Unpatched Windows Defender Zero-Day, AI Exfiltration, and Supply-Chain Worms: A Convergence Demanding Immediate Action

Public Sector

Published on

June 17, 2026

Table of Contents

Threat Assessment Level: ELEVATED Elevated due to an unpatched Microsoft Defender privilege escalation zero-day with public proof-of-concept, a confirmed AI-based data exfiltration vulnerability in Microsoft 365 Copilot, active supply-chain worms compromising developer ecosystems, continued ransomware pressure on county and state government, and five new Rockwell Automation ICS advisories affecting water/wastewater infrastructure. <h2> Executive Summary </h2> State government IT leaders face a compressed decision window this week. A rare convergence of threats — an unpatched zero-day on every Windows endpoint, a novel attack class weaponizing your own AI tools against you, and self-propagating supply-chain worms already inside major package ecosystems — demands coordinated action across endpoint security, cloud administration, DevOps, and OT/ICS teams simultaneously. Meanwhile, a Georgia county just paid $200,000 in ransom after a month-long outage of court and law enforcement systems, reinforcing that sub-state government entities remain squarely in the crosshairs of ransomware operators. The question is not whether your state will face a similar incident, but whether your backup integrity and response playbooks will hold when it happens. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-50656 "RoguePlanet" — Microsoft Defender zero-day with public PoC, no patch available </td> <td> Every state Windows endpoint running Defender is vulnerable to SYSTEM-level privilege escalation. Attackers who gain initial access can immediately escalate to full system control. </td> </tr> <tr> <td> CVE-2025-32711 "EchoLeak" — M365 Copilot zero-click data exfiltration </td> <td> If your state deploys Microsoft 365 Copilot, a hidden payload in any inbound email can silently exfiltrate emails, Teams messages, and SharePoint files — no user interaction required. </td> </tr> <tr> <td> Shai-Hulud supply-chain worm — 516+ packages, 3,000+ repos, 200+ developer accounts compromised </td> <td> Self-propagating worm using Git timestamp manipulation to evade code review. Government is explicitly listed as a targeted industry. </td> </tr> <tr> <td> Mastra npm compromise — 144 packages, 918K weekly downloads of @mastra/core </td> <td> Hijacked legitimate contributor account used to inject cross-platform infostealer with C2 infrastructure at 23.254.164[.]92 and 23.254.164[.]123. </td> </tr> <tr> <td> Murray County, GA ransomware — $200K paid, month-long outage </td> <td> Tax, court, and law enforcement systems encrypted including backups. Direct peer-organization impact. </td> </tr> <tr> <td> 5 Rockwell Automation ICS advisories — Logix 5370/5570, CompactLogix, FLEX I/O, RSLinx, FactoryTalk </td> <td> Denial-of-service and unauthorized access vulnerabilities in PLCs commonly deployed in state water/wastewater facilities. </td> </tr> <tr> <td> CVE-2026-48907 (Joomla JCE) added to CISA KEV </td> <td> Active exploitation confirmed; affects state agencies running Joomla-based public-facing sites. </td> </tr> <tr> <td> WARLORD KITTEN (Iran-nexus APT) — fresh OtakuKit IOC refresh </td> <td> New malware hashes published 2026-06-17 indicate continued operational activity by this IRGC-affiliated group. </td> </tr> <tr> <td> APT29 (Russia SVR) — new credential-harvesting executable targeting government </td> <td> Nation-state credential theft campaign active as of June 15; government and telecom organizations at elevated risk. </td> </tr> <tr> <td> Three FortiSandbox CVEs (CVE-2026-39813/39808/25089) confirmed exploited in the wild </td> <td> CVSS 9.1 vulnerabilities in network security appliances confirmed exploited June 16; one exploit AI-assisted. </td> </tr> <tr> <td> ShinyHunters/UNC6040 — mass exploitation of Oracle PeopleSoft (CVE-2026-35273) </td> <td> Approximately 100 organizations compromised in five days; state HR and finance ERP systems at direct risk. </td> </tr> <tr> <td> CVE-2026-20262 (Cisco Catalyst SD-WAN Manager) added to CISA KEV </td> <td> Active exploitation of state network infrastructure confirmed; transportation and distributed-site agencies most exposed. