When Every Door Opens at Once: The Converging Cyber Threats State Government Leaders Cannot Afford to Ignore

Public Sector

Published on

March 26, 2026

Table of Contents

Threat Assessment Level: ELEVATED Changed from HIGH (prior cycle, March 25) to ELEVATED. Rationale: The acute threats identified last cycle — the DarkSword iOS exploit leak, the Foster City ransomware emergency, and the TeamPCP supply chain cascade — remain active but are now better characterized, with Microsoft publishing detection guidance and CISA issuing patching directives. However, new developments this cycle (Pay2Key ransomware re-emergence, Kimsuky government-targeting campaign, Ivanti EPMM active exploitation, and the confirmation that Coruna is a maintained nation-state exploit framework now publicly available) sustain an elevated posture. The threat environment has not improved — it has broadened. <h2>Introduction                                 </h2> State government IT leaders are facing a threat environment unlike anything in recent memory. In the span of a single week, a supply chain attack has wormed its way through seven developer ecosystems and over 1,000 SaaS environments. An Iranian ransomware group thought dormant has resurfaced with the ability to encrypt an entire enterprise in three hours. Government-grade iPhone exploitation tools — once the exclusive province of nation-states — have been posted to GitHub for anyone to download. And a North Korean espionage group has been caught using the same remote management software that your MSPs use to administer state endpoints. These are not hypothetical scenarios. They are happening now, and they are converging on the same infrastructure that state agencies depend on to deliver public services. This briefing distills the most critical intelligence from the past 72 hours into actionable guidance for state CIOs and CISOs. The message is straightforward: the window for proactive defense is narrowing, and several of these threats require decisions — not just awareness — this week. <h2>What Changed This Week</h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> TeamPCP supply chain attack expands to 7+ ecosystems; Lapsus$ joins extortion </td> <td> Any state DevOps team using Trivy, LiteLLM, GitHub Actions, or related open-source tools may have compromised credentials. Over 1,000 SaaS environments affected with worm-like propagation. </td> </tr> <tr> <td> Pay2Key (Iran-linked) ransomware re-emerges with 3-hour encryption capability </td> <td> Encrypted a U.S. healthcare provider’s entire infrastructure in under 3 hours. Has collected $8M+ from 170 victims since July 2025. Possible change of ownership to Russian-speaking operators. </td> </tr> <tr> <td> Coruna iOS exploit kit confirmed as Operation Triangulation evolution; DarkSword leaked on GitHub </td> <td> Kaspersky confirms Coruna is a continuously maintained nation-state framework. Combined with the DarkSword GitHub leak (March 23), full iPhone compromise capability is now open-source and available to any threat actor. </td> </tr> <tr> <td> Kimsuky (North Korea) targeting government with ConnectWise/PowerShell tooling </td> <td> Fresh indicators show DPRK espionage actors using the same remote management tools that MSPs deploy on state agency endpoints. </td> </tr> <tr> <td> Ivanti EPMM CVE-2026-1281 & CVE-2026-1340 under active exploitation </td> <td> Two CVSS 9.8 unauthenticated remote code execution flaws in Ivanti’s mobile device management platform, with government explicitly listed as a target sector. </td> </tr> <tr> <td> CISA publishes ICS advisories for Schneider Electric and Automated Logic building systems </td> <td> Vulnerabilities in DCS workstations, building automation controllers, and BMS web interfaces — systems commonly deployed in state government facilities. </td> </tr> <tr> <td> CISA operational capacity continues to degrade </td> <td> Workforce reductions, defunded programs, and lapsed information-sharing authorities are transferring federal cybersecurity responsibilities to states at the worst possible time. States should not assume federal incident response support will be available at prior