Three Critical Zero-Days in 72 Hours: What State Government IT Leaders Must Do Now

Public Sector

Published on

June 12, 2026

Table of Contents

Threat Assessment Level: ELEVATED Three CISA Known Exploited Vulnerability (KEV) additions in a single 72-hour window — targeting VPN gateways, mobile device management infrastructure, and endpoint browsers — have created an unprecedented compressed patching emergency for state government networks. Simultaneously, ransomware operators are actively refreshing campaigns against government targets, and a China-nexus espionage actor remains potentially embedded in state network infrastructure after a suspicious 22-day operational silence. This is not a theoretical risk briefing. These vulnerabilities are being exploited right now , with public exploit code available for the most severe. <h2> What Changed </h2> The period from June 9–11, 2026 saw a rapid escalation in confirmed threats to state government infrastructure: <ul> <li> June 9: CISA added CVE-2026-50751 (Check Point Security Gateway authentication bypass, CVSS 9.3) and CVE-2026-11645 (Google Chrome V8 zero-day, CVSS 8.8) to the KEV catalog — both confirmed actively exploited </li> <li> June 9: CVE-2026-7473 (Arista EOS tunnel bypass) confirmed exploited, enabling attackers to inject traffic past network segmentation </li> <li> June 11: CISA added CVE-2026-10520 (Ivanti Sentry unauthenticated remote code execution, CVSS 10.0) to the KEV catalog — public proof-of-concept exploit available </li> <li> June 11–12: Gunra, Qilin, and PUNK SPIDER (Akira) ransomware groups refreshed targeting data confirming active campaigns against North American government entities </li> <li> June 10–11: FAMOUS CHOLLIMA (DPRK) activated new C2 infrastructure and updated the INVISIBLEFERRET malware family, indicating a preparation phase preceding new operations </li> <li> Ongoing: APT42/Charming Kitten (Iran — IRGC-IO) continues active credential harvesting operations via spearphishing and ClickFix social engineering against state government employees with access to law enforcement, regulatory, and infrastructure oversight systems </li> <li> Ongoing: China-nexus actor UNC5475 has been dormant for 22 days after confirmed exploitation of state government Cisco infrastructure — silence that likely indicates successful persistent access, not departure </li> </ul> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Severity </th> <th> Actor/Source </th> </tr> </thead> <tbody> <tr> <td> 21 May 2026 </td> <td> UNC5475 last observed exploiting Cisco ASA/FTD zero-days against government networks </td> <td> HIGH </td> <td> China-nexus (UNC5475) </td> </tr> <tr> <td> 9 Jun 2026 </td> <td> CVE-2026-7473 (Arista EOS tunnel bypass) added to CISA KEV </td> <td> HIGH </td> <td> Unknown actors </td> </tr> <tr> <td> 9 Jun 2026 </td> <td> CVE-2026-50751 (Check Point VPN auth bypass) added to CISA KEV </td> <td> CRITICAL </td> <td> Unknown actors </td> </tr> <tr> <td> 9 Jun 2026 </td> <td> CVE-2026-11645 (Chrome V8 RCE) added to CISA KEV </td> <td> HIGH </td> <td> Unknown actors </td> </tr> <tr> <td> 10 Jun 2026 </td> <td> FAMOUS CHOLLIMA (DPRK) activated new C2 infrastructure </td> <td> MODERATE </td> <td> DPRK (FAMOUS CHOLLIMA) </td> </tr> <tr> <td> 11 Jun 2026 </td> <td> CVE-2026-10520 (Ivanti Sentry RCE) added to CISA KEV; PoC published </td> <td> CRITICAL </td> <td> Unknown actors </td> </tr> <tr> <td> 11 Jun 2026 </td> <td> Qilin ransomware activity update — government targeting confirmed </td> <td> MODERATE </td> <td> Qilin/REVENANT SPIDER </td> </tr> <tr> <td> 12 Jun 2026 </td> <td> Gunra ransomware activity refresh — North America government targeting </td> <td> MODERATE </td> <td> Gunra </td> </tr> </tbody> </table> <h2> Critical Vulnerability Analysis </h2> <h3> CVE-2026-10520: Ivanti Sentry — Unauthenticated Root RCE (CVSS 10.0) </h3> This is the single highest-priority item for any state agency running Ivanti Sentry (formerly MobileIron Sentry). An OS command injection flaw allows a remote, unauthenticated attacker to achieve root-level code execution. No credentials required. No user interaction required. Public exploit code