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> 2026-05-13 </td> <td> Murray County, GA ransomware attack begins </td> <td> Tax, court, law enforcement systems encrypted; backups destroyed </td> </tr> <tr> <td> 2026-06-12 </td> <td> ShinyHunters/UNC6040 mass exploitation of Oracle PeopleSoft (CVE-2026-35273) begins; ~100 orgs compromised </td> <td> State HR/Finance ERP systems at risk </td> </tr> <tr> <td> 2026-06-12 </td> <td> Handala/VOID MANTICORE (IRGC) breaches California water utilities </td> <td> Critical infrastructure targeting confirmed </td> </tr> <tr> <td> 2026-06-15 </td> <td> CISA adds CVE-2026-20262 (Cisco Catalyst SD-WAN Manager) to KEV </td> <td> Active exploitation of state network infrastructure </td> </tr> <tr> <td> 2026-06-15 </td> <td> APT29 (Russia SVR) deploys new credential-harvesting executable targeting government </td> <td> Nation-state espionage activity ongoing </td> </tr> <tr> <td> 2026-06-16 </td> <td> Three FortiSandbox CVEs confirmed exploited in the wild (CVE-2026-39813/39808/25089) </td> <td> Network security appliances compromised; one exploit AI-assisted </td> </tr> <tr> <td> 2026-06-16 </td> <td> CISA adds CVE-2026-48907 (Joomla JCE) to KEV </td> <td> Web application exploitation active </td> </tr> <tr> <td> 2026-06-16 </td> <td> Five Rockwell Automation ICS advisories published </td> <td> Water/wastewater SCADA at risk </td> </tr> <tr> <td> 2026-06-16 </td> <td> Murray County pays $200K ransom; systems begin recovery </td> <td> Demonstrates ransomware ROI for attackers targeting government </td> </tr> <tr> <td> 2026-06-17 </td> <td> CVE-2026-50656 "RoguePlanet" PoC published — no patch </td> <td> Every Defender-protected endpoint vulnerable </td> </tr> <tr> <td> 2026-06-17 </td> <td> Mastra npm compromise discovered — 144 packages weaponized </td> <td> State DevOps pipelines in blast radius </td> </tr> <tr> <td> 2026-06-17 </td> <td> WARLORD KITTEN OtakuKit IOC refresh </td> <td> Iran-nexus APT remains operationally active </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. CVE-2026-50656 "RoguePlanet" — The Defender Becomes the Vulnerability </h3> A race condition in the Microsoft Malware Protection Engine (MsMpEng.exe) allows any local user to escalate to SYSTEM privileges on fully patched Windows 10 and Windows 11 systems. The exploit works regardless of whether real-time protection is enabled or disabled. Why this is critical for state government: Microsoft Defender is the default endpoint protection across most state enterprise deployments. With a public proof-of-concept and no available patch, every state workstation and server is one initial-access foothold away from full compromise. Ransomware operators and nation-state actors routinely chain initial access (phishing, supply-chain) with local privilege escalation — this zero-day provides that second link for free. Detection is currently the only mitigation. Monitor for cmd.exe or powershell.exe spawning as SYSTEM from the MsMpEng.exe process tree. <h3> 2. CVE-2025-32711 "EchoLeak" — Your AI Assistant as an Exfiltration Channel </h3> This zero-click indirect prompt injection vulnerability in Microsoft 365 Copilot represents a fundamentally new attack class. An attacker embeds hidden instructions (white-on-white text, HTML comments) in an email sent to a Copilot-enabled user. When Copilot processes that email as context, it silently follows the injected instructions — exfiltrating emails, Teams messages, and SharePoint/OneDrive files to attacker-controlled endpoints. No user interaction required. The victim never clicks a link or opens an attachment. The email simply