levels. </td> </tr> </tbody> </table> <h2>Threat Timeline: Key Events (March 6–26, 2026)</h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Threat Category </th> </tr> </thead> <tbody> <tr> <td> Mar 6 </td> <td> MuddyWater (Iran/MOIS) Dindoor campaign last observed activity </td> <td> Nation-State Espionage </td> </tr> <tr> <td> Mar 11 </td> <td> Handala / Void Manticore execute 12-petabyte Stryker wiper attack </td> <td> Nation-State Destructive </td> </tr> <tr> <td> Mar 18 </td> <td> TeamPCP supply chain compromise discovered across 6 ecosystems </td> <td> Supply Chain </td> </tr> <tr> <td> Mar 22 </td> <td> Foster City, CA declares state of emergency after ransomware attack </td> <td> Ransomware — Local Gov </td> </tr> <tr> <td> Mar 23 </td> <td> FBI confirms Iranian attribution for Handala; seizes leak sites </td> <td> Nation-State Attribution </td> </tr> <tr> <td> Mar 23 </td> <td> DarkSword iOS exploit kit leaked on GitHub </td> <td> Mobile Exploitation </td> </tr> <tr> <td> Mar 24 </td> <td> CISA issues 21-day iOS patching directive </td> <td> Vulnerability Management </td> </tr> <tr> <td> Mar 24 </td> <td> CISA publishes ICS advisories for Schneider Electric and Automated Logic </td> <td> OT/ICS Vulnerability </td> </tr> <tr> <td> Mar 25 </td> <td> TeamPCP expands to LiteLLM (PyPI); Lapsus$ joins extortion wave </td> <td> Supply Chain Escalation </td> </tr> <tr> <td> Mar 25 </td> <td> Georgia awards $10M in cybersecurity grants to schools and local governments </td> <td> Defensive Investment </td> </tr> <tr> <td> Mar 25–26 </td> <td> Kimsuky fresh IOCs targeting government via ConnectWise/PowerShell </td> <td> Nation-State Espionage </td> </tr> <tr> <td> Mar 26 </td> <td> Pay2Key ransomware re-emergence reported with enhanced TTPs </td> <td> Ransomware — Iranian </td> </tr> <tr> <td> Mar 26 </td> <td> Kaspersky confirms Coruna as Operation Triangulation evolution </td> <td> Mobile Exploitation </td> </tr> <tr> <td> Mar 26 </td> <td> Ivanti EPMM CVE-2026-1281/1340 active exploitation targeting government </td> <td> Vulnerability Exploitation </td> </tr> </tbody> </table> <h2>Key Threat Analysis                         </h2> <h3>1. The TeamPCP Supply Chain Cascade: 1,000+ Environments and Counting</h3> The TeamPCP supply chain compromise is now the most significant software supply chain attack since SolarWinds — and it is still expanding. What began as a compromise of the Trivy CI/CD pipeline has cascaded through GitHub Actions, Docker Hub, npm, OpenVSX, PyPI, VS Code extensions, and now the LiteLLM Python library (versions 1.82.7 and 1.82.8). The malicious packages deploy credential-harvesting backdoors that enable Kubernetes-wide persistence and lateral movement. The addition of Lapsus$ to the extortion wave is a significant escalation. This group, known for high-profile breaches of major technology companies, is now leveraging credentials stolen through the TeamPCP pipeline to extort victims directly. Why state government should care: Any agency development team, data analytics group, or contractor using open-source Python libraries, Docker containers, or GitHub Actions workflows could be affected. The worm-like propagation means a single compromised dependency can spread laterally across interconnected environments. Microsoft published formal detection and investigation guidance on March 24 — this should be applied immediately. Key TTPs: Supply Chain Compromise (T1195.002), Python scripting (T1059.006), Credentials in Files (T1552.001), Valid Accounts for lateral movement (T1078), Container Deployment (T1610) <h3>2. Pay2Key: Iranian Ransomware Returns with a 3-Hour Kill Chain</h3> Pay2Key, an Iran-linked ransomware operation active since 2020, has resurfaced with dramatically improved capabilities. In a recent attack on a U.S. healthcare provider, the group encrypted the entire infrastructure in just three hours — a timeline that leaves virtually no room for manual incident response. Their updated playbook is notable for its use of legitimate tools to evade detection: TeamViewer for interactive access, Mimikatz and LaZagne for credential harvesting, Advanced IP Scanner and NetScan for network reconnaissance, and direct