is available. Why this matters for state government: Ivanti Sentry is widely deployed across government environments as a gateway component for mobile device management. Compromise gives an attacker root access to a system that brokers trust between your MDM platform and managed devices — including phones and tablets used by agency leadership, law enforcement, and emergency management personnel. Affected versions: All versions prior to R10.5.2, R10.6.2, and R10.7.1. This is the third distinct Ivanti product vulnerability requiring emergency response in recent weeks, following CVE-2026-1281 and CVE-2026-1340 in Ivanti EPMM. The pattern indicates systemic code quality issues across the Ivanti product line — a vendor risk that demands strategic attention beyond individual patches. <h3> CVE-2026-50751: Check Point Security Gateway — VPN Without a Password (CVSS 9.3) </h3> A logic flaw in Check Point's Remote Access VPN implementation using the deprecated IKEv1 protocol allows an unauthenticated attacker to establish a full VPN connection without providing valid credentials . This effectively renders your VPN perimeter meaningless for any gateway still running IKEv1. Why this matters for state government: Many state agencies retain IKEv1 configurations for backward compatibility with legacy systems at smaller affiliated agencies or local government partners. This vulnerability turns that technical debt into an open door. <h3> CVE-2026-11645: Chrome V8 — Drive-by Browser RCE (CVSS 8.8) </h3> An out-of-bounds read/write vulnerability in Chrome's V8 JavaScript engine allows remote code execution via a crafted webpage. A state employee simply visiting a compromised or malicious website triggers exploitation — no clicks, no downloads, no warnings. Why this matters for state government: This is a watering-hole and spearphishing enabler. Combined with the VPN and gateway vulnerabilities above, an attacker could chain: credential-free VPN access (Check Point) → MDM gateway compromise (Ivanti Sentry) → browser-based lateral movement (Chrome V8). No evidence of active chaining has been observed yet, but the temporal clustering of these three KEVs within 72 hours is notable. <h2> Ransomware Threat: Gunra, Qilin, and Akira Targeting Government </h2> Gunra , Qilin , and PUNK SPIDER (Akira) ransomware operations all refreshed their activity profiles on June 11–12, with confirmed targeting of government, law enforcement, and critical infrastructure sectors in North America. Gunra (emerged April 2025) uses a combination of spearphishing and credentials purchased from Initial Access Brokers (IABs) to gain entry. Their ransom note (r3adm3.txt) and Tor-based data leak site indicate a mature double-extortion operation. Qilin continues to operate as one of the most prolific ransomware-as-a-service platforms targeting the public sector. PUNK SPIDER (Akira ransomware) — confirmed on June 11 to explicitly target US government entities via SonicWall VPN exploitation (CVE-2024-40766) — has augmented operations with AI-generated scripts that accelerate credential extraction and encryption timelines. The convergence of multiple ransomware groups simultaneously targeting state and local government reflects the sector's status as the #2 most-targeted vertical for ransomware, driven by limited budgets, legacy systems, and political pressure to restore services. <h2> Nation-State Espionage: The Silence Is the Signal </h2> <h3> UNC5475 (China-Nexus) — 22 Days of Silence </h3> UNC5475, a suspected Chinese espionage group, was last observed on May 21 exploiting zero-day vulnerabilities in Cisco ASA/FTD firewalls (CVE-2025-20333, CVE-2025-20362, CVE-2025-20363) targeting government networks in the Americas. Their tradecraft includes deploying custom malware that hooks authentication functions, disables logging, and manipulates crash dumps to avoid forensic detection. Twenty-two days of silence from an actor with confirmed access to government network infrastructure is not reassuring — it is consistent with "low-and-slow" espionage tradecraft where the initial compromise phase gives way to quiet data collection. The absence of new indicators