Triple Supply Chain Threat Converges on State Government: FortiBleed, SaaS OAuth Weaponization, and Critical Infrastructure Under Siege

Public Sector

Published on

June 19, 2026

Table of Contents

Threat Assessment Level: ELEVATED (Worsening) Changed from ELEVATED-STABLE in the prior cycle. The convergence of three simultaneous supply chain/credential attack vectors targeting state government infrastructure — FortiBleed credential exposure, Klue/Icarus SaaS OAuth weaponization, and the Texas vendor breach — combined with new critical vulnerabilities in Cisco ISE and a novel AI attack class, justifies the upward trend. <h2> Introduction </h2> In the past 72 hours, state government IT infrastructure has become the intersection point for three distinct but converging attack campaigns — each exploiting a different flavor of third-party trust. Nearly 74,000 Fortinet firewalls worldwide have had administrator credentials exposed and cracked. A new extortion group weaponized dormant SaaS OAuth tokens to exfiltrate CRM data from enterprise victims. And a peer state — Texas — lost over 3 million resident records through a compromised licensing vendor. These are not theoretical risks. They are active operations, confirmed by CISA alerts, vendor disclosures, and peer-state incident reports. The common thread: trusted third-party access that was never adequately monitored, rotated, or scoped. This brief provides state government CIOs and CISOs with the specific intelligence needed to act — today, this week, and this month. <h2> What Changed (June 17–19, 2026) </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Impact to State Government </th> </tr> </thead> <tbody> <tr> <td> June 10 </td> <td> CVE-2026-50656 — Windows Defender privilege escalation zero-day with public PoC; active exploitation ongoing </td> <td> Unpatched Windows endpoints across state agencies exposed to local privilege escalation; no patch available at time of writing </td> </tr> <tr> <td> June 12 </td> <td> VOID MANTICORE/Handala (IRGC-affiliated) confirms breach of California water utilities </td> <td> Direct critical infrastructure attack by nation-state actor; state water/wastewater operators should validate OT segmentation immediately </td> </tr> <tr> <td> June 17–18 </td> <td> FortiBleed — CISA publishes formal hardening alert after 73,932 FortiGate credentials exposed globally via GPU-accelerated hash cracking </td> <td> State Fortinet perimeter estate is in confirmed blast radius; public sector entities tagged in eCrime sales catalogs </td> </tr> <tr> <td> June 18 </td> <td> CISA adds CVE-2026-20253 to Known Exploited Vulnerabilities catalog (active exploitation confirmed) </td> <td> Product identification pending — naming convention suggests Cisco product; BOD 22-01 compliance clock starts </td> </tr> <tr> <td> June 18 </td> <td> Cisco ISE Critical RCE — CVE-2026-20181 & CVE-2026-20190 disclosed; no workaround available </td> <td> State NAC infrastructure directly exposed; ISE controls network segmentation for dozens of agencies </td> </tr> <tr> <td> June 17 </td> <td> Salesforce disables Klue Battlecards integration after Icarus group exfiltrates CRM data via stolen OAuth tokens </td> <td> Any state Salesforce org with competitive intelligence or abandoned integrations faces identical risk </td> </tr> <tr> <td> June 12–17 </td> <td> Texas state government breach — 3M+ records (DL numbers, passports, addresses) stolen via third-party licensing vendor </td> <td> Direct peer-state analog; demonstrates vendor compromise pathway to mass PII exfiltration </td> </tr> <tr> <td> June 18 </td> <td> M365 Copilot "SearchLeak" disclosed — parameter-to-prompt injection enables full tenant data exfiltration via single crafted link </td> <td> State M365/Copilot Enterprise deployments exposed to new attack class; Microsoft patched server-side </td> </tr> <tr> <td> June 18 </td> <td> Oracle Critical Patch Update (June 2026) released; ShinyHunters/UNC6040 mass exploitation of Oracle PeopleSoft (CVE-2026-35273) continues </td> <td> State HR/Finance ERP systems running PeopleSoft remain at risk </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Actor/Campaign </th> <th> Target </th> <th> Technique </th> <th> Status </th> </tr> </thead> <tbody> <tr> <td> June 10 </td> <td> Unknown </td> <td> Windows endpoints </td> <td> CVE-2026-50656 (Defender privilege escalation zero-day, public PoC) </td> <td> Active — unpatched </td> </tr> <tr> <td> June 11 </td> <td> Icarus (new extortion group) </td> <td> Klue → Salesforce CRM customers </td> <td> OAuth token theft via legacy integration credential (T1528) </td> <td> Active — Salesforce disabled integration June 17 </td> </tr> <tr> <td> June 12 </td> <td> ShinyHunters/UNC6040 </td> <td> Oracle PeopleSoft (~100 orgs) </td> <td> CVE-2026-35273 mass exploitation </td> <td> Active </td> </tr> <tr> <td> June 12 </td> <td> VOID MANTICORE/Handala (IRGC-affiliated) </td> <td> California water utilities </td> <td> Critical infrastructure breach </td> <td> Confirmed </td> </tr> <tr> <td> June 16 </td> <td> Ransomware (unattributed) </td> <td> Murray County, GA </td> <td> Encrypted tax, court, law enforcement systems + backups; $200K ransom paid </td> <td> Resolved (paid) </td> </tr> <tr> <td> June 17–18 </td> <td> Russia-nexus (UNC5435 attributed) </td> <td> 73,932 FortiGate firewalls globally </td> <td> Credential stuffing + 45-GPU hash cracking cluster (T1110.002) </td> <td> Active — credentials circulating </td> </tr> <tr> <td> June 18 </td> <td> Unknown </td> <td> Undetermined product </td> <td> CVE-2026-20253 (CISA KEV — active exploitation) </td> <td> Active </td> </tr> <tr> <td> June 18 </td> <td> N/A (vulnerability) </td> <td> Cisco ISE </td> <td> CVE-2026-20181, CVE-2026-20190 (Critical RCE) </td> <td> Patch available, no exploitation reported yet </td> </tr> <tr> <td> June 18 </td> <td> N/A (patched) </td> <td> M365 Copilot Enterprise </td> <td> SearchLeak — parameter-to-prompt injection (T1566.002 → T1114.002) </td> <td> Patched server-side </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. FortiBleed: Industrial-Scale Credential Harvesting Targeting Government </h3> The FortiBleed operation represents a paradigm shift in credential theft — not a vulnerability exploit, but the industrialization of credential cracking. A threat actor (attributed to Russia-nexus UNC5435) deployed a 45-GPU cluster to crack SHA-256 legacy password hashes extracted from FortiGate devices. The resulting catalog of 73,932 valid administrator credentials is being sold through eCrime channels, with government agencies explicitly tagged as high-value entries. Why this matters for state government: Fortinet FortiGate is the dominant perimeter firewall/VPN platform across state networks. If your organization runs FortiGate with legacy hash configurations, your admin credentials may already be in adversary hands. Historical pattern analysis shows a 10–14 day window between credential exposure and ransomware deployment via access brokers. Named actors in the chain: UNC5435 (credential harvesting) → HOOK SPIDER (access brokerage) → PUNK SPIDER/Akira, LockBit5, Cloak, IncRansom (ransomware deployment) <h3> 2. Icarus/Klue: SaaS OAuth Tokens Are the New Attack Surface </h3> On June 11, a new extortion group called Icarus (active since April 2026, pattern mirrors ShinyHunters/UNC6395) compromised Klue's backend through a legacy integration credential. They pushed malicious code to harvest OAuth tokens from connected Salesforce instances, then used automated Python scripts to bulk-query Salesforce REST APIs for approximately 24 hours before detection. Confirmed victims include Huntress and Recorded Future. Why this matters for state government: State agencies increasingly use Salesforce for constituent services, vendor management, and case tracking. Any connected integration platform — competitive intelligence tools, analytics plugins, abandoned proof-of-concept integrations — represents the same attack surface that Icarus exploited. Dormant OAuth tokens with broad API permissions are the equivalent of leaving admin credentials in a shared spreadsheet. <h3> 3. Texas Vendor Breach: Peer-State Warning on Third-Party Risk </h3> The Texas state government lost 3M+ records (driver's license numbers, passport numbers, residential addresses) through a compromised third-party hunting/fishing license system