td> <td> Public PoC available since March 24; historical pattern of Citrix vulns weaponized by Qilin/Play/Akira within 2 weeks </td> </tr> <tr> <td> Axios supply chain compromise leads to confirmed state government intrusion </td> <td> 60% </td> <td> 7 days </td> <td> 80% cloud environment prevalence; 3% confirmed execution rate; state agencies run Node.js applications </td> </tr> <tr> <td> Iranian retaliatory operation targets a U.S. state or local government entity </td> <td> 50% </td> <td> 30 days </td> <td> Escalation trajectory following DOJ seizure → FBI Director breach; state agencies are softer targets than federal </td> </tr> <tr> <td> Tycoon2FA campaign successfully compromises state M365 tenant via session token theft </td> <td> 70% </td> <td> 14 days </td> <td> Platform fully operational; M365 is universal in state government; MFA bypass makes conditional access policies insufficient alone </td> </tr> <tr> <td> Unpatched F5 BIG-IP devices used as pivot points in ransomware attacks on state networks </td> <td> 75% </td> <td> 7 days </td> <td> Active webshell deployment confirmed; KEV deadline passed; ransomware operators routinely leverage edge device footholds </td> </tr> <tr> <td> DeepLoad or similar AI-obfuscated malware evades state EDR deployments </td> <td> 55% </td> <td> 30 days </td> <td> AI-generated polymorphic code is a new evasion class; WMI persistence is under-monitored in many state environments </td> </tr> </tbody> </table> <h2>SOC Operational Guidance</h2> <h3>Hunt Immediately</h3> Axios Supply Chain (CLU-035) <ul> <li>Hypothesis: State CI/CD pipelines or developer workstations pulled trojanized Axios versions in the last 48 hours, and RAT beacons are active.</li> <li>Detection: Search for DNS queries or HTTP connections to sfrclak[.]com and 142.11.206[.]73 on port 8000. Search for process creation of com.apple.act.mond (macOS), registry key creation under HKCU\Software\Microsoft\Windows\CurrentVersion\Run with value "MicrosoftUpdate" (Windows), or Python process ld.py (Linux). Query npm cache/lock files for axios@1.14.1, axios@0.30.4, or plain-crypto-js@4.2.1.</li> <li>ATT&CK: T1195.002, T1547.001, T1071.001</li> </ul> F5 BIG-IP Webshell Deployment <ul> <li>Hypothesis: Unpatched F5 BIG-IP devices have been compromised via iControl REST API and webshells are present.</li> <li>Detection: Search F5 logs for ForwarderPassThroughWorker entries with user: local/f5hubblelcdadmin, method: POST, and uri: http://localhost:8100/mgmt/tm/util/bash. Alert on avc: received setenforce notice (enforcing=0) indicating SELinux has been disabled. Audit all files in web-accessible directories on BIG-IP devices for unauthorized additions.</li> <li>ATT&CK: T1190, T1505.003, T1562.001</li> </ul> Tycoon2FA / AiTM Phishing <ul> <li>Hypothesis: State employees have received phishing emails directing them to adversary-in-the-middle proxies mimicking Microsoft 365 login pages, and session tokens have been stolen.</li> <li>Detection: Monitor Entra ID sign-in logs for impossible travel, anomalous token replay (same session token from different IPs), and sign-ins from known AiTM infrastructure. Review mail flow rules for newly created forwarding rules (T1114.003). Hunt for OAuth app consent grants from unfamiliar applications.</li> <li>ATT&CK: T1556.006 (MFA Bypass via AiTM), T1539 (Steal Web Session Cookie), T1114.003 (Email Forwarding Rule)</li> </ul> DeepLoad / ClickFix Social Engineering <ul> <li>Hypothesis: State employees have encountered fake browser update prompts and executed malicious scripts, establishing WMI persistence.</li> <li>Detection: Query for WMI event subscriptions (__EventFilter, __EventConsumer, __FilterToConsumerBinding) created in the last 7 days. Hunt for mshta.exe execution with network connections (T1218.005). Monitor for wt.exe or LockAppHost.exe in unexpected directories.</li> <li>ATT&CK: T1204.001 (User Execution), T1546.003 (WMI Event Subscription), T1218.005 (Mshta)</li> </ul> <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services (State Treasury, Revenue, Tax Systems)</h3> <ul> <li>Priority threat: Tycoon2FA credential theft targeting M365 accounts with access to financial systems and taxpayer PII. Ransomware groups (Qilin, Akira) specifically target organizations holding financial records.</li> <li>Action: Enforce phishing-resistant MFA (FIDO2/hardware keys) for all accounts with access to treasury, tax, and revenue systems. Implement conditional access policies requiring compliant devices and blocking legacy authentication protocols. Audit Entra ID for stale service principals with elevated permissions.