When Attackers Call You on Teams: The Evolving Threat Landscape Facing State Government IT

Public Sector

Published on

April 27, 2026

Table of Contents

Threat Assessment Level: ELEVATEDUnchanged from the prior assessment period. Multiple active campaigns targeting government entities, evolving social engineering evasion techniques, a critical infrastructure vendor breach, and fresh nation-state indicators collectively sustain this posture. No single event warranted escalation to HIGH, but the convergence of threats across identity, supply chain, and infrastructure domains demands sustained vigilance. <h2>Executive Summary                            </h2> This week, the threat environment for state and local government shifted in ways that matter operationally — not because of a single catastrophic event, but because adversaries are adapting faster than many defensive playbooks. A financially motivated group is now impersonating your IT help desk over Microsoft Teams to deploy persistent malware. The ClickFix social engineering technique — already a top-tier threat to government — has evolved to bypass the PowerShell-based detections most SOCs rely on. A major utility technology vendor disclosed a breach that may ripple through state water and energy infrastructure. And Russia’s APT28 refreshed its malware toolkit with high-confidence indicators that belong in every state detection stack today. None of these threats exist in isolation. They converge on the same infrastructure your agencies depend on daily: Microsoft 365, Entra ID, Cisco firewalls, and the vendor ecosystem that keeps critical services running. This brief breaks down what changed, what it means, and exactly what to do about it. <h2>What Changed This Week                         </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> 24 Apr </td> <td> Google Threat Intelligence Group (GTIG) publishes full analysis of UNC6692’s SNOW malware framework </td> <td> Documents a complete domain-compromise kill chain initiated through Microsoft Teams impersonation — directly threatens every M365/Teams environment </td> </tr> <tr> <td> 24 Apr </td> <td> CISA adds 4 new entries to the Known Exploited Vulnerabilities (KEV) catalog </td> <td> Mandatory patching timelines apply to federal systems; state agencies aligned with CISA guidance must prioritize </td> </tr> <tr> <td> 22 Apr </td> <td> CyberProof Threat Research documents a new ClickFix variant using cmdkey and regsvr32 instead of PowerShell </td> <td> Renders most existing ClickFix detection rules ineffective — government is an explicit target </td> </tr> <tr> <td> 26–27 Apr </td> <td> WARLOCK SPIDER (Storm-2603) actor profile refreshed; Qilin ransomware FTP exfiltration infrastructure confirmed active </td> <td> U.S. government explicitly listed as a target; active infrastructure IOCs available for blocking </td> </tr> <tr> <td> 26 Apr </td> <td> DragonForce ransomware actor profile updated; active targeting of government and healthcare confirmed </td> <td> Adds to the ransomware pressure on state and local government alongside WARLOCK SPIDER and Akira </td> </tr> <tr> <td> 27 Apr </td> <td> CrowdStrike delivers fresh APT28 (Fancy Bear) malware indicators at confidence level 90 </td> <td> Russia’s premier cyber-espionage group has refreshed its tooling — updated indicators are available via Anomali ThreatStream Next-Gen  and CrowdStrike feeds </td> </tr> <tr> <td> 13 Apr (disclosed) </td> <td> Itron discloses unauthorized access to internal IT systems via SEC 8-K filing </td> <td> Itron provides smart meters and grid management to utilities and municipalities nationwide — supply chain exposure for any state using their products </td> </tr> <tr> <td> 27 Apr </td> <td> Vibing.exe — a Microsoft Store application linked to a Microsoft GenAI research lab in Beijing — found harvesting screenshots, audio, clipboard data </td> <td> Demonstrates that the Microsoft Store itself can be a vector for surveillance-capable software on government endpoints </td> </tr> <tr> <td> 23 Apr (ongoing) </td> <td> Joint 16-agency advisory confirms Volt Typhoon and Flax Typhoon remain pre-positioned in U.S. critical infrastructure via 200,000+ compromised SOHO routers </td> <td> The “IOC