vendor. The attack leveraged supply chain compromise (T1195.002) and likely vendor credential abuse (T1078) to access and exfiltrate bulk PII. Why this matters: Every state government relies on specialized vendors for licensing, permitting, and constituent-facing services. These vendors often maintain persistent access to state databases with minimal monitoring. The Texas breach is a direct analog for any state with outsourced licensing systems. <h3> 4. Cisco ISE Critical RCE: Network Access Control at Risk </h3> CVE-2026-20181 and CVE-2026-20190 affect Cisco Identity Services Engine — the platform many state governments use to enforce network segmentation, device posture assessment, and role-based access control. These are Critical-rated remote code execution vulnerabilities with no workaround. If ISE is compromised, an attacker gains control of the policy engine that decides which devices access which network segments. <h3> 5. M365 Copilot SearchLeak: A New Attack Class Emerges </h3> The "SearchLeak" vulnerability disclosed by Varonis establishes parameter-to-prompt (P2P) injection as a new attack class. A crafted URL with a malicious ?q= parameter causes M365 Copilot to execute natural language instructions with the victim's full Microsoft Graph permissions — accessing emails, SharePoint, and OneDrive, then exfiltrating data through a Bing Image Search SSRF proxy. While Microsoft has patched this specific variant, the underlying architectural issue — AI copilots inheriting user permissions and accepting instructions via URL parameters — will produce recurring vulnerabilities across every AI-enhanced SaaS platform state government deploys. <h3> 6. Nation-State Persistent Pressure </h3> The UK's National Cyber Security Centre (NCSC) publicly warned this week that critical infrastructure remains under "sustained cyber pressure" from Russia, China, and Iran , with 75% of attacks on critical infrastructure attributed to state-linked actors. Named actors with confirmed or assessed government-targeting activity: <ul> <li> APT29 (Russia SVR) — credential harvesting, cloud exploitation </li> <li> Sandworm/Electrum (Russia GRU) — critical infrastructure disruption </li> <li> UNC5435 (Russia-nexus) — FortiBleed credential operations </li> <li> VOID MANTICORE/Handala (IRGC-affiliated) — confirmed California water utility breach (June 12) </li> <li> Volt Typhoon / Salt Typhoon (China) — prepositioning in US infrastructure (no new indicators this cycle, but NCSC confirms active operations) </li> <li> SloppyLemming — BurrowShell backdoor campaign targeting government entities (South/East Asia focus, potential expansion) </li> </ul> <h2> Predictive Analysis (72-Hour Horizon) </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional Klue/Icarus victim disclosures emerge, potentially including government SaaS vendors </td> <td> HIGH (>75%) </td> <td> Only 2 victims publicly claimed; Salesforce disabled integration affecting many customers; extortion timeline suggests more disclosures imminent </td> </tr> <tr> <td> CVE-2026-20253 product identification reveals a state-relevant platform (likely Cisco based on naming convention) </td> <td> MODERATE-HIGH (50–70%) </td> <td> CVE naming pattern and CISA prioritization suggest major enterprise vendor </td> </tr> <tr> <td> FortiBleed-derived credentials leveraged for ransomware deployment against government targets </td> <td> MODERATE (50–70%) </td> <td> Historical pattern: credential exposure → 10–14 day access broker dwell → ransomware; government entities explicitly tagged in sales catalog </td> </tr> <tr> <td> Akira/PUNK SPIDER silence (~7 days) breaks with new state/local government victim announcement </td> <td> LOW-MODERATE (30–50%) </td> <td> Typical 2-week campaign cadence; silence may indicate target selection or retooling phase </td> </tr> <tr> <td> P2P injection variants discovered in other AI-enhanced SaaS platforms (ServiceNow, Salesforce Einstein) </td> <td> MODERATE (40–60%) </td> <td> Architectural pattern is systemic, not product-specific; security researchers actively probing </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK Technique </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> FortiGate