</li> </ul> <h3>Energy and Utilities (State-Regulated Water, Power, Transportation SCADA)</h3> <ul> <li>Priority threat: Edge device exploitation (F5 BIG-IP, Citrix NetScaler) as pivot points into OT/SCADA networks. MuddyWater (MOIS) has historically targeted critical infrastructure for espionage and pre-positioning.</li> <li>Action: Verify network segmentation between IT and OT environments — specifically confirm that F5/Citrix management interfaces are not reachable from OT VLANs. Patch or isolate all F5 BIG-IP devices immediately. Audit remote access pathways into SCADA environments and disable any that use compromised VPN gateways.</li> </ul> <h3>Healthcare (State Health Departments, Medicaid Systems, Public Hospitals)</h3> <ul> <li>Priority threat: Ransomware targeting healthcare data repositories. The Marquis Health Services breach (affecting 672,000+ individuals via Akira ransomware) demonstrates the sector's continued targeting. ClickFix/DeepLoad social engineering targets healthcare workers accustomed to frequent software updates.</li> <li>Action: Ensure offline backups of Medicaid enrollment databases and electronic health records are current and tested. Brief clinical and administrative staff on ClickFix social engineering tactics — fake browser update prompts are the primary delivery mechanism. Verify that WMI event subscription monitoring is enabled on endpoints in healthcare environments.</li> </ul> <h3>Government (Executive Agencies, Courts, Law Enforcement, Elections)</h3> <ul> <li>Priority threat: Iranian retaliatory operations (Handala/Void Manticore, IRGC-affiliated) targeting government officials and systems. Supply chain compromise (Axios, TeamPCP) affecting government web applications and internal tools. Credential theft campaigns targeting the M365/Entra ID identity backbone.</li> <li>Action: Brief agency heads and elected officials on the Iranian targeting of individual government officials — personal email accounts are being targeted, not just government systems. Audit all Node.js applications across agencies for Axios dependency versions. Implement emergency conditional access policies in Entra ID requiring token binding and blocking sessions from anonymizing infrastructure.</li> </ul> <h3>Aviation and Logistics (State DOT, Airport Authorities, Port Systems)</h3> <ul> <li>Priority threat: Cisco SD-WAN vulnerabilities (referenced in CISA KEV alerts) affecting inter-agency and transportation network connectivity. Supply chain compromise affecting logistics management applications built on Node.js.</li> <li>Action: Audit Cisco SD-WAN deployments for KEV-listed vulnerabilities and apply patches. Review all third-party logistics and fleet management applications for Axios dependency exposure. Ensure transportation management systems have network segmentation from general enterprise IT.</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>IMMEDIATE (Within 24 Hours)</h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IMMEDIATE </td> <td> DevOps </td> <td> Audit all Node.js projects for axios@1.14.1, axios@0.30.4, and plain-crypto-js@4.2.1. Pin Axios to verified safe version (1.14.0 or earlier). Scan build artifacts and running containers for IOCs listed above. Kill any process communicating with sfrclak[.]com or 142.11.206[.]73. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Patch all F5 BIG-IP devices to remediated firmware. If patching is not possible within 24 hours, isolate the device from the network and restrict iControl REST API access to management-only VLANs. Forensically examine any unpatched device for webshells. </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Deploy blocking rules for all IOCs in the table above across DNS, proxy, firewall, and EDR platforms. Begin hunting for Axios C2 beacons, F5 webshells, and WMI persistence artifacts using the hypotheses provided. </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Review Entra ID sign-in logs for the last 14 days for indicators of AiTM session token theft: impossible travel, token replay from new IPs, and anomalous OAuth consent grants. </td> </tr> <tr> <td> IMMEDIATE </td> <td> CISO </td> <td> Issue an agency-wide advisory on ClickFix social engineering — instruct all employees that legitimate browser updates never require copying and pasting commands into a terminal or Run dialog. </td> </tr> </tbody> </table> <h3>7-DAY</h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 7-DAY </td> <td> IT Ops </td> <td> Patch all Citrix NetScaler devices for CVE-2026-3055. If patching is delayed, implement WAF rules to block known PoC exploitation patterns and restrict management interface access. </td> </tr> <tr> <td> 7-DAY </td> <td> DevOps </td> <td> Implement npm/PyPI package