The Federal Safety Net Is Fraying: What State CISOs Must Do Now to Defend Against Converging Threats

Public Sector

Published on

March 18, 2026

Table of Contents

State government IT leaders face a threat environment unlike anything in recent memory. In the span of a single week, the federal cybersecurity apparatus that states have relied upon for a decade suffered its deepest structural cuts yet, six industrial control system advisories landed affecting equipment in state buildings and water systems, and a social engineering technique called "ClickFix" exploded across multiple ransomware and espionage campaigns — with government employees squarely in the crosshairs. This is not a drill. The convergence of degraded federal support, active nation-state operations, and a rapidly expanding OT attack surface demands that state CIOs and CISOs take immediate, concrete action. This brief lays out what changed, what it means, and exactly what to do about it. <h2> What Changed This Week </h2> The week of March 10–17, 2026 delivered four developments that individually would warrant attention. Together, they represent a structural shift in the threat landscape for state government. <h3> 1. CISA's election security and cyber defense programs have been hollowed out.  </h3> The New York Times and multiple outlets reported on March 17 that staffing overhauls have gutted the programs states relied upon to safeguard voting systems and receive federal cyber support. Key departures include the leader of federal cyber defense programs. CIRCIA incident reporting town halls have been delayed. The 2015 Cybersecurity Information Sharing Act — the legal backbone for threat intelligence sharing between the private sector and government — lapsed during the October 2025 government shutdown and has not been renewed. <h3> 2. Six ICS/OT advisories in one week target equipment deployed in state facilities.  </h3> CISA published advisories affecting Schneider Electric EcoStruxure Data Center Expert (hard-coded credentials in data center monitoring), Schneider SCADAPack x70 RTUs (water/wastewater SCADA), Trane Tracer building management systems (arbitrary command execution in state buildings), Siemens SICAM and SIMATIC S7-1500 controllers, and CODESYS in Festo automation products. This is an unusually high volume of advisories affecting products commonly found in state government environments. <h3> 3. ClickFix social engineering has been adopted by at least five unrelated threat groups in two weeks.  </h3> This technique tricks users into manually executing malicious commands by presenting fake error messages or verification prompts — completely bypassing email security controls. It has now been weaponized by the Termite ransomware group (via CastleRAT), the newly reported LeakNet ransomware gang (via Deno-based in-memory loaders), macOS infostealer operators (MacSync), DNS-based delivery operators, and unknown actors who compromised over 250 WordPress sites including a U.S. Senate candidate's official webpage. <h3> 4. Nation-state actors — Russia, China, and Iran — are all running active operations against U.S. government targets.  </h3> APT28/Fancy Bear government-targeting IOCs were refreshed on March 17. Chinese actors Volt Typhoon and Salt Typhoon are actively mapping industrial control loops and breaching U.S. telecommunications infrastructure respectively. Iranian threat actors, operating at elevated tempo since the start of the Iran conflict on February 28, are conducting both destructive wiper operations (Handala/Void Manticore, IRGC-affiliated) and espionage campaigns (MuddyWater, MOIS) against U.S. entities. <h2> Threat Timeline: Key Events (March 2–17, 2026) </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Impact to State Government </th> </tr> </thead> <tbody> <tr> <td> Mar 2 </td> <td> CISA cyber defense program leader resigns </td> <td> Loss of key federal cyber support leadership </td> </tr> <tr> <td> Mar 6 </td> <td> Cisco confirms two additional SD-WAN vulnerabilities under active exploitation (CVE-2026-20122, CVE-2026-20128) </td> <td> Direct risk to state WAN infrastructure </td> </tr> <tr> <td> Mar 7 </td> <td> Termite ransomware (Velvet Tempest) adopts ClickFix + CastleRAT </td> <td> New ransomware delivery vector targeting government </td> </tr> <tr> <td> Mar 9 </td> <td> Microsoft warns ClickFix now targeting Windows Terminal </td> <td> Technique evolution — harder to detect </td> </tr> <tr> <td> Mar 9 </td> <td> CIRCIA incident reporting town halls delayed </td> <td> Reduced federal incident coordination </td> </tr> <tr> <td> Mar 10 </td> <td> CISA adds Ivanti EPM flaw to KEV catalog </td> <td> Risk to state endpoint management platforms </td> </tr> <tr> <td> Mar 10 </td> <td> Salt Typhoon telecom breach confirmed </td> <td> Chinese espionage targeting U.S. communications infrastructure </td> </tr> <tr> <td> Mar 11 </td> <td> 250+ WordPress sites compromised with ClickFix lures </td> <td> Government-adjacent sites weaponized </td> </tr> <tr> <td> Mar 12 </td> <td> CISA issues Emergency Directive ED 26-03 for Cisco SD-WAN </td> <td> Mandatory action for federal; strongly recommended for state </td> </tr> <tr> <td> Mar 12 </td> <td> Microsoft publishes Storm-2561 VPN poisoning TTPs </td> <td> Fake VPN installers mimicking Fortinet, Cisco, Ivanti brands </td> </tr> <tr> <td> Mar 12 </td> <td> Trane Tracer BMS advisory published (ICSA-26-071-01) </td> <td> Arbitrary command execution in state building systems </td> </tr> <tr> <td> Mar 15 </td> <td> Google emergency patches Chrome 146 for two zero-days </td> <td> Active exploitation of state employee browsers </td> </tr> <tr> <td> Mar 16 </td> <td> CVE-2025-47813 (Wing FTP Server) added to CISA KEV </td> <td> Path disclosure chainable to RCE; patch deadline Mar 30 </td> </tr> <tr> <td> Mar 17 </td> <td> CISA publishes 4 ICS advisories (Schneider, Siemens, CODESYS) </td> <td> Hard-coded credentials in data center equipment </td> </tr> <tr> <td> Mar 17 </td> <td> NYT reports CISA election security programs gutted </td> <td> Structural loss of federal cyber support for states </td> </tr> <tr> <td> Mar 17 </td> <td> LeakNet ransomware adopts ClickFix + Deno in-memory loader </td> <td> Fifth threat group adopting ClickFix in two weeks </td> </tr> <tr> <td> Mar 17 </td> <td> APT28/Fancy Bear government-targeting IOCs refreshed </td> <td> Russian military intelligence maintains active government targeting posture </td> </tr> </tbody> </table> <h2> Threat Analysis: Four Converging Risks </h2> <h3> 1. The CISA Gap: States Are Increasingly On Their Own </h3> The degradation of CISA is not a temporary disruption — it is a structural change in the federal-state cybersecurity relationship. States that previously relied on CISA for threat intelligence sharing, incident response surge capacity, vulnerability scanning, and election security support must now develop or procure these capabilities independently. The practical impacts are already visible: <ul> <li> Threat sharing is degraded. The lapse of the 2015 Cybersecurity Information Sharing Act removes the legal framework that enabled private-sector threat data to flow to government defenders. </li> <li> Incident response capacity is reduced. When the next major state government breach occurs, federal surge support may not arrive at the speed or scale states have come to expect. </li> <li> Election security support is gutted. With 2026 midterms approaching, states must self-fund the election infrastructure security work CISA previously provided. </li> </ul> What this means for budget planning: FY2027 cybersecurity budgets should account for capabilities the state previously received from CISA at no cost. This includes threat intelligence feeds, vulnerability scanning services, incident response retainers, and election security assessments. <h3> 2. Nation-State Actors: Russia, China, and Iran Are All Active </h3> Multiple nation-state threat groups are conducting operations relevant to state government networks: <ul> <li> APT28 / Fancy Bear (Russia, GRU): Government-targeting indicators for X-Agent malware (HeaderDropper variant) were refreshed on March 17 at very-high severity. APT28 has a long history of targeting U.S. government entities at all levels. Active IOCs are listed in the SOC Guidance section below. </li> <li> Volt Typhoon / SYLVANITE (China, MSS): Dragos reported in February that SYLVANITE — linked to Volt Typhoon — is actively "mapping control loops across industrial infrastructure." While no direct state government compromise has been publicly reported, the absence of visible activity likely indicates pre-positioning rather than inactivity. Volt Typhoon's known playbook involves living-off-the-land techniques that are extremely difficult to detect. </li> <li> Salt Typhoon (China): Confirmed breach of major U.S. telecommunications providers (March 10), with implications for the confidentiality of state government communications traversing compromised carrier networks. </li> <li> Handala / Void Manticore (Iran, IRGC): Conducting destructive wiper operations against U.S. entities amid the ongoing Iran conflict (Operation Epic Fury / Roaring Lion, which began February 28). The Stryker wiper attack demonstrated willingness to target U.S. organizations. </li> <li> MuddyWater (Iran, MOIS): Deploying the Dindoor backdoor against U.S. banks, airports, and non-profits — espionage operations running in parallel with Handala's destructive campaigns. MuddyWater operates under Iran's Ministry of Intelligence and Security (MOIS), distinct from the IRGC-affiliated actors conducting wiper operations. </li> <li> Storm-2561: Microsoft published a detailed analysis on March 12 of this group's SEO poisoning campaign that delivers trojanized VPN installers mimicking Fortinet, Cisco, and Ivanti branding — all vendors commonly used in state government environments. </li> </ul> <h3> 3. OT/ICS: The Physical-Consequence Attack Surface Is Expanding </h3> The batch of six ICS advisories published between March 12–17 is not routine. The affected products — Schneider Electric EcoStruxure, SCADAPack RTUs, Trane Tracer BMS, Siemens SICAM and SIMATIC controllers — are commonly deployed in state government environments for data center monitoring, water/wastewater treatment, building management, and transportation SCADA. The most concerning findings: <ul> <li> Schneider Electric EcoStruxure Data Center Expert contains hard-coded credentials. This product monitors environmental conditions and power management in data centers. Hard-coded credentials provide trivial initial access if the system is network-accessible. </li> <li> Trane Tracer SC/SC+/Concierge allows arbitrary command execution. These building management systems control HVAC, lighting, and access systems in state government facilities. Arbitrary command execution could enable an attacker to manipulate physical building systems. </li> <li> Schneider SCADAPack x70 RTUs are used in water and wastewater SCADA environments. Combined with the Dragos finding that state-affiliated hackers are actively mapping control loops in industrial environments, this vulnerability represents a direct physical-consequence risk. </li> </ul> <h3> 4. ClickFix: A Social Engineering Technique That Bypasses Your Email Security </h3> ClickFix deserves special attention because it represents a fundamental shift in social engineering tactics. Unlike traditional phishing — which delivers a malicious attachment or link via email — ClickFix tricks users into manually copying and executing malicious commands by presenting fake error messages, browser verification prompts, or IT support dialogs on compromised websites. Why this matters for state government: <ul> <li> It bypasses email security entirely because the malicious payload is never delivered via email </li> <li> State employees frequently encounter legitimate IT verification prompts and self-service portals, making them susceptible to mimicry </li> <li> The technique has been adopted by at least five unrelated threat groups in two weeks: Termite ransomware (CastleRAT), LeakNet ransomware (Deno loader), MacSync infostealer operators, DNS-based delivery operators, and unknown actors via 250+ compromised WordPress sites </li> <li> A DNS-based variant uses nslookup to retrieve PowerShell payloads — the first known use of DNS as a ClickFix delivery channel </li> </ul> The cross-pollination speed is alarming. When a technique spreads this rapidly across unrelated groups, it signals that the method is effective and difficult to defend against with existing controls. <h2> Predictive Analysis: What Comes Next </h2> Based on current threat trajectories, actor operational tempo, and the convergence of enabling conditions: <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> ClickFix campaigns specifically targeting .gov or government-adjacent websites </td> <td> 70% </td> <td> 7 days </td> <td> Technique proliferation rate, government already in target set, 250+ sites already compromised </td> </tr> <tr> <td> Iran-linked actors (Handala/Void Manticore or MuddyWater) claim another U.S. target </td> <td> 65% </td> <td> 7 days </td> <td> Escalating conflict since Feb 28, demonstrated operational tempo, dual IRGC and MOIS campaigns active </td> </tr> <tr> <td> Additional CISA KEV entries for ICS/OT vulnerabilities with compressed remediation timelines </td> <td> 50% </td> <td> 14 days </td> <td> Anomalous advisory volume this week, Dragos OT threat reporting </td> </tr> <tr> <td> Ransomware group successfully encrypts a state or local government network </td> <td> 50% </td> <td> 30 days </td> <td> 49% YoY increase in ransomware, 130+ active groups, ClickFix as new initial access vector </td> </tr> <tr> <td> Chinese