Extinction” concept means traditional blocklist defenses are structurally insufficient against these actors </td> </tr> <tr> <td> 23 Apr (ongoing) </td> <td> CISA Malware Analysis Report on FIRESTARTER firmware backdoor targeting Cisco ASA/FTD firewalls </td> <td> Persists at the pre-OS boot level, surviving standard patching — forensic verification required per Emergency Directive 25-03 </td> </tr> <tr> <td> Apr (ongoing) </td> <td> Microsoft Entra ID Service Principal privilege escalation vulnerability patched in April 2026 Patch Tuesday </td> <td> Unpatched Entra ID environments remain exposed to tenant admin takeover via Service Principal abuse — verify patch deployment immediately </td> </tr> </tbody> </table> <h2>Threat Timeline: Key Events (April 2026)</h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor / Campaign </th> <th> Target Sector </th> </tr> </thead> <tbody> <tr> <td> 13 Apr </td> <td> Itron detects unauthorized IT system access </td> <td> Unattributed </td> <td> Energy, Water, Utilities </td> </tr> <tr> <td> 22 Apr </td> <td> ClickFix cmdkey/regsvr32 evasion variant documented </td> <td> Financially motivated (multiple affiliates) </td> <td> Government, Commercial </td> </tr> <tr> <td> 23 Apr </td> <td> CISA publishes FIRESTARTER MAR; updates Emergency Directive 25-03 </td> <td> China-nexus (suspected) </td> <td> Network infrastructure </td> </tr> <tr> <td> 23 Apr </td> <td> 16-agency advisory on Volt Typhoon / Flax Typhoon SOHO router compromise </td> <td> Volt Typhoon (PLA/MSS), Flax Typhoon (Integrity Technology Group/MSS) </td> <td> U.S. critical infrastructure </td> </tr> <tr> <td> 24 Apr </td> <td> GTIG publishes UNC6692 SNOW framework analysis </td> <td> UNC6692 (financially motivated) </td> <td> Enterprise, Government </td> </tr> <tr> <td> 24 Apr </td> <td> CISA adds 4 new KEV entries </td> <td> Multiple </td> <td> Cross-sector </td> </tr> <tr> <td> 26 Apr </td> <td> DragonForce ransomware actor profile updated; active targeting confirmed </td> <td> DragonForce </td> <td> Government, Healthcare </td> </tr> <tr> <td> 26–27 Apr </td> <td> WARLOCK SPIDER / Qilin ransomware infrastructure refreshed </td> <td> WARLOCK SPIDER (Storm-2603) </td> <td> Government, Healthcare, Energy </td> </tr> <tr> <td> 27 Apr </td> <td> APT28 fresh malware indicators delivered via CrowdStrike </td> <td> APT28 / Fancy Bear (Russia/GRU) </td> <td> Government (targeted) </td> </tr> <tr> <td> 27 Apr </td> <td> Vibing.exe surveillance application identified </td> <td> Linked to Microsoft GenAI research (Beijing) </td> <td> Any Microsoft Store user </td> </tr> </tbody> </table> <h2>Key Threat Analysis                                </h2> <h3>1. UNC6692 SNOW Framework: Your Help Desk Is Calling — But It’s Not Your Help Desk</h3> What it is: UNC6692 is a financially motivated threat group that has built a sophisticated attack chain around Microsoft Teams social engineering. The playbook: flood a target’s inbox with spam email, then call them on Teams posing as IT support offering to “fix” the problem. Once the victim grants remote access, the attackers deploy an AutoHotKey-based loader that installs the SNOW malware suite — Snowbelt, Snowglaze, and Snowbasin — designed for persistent access, credential harvesting, and ultimately full domain compromise including NTDS.dit exfiltration. Why it matters for state government: Every state agency runs Microsoft Teams. The attack exploits trust in internal IT communications and requires no malware delivery via email — it comes through a collaboration platform most security tools treat as trusted. Four independent sources (GTIG, SecurityWeek, HackerNews, SOCPrime) have confirmed the TTPs. Key ATT&CK techniques: T1566.003 (Spearphishing via Service), T1204.002 (User Execution: Malicious File), T1219 (Remote Access Software), T1059.010 (AutoHotKey scripting), T1078.004 (Cloud Account abuse), T1114.002 (Remote Email Collection) <h3>2. ClickFix Evolves: PowerShell Is Out, LOLBins Are In</h3> What it is: ClickFix — the social engineering technique that tricks users into executing malicious commands via fake CAPTCHA pages — has been one of the most effective initial access vectors against government targets in 2026. This week, researchers documented a significant