may mean they have achieved persistent access and no longer need to generate detectable activity. <h3> APT42/Charming Kitten (Iran — IRGC-IO) </h3> Iranian state-sponsored actors continue credential harvesting operations via spearphishing, with the ClickFix social engineering technique confirmed in use. State government employees with access to law enforcement, regulatory, or infrastructure oversight systems remain high-value targets for Iranian intelligence collection. <h3> FAMOUS CHOLLIMA (DPRK) </h3> New command-and-control infrastructure was activated on June 10. The INVISIBLEFERRET malware family — associated with DPRK operations — received updates on June 11. Malware refresh without corresponding campaign data often indicates a preparation phase preceding new operations. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional Ivanti product vulnerabilities disclosed </td> <td> 70% </td> <td> 7 days </td> <td> Systemic vendor code quality pattern; three CVEs across two products in recent weeks </td> </tr> <tr> <td> Opportunistic exploitation of CVE-2026-10520 by ransomware actors </td> <td> 70% </td> <td> 7 days </td> <td> Public PoC + CVSS 10.0 + government targeting preference </td> </tr> <tr> <td> Gunra or Qilin claims a US state/local government victim </td> <td> 50% </td> <td> 14 days </td> <td> Activity tempo refresh + confirmed government targeting </td> </tr> <tr> <td> UNC5475 resurfaces with new zero-day or pivots to alternative infrastructure vendor </td> <td> 35% </td> <td> 14 days </td> <td> 22-day dormancy consistent with operational pivot </td> </tr> <tr> <td> Chained exploitation of Check Point + Ivanti + Chrome against a single target </td> <td> 25% </td> <td> 30 days </td> <td> Temporal clustering of KEVs; no confirmed chaining yet </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Immediate Detection Priorities </h3> For CVE-2026-10520 (Ivanti Sentry): <ul> <li> Monitor for unexpected outbound connections from Sentry appliances (T1041 — Exfiltration Over C2 Channel) </li> <li> Hunt for new processes spawned by the Sentry web service with root privileges (T1059.004 — Unix Shell) </li> <li> Alert on any OS command patterns in Sentry HTTP request logs (T1190 — Exploit Public-Facing Application) </li> <li> Baseline normal Sentry process trees and alert on deviations </li> </ul> For CVE-2026-50751 (Check Point VPN): <ul> <li> Audit all VPN session establishments for sessions lacking proper authentication events (T1133 — External Remote Services) </li> <li> Hunt for VPN connections using IKEv1 that bypass the normal authentication flow (T1078 — Valid Accounts) </li> <li> Correlate VPN session logs with identity provider authentication logs — any VPN session without a corresponding IdP event is suspicious </li> <li> Monitor for new VPN tunnel configurations or policy modifications (T1556 — Modify Authentication Process) </li> </ul> For CVE-2026-11645 (Chrome V8): <ul> <li> Monitor for unusual child processes spawned by Chrome renderer processes (T1203 — Exploitation for Client Execution) </li> <li> Alert on Chrome crashes followed by suspicious process execution </li> <li> Hunt for drive-by download indicators: unexpected file writes to temp directories following browser navigation (T1189 — Drive-by Compromise) </li> </ul> For UNC5475 (Cisco ASA/FTD): <ul> <li> Hunt for AAA function anomalies on Cisco ASA/FTD appliances (T1014 — Rootkit) </li> <li> Verify syslog forwarding is functioning — disabled logging is a primary UNC5475 indicator (T1070.004 — Indicator Removal) </li> <li> Inspect crash dump files for unexpected modifications </li> <li> Baseline ASA process behavior and alert on deviations from normal </li> </ul> For Ransomware (Gunra/Qilin/Akira): <ul> <li> Monitor for the ransom note filename r3adm3.txt appearing on file shares (T1486 — Data Encrypted for Impact) </li> <li> Hunt for volume shadow copy deletion (T1490 — Inhibit System Recovery) </li> <li> Alert on bulk file encryption patterns (high-entropy file writes at scale) </li> <li> Monitor for data staging and exfiltration to web services prior to encryption (T1567 — Exfiltration Over Web