interaction with Active Directory via dsa.msc rather than noisier enumeration tools. A “No Defender” evasion toolkit was deployed and then removed to frustrate forensic analysis. The ransomware itself was delivered as a self-extracting 7zip archive (abc.exe). The attribution picture is complicated. Pay2Key attempted to sell its entire operation in late 2025, and ties to Russian-speaking threat actors on criminal forums raise questions about current ownership. An Iranian-origin ransomware group potentially now operated by Russian-speaking criminals represents a dangerous convergence of nation-state and cybercriminal ecosystems. Since July 2025, Pay2Key has collected over $8 million from 170 victims. The group has explicitly demonstrated willingness to prioritize destruction over financial gain — blurring the line between criminal ransomware and state-directed sabotage. Key TTPs: Remote Access via TeamViewer (T1021.001), Credential Dumping (T1003), Data Encrypted for Impact (T1486), Disable Security Tools (T1562.001), Remote System Discovery (T1018), Domain Account Discovery (T1087.002), Inhibit System Recovery (T1490) <h3>3. Government-Grade iPhone Exploitation Is Now Open Source</h3> The mobile threat landscape for government has fundamentally changed. Kaspersky’s Global Research and Analysis Team (GReAT) has confirmed that the Coruna iOS exploit kit is a continuously maintained evolution of Operation Triangulation — the sophisticated espionage framework originally attributed to a Russia-aligned nation-state actor. Coruna contains 5 full iOS exploit chains and 23 individual exploits targeting iOS versions 13.0 through 17.2.1, including CVE-2023-32434 and CVE-2023-38606 (originally zero-days in Operation Triangulation). The framework now supports Apple A17, M3, M3 Pro, and M3 Max processors. Combined with the DarkSword exploit kit leak on GitHub (March 23) — developed by Iranian state actors UNC6353, UNC6748, and PARS Defense — two independent government-grade iOS exploitation frameworks are now publicly available. The traditional assumption that full-chain mobile exploits are restricted to well-resourced nation-states is no longer valid. Coruna has already been observed in watering hole attacks in Ukraine and mass exploitation campaigns deploying PLASMAGRID malware via fake gambling and cryptocurrency sites. CISA issued a 21-day patching directive on March 24. Key TTPs: Exploitation of Remote Services / Watering Hole (T1210), Exploitation for Client Execution (T1203), Data from Local System (T1005), Indicator Removal (T1070.004) <h3>4. Kimsuky Targets Government with ConnectWise and PowerShell</h3> Fresh indicators from the past 48 hours show Kimsuky, North Korea’s prolific cyber espionage group, deploying password-stealing trojans associated with ConnectWise and PowerShell threat families against government targets. Confirmed malicious executables have been identified and tagged as very-high severity; hash IOCs are available via Anomali ThreatStream Next-Gen. This is significant because ConnectWise ScreenConnect is widely used by managed service providers (MSPs) supporting state government agencies. If Kimsuky is leveraging legitimate remote management tools for persistence, this creates a supply-chain-adjacent threat vector that bypasses traditional perimeter defenses. ScreenConnect is already a convergence point for multiple threat streams: tax-season phishing campaigns are delivering ScreenConnect-based malware, and CVE-2026-3564 exposes ScreenConnect servers to hijacking. Key TTPs: Remote Access Software (T1219), PowerShell (T1059.001), Credentials from Password Stores (T1555), Malicious File Execution (T1204.002) <h3>5. Ivanti EPMM: Unauthenticated RCE Targeting Government MDM</h3> Two critical vulnerabilities in Ivanti Endpoint Manager Mobile (EPMM) — CVE-2026-1281 and CVE-2026-1340, both rated CVSS 9.8 — are under active exploitation. Both are unauthenticated remote code execution flaws via code injection. Government is explicitly listed among the target sectors. Ivanti EPMM is used for mobile device management. A compromise of this platform could give attackers control over an agency’s entire managed mobile device