evolution: the latest variant abandons PowerShell entirely. Instead, it chains two native Windows utilities: <ul> <li>cmdkey.exe — stores credentials to an attacker-controlled IP address</li> <li>regsvr32.exe — loads a remote DLL via UNC path without dropping files to disk</li> </ul> The attack then creates a scheduled task (“RunNotepadNow”) that pulls its definition from a remote XML file, enabling persistent and updatable command-and-control. Why it matters: Most SOC detection rules for ClickFix key on PowerShell execution patterns. This variant produces zero PowerShell telemetry. If your detection engineering hasn’t been updated for this LOLBin variant, these attacks will sail through undetected. Anomali ThreatStream Next-Gen campaign data explicitly confirms government as a target sector. Key ATT&CK techniques: T1204.001 (User Execution: Malicious Link), T1059.003 (Windows Command Shell), T1218.010 (Regsvr32 proxy execution), T1053.005 (Scheduled Task persistence), T1078.001 (Default Accounts — cmdkey credential storage) <h3>3. WARLOCK SPIDER and the Qilin Ransomware Refresh</h3> What it is: WARLOCK SPIDER (also tracked as Storm-2603, GOLD SALEM) is a ransomware-focused threat group operating the Qilin ransomware. This week, their actor profile was refreshed with confirmed active infrastructure — specifically FTP-based data exfiltration servers at 176.113.115.209 and 176.113.115.97 (confidence: 100). Their target list explicitly includes U.S. government, government public services, healthcare, energy, education, and manufacturing. Alongside WARLOCK SPIDER, the DragonForce, Akira, and Everest ransomware groups all showed updated activity profiles targeting government in the same reporting window. The ransomware ecosystem targeting state and local government is not contracting — it is actively refreshing infrastructure and expanding. Key ATT&CK techniques: T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery), T1048.003 (Exfiltration Over Unencrypted Protocol — FTP) <h3>4. APT28 (Fancy Bear): Fresh Russian Malware Indicators</h3> What it is: Anomali detected malware indicators attributed to APT28/Fancy Bear — Russia’s GRU-linked cyber-espionage group. These are targeted malware samples, not commodity tools. While specific technique details were not included, APT28 historically operates with spearphishing attachments (T1566.001), credential dumping (T1003), and sophisticated C2 over standard web protocols (T1071). Why it matters: APT28 has a documented history of targeting government entities. Fresh indicators mean refreshed tooling. The specific hash values from this reporting cycle are available through Anomali ThreatStream Next-Gen — SOC teams should pull the latest APT28 indicators directly from our platform and deploy them to the detection stack immediately. <h3>5. Itron Breach: A Supply Chain Signal for Water and Energy</h3> What it is: Itron — a $2.37 billion company providing smart meters, grid management, and data analytics to utilities and municipalities — disclosed unauthorized access to its internal IT systems via an SEC 8-K filing. The breach was detected on April 13. No ransomware group has claimed responsibility. The company states customer-hosted systems were unaffected, but the investigation is ongoing. Why it matters: If your state uses Itron products for water monitoring, smart metering, or energy grid management, this is a supply chain exposure that requires active vendor engagement. The absence of a ransomware claim could indicate espionage rather than financial motivation — which may be worse from a long-term risk perspective. <h3>6. Continuing Threats: Volt Typhoon, FIRESTARTER, and APT41</h3> Three major threats from the prior reporting cycle remain active and unresolved: <ul> <li>Volt Typhoon and Flax Typhoon (China/PLA-MSS) remain pre-positioned in U.S. critical infrastructure via 200,000+ compromised SOHO routers. The joint 16-agency advisory introduced the “IOC Extinction” concept — these actors rotate infrastructure so rapidly that traditional blocklists are structurally ineffective. Behavioral detection is the only reliable countermeasure.