Service) </li> </ul> <h3> Hunting Hypotheses </h3> <ol> <li> "An attacker has established VPN access to our network without valid credentials via Check Point IKEv1 bypass." — Search for VPN sessions with no corresponding MFA challenge or IdP authentication event in the past 30 days. </li> <li> "UNC5475 has persistent access to our Cisco infrastructure and is in a quiet collection phase." — Audit all ASA/FTD appliances for: disabled syslog, modified AAA configurations, unexpected scheduled tasks, or crash dump files with recent modification timestamps that don't correspond to actual crashes. </li> <li> "An Initial Access Broker has already sold credentials to our environment to a ransomware operator." — Search dark web monitoring feeds for any state agency domain credentials; audit all remote access sessions for anomalous geographic or temporal patterns. </li> <li> "Ivanti Sentry has been compromised and is being used as a pivot point into our MDM infrastructure." — Verify Sentry appliance integrity: check running processes against known-good baselines, audit outbound network connections, verify file system integrity. </li> </ol> <h3> IOC Blocking Guidance </h3> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> gunrabxbig445sjqa535uaymzerj6fp4nwc6ngc2xughf2pedjdhk4ad[.]onion </td> <td> Gunra ransomware data leak site </td> </tr> <tr> <td> Domain </td> <td> wthelpdesk[.]com </td> <td> Malicious infrastructure </td> </tr> <tr> <td> URL </td> <td> hxxp://zebra.wthelpdesk[.]com/ </td> <td> Malicious infrastructure </td> </tr> <tr> <td> IP </td> <td> 209.99.40[.]222 </td> <td> Threat infrastructure </td> </tr> <tr> <td> SHA-256 </td> <td> bb61bbf81a04af3e95195d290fe63b50c8689565391ab79128b29599d9d19e81 </td> <td> Malicious binary </td> </tr> <tr> <td> SHA-1 </td> <td> 47015b415f0eaaf44583553e8da1aa56f93218ae </td> <td> Malicious binary </td> </tr> <tr> <td> MD5 </td> <td> 16a3445c7dc3622605b5532a7c3263ec </td> <td> Malicious binary </td> </tr> <tr> <td> Filename </td> <td> r3adm3.txt </td> <td> Gunra ransomware note </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Tax Systems) </h3> <ul> <li> Priority: CVE-2026-50751 (Check Point VPN bypass) — treasury and tax systems often use VPN for inter-agency financial data exchange. An unauthenticated VPN session could provide direct access to financial transaction systems. </li> <li> Action: Immediately audit all Check Point gateways protecting financial system enclaves. Verify that no IKEv1 tunnels exist to banking partners or payment processors. </li> <li> Ransomware concern: Tax filing season data and citizen financial PII make revenue agencies prime ransomware targets for double-extortion leverage. </li> </ul> <h3> Energy (State Energy Regulatory Oversight, Affiliated Utilities) </h3> <ul> <li> Priority: CISA ICS advisories issued this cycle for Schneider Electric EcoStruxure Panel Server and Schneider Modicon Switches — both common in utility SCADA environments under state regulatory oversight. </li> <li> Action: Coordinate with regulated utilities to confirm ICS patch status. Verify network segmentation between IT and OT environments — CVE-2026-7473 (Arista EOS tunnel bypass) could enable traffic injection across segmentation boundaries. </li> <li> Nation-state concern: Volt Typhoon pre-positioning doctrine specifically targets energy infrastructure for potential disruption during geopolitical crisis. </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems, Public Hospitals) </h3> <ul> <li> Priority: Ivanti Sentry (CVE-2026-10520) is widely deployed in healthcare for mobile device management of clinical tablets and provider devices. Compromise could expose patient health information and disrupt clinical workflows. </li> <li> Action: Healthcare-affiliated agencies should treat Ivanti Sentry patching as patient-safety-critical. Verify that MDM-managed devices used for e-prescribing and patient records are not accessible via compromised Sentry infrastructure. </li> <li> Ransomware concern: Healthcare remains the sector where ransomware most directly threatens life safety. Gunra and Qilin both list healthcare among target verticals. </li> </ul> <h3> Government (Executive Agencies, Legislature, Courts, Law Enforcement) </h3> <ul> <li> Priority: All three KEV vulnerabilities directly impact standard state government infrastructure. The combination of credential-free VPN access (Check Point), unauthenticated gateway RCE (Ivanti), and drive-by browser exploitation (Chrome) creates a multi-vector threat to government operations. </li> <li> Action: Law enforcement and judicial systems should receive priority patching given the sensitivity of criminal justice data. Verify that court case management systems and law enforcement intelligence databases are not accessible from VPN segments using IKEv1. </li> <li> Espionage concern: UNC5475's confirmed targeting of government Cisco infrastructure means state law enforcement and regulatory agencies with Cisco ASA/FTD deployments should assume they are potential targets. </li> </ul> <h3> Aviation/Logistics (State DOT, Port Authorities, Transit Systems) </h3> <ul> <li> Priority: Transportation management systems often rely on network segmentation (Arista switches) to separate operational technology from administrative networks. CVE-2026-7473 undermines this segmentation model. </li> <li> Action: Audit Arista EOS switches in transportation management centers for patch currency. Verify that traffic signal control, transit dispatch, and port management systems maintain air-gapped or hardware-enforced segmentation that doesn't rely solely on VLAN/tunnel isolation. </li> <li> Supply chain concern: Transportation logistics systems are attractive targets for both ransomware (operational disruption leverage) and nation-state actors (pre-positioning for potential kinetic conflict scenarios). </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🔴 CRITICAL </td> <td> IT Operations </td> <td> Patch all Ivanti Sentry instances to R10.5.2, R10.6.2, or R10.7.1. If patching cannot be completed within 24 hours, immediately remove Sentry from internet-facing access via firewall rules. CVE-2026-10520 is CVSS 10.0 with public exploit code. </td> </tr> <tr> <td> 🔴 CRITICAL </td> <td> IT Operations </td> <td> Apply Check Point hotfix (sk185033) to all Security Gateways. Disable IKEv1 on all gateways where operationally feasible. Any VPN connection using IKEv1 is currently exploitable without credentials. </td> </tr> <tr> <td> 🔴 CRITICAL </td> <td> IT Operations / SOC </td> <td> Force Chrome update to version 149.0.7827.103+ on all managed endpoints. Implement endpoint policy to block execution of Chrome versions below this threshold. </td> </tr> <tr> <td> 🟠 HIGH </td> <td> SOC </td> <td> Audit VPN session logs for the past 30 days — identify any sessions that lack corresponding identity provider authentication events. These may indicate exploitation of CVE-2026-50751. </td> </tr> <tr> <td> 🟠 HIGH </td> <td> SOC </td> <td> Validate MFA enforcement on all remote access pathways. Confirm that no remote access method allows single-factor authentication. Ransomware groups are actively purchasing IAB credentials. </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟠 HIGH </td> <td> SOC / Hunt Team </td> <td> Conduct proactive threat hunt on all Cisco ASA/FTD appliances for UNC5475 indicators: AAA configuration anomalies, disabled syslog forwarding, unexpected crash dump modifications, unrecognized scheduled tasks. </td> </tr> <tr> <td> 🟠 HIGH </td> <td> IT Operations </td> <td> Audit all Ivanti products in the environment (Sentry, EPMM, Connect Secure, Neurons). Confirm patch currency across the entire Ivanti portfolio. Treat Ivanti as an elevated vendor risk requiring enhanced monitoring. </td> </tr> <tr> <td> 🟡 MODERATE </td> <td> IT Operations </td> <td> Audit Arista EOS switches for CVE-2026-7473 patch status. Verify that network segmentation between sensitive enclaves is not solely dependent on tunnel-based isolation. </td> </tr> <tr> <td> 🟡 MODERATE </td> <td> SOC </td> <td> Review ICS advisory applicability for Schneider Electric EcoStruxure Panel Server and Modicon Switches in any state-managed or state-regulated facility management systems. </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟡 MODERATE </td> <td> CISO / Architecture </td> <td> Develop IKEv1 deprecation plan with migration timeline to IKEv2/IPsec or modern VPN alternatives (WireGuard, ZTNA). IKEv1 is a recurring attack surface that will continue generating critical vulnerabilities. </td> </tr> <tr> <td> 🟡 MODERATE </td> <td> CISO / Procurement </td> <td> Evaluate Ivanti vendor risk — three critical vulnerabilities across two products in recent weeks indicates systemic issues. Assess alternative MDM/gateway solutions for long-term diversification. </td> </tr> <tr> <td> 🟡 MODERATE </td> <td> CISO </td> <td> Commission tabletop exercise simulating a ransomware attack leveraging IAB-purchased credentials + VPN bypass for initial access. Test incident response procedures, backup restoration timelines, and executive communication plans. </td> </tr> <tr> <td> 🟡 MODERATE </td> <td> CISO / IR </td> <td> Update incident response playbooks to include scenarios for: (a) Ivanti appliance compromise as pivot point, (b) VPN authentication bypass with no credential indicators, (c) China-nexus persistent access discovery on network infrastructure. </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <ul> <li> Brief the Governor's office / agency heads on the current threat posture. Three simultaneous critical vulnerabilities in perimeter infrastructure, combined with active ransomware targeting of government, warrants executive awareness. </li> <li> Verify cyber insurance policy covers the current threat scenarios — particularly ransomware with data exfiltration and nation-state espionage discovery. </li> <li> Confirm communication plans with CISA, MS-ISAC, and state law enforcement cyber units. If UNC5475 persistent access is discovered during hunting, federal coordination will be required. </li> <li> Pre-position incident response retainer — ensure your IR firm is on standby and familiar with your environment. Response time matters when a CVSS 10.0 exploit is public. </li> </ul> <h2> The Bottom Line </h2> The 72-hour window of June 9–11 delivered three confirmed-exploited vulnerabilities targeting the exact infrastructure stack that state governments depend on: VPN gateways, mobile device management, and web browsers. This is not coincidence — it reflects the reality that state government perimeter infrastructure is under sustained, multi-vector assault from both criminal and nation-state actors simultaneously. The Ivanti Sentry vulnerability (CVE-2026-10520) demands the most urgent response. A CVSS 10.0 unauthenticated RCE with public exploit code on a system that manages trust relationships with every mobile device in your environment is as severe as vulnerabilities get. Every hour it remains unpatched is an hour an attacker can achieve root access without knowing a single credential. But patching alone is insufficient. UNC5475's 22-day silence after confirmed exploitation of government Cisco infrastructure is a reminder that the most dangerous threats are the ones you can't see. Proactive hunting — not just reactive patching — is what separates organizations that detect espionage from those that discover it in a congressional hearing. The ransomware groups aren't waiting either. Gunra, Qilin, and Akira are all actively targeting government this week, armed with IAB-purchased credentials and AI-accelerated tooling. Your MFA enforcement, your backup integrity, and your incident response readiness will determine whether a breach becomes a headline. Act today. Patch the critical vulnerabilities. Hunt for the quiet threats. Prepare for the ransomware attempt that is statistically likely within the next two weeks. Published 12 June 2026 | Anomali CTI Desk For questions or additional context, contact your Anomali account team or the CTI Desk directly.

FEATURED RESOURCES

June 12, 2026

Anomali Cyber Watch

Iran's Cyber Offensive Enters a Dangerous New Phase: What CISOs Must Know on Day 104

June 12, 2026

Anomali Cyber Watch

Public Sector

Three Critical Zero-Days in 72 Hours: What State Government IT Leaders Must Do Now

June 11, 2026

Anomali Cyber Watch

Iranian Cyber Operations in Strategic Pause — But Pre-Positioning Accelerates Behind the Diplomacy

Explore All