admin logins from unexpected IPs/geolocations </td> <td> T1078 (Valid Accounts), T1133 (External Remote Services) </td> <td> Alert on any FortiGate admin authentication from non-approved IP ranges; correlate with FortiBleed exposure window </td> </tr> <tr> <td> CRITICAL </td> <td> Salesforce REST API queries with automated user-agents </td> <td> T1119 (Automated Collection), T1528 (Steal Application Access Token) </td> <td> Alert on Python-urllib or scripted user-agents querying /services/data/v59.0/sobjects or /services/data/v59.0/query </td> </tr> <tr> <td> HIGH </td> <td> M365 Copilot URL sharing with encoded parameters </td> <td> T1566.002 (Spearphishing Link), T1059 (Command and Scripting Interpreter) </td> <td> Inspect URLs to m365.cloud.microsoft.com containing HTML tags or natural language instructions in ?q= parameter </td> </tr> <tr> <td> HIGH </td> <td> Cisco ISE management plane access from non-jump-host IPs </td> <td> T1190 (Exploit Public-Facing Application) </td> <td> Until patched, restrict and alert on any ISE admin access outside approved bastion hosts </td> </tr> <tr> <td> MODERATE </td> <td> RDP lateral movement following VPN authentication </td> <td> T1021.001 (Remote Desktop Protocol) </td> <td> Correlate new VPN sessions (especially FortiGate SSL VPN) with subsequent RDP to internal hosts — indicator of credential-to-ransomware pipeline </td> </tr> <tr> <td> MODERATE </td> <td> OAuth token creation/modification in Salesforce, ServiceNow </td> <td> T1528 (Steal Application Access Token) </td> <td> Alert on new Connected App registrations or OAuth scope changes outside change windows </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: FortiBleed credentials already in use. Hunt for FortiGate admin sessions originating from TOR exit nodes, known bulletproof hosting ASNs, or geolocations inconsistent with admin staff locations. Time window: June 10–present. </li> <li> Hypothesis: Dormant SaaS integrations with excessive OAuth scope. Inventory all Salesforce Connected Apps; identify any with full or api scope that haven't authenticated in >90 days. These are the Klue-equivalent attack surface. </li> <li> Hypothesis: P2P injection reconnaissance. Search email gateway logs and proxy logs for inbound URLs containing m365.cloud.microsoft.com with unusually long or encoded query strings. Even though SearchLeak is patched, variants may exist. </li> <li> Hypothesis: Akira/ransomware staging via compromised VPN. Hunt for new scheduled tasks, service installations, or PowerShell execution on systems accessed via SSL VPN within 24 hours of VPN session establishment. Focus on T1053.005 (Scheduled Task) and T1059.001 (PowerShell). </li> </ol> <h3> Blocking Guidance </h3> <ul> <li> Block Python-urllib user-agent at Salesforce API gateway (or alert if blocking impacts legitimate automation) </li> <li> Restrict Cisco ISE management interfaces to designated jump hosts via ACL (compensating control until patch) </li> <li> Disable internet-facing FortiGate management interfaces immediately </li> <li> Review and revoke OAuth tokens for any integration platform that has been disabled or decommissioned </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Tax Systems) </h3> <ul> <li> Primary threat: FortiBleed credential access → ransomware targeting tax/revenue systems (cf. Murray County, GA — tax systems encrypted) </li> <li> Action: Validate that FortiGate devices protecting financial system enclaves have completed credential rotation; ensure offline backup integrity for tax processing databases </li> <li> Watch: ShinyHunters/UNC6040 Oracle PeopleSoft exploitation — state financial ERP systems running PeopleSoft must verify CVE-2026-35273 patching status </li> </ul> <h3> Energy (State-Operated Utilities, SCADA/ICS) </h3> <ul> <li> Primary threat: VOID MANTICORE/Handala (IRGC-affiliated) confirmed breach of California water utilities; NCSC warns of sustained Russia/China/Iran pressure on critical infrastructure </li> <li> Action: Validate network segmentation between IT and OT per CISA ICS advisories (Mitsubishi MELSEC iQ-F, Schneider Electric Easergy/EcoStruxure/PowerLogic, Rockwell FactoryTalk