inventory — the ability to push configurations, install applications, or access device data at scale. Key TTPs: Exploit Public-Facing Application (T1190), Command and Scripting Interpreter (T1059), Valid Accounts for persistence (T1078) <h3>6. OT/ICS: Building Management and Industrial Control Vulnerabilities</h3> CISA published multiple ICS advisories on March 24 affecting systems commonly deployed in state government facilities: <ul> <li>Schneider Electric EcoStruxure Foxboro DCS (ICSA-26-083-02): Vulnerability in distributed control system workstations and servers</li> <li>Schneider Electric Plant iT/Brewmaxx (ICSA-26-083-03): Privilege escalation leading to remote code execution</li> <li>Automated Logic WebCTRL Premium Server (ICSA-26-078-08): Attackers can read, intercept, or modify communications in building automation systems</li> <li>Schneider Electric Modicon Controllers (ICSA-26-078-02): Cross-site scripting and open redirect leading to account compromise</li> </ul> State government facilities — courthouses, data centers, office complexes, water treatment plants — commonly use these building management and process control systems. Iranian threat actors have demonstrated sustained interest in OT pre-positioning against U.S. infrastructure, making these advisories more than routine patch notifications. Key TTPs: Manipulation of Control (T0831), Modify Parameter (T0836), Unauthorized Command Message (T0855), Exploit Public-Facing Application (T1190) <h2>The Structural Shift: CISA Capacity Degradation</h2> One development that does not appear in vulnerability databases or threat feeds but profoundly affects state government security posture: CISA’s operational capacity continues to degrade. Workforce reductions, defunded election security programs, and the lapse of the Cybersecurity Information Sharing Act are creating a federal-to-state risk transfer that is not temporary. States that previously relied on CISA for threat intelligence sharing, incident response support, and election security guidance are increasingly on their own. Georgia’s recent $10 million cybersecurity grant program for schools and local governments (announced March 25) offers one model for states to fill this gap with their own resources. But the broader legislative picture remains quiet — no new federal or state cybersecurity legislation has advanced in recent weeks, even as the threat environment intensifies. <h2>Predictive Analysis: What Comes Next</h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> TeamPCP supply chain artifacts discovered in additional ecosystems beyond the current 7 </td> <td> >75% (HIGH) </td> <td> 1–2 weeks </td> <td> Worm-like propagation pattern; cached malicious artifacts still circulating on mirror infrastructure despite takedowns </td> </tr> <tr> <td> Tax-season phishing campaigns intensify with ScreenConnect delivery and EDR bypass techniques </td> <td> >75% (HIGH) </td> <td> Through April 15 </td> <td> Seasonal pattern; multiple active campaigns already observed; tax deadline creates urgency </td> </tr> <tr> <td> Pay2Key targets additional U.S. organizations, potentially including government </td> <td> 50–75% (MODERATE) </td> <td> 2–4 weeks </td> <td> Geopolitical acceleration of Iranian operations; 170 victims since July 2025 indicates high operational tempo </td> </tr> <tr> <td> Coruna/DarkSword exploit code integrated into commodity exploit kits </td> <td> 50–75% (MODERATE) </td> <td> 2–3 weeks </td> <td> Modular design confirmed by Kaspersky; GitHub availability lowers barrier to adoption </td> </tr> <tr> <td> Kimsuky ConnectWise campaign expands to target MSPs serving state government </td> <td> 25–50% (LOW-MODERATE) </td> <td> 2–6 weeks </td> <td> Early indicators only; DPRK actors have historically targeted MSPs as access vectors </td> </tr> <tr> <td> Additional Iranian cyber operations against U.S. targets (beyond Pay2Key, Handala, MuddyWater/MOIS) </td> <td> 50–75% (MODERATE) </td> <td> 2–4 weeks </td> <td> Four distinct Iranian groups already active; geopolitical tensions show no signs of de-escalation </td> </tr> </tbody> </table> <h2>SOC Operational Guidance</h2> <h3>Detection Priorities</h3> <ol> <li> Pay2Key Ransomware TTPs — Hunt Immediately</li> </ol> Pay2Key’s 3-hour encryption timeline means detection must happen early in the kill chain or not at all. Focus on the reconnaissance and credential access phases: <ul> <li>Hypothesis: Attackers are using TeamViewer for interactive access from unauthorized external IPs.