needs to exist in their mailbox for Copilot to ingest it as context. Microsoft applied a server-side patch in May 2026, but the underlying attack class — indirect prompt injection against RAG-based AI assistants — remains viable. State agencies deploying Copilot should verify the patch is active and consider restricting Copilot's access to external email context. <h3> 3. Supply-Chain Worms: Shai-Hulud and Mastra </h3> Two distinct but related supply-chain attacks are actively compromising developer ecosystems: Shai-Hulud (attributed to TeamPCP) is a self-propagating worm that has compromised 516+ packages across npm, PyPI, and RubyGems, 3,000+ GitHub repositories, and 200+ developer accounts. It uses a novel technique — Git commit timestamp backdating and author metadata forgery — to make malicious commits appear legitimate and evade code review. Government organizations are explicitly listed as targets. GitHub has declined to fix the underlying platform design flaws that enable propagation. Mastra npm compromise exploited a hijacked legitimate contributor account ("ehindero") to publish 144 malicious packages injecting the "easy-day-js" dependency. The payload disables TLS validation, downloads a cross-platform infostealer, harvests browser credentials and crypto wallets, and establishes persistence. C2 infrastructure is active at 23.254.164[.]92 and 23.254.164[.]123. State government exposure: Any state agency with DevOps pipelines consuming npm, PyPI, or GitHub-hosted dependencies is in the blast radius. Both attacks would be mitigated by requiring SLSA provenance attestations on package installation — a policy decision, not a tooling decision. <h3> 4. Ransomware Continues to Devastate County Government </h3> Murray County, Georgia discovered their attack at 3 AM on May 13 when law enforcement software went offline. The attackers encrypted systems supporting the Tax Commissioner, Tax Assessors, Probate Court, Juvenile Court, and Sheriff's Office — and critically, encrypted the backups as well . After nearly a month offline, the county paid $200,000. This follows the pattern established by groups like Akira (PUNK SPIDER), Qilin (REVENANT SPIDER), and DragonForce — all of which actively target government entities and prioritize backup destruction (T1490) to maximize pressure. For state IT leadership: The question is whether centralized backup-as-a-service for county interconnections would reduce systemic risk. Individual counties often lack the resources for air-gapped or immutable backup architectures. <h3> 5. Rockwell Automation ICS Vulnerabilities — Water/Wastewater at Risk </h3> Five simultaneous CISA ICS advisories cover Rockwell Automation products commonly deployed in state water and wastewater facilities: <ul> <li> Logix 5370 & 5570 Controllers — Denial-of-service via CIP causing major nonrecoverable fault </li> <li> CompactLogix — Denial-of-service </li> <li> FLEX I/O EtherNet/IP Adapters — Unauthorized access and account takeover </li> <li> RSLinx — Application denial-of-service </li> <li> FactoryTalk Analytics PavilionX — Privileged operation execution </li> </ul> Combined with the June 12 IRGC-affiliated breach of California water utilities (Handala/VOID MANTICORE), the water sector threat picture is acute. These vulnerabilities provide the technical pathway; the Iran-nexus actors provide the intent. <h3> 6. Nation-State Activity: Persistent but Evolving </h3> <table> <thead> <tr> <th> Actor </th> <th> Affiliation </th> <th> Recent Activity </th> <th> Target </th> </tr> </thead> <tbody> <tr> <td> APT29 </td> <td> Russia SVR </td> <td> New credential-harvesting executable (June 15) </td> <td> Government, telecom </td> </tr> <tr> <td> WARLORD KITTEN </td> <td> IRGC (Iran) </td> <td> OtakuKit malware IOC refresh (June 17) </td> <td> Government, defense </td> </tr> <tr> <td> Handala / VOID MANTICORE </td> <td> IRGC (Iran) </td> <td> California water utility breach (June 12) </td> <td> Critical