APT pre-positioning in state OT infrastructure discovered </td> <td> 35% </td> <td> 90 days </td> <td> Dragos SYLVANITE/Volt Typhoon reporting, "mapping control loops" activity, historical pattern of delayed discovery </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Hunting Hypotheses </h3> <table> <thead> <tr> <th> # </th> <th> Hypothesis </th> <th> ATT&CK Technique </th> <th> Detection Approach </th> </tr> </thead> <tbody> <tr> <td> H1 </td> <td> ClickFix has delivered payloads to state endpoints via compromised websites </td> <td> T1204.002 (User Execution: Malicious File), T1059.001 (PowerShell) </td> <td> Hunt for powershell.exe or cmd.exe spawned by browser processes (chrome.exe, msedge.exe). Look for clipboard paste events followed by command execution. </td> </tr> <tr> <td> H2 </td> <td> Storm-2561 trojanized VPN installers are present on state endpoints </td> <td> T1036 (Masquerading), T1608.005 (Stage Capabilities: Link Target) </td> <td> Search for VPN installer executables downloaded from non-vendor domains. Audit DNS logs for domains mimicking Fortinet, Cisco, or Ivanti download sites. </td> </tr> <tr> <td> H3 </td> <td> Schneider EcoStruxure DCE hard-coded credentials are being used for unauthorized access </td> <td> T1078 (Valid Accounts), T0859 (Valid Accounts — ICS) </td> <td> Audit authentication logs on EcoStruxure DCE instances for default/hard-coded credential usage. Check for unexpected remote access to data center monitoring systems. </td> </tr> <tr> <td> H4 </td> <td> DNS-based ClickFix variant is using nslookup for payload retrieval </td> <td> T1071.004 (Application Layer Protocol: DNS) </td> <td> Monitor for anomalous nslookup executions from user workstations, especially those followed by PowerShell execution. Baseline normal DNS tool usage. </td> </tr> <tr> <td> H5 </td> <td> Volt Typhoon living-off-the-land activity in OT-adjacent network segments </td> <td> T1059.001 (PowerShell), T1218 (System Binary Proxy Execution) </td> <td> Hunt for unusual use of native Windows tools (wmic, ntdsutil, netsh) on systems with connectivity to OT/SCADA networks. Focus on lateral movement from IT to OT segments. </td> </tr> </tbody> </table> <h3> Key ATT&CK Techniques to Monitor </h3> <table> <thead> <tr> <th> Technique ID </th> <th> Name </th> <th> Relevance </th> </tr> </thead> <tbody> <tr> <td> T1204.002 </td> <td> User Execution: Malicious File </td> <td> ClickFix — user manually executes payload </td> </tr> <tr> <td> T1059.001 </td> <td> PowerShell </td> <td> ClickFix payload execution, Volt Typhoon LOTL </td> </tr> <tr> <td> T1071.004 </td> <td> DNS Application Layer Protocol </td> <td> DNS-based ClickFix variant </td> </tr> <tr> <td> T1190 </td> <td> Exploit Public-Facing Application </td> <td> Cisco SD-WAN, FortiOS, Wing FTP, Ivanti EPM </td> </tr> <tr> <td> T1078 </td> <td> Valid Accounts </td> <td> Schneider hard-coded creds, APT28, Storm-2561 </td> </tr> <tr> <td> T0855 </td> <td> Unauthorized Command Message </td> <td> Trane Tracer BMS arbitrary command execution </td> </tr> <tr> <td> T0831 </td> <td> Manipulation of Control </td> <td> ICS/SCADA impact from OT vulnerabilities </td> </tr> <tr> <td> T1036 </td> <td> Masquerading </td> <td> Storm-2561 fake VPN installers </td> </tr> <tr> <td> T1189 </td> <td> Drive-by Compromise </td> <td> ClickFix via compromised WordPress sites </td> </tr> </tbody> </table> <h3> Defensive Guidance </h3> <ul> <li> Email security alone will not stop ClickFix. Implement browser isolation or endpoint detection rules that alert on command-line interpreters (cmd.exe, powershell.exe, terminal) spawned by browser processes. </li> <li> Segment OT networks aggressively. The combination of hard-coded credentials in Schneider products and active nation-state mapping of control loops means any OT system reachable from the IT network is at elevated risk. </li> <li> Audit VPN installer sources. Storm-2561's SEO poisoning campaign places trojanized VPN installers at the top of search results. Ensure employees download VPN clients only from approved internal sources or verified vendor URLs. </li> <li> Patch Chrome immediately. Two zero-days in Chrome 146 (patched to 146.0.7680.75+) are under active exploitation. This is the single fastest-impact action available. </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Tax Systems) </h3> State financial systems process tax payments, benefits disbursements, and vendor payments for millions of residents. The BridgePay ransomware attack (February 10–16) disrupted payment processing for multiple cities and