</li> <li>FIRESTARTER, a firmware backdoor targeting Cisco ASA/FTD firewalls, persists at the pre-OS boot level and survives standard patching. CISA’s Emergency Directive 25-03 requires forensic verification of affected devices.</li> <li>APT41 (China/MSS) maintains active targeting of U.S. state government .NET web applications. No new indicators this cycle, but the campaign remains active.</li> </ul> <h2>Predictive Analysis: What Comes Next</h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> <th> Timeframe </th> </tr> </thead> <tbody> <tr> <td> Additional UNC6692 SNOW reporting with actionable IOCs (hashes, domains) as GTIG analysis propagates </td> <td> HIGH (>70%) </td> <td> GTIG full analysis published; security community amplification cycle underway </td> <td> 3–5 days </td> </tr> <tr> <td> Itron breach attribution — ransomware claim on leak site or espionage determination </td> <td> MODERATE (40–60%) </td> <td> SEC 8-K filed; if ransomware, leak site claim typically follows within 1–2 weeks </td> <td> 1–2 weeks </td> </tr> <tr> <td> CISA KEV additions for Samsung MagicINFO (CVE-2024-7399) or SharePoint (CVE-2025-53770) </td> <td> MODERATE (40–60%) </td> <td> Active exploitation campaigns detected; KEV addition follows confirmed exploitation </td> <td> 1–2 weeks </td> </tr> <tr> <td> ClickFix cmdkey/regsvr32 variant used in confirmed government compromise </td> <td> MODERATE (40–60%) </td> <td> Government explicitly targeted; variant evades common detections </td> <td> 2–4 weeks </td> </tr> <tr> <td> Direct ransomware incident against a U.S. state or local government entity </td> <td> LOW-MODERATE (25–40%) </td> <td> WARLOCK SPIDER, DragonForce, Akira all actively targeting government; infrastructure refreshed </td> <td> 1–2 weeks </td> </tr> <tr> <td> Volt Typhoon activation (destructive action vs. continued prepositioning) </td> <td> LOW (<20%) </td> <td> Prepositioning posture maintained; activation likely tied to geopolitical trigger </td> <td> Indeterminate </td> </tr> </tbody> </table> <h2>SOC Operational Guidance                      </h2> <h3>Immediate Detection Priorities</h3> Hunt Hypothesis 1: ClickFix LOLBin Variant Adversaries are using cmdkey.exe to store credentials to external IPs and regsvr32.exe to load remote DLLs via UNC paths, bypassing PowerShell-based ClickFix detections. <ul> <li>Monitor: Process creation events for cmdkey.exe with command-line arguments containing external IP addresses (T1059.003, T1078.001)</li> <li>Monitor:regsvr32.exe loading DLLs via UNC paths (\\<IP>\<share>\*.dll) (T1218.010)</li> <li>Monitor: Scheduled task creation with the name “RunNotepadNow” or tasks pulling XML definitions from remote URLs (T1053.005)</li> <li>Detection logic: Alert on cmdkey /add commands referencing any non-RFC1918 IP address. Alert on regsvr32 /s /n /i:\\ with external paths.</li> </ul> Hunt Hypothesis 2: UNC6692 Teams-Based Social Engineering Adversaries are using email bombing followed by Microsoft Teams calls impersonating IT help desk to deploy SNOW malware via AutoHotKey loaders. <ul> <li>Monitor: Unusual volume of inbound external Teams calls or messages, especially from unverified domains (T1566.003)</li> <li>Monitor: AutoHotKey process execution (AutoHotKey.exe, .ahk file creation) on endpoints (T1059.010)</li> <li>Monitor: Remote access tool sessions initiated during or immediately after Teams calls (T1219)</li> <li>Monitor: Anomalous M365 email access patterns post-compromise — bulk email reads or forwarding rule creation (T1114.002)</li> <li>Investigate: Any user-reported “IT called me on Teams” incidents — establish a clear internal communication policy that IT will never cold-call via Teams requesting remote access.</li> </ul> Hunt Hypothesis 3: Vibing.exe Surveillance Application A Microsoft Store application is exfiltrating screenshots, audio, clipboard data, and window titles to an Azure Front Door endpoint. <ul> <li>Hunt: Search EDR for vibing.exe or Vibing Installer.exe across all managed endpoints</li> <li>Monitor: WebSocket connections to Azure Front Door endpoints from non-approved applications (T1041)</li> </ul> Hunt Hypothesis 4: Qilin Ransomware Exfiltration WARLOCK SPIDER is using FTP for pre-encryption data exfiltration to known infrastructure. <ul> <li>Monitor: Any outbound FTP (port 21) traffic to external destinations — FTP exfiltration