</li> </ul> <ul> <li>Detection: Monitor for TeamViewer process execution (TeamViewer.exe, TeamViewer_Service.exe) on servers and workstations where it is not an approved tool. Alert on TeamViewer connections from IP ranges outside your MSP allowlist. (T1021.001)</li> <li>ATT&CK: T1021.001 — Remote Services</li> </ul> <ul> <li>Hypothesis: Credential harvesting tools are being deployed prior to ransomware execution.</li> </ul> <ul> <li>Detection: Alert on execution of Mimikatz, LaZagne, ExtPassword, or their known filenames/hashes. Monitor for LSASS memory access (Sysmon Event ID 10 with TargetImage containing lsass.exe). (T1003)</li> <li>ATT&CK: T1003 — OS Credential Dumping</li> </ul> <ul> <li>Hypothesis: Attackers are enumerating Active Directory using native tools to avoid detection.</li> </ul> <ul> <li>Detection: Monitor for dsa.msc (Active Directory Users and Computers) launched from non-administrative workstations or by non-admin accounts. Alert on Advanced IP Scanner or ns.exe (NetScan) execution. (T1087.002, T1018)</li> <li>ATT&CK: T1087.002 — Account Discovery: Domain Account; T1018 — Remote System Discovery</li> </ul> <ul> <li>Hypothesis: Ransomware is delivered via self-extracting archives.</li> </ul> <ul> <li>Detection: Monitor for self-extracting 7zip archives executing from %TEMP% or user download directories. Alert on rapid file encryption patterns (high volume of file modification events across network shares). (T1486)</li> <li>ATT&CK: T1486 — Data Encrypted for Impact</li> </ul> <ul> <li>Hypothesis: Attackers are disabling endpoint protection before ransomware deployment.</li> </ul> <ul> <li>Detection: Alert on Windows Defender service stops, tamper protection modifications, or security product uninstallation events. Monitor for unknown executables that are deployed and then deleted within a short timeframe (“No Defender” pattern). (T1562.001)</li> <li>ATT&CK: T1562.001 — Impair Defenses: Disable or Modify Tools</li> </ul> <ol start="2"> <li> Kimsuky ConnectWise/PowerShell Campaign</li> </ol> <ul> <li>Detection: Retrieve current Kimsuky malicious hash IOCs from Anomali ThreatStream Next-Gen and deploy to endpoint protection blocklists. Monitor for ConnectWise ScreenConnect agent installations that were not initiated through your approved MSP change management process. Alert on PowerShell execution with encoded commands or download cradles on endpoints where ScreenConnect is installed. (T1219, T1059.001, T1555)</li> <li>ATT&CK: T1219 — Remote Access Software; T1059.001 — PowerShell; T1555 — Credentials from Password Stores</li> </ul> <ol start="3"> <li> Supply Chain Indicators (TeamPCP/LiteLLM)</li> </ol> <ul> <li>Detection: Scan all Python environments, Docker images, and CI/CD pipelines for litellm==1.82.7 or litellm==1.82.8. Monitor for unexpected outbound connections from CI/CD runners or container orchestration platforms. Alert on new Kubernetes service accounts or pod deployments that were not initiated through approved workflows. (T1195.002, T1610)</li> <li>ATT&CK: T1195.002 — Supply Chain Compromise; T1610 — Deploy Container</li> </ul> <ol start="4"> <li> iOS Exploitation (DarkSword/Coruna)</li> </ol> <ul> <li>Detection: Monitor MDM telemetry for iOS devices exhibiting unexpected behavior: new profiles installed, unknown applications, or devices that have stopped checking in. Alert on any state-managed device running iOS versions below 18.8. If your MDM is Ivanti EPMM, verify the MDM platform itself is not compromised (see CVE-2026-1281/1340 below). (T1210, T1203)</li> <li>ATT&CK: T1210 — Exploitation of Remote Services; T1203 — Exploitation for Client Execution</li> </ul> <ol start="5"> <li> Ivanti EPMM Exploitation</li> </ol> <ul> <li>Detection: Monitor Ivanti EPMM server logs for unauthenticated API calls, unexpected administrative actions, or code injection patterns. If