demonstrates the cascading impact of payment vendor compromise. <ul> <li> Priority: Audit third-party payment processor security posture and contractual incident response requirements </li> <li> Priority: Deploy phishing-resistant MFA (FIDO2) on all financial transaction systems — ClickFix and Storm-2561 both target credentials that enable financial fraud </li> <li> Monitor: MuddyWater (Dindoor backdoor, MOIS-affiliated) is actively targeting U.S. financial institutions </li> </ul> <h3> Energy and Water/Wastewater (State-Managed Utilities and SCADA) </h3> The Schneider SCADAPack x70 RTU advisory and Dragos reporting on SYLVANITE/Volt Typhoon mapping control loops make this the highest-risk sector this week. <ul> <li> Priority: Inventory all SCADAPack x70 and Siemens SIMATIC S7-1500 deployments; apply vendor patches or isolate from network </li> <li> Priority: Validate that OT networks are not reachable from IT networks without passing through a monitored jump host or demilitarized zone </li> <li> Monitor: Any unusual use of native Windows administration tools on systems adjacent to SCADA networks (Volt Typhoon indicator) </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> State health agencies manage Medicaid enrollment, public health surveillance, and vital records containing protected health information for millions of residents. <ul> <li> Priority: ClickFix awareness training for healthcare workers who routinely interact with web-based clinical and enrollment systems </li> <li> Priority: Ensure Chrome 146 is patched across all clinical and administrative workstations — healthcare environments often lag on browser patching </li> <li> Monitor: Ransomware groups (Qilin, Medusa, Play) continue to disproportionately target healthcare </li> </ul> <h3> Government Administration (All Executive Branch Agencies) </h3> The broadest attack surface — every state employee is a potential ClickFix target, and every agency uses the shared IT infrastructure (Cisco SD-WAN, FortiGate, M365) that is under active threat. <ul> <li> Priority: Issue ClickFix awareness advisory to all state employees within 48 hours </li> <li> Priority: Confirm Cisco SD-WAN Manager patched per CISA Emergency Directive ED 26-03 </li> <li> Priority: Conduct M365 security configuration audit — the Western Australia government audit (March 10) found weak conditional access policies, MFA gaps, and permissive OAuth consent settings in a directly analogous state government M365 environment </li> <li> Monitor: APT28 government-targeting IOCs (hashes listed above) </li> </ul> <h3> Aviation and Transportation/Logistics (State DOT, Transit Authorities, Airports) </h3> The Qilin ransomware attack on Tulsa International Airport (February 2) and MuddyWater targeting of U.S. airports demonstrate that transportation infrastructure is in the active target set. <ul> <li> Priority: Review airport and transit authority network segmentation — ensure operational technology (baggage handling, signaling, traffic management) is isolated from IT networks </li> <li> Priority: Audit Siemens SICAM deployments in transportation SCADA environments against the March 17 advisory </li> <li> Monitor: Iranian threat actors (MuddyWater, MOIS-affiliated) have specifically targeted U.S. airports in recent campaigns </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> Immediate Actions (Next 48 Hours) </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Patch Chrome 146 to 146.0.7680.75+ on all state endpoints. Two zero-days under active exploitation. Verify via endpoint management console. </td> <td> Desktop / Endpoint Ops </td> </tr> <tr> <td> 2 </td> <td> Confirm Cisco SD-WAN Manager patched for CVE-2026-20122 and CVE-2026-20128. If unpatched, conduct threat hunt per CISA Emergency Directive ED 26-03. </td> <td> Network Operations </td> </tr> <tr> <td> 3 </td> <td> Issue ClickFix awareness alert to all state employees. Key message: never execute commands from pop-up prompts, browser error messages, or verification windows. Report suspicious prompts to the SOC immediately. </td> <td> CISO Office / Security Awareness </td> </tr> <tr> <td> 4 </td> <td> Ingest APT28/X-Agent IOCs into EDR and SIEM (hashes listed in SOC Guidance above). </td> <td> SOC / Threat Detection </td> </tr> </tbody> </table> <h3> 7-Day Actions </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> Inventory and patch Wing FTP Server instances (CVE-2025-47813). CISA KEV deadline: March 30. </td> <td> Vulnerability Management </td> </tr> <tr> <td> 6 </td> <td> Audit Schneider Electric EcoStruxure DCE deployments in