infrastructure </td> </tr> <tr> <td> ShinyHunters / UNC6040 </td> <td> Criminal </td> <td> Oracle PeopleSoft mass exploitation (June 12) </td> <td> Enterprise ERP </td> </tr> <tr> <td> HOOK SPIDER </td> <td> Russia-nexus </td> <td> Access broker activity (ongoing) </td> <td> Initial access sales </td> </tr> </tbody> </table> Notable absence: Volt Typhoon and Salt Typhoon (China-nexus) have shown zero indicators for 3+ intelligence cycles. This could indicate an operational pause, a shift to unattributed infrastructure, or a collection gap. Given their known focus on pre-positioning within U.S. critical infrastructure, this silence warrants proactive hunting rather than complacency. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Microsoft releases out-of-band Defender patch for CVE-2026-50656 </td> <td> 75% </td> <td> 7 days </td> <td> Public PoC + media pressure + SYSTEM escalation severity </td> </tr> <tr> <td> Commodity ransomware operators incorporate RoguePlanet into attack chains </td> <td> 60% </td> <td> 14 days </td> <td> Public PoC lowers barrier; LPE is the missing link in many intrusion chains </td> </tr> <tr> <td> Shai-Hulud worm variants expand to Go modules and Cargo ecosystems </td> <td> 50% </td> <td> 30 days </td> <td> GitHub's refusal to address design flaws + worm's self-propagating nature </td> </tr> <tr> <td> DragonForce ransomware affiliates claim US state/local government victims </td> <td> 35% </td> <td> 30 days </td> <td> Active MSP targeting (Helix International pattern) provides lateral access to government clients </td> </tr> <tr> <td> Iran-nexus actors (APT42/Charming Kitten) surge credential harvesting ahead of 2026 midterms </td> <td> 40% </td> <td> 60 days </td> <td> Historical pattern of election-cycle activity + current operational tempo </td> </tr> <tr> <td> Additional Rockwell Automation exploitation in water/wastewater sector </td> <td> 45% </td> <td> 30 days </td> <td> Five new advisories + confirmed Iran-nexus intent (Handala breach) </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Detect </th> <th> ATT&CK ID </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> RoguePlanet exploitation </td> <td> T1068 </td> <td> Alert on cmd.exe, powershell.exe, or unknown processes spawning as SYSTEM from MsMpEng.exe parent process. Monitor for race condition artifacts: rapid file creation/deletion in Defender scan directories. </td> </tr> <tr> <td> CRITICAL </td> <td> EchoLeak prompt injection </td> <td> T1566.001, T1567 </td> <td> Scan inbound email for hidden HTML comments, white-on-white text (font-size:0, color matching background), and Unicode zero-width characters. Alert on Copilot-initiated outbound connections to unrecognized domains. </td> </tr> <tr> <td> HIGH </td> <td> Supply-chain payload execution </td> <td> T1195.002, T1059.007 </td> <td> Monitor CI/CD runners and developer workstations for outbound connections to 23.254.164[.]92 and 23.254.164[.]123. Alert on npm install of packages lacking SLSA provenance. Detect TLS validation disabling in Node.js processes. </td> </tr> <tr> <td> HIGH </td> <td> Backup destruction </td> <td> T1490 </td> <td> Alert on volume shadow copy deletion (vssadmin delete shadows), modification of backup agent configurations, and bulk file encryption patterns in backup storage locations. </td> </tr> <tr> <td> HIGH </td> <td> Rockwell PLC anomalies </td> <td> T0831, T0814 </td> <td> Monitor CIP traffic for malformed packets targeting Logix 5370/5570. Alert on unauthorized connections to FLEX I/O adapters. Baseline normal PLC communication patterns and alert on deviations. </td> </tr> <tr> <td> MODERATE </td> <td> APT29 credential harvesting </td> <td> T1078, T1555 </td> <td> Hunt for new unsigned executables in %APPDATA% and %TEMP% making outbound HTTPS connections. Correlate with Azure AD impossible-travel alerts. </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: RoguePlanet PoC has already been incorporated into