Historian); ensure ICS systems are not reachable from FortiGate VPN segments </li> <li> Watch: Six new ICS advisories this cycle — review applicability to state water/wastewater and power distribution SCADA </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware operators (IncRansom, Cloak, LockBit5) actively targeting government public services including health systems; PII exfiltration via vendor compromise (Texas analog) </li> <li> Action: Audit third-party vendor access to Medicaid/benefits databases; verify that vendor connections use time-limited credentials with least-privilege API scope </li> <li> Watch: ConnectWise ScreenConnect CVE-2025-3935 (improper authentication) — healthcare MSPs frequently use ScreenConnect for remote support </li> </ul> <h3> Government (Executive Branch, Public Safety, Courts) </h3> <ul> <li> Primary threat: Triple convergence — FortiBleed (perimeter), Klue/Icarus (SaaS), Texas vendor breach (third-party) all directly target government operations </li> <li> Action: Emergency FortiGate credential rotation; SaaS OAuth audit; vendor access review for all licensing/permitting systems </li> <li> Watch: Murray County, GA paid $200K ransom after court and law enforcement systems encrypted including backups — validate backup isolation for court management and public safety systems </li> </ul> <h3> Aviation/Logistics (State DOT, Airport Authorities, Fleet Management) </h3> <ul> <li> Primary threat: Nation-state prepositioning (Volt Typhoon) in transportation infrastructure; FortiBleed exposure of traffic management system perimeters </li> <li> Action: Verify that traffic management, airport operations, and fleet management systems are segmented from general-purpose IT networks; confirm FortiGate devices in transportation enclaves are included in credential rotation </li> <li> Watch: AzeoTech DAQFactory and AVer PTC camera advisories may affect transportation monitoring systems </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops </td> <td> Rotate ALL FortiGate administrator and SSL VPN credentials. Force PBKDF2 hash migration by requiring admin re-login post-firmware upgrade. Disable internet-facing management interfaces. This is not optional — credentials are confirmed compromised and circulating in eCrime markets. </td> </tr> <tr> <td> 2 </td> <td> IT Ops </td> <td> Apply Cisco ISE patches for CVE-2026-20181 and CVE-2026-20190. If maintenance window is required, implement compensating ACLs restricting ISE management plane to jump hosts only. No workaround exists. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Audit all Salesforce Connected Apps and OAuth integrations. Revoke tokens for any competitive intelligence, abandoned, or decommissioned integration platforms. Alert on Python-urllib user-agent strings querying Salesforce REST API endpoints. </td> </tr> <tr> <td> 4 </td> <td> CISO </td> <td> Brief executive leadership on FortiBleed exposure and the 10–14 day ransomware deployment window. Secure authorization for emergency maintenance windows. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> SOC </td> <td> Deploy URL inspection rules to detect/block links containing encoded HTML or natural language instructions in M365 Copilot URL parameters. Brief security awareness team on P2P injection phishing lure format. </td> </tr> <tr> <td> 6 </td> <td> IT Ops </td> <td> Monitor CISA KEV catalog daily for CVE-2026-20253 product identification; prepare expedited patching workflow once product is confirmed. </td> </tr> <tr> <td> 7 </td> <td> CISO </td> <td> Commission full inventory of all SaaS-to-SaaS OAuth integrations across state Salesforce, ServiceNow, and HubSpot instances. Identify dormant/legacy credentials with excessive scope. </td> </tr> <tr> <td> 8 </td> <td> IT Ops </td> <td> Verify Oracle PeopleSoft instances have applied patches for CVE-2026-35273 and June 2026 Critical Patch Update. </td> </tr> <tr> <td> 9 </td> <td> IR Team </td> <td> Update incident response playbooks to include SaaS OAuth token compromise scenario (Klue/Icarus pattern) and FortiBleed-to-ransomware escalation path. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 10 </td> <td> CISO </td> <td> Develop AI Copilot security policy addressing P2P injection risk class. Restrict Copilot Enterprise Search URL sharing to internal-only until Microsoft confirms all race condition variants are patched. </td> </tr> <tr> <td> 11 </td> <td> IT Ops </td> <td> Review and harden ICS/SCADA environments per CISA ICS advisories for Mitsubishi MELSEC iQ-F, Schneider Electric PowerChute/Easergy, and Rockwell FactoryTalk Historian. Validate IT/OT network segmentation. </td> </tr> <tr> <td> 12 </td> <td> CISO </td> <td> Implement OAuth token rotation policy: maximum 90-day lifetime for all SaaS integration tokens; automated revocation for integrations inactive >30 days. </td> </tr> <tr> <td> 13 </td> <td> CISO </td> <td> Conduct tabletop exercise simulating FortiBleed → access broker → ransomware attack chain targeting state tax/court systems. Include backup recovery validation. </td> </tr> <tr> <td> 14 </td> <td> CIO </td> <td> Establish redundant OSINT collection capability with automated health monitoring and failover to prevent single-source intelligence blind spots. </td> </tr> </tbody> </table> <h2> IOC Blocking Guidance </h2> The following verified network-level indicators are associated with campaigns discussed in this report. Deploy to perimeter controls, EDR, and SIEM correlation rules as appropriate. File Hashes: Validated SHA-256 indicators associated with FortiBleed, Icarus/Klue, and related campaigns are available directly via Anomali ThreatStream. Please query ThreatStream for the latest verified hash indicators tied to UNC5435, Icarus, ShinyHunters/UNC6040, and VOID MANTICORE. Do not rely on unattributed hash lists circulating in open-source channels — attribution context is required to assess relevance and avoid false positives. Network Indicators to Monitor: <table> <thead> <tr> <th> Indicator </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Salesforce API paths /services/data/v59.0/sobjects and /services/data/v59.0/query accessed by Python-urllib or other scripted user-agents </td> <td> Icarus/Klue OAuth abuse pattern — automated bulk CRM exfiltration </td> </tr> <tr> <td> URLs matching bing[.]com/images/searchbyimage?cbir=sbi&imgurl= with external attacker-controlled domains appended </td> <td> M365 Copilot SearchLeak SSRF exfiltration channel — monitor even post-patch for variant activity </td> </tr> </tbody> </table> For the full, continuously updated IOC feed including network infrastructure, file hashes, and behavioral signatures associated with all campaigns in this report, access Anomali ThreatStream or contact your Anomali account team. <h2> Bottom Line </h2> State government sits at the intersection of three simultaneously active attack surfaces — perimeter devices (FortiBleed), SaaS integrations (Icarus/Klue), and third-party vendors (Texas breach) — while being explicitly targeted by both ransomware operators and nation-state actors. The 10–14 day window between FortiBleed credential exposure and likely ransomware deployment is closing. The VOID MANTICORE/Handala water utility breach confirms that IRGC-affiliated actors are actively targeting US critical infrastructure. Every day without credential rotation, OAuth audit, and vendor access review is a day closer to an incident that costs orders of magnitude more than the maintenance window disruption. Act today. Rotate credentials. Audit OAuth tokens. Verify your backups are isolated. The adversary already has the keys — the only question is whether you change the locks before they use them. Published June 19, 2026 | Anomali CTI Desk Intelligence cutoff: 2026-06-19 0600 UTC Next update: 2026-06-20 For questions or additional IOC feeds, contact your Anomali account team or access ThreatStream directly.

FEATURED RESOURCES

June 19, 2026

Anomali Cyber Watch

Iran's Cyber Forces Are Converging: FortiBleed, Cisco KEV, and the Access-to-Destruction Pipeline

June 19, 2026

Anomali Cyber Watch

Public Sector

Triple Supply Chain Threat Converges on State Government: FortiBleed, SaaS OAuth Weaponization, and Critical Infrastructure Under Siege

June 18, 2026

Anomali Cyber Watch

Iranian Cyber Forces Converge: Access Brokers Now Sharing Tooling with Destructive Operators

Explore All