integrity verification in all CI/CD pipelines: pin dependencies to exact versions with hash verification, enable npm audit as a blocking gate, and configure Dependabot or Renovate for automated vulnerability scanning. </td> </tr> <tr> <td> 7-DAY </td> <td> Identity/IAM </td> <td> Deploy phishing-resistant MFA (FIDO2 security keys or Windows Hello for Business) for all privileged accounts, starting with domain admins, M365 global admins, and accounts with access to financial/PII systems. </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Implement WMI event subscription monitoring across all Windows endpoints. Create detection rules for new __EventFilter and __EventConsumer objects. This addresses the DeepLoad persistence mechanism that survives standard remediation. </td> </tr> <tr> <td> 7-DAY </td> <td> IT Ops </td> <td> Audit Ivanti EPMM deployments for CVE-2025-4427 and CVE-2025-4428 (chained authentication bypass + RCE). CISA has confirmed widespread exploitation against government targets. </td> </tr> </tbody> </table> <h3>30-DAY</h3> <table> <thead> <tr> <th> Priority </th> <th> Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Commission a supply chain security assessment of all open-source dependencies consumed by state applications. Establish a software bill of materials (SBOM) requirement for all new procurements and major application updates. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Review and update the state's incident response plan to include supply chain compromise scenarios (Axios-type) and edge device mass exploitation scenarios (F5/Citrix-type). Conduct a tabletop exercise with agency IT leads. </td> </tr> <tr> <td> 30-DAY </td> <td> Identity/IAM </td> <td> Implement continuous access evaluation (CAE) and token binding in Entra ID to mitigate AiTM session token theft. Evaluate deploying conditional access policies that require device compliance and block sessions from non-managed devices for sensitive applications. </td> </tr> <tr> <td> 30-DAY </td> <td> IT Ops </td> <td> Establish a hardened, isolated management network for all edge devices (F5, Citrix, Fortinet, Ivanti). Management interfaces must not be accessible from the general enterprise network or the internet. </td> </tr> <tr> <td> 30-DAY </td> <td> Executive </td> <td> Brief the Governor's office and legislative leadership on the current threat environment, the Iranian retaliatory targeting of government officials, and the resource requirements for maintaining defensive posture. CISA's reduced operational capacity increases the burden on state-level cybersecurity teams. </td> </tr> </tbody> </table> <h2>Bottom Line                                 </h2> The threat environment facing state government IT infrastructure is not abstract — it is active, concurrent, and accelerating. Three critical attack vectors are being exploited simultaneously: a supply chain compromise in one of the world's most widely used software libraries, remote code execution in edge devices that form the perimeter of state networks, and credential theft platforms specifically designed to defeat the MFA protections most state agencies rely on. The Axios compromise discovered hours ago is particularly urgent because it exploits the trust model that underpins modern software development. Every hour that passes without auditing your Node.js dependencies is an hour that a RAT may be beaconing from inside your network. The F5 and Citrix vulnerabilities are urgent because they are your front door. Ransomware operators are watching the same advisories you are, and they move faster than patch cycles. The Iranian retaliatory operations are urgent because they have already reached the level of targeting individual U.S. government officials by name, and state agencies — with fewer defensive resources than federal counterparts — represent attractive secondary targets. Act today. Audit your Axios dependencies. Patch or isolate your F5 and Citrix devices. Hunt for AiTM session theft in your Entra ID logs. Brief your people on ClickFix. The 72-hour window between vulnerability disclosure and ransomware weaponization is not a planning horizon — it is a countdown.

FEATURED RESOURCES

March 31, 2026

Anomali Cyber Watch

Iran Cyber War, Day 32: FBI Director Breached, Critical Infrastructure Under Siege, and the Silence That Should Worry You Most

March 31, 2026

Public Sector

Anomali Cyber Watch

The 72-Hour Window: Critical Supply Chain and Edge Device Threats Demand Immediate State Government Action

March 30, 2026

Anomali Cyber Watch

When Ceasefires Don’t Apply to Cyberspace: 30 Days Into the Iran Cyber War, the Threat Has Never Been Higher

Explore All