state data centers for hard-coded credential vulnerability. Apply vendor patch or network-isolate. </td> <td> Facilities / OT Security </td> </tr> <tr> <td> 7 </td> <td> Audit Trane Tracer SC/SC+/Concierge BMS deployments in state buildings. The arbitrary command execution vulnerability has physical-consequence implications. </td> <td> Facilities / OT Security </td> </tr> <tr> <td> 8 </td> <td> Confirm Ivanti EPM patch status. CISA flagged an Ivanti EPM flaw as actively exploited on March 10. </td> <td> Endpoint Ops </td> </tr> <tr> <td> 9 </td> <td> Block Storm-2561 TTPs at web proxy: flag VPN installer downloads from non-vendor domains, especially those mimicking Fortinet, Ivanti, or Cisco branding. </td> <td> SOC / Web Security </td> </tr> </tbody> </table> <h3> 30-Day Actions </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 10 </td> <td> Conduct M365 security configuration audit modeled on the Western Australia government findings. Focus on conditional access policies, MFA enforcement gaps, OAuth app consent settings, and mail forwarding rules. </td> <td> Cloud Security / IAM </td> </tr> <tr> <td> 11 </td> <td> Assess CISA service degradation impact and develop contingency plans. Identify which CISA services the state relied upon (threat sharing, incident response, election security, vulnerability scanning) and budget for alternatives. </td> <td> CISO Office / Policy </td> </tr> <tr> <td> 12 </td> <td> Review third-party payment processor security posture. The BridgePay ransomware attack disrupted payment systems for multiple cities. Ensure state payment vendors have tested incident response plans and contractual security requirements. </td> <td> Procurement / Vendor Risk </td> </tr> <tr> <td> 13 </td> <td> Evaluate SCADAPack x70 RTU and Siemens SIMATIC S7-1500 exposure in water/wastewater and transportation SCADA. Cross-reference with Dragos finding that state-affiliated hackers are mapping control loops in OT environments. </td> <td> OT Security / Critical Infrastructure </td> </tr> </tbody> </table> <h3> Executive and IR Preparedness </h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> </tr> </thead> <tbody> <tr> <td> 14 </td> <td> Brief the Governor's office and agency heads on the CISA degradation and its implications for state cybersecurity posture ahead of 2026 midterms. </td> <td> CIO / CISO </td> </tr> <tr> <td> 15 </td> <td> Validate incident response retainer contracts. With reduced federal surge capacity, ensure the state has commercial IR retainers that can respond within contractual SLAs. Test activation procedures. </td> <td> CISO Office </td> </tr> <tr> <td> 16 </td> <td> Conduct a tabletop exercise simulating a ransomware attack on a state agency during a period of degraded federal support. Test state-level response without CISA assistance. </td> <td> CISO Office / Agency CISOs </td> </tr> <tr> <td> 17 </td> <td> Review cyber insurance coverage in light of the expanded OT threat surface and ClickFix-enabled ransomware delivery. Ensure policy covers OT incidents and social engineering-initiated compromises. </td> <td> Risk Management / Legal </td> </tr> </tbody> </table> <h2> The Bottom Line </h2> The three developments this week — CISA's structural degradation, the surge in OT/ICS advisories, and the rapid proliferation of ClickFix — are not isolated events. They are converging to create a threat environment where state governments face more sophisticated attacks with less federal support than at any point in the last decade. Layered on top of this, nation-state actors from Russia, China, and Iran are all running active operations, with Iranian threat groups operating at elevated tempo since the start of the Iran conflict on February 28. The math is straightforward: nation-state actors are actively targeting government networks and mapping industrial control systems. Ransomware groups are adopting social engineering techniques that bypass your email security. And the federal agency that was supposed to help you deal with all of this has been hollowed out. States that act now — patching critical vulnerabilities, training employees on ClickFix, auditing OT environments, and planning for reduced federal support — will be in a defensible position. States that wait for the next CISA advisory may find that advisory never comes. Patch Chrome today. Issue the ClickFix alert tomorrow. Start your OT audit this week. Brief your leadership on the CISA gap this month. The threat actors are not waiting, and neither should you.

FEATURED RESOURCES

March 18, 2026

Public Sector

Anomali Cyber Watch