is a hallmark of this group (T1048.003)</li> <li>Investigate: Outbound FTP connections from servers or workstations that have no business reason for FTP usage</li> </ul> <h3>ATT&CK Technique Summary for This Cycle</h3> <table> <thead> <tr> <th> Technique ID </th> <th> Name </th> <th> Associated Threat </th> </tr> </thead> <tbody> <tr> <td> T1566.003 </td> <td> Phishing: Spearphishing via Service </td> <td> UNC6692 SNOW (Teams) </td> </tr> <tr> <td> T1204.001 </td> <td> User Execution: Malicious Link </td> <td> ClickFix (fake CAPTCHA) </td> </tr> <tr> <td> T1204.002 </td> <td> User Execution: Malicious File </td> <td> UNC6692 SNOW (AutoHotKey) </td> </tr> <tr> <td> T1059.003 </td> <td> Command and Scripting: Windows Command Shell </td> <td> ClickFix cmdkey/regsvr32 variant </td> </tr> <tr> <td> T1059.010 </td> <td> Command and Scripting: AutoHotKey </td> <td> UNC6692 SNOW </td> </tr> <tr> <td> T1218.010 </td> <td> System Binary Proxy Execution: Regsvr32 </td> <td> ClickFix LOLBin variant </td> </tr> <tr> <td> T1053.005 </td> <td> Scheduled Task/Job </td> <td> ClickFix persistence </td> </tr> <tr> <td> T1078.004 </td> <td> Valid Accounts: Cloud Accounts </td> <td> UNC6692, Entra ID flaw </td> </tr> <tr> <td> T1098 </td> <td> Account Manipulation </td> <td> Entra ID privilege escalation </td> </tr> <tr> <td> T1114.002 </td> <td> Email Collection: Remote Email Collection </td> <td> UNC6692 post-compromise </td> </tr> <tr> <td> T1219 </td> <td> Remote Access Software </td> <td> UNC6692 SNOW </td> </tr> <tr> <td> T1486 </td> <td> Data Encrypted for Impact </td> <td> WARLOCK SPIDER / Qilin </td> </tr> <tr> <td> T1490 </td> <td> Inhibit System Recovery </td> <td> WARLOCK SPIDER / Qilin </td> </tr> <tr> <td> T1048.003 </td> <td> Exfiltration Over Unencrypted Protocol (FTP) </td> <td> Qilin ransomware </td> </tr> </tbody> </table> <h2>Sector-Specific Defensive Priorities         </h2> <h3>Financial Services (State Treasury, Revenue, Benefits Systems)</h3> State financial systems process tax payments, benefits disbursements, and procurement transactions — making them high-value targets for both ransomware operators and credential-theft campaigns. <ul> <li>Priority 1: UNC6692 SNOW framework poses direct risk to M365-integrated financial workflows. Restrict external Teams access for finance-facing accounts and enforce phishing-resistant MFA (FIDO2) on all accounts with access to financial systems.</li> <li>Priority 2: ClickFix cmdkey/regsvr32 variant can harvest stored credentials for financial applications. Audit cmdkey credential stores on finance workstations — no external IPs should be present.</li> <li>Priority 3: WARLOCK SPIDER/Qilin explicitly targets financial services. Ensure offline backups of financial databases are current and tested. Monitor for outbound FTP from financial system servers.</li> </ul> <h3>Energy (State Energy Offices, Utility Oversight, Grid Interdependencies)</h3> <ul> <li>Priority 1: The Itron breach is the most immediate concern. If your state’s regulated utilities or municipal power/water systems use Itron smart meters or grid management platforms, initiate vendor engagement immediately. Request Itron’s breach notification letter and assess whether any state-managed or state-overseen systems share network connectivity with Itron infrastructure.</li> <li>Priority 2:Volt Typhoon prepositioning in critical infrastructure remains the strategic threat. Behavioral detection of lateral movement (not IOC-based blocking) is the only effective countermeasure. Focus on anomalous authentication patterns in OT-adjacent networks.</li> <li>Priority 3: Ensure SCADA/ICS networks are segmented from enterprise IT. The convergence of IT breaches (Itron) and OT prepositioning (Volt Typhoon) means a single compromise could bridge both domains.</li> </ul> <h3>Healthcare (State Health Agencies, Medicaid Systems, Public Health)</h3> <ul> <li>Priority 1: WARLOCK SPIDER/Qilin, DragonForce, and Akira all explicitly target healthcare. State Medicaid systems, public health databases, and hospital oversight systems are in scope. Block Qilin exfiltration IPs and monitor for outbound FTP from healthcare data repositories.