post-exploitation frameworks used against state networks. </li> <ul> <li> Hunt: Search EDR telemetry for SYSTEM-level process creation from MsMpEng.exe parent in the last 7 days. Correlate with any initial access alerts (phishing, VPN exploitation) in the same timeframe. </li> </ul> <li> Hypothesis: State developer workstations have consumed compromised Mastra or Shai-Hulud packages. </li> <ul> <li> Hunt: Query package manager logs (npm, pip) across developer endpoints for easy-day-js, @mastra/* packages installed after 2026-06-16, or any package with 4.6MB+ obfuscated payloads. Check for outbound connections to 23.254.164[.]0/24. </li> </ul> <li> Hypothesis: Copilot-enabled mailboxes have received EchoLeak-class prompt injection emails. </li> <ul> <li> Hunt: Search email gateway logs for messages containing hidden HTML elements (display:none, font-size:0, zero-width Unicode). Review Copilot audit logs for unusual data access patterns or responses containing exfiltration instructions. </li> </ul> <li> Hypothesis: Rockwell PLCs in state water facilities are accessible from IT networks due to segmentation gaps. </li> <ul> <li> Hunt: Scan for CIP/EtherNet/IP traffic (TCP/44818, UDP/2222) crossing IT/OT network boundaries. Verify that Logix 5370/5570 controllers are not reachable from corporate VLANs. </li> </ul> </ol> <h3> Blocking Actions </h3> <ul> <li> Block 23.254.164[.]92 and 23.254.164[.]123 at perimeter firewalls and DNS sinkholes </li> <li> Block installation of npm package easy-day-js in enterprise package registries </li> <li> Add Joomla JCE exploitation signatures (CVE-2026-48907) to WAF rules for state Joomla deployments </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Pension Systems) </h3> <ul> <li> Oracle PeopleSoft (CVE-2026-35273): If state financial systems run PeopleSoft, verify patching status immediately. ShinyHunters/UNC6040 compromised ~100 organizations in 5 days. </li> <li> M365 Copilot: Treasury and revenue staff handling sensitive financial data are high-value EchoLeak targets. Consider restricting Copilot access for users processing tax records and pension data until prompt injection defenses mature. </li> <li> Ransomware: Murray County's Tax Commissioner and Tax Assessors were primary targets. Ensure financial system backups are immutable and air-gapped. </li> </ul> <h3> Energy (State-Managed Utilities, Grid Coordination) </h3> <ul> <li> Rockwell Automation: Energy facilities using Logix controllers should implement CIP traffic filtering and verify network segmentation immediately. </li> <li> Volt Typhoon absence: The lack of visible China-nexus activity targeting energy infrastructure is not reassurance — it may indicate pre-positioned access operating below detection thresholds. Conduct proactive threat hunts for living-off-the-land techniques (T1218, T1053). </li> <li> FortiSandbox vulnerabilities: If energy facilities use Fortinet appliances, verify patching for CVE-2026-39813/39808/25089 (all CVSS 9.1, confirmed exploited in the wild). </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Ransomware resilience: Healthcare data systems face the same backup-destruction playbook seen in Murray County. Validate that Medicaid, vital records, and public health systems have offline recovery capability tested within the last 90 days. </li> <li> Supply-chain risk: Health IT systems increasingly rely on modern web frameworks. Audit npm/Python dependencies in patient portal and telehealth applications for Shai-Hulud or Mastra compromise indicators. </li> <li> EchoLeak: Healthcare staff using Copilot with access to PHI represent a high-consequence exfiltration target. Apply data classification restrictions to Copilot's context window. </li> </ul> <h3> Government (Executive Branch Agencies, Courts, Law Enforcement) </h3> <ul> <li> RoguePlanet (CVE-2026-50656): This is your most urgent endpoint risk. Every agency workstation is affected. Deploy detection rules immediately; prepare for emergency patching when Microsoft releases a fix. </li> <li> Murray County playbook: Brief agency heads on the county ransomware scenario. Validate that court management systems, law enforcement databases (CJIS), and DMV systems have tested offline backup restoration procedures. </li> <li> Credential theft: APT29's new credential harvester and the EchoLeak class both target government. Enforce phishing-resistant MFA (FIDO2) for all privileged accounts. Monitor for impossible-travel in Azure AD. </li> <li> WARLORD KITTEN: State agencies with defense or law enforcement functions should ingest the latest OtakuKit IOCs into detection platforms. </li> </ul> <h3> Aviation / Logistics (State DOT, Port Authorities, Airports) </h3> <ul> <li> DragonForce ransomware: This group recently targeted UK logistics and MSP infrastructure. State DOT and port authority systems connected via MSP relationships are potential lateral-movement targets. Verify MSP access controls and monitor for unauthorized RMM tool deployment. </li> <li> Cisco SD-WAN (CVE-2026-20262): Transportation agencies relying on Cisco SD-WAN for distributed site connectivity must patch immediately — this is on the CISA KEV with confirmed exploitation. </li> <li> ICS/SCADA: Traffic management systems and port automation using Rockwell controllers should apply the same mitigations as water/wastewater facilities. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Deploy Chrome 149.0.7827.155+ and Firefox 152 to all state endpoints </td> <td> IT Ops / Endpoint Management </td> <td> 6 critical RCE flaws in Chrome and 13 high-severity bugs in Firefox enable sandbox escape </td> </tr> <tr> <td> Create EDR detection rule for SYSTEM-level process spawning from MsMpEng.exe </td> <td> SOC / Detection Engineering </td> <td> CVE-2026-50656 has no patch; detection is the only mitigation for RoguePlanet </td> </tr> <tr> <td> Verify M365 Copilot server-side patch status; restrict Copilot external email context access </td> <td> M365 Administration </td> <td> CVE-2025-32711 EchoLeak enables zero-click exfiltration from state tenant </td> </tr> <tr> <td> Block 23.254.164[.]92 and 23.254.164[.]123 at all perimeter firewalls </td> <td> Network Security / SOC </td> <td> Active C2 infrastructure for Mastra npm supply-chain attack </td> </tr> <tr> <td> Verify Joomla JCE patching on all state-hosted Joomla sites </td> <td> Web Application Team </td> <td> CVE-2026-48907 added to CISA KEV with confirmed active exploitation </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Audit all CI/CD pipelines for @mastra/* npm dependencies; block packages lacking SLSA provenance </td> <td> DevOps / AppSec </td> <td> 144 malicious packages with 918K weekly downloads; state build pipelines at risk </td> </tr> <tr> <td> Enable GPG/SSH commit signing and GitHub Vigilant Mode for all state repositories </td> <td> DevOps </td> <td> Shai-Hulud worm exploits unsigned commits and timestamp manipulation </td> </tr> <tr> <td> Assess Rockwell Automation deployments in water/wastewater; implement CIP traffic filtering and network segmentation </td> <td> OT/ICS Security </td> <td> 5 new CISA advisories + confirmed Iran-nexus intent against water sector </td> </tr> <tr> <td> Ingest WARLORD KITTEN OtakuKit IOCs into SIEM/EDR platforms </td> <td> SOC / Threat Intel </td> <td> Fresh hashes published 2026-06-17 indicate active Iranian APT operations </td> </tr> <tr> <td> Validate immutable/air-gapped backup status for all Tier-1 state systems </td> <td> IT Ops / BC/DR </td> <td> Murray County scenario demonstrates backup encryption as standard ransomware playbook </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Commission tabletop exercise: ransomware with backup encryption + month-long outage of court/law enforcement systems </td> <td> CISO / IR Team </td> <td> Murray County provides a real-world scenario template; validate state response capability </td> </tr> <tr> <td> Establish "AI Security" workstream separate from cloud security program </td> <td> CISO / Security Architecture </td> <td> EchoLeak class demonstrates that enterprise AI assistants create novel exfiltration channels requiring dedicated governance </td> </tr> <tr> <td> Evaluate centralized backup-as-a-service offering for county/municipal interconnections </td> <td> CIO / CISO </td> <td> Reduce systemic risk from under-resourced county IT programs that cannot maintain air-gapped backups independently </td> </tr> <tr> <td> Conduct proactive threat hunt for Volt Typhoon / Salt Typhoon living-off-the-land indicators </td> <td> SOC / Threat Hunting </td> <td> 3+ cycles of silence from primary China-nexus pre-positioning threat warrants active search, not passive monitoring </td> </tr> <tr> <td> Implement SLSA provenance requirements as policy for all state software procurement and development </td> <td> CISO / Procurement </td> <td> Both Shai-Hulud and Mastra attacks are defeated by provenance enforcement — this is a policy decision with technical enforcement </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> The following indicators are confirmed from intelligence collection and should be added to blocking and detection platforms: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 23.254.164[.]92 </td> <td> Mastra npm compromise — C2 dropper/loader </td> </tr> <tr> <td> IPv4 </td> <td> 23.254.164[.]123 </td> <td> Mastra npm compromise — C2 exfiltration </td> </tr> <tr> <td> npm package </td> <td> easy-day-js </td> <td> Malicious dependency injected into @mastra packages </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report — including WARLORD KITTEN OtakuKit hashes, APT29 credential harvester samples, and DragonForce infrastructure — are available through Anomali ThreatStream Next-Gen and partner feeds. <h2> Closing </h2> The threat environment facing state government this week is defined by a single uncomfortable truth: your defensive tools are becoming your attack surface. Microsoft Defender — the endpoint protection agent on every state workstation — is now a privilege escalation vector with no patch. Microsoft 365 Copilot — deployed to boost productivity — is a zero-click exfiltration channel. Your developers' package managers — essential to building and maintaining state applications — are compromised by self-propagating worms. This is not a theoretical future state. These are active, confirmed vulnerabilities with public exploitation code and real-world victims. Murray County, Georgia is recovering from a month-long outage that cost $200,000 in ransom alone — to say nothing of the operational impact on courts, law enforcement, and citizen services. The decisions required are clear and time-bounded: <ol> <li> Today: Deploy compensating detection controls for RoguePlanet. Restrict Copilot's external context. Block the Mastra C2 infrastructure. </li> <li> This week: Enforce supply-chain provenance. Segment OT networks. Validate backups. </li> <li> This month: Exercise your response plans against the Murray County scenario. Establish AI security governance. Hunt for what you cannot see. </li> </ol> The window between public proof-of-concept and commodity exploitation is measured in days, not weeks. Act accordingly. Anomali CTI Desk | 2026-06-17 For questions or additional context on any finding in this report, contact your Anomali intelligence team.

FEATURED RESOURCES

June 17, 2026

Anomali Cyber Watch

Iranian Cyber Operations Intensify as Conflict Enters Day 110: SD-WAN Kill Chains, ICS Vulnerabilities, and Supply Chain Compromise Converge

June 17, 2026

Anomali Cyber Watch

Public Sector

Unpatched Windows Defender Zero-Day, AI Exfiltration, and Supply-Chain Worms: A Convergence Demanding Immediate Action

June 16, 2026

Anomali Cyber Watch

Iranian Cyber Operations Intensify: Seven Cisco SD-WAN Exploits, AI-Generated Attack Code, and Fresh C2 Infrastructure Signal Imminent Escalation

Explore All