</li> <li>Priority 2: UNC6692 Teams impersonation is particularly dangerous in healthcare environments where IT support interactions are frequent and trust is high. Establish a clear policy: IT will never initiate unsolicited Teams calls requesting remote access.</li> <li>Priority 3: Ensure HIPAA-regulated data stores have immutable backups. Ransomware actors increasingly target healthcare knowing that patient safety concerns accelerate ransom payment decisions.</li> </ul> <h3>Government (Executive Branch Agencies, Legislature, Courts)</h3> <ul> <li>Priority 1: ClickFix remains the most likely initial access vector for state government compromise. The cmdkey/regsvr32 variant specifically targets government. Update detection rules immediately — PowerShell-only monitoring is no longer sufficient.</li> <li>Priority 2:APT28/Fancy Bear fresh indicators suggest active Russian intelligence collection against government targets. Pull the current APT28 indicator set from Anomali ThreatStream Next-Gen and deploy to EDR and email security gateways. Brief agency security officers on spearphishing awareness.</li> <li>Priority 3:APT41 continues targeting state government .NET web applications. Audit all internet-facing .NET applications for current patching status, particularly SharePoint instances (CVE-2025-53770 is under active exploitation by China-origin actors).</li> <li>Priority 4: Review Microsoft Store application policies. The Vibing.exe incident demonstrates that even “trusted” app stores can distribute surveillance-capable software. Consider WDAC/AppLocker policies restricting Store installations to an approved whitelist.</li> </ul> <h3>Aviation / Logistics (State DOT, Airport Authorities, Port Systems)</h3> <ul> <li>Priority 1: WARLOCK SPIDER’s target list includes transportation and logistics. State DOT systems managing traffic infrastructure, airport IT networks, and port logistics platforms should be assessed for ransomware readiness — particularly backup integrity and network segmentation.</li> <li>Priority 2: Volt Typhoon’s prepositioning in critical infrastructure includes transportation systems. Audit SOHO routers and edge devices in DOT field offices and remote transportation management centers for signs of compromise. Replace end-of-life networking equipment that cannot receive firmware updates.</li> <li>Priority 3: The FIRESTARTER Cisco ASA/FTD backdoor is relevant to any agency using Cisco firewalls at transportation facilities. Verify compliance with CISA Emergency Directive 25-03 — standard patching is insufficient; forensic verification of firmware integrity is required.</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>IMMEDIATE (Within 24 Hours)</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Create detection rules for ClickFix LOLBin variant: Alert on cmdkey.exe with external IP arguments and regsvr32.exe loading DLLs via UNC paths. Existing PowerShell-based ClickFix rules do not detect this variant. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy APT28/Fancy Bear IOCs to detection stack: Pull the current APT28 malware indicator set (confidence 90) directly from Anomali ThreatStream Next-Gen and CrowdStrike Falcon Intelligence feeds and deploy to EDR and email security gateways. </td> </tr> <tr> <td> 3 </td> <td> Security Awareness </td> <td> Issue advisory to all agency staff: IT support will never initiate unsolicited Microsoft Teams calls requesting remote access. Any such call should be reported to the SOC immediately. </td> </tr> </tbody> </table> <h3>7-DAY Actions</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops / M365 Admin </td> <td> Restrict Microsoft Teams external access: Configure external access policies to block or limit inbound Teams calls and messages from unverified external domains. This is the primary mitigation for UNC6692 SNOW. </td> </tr> <tr> <td> 2 </td> <td> IT Ops </td> <td> Inventory Itron product usage across all state agencies and utility oversight bodies. If Itron systems are in use, contact the vendor for breach impact assessment and monitor for follow-on advisories. </td> </tr> <tr> <td> 3 </td> <td> IT Ops / IAM </td> <td> Audit Microsoft Entra ID Service Principal permissions. A recently patched vulnerability allowed privilege escalation to tenant admin via Service Principal abuse. Verify Entra ID agent configurations are current and remove excessive Service Principal privileges. Confirm April 2026 Patch Tuesday updates are deployed. </td> </tr> <tr> <td> 4 </td> <td> IT Ops / M365 Admin </td> <td> Evaluate RemoveMicrosoftCopilotApp Group Policy for enterprise deployment to reduce attack surface from bundled AI features on managed endpoints. </td> </tr> <tr> <td> 5 </td> <td> SOC </td> <td> Tune Teams telemetry: Enable and review audit logging for external Teams interactions, particularly inbound calls from external tenants and screen-sharing sessions initiated by external users. </td> </tr> </tbody> </table> <h3>30-DAY Actions</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> CISO / Enterprise Architecture </td> <td> Implement Microsoft Store application whitelisting. Deploy AppLocker or Windows Defender Application Control (WDAC) policies restricting Microsoft Store app installation to an approved list. The Vibing.exe incident proves the Store is not a trusted boundary. </td> </tr> <tr> <td> 2 </td> <td> CISO / Procurement </td> <td> Request security posture assessments from all contracted MSPs. Require SOC 2 Type II attestation or equivalent. MSP supply chain compromise remains a structurally high risk for state government — the absence of recent incidents is not evidence of safety. </td> </tr> <tr> <td> 3 </td> <td> CISO / Network Engineering </td> <td> Verify Cisco ASA/FTD firmware integrity per CISA Emergency Directive 25-03. The FIRESTARTER backdoor persists at the pre-OS boot level and survives standard patching. Forensic verification — not just patching — is required. </td> </tr> <tr> <td> 4 </td> <td> CISO / Application Security </td> <td> Audit all internet-facing .NET web applications for current patching, with specific attention to SharePoint instances. APT41 continues targeting state government .NET applications, and CVE-2025-53770 is under active exploitation. </td> </tr> <tr> <td> 5 </td> <td> CISO / IR Planning </td> <td> Update incident response playbooks to include Teams-based social engineering scenarios (UNC6692), LOLBin-based ClickFix variants (cmdkey/regsvr32), and supply chain breach response procedures (Itron model). Tabletop these scenarios within 30 days. </td> </tr> </tbody> </table> <h2>The Bottom Line                             </h2> The threat actors targeting state government are not standing still. This week alone, we saw a social engineering campaign weaponize Microsoft Teams as an attack platform, a proven phishing technique evolve to evade the detection rules most SOCs have in place, a critical infrastructure vendor disclose a breach with unknown scope, and Russia’s most capable cyber-espionage group refresh its malware arsenal. What makes this moment particularly challenging is the convergence. UNC6692 exploits your collaboration platform. ClickFix exploits your users and now evades your detections. Itron’s breach threatens your supply chain. Volt Typhoon sits quietly in your infrastructure waiting. These are not separate problems — they are different facets of the same reality: adversaries are targeting the trust relationships and technology dependencies that make state government function. The good news is that the defensive actions are concrete and achievable. Restricting Teams external access, updating detection rules for LOLBin-based social engineering, blocking known ransomware infrastructure, and inventorying vendor exposure are all actions that can be taken this week with existing resources. The question is not whether these threats will reach your environment. Several of them already have the capability. The question is whether your defenses have kept pace with the adversary’s evolution. Based on this week’s intelligence, the answer for most state agencies is: not yet — but the gap is closable if you act now.

FEATURED RESOURCES

April 27, 2026

Anomali Cyber Watch

Ceasefire That Isn’t: Day 59 of Iran’s Cyber War on U.S. Critical Infrastructure

April 27, 2026

Anomali Cyber Watch

Public Sector

When Attackers Call You on Teams: The Evolving Threat Landscape Facing State Government IT

April 24, 2026

Anomali Cyber Watch

Iran’s Cyber War Machine Is Accelerating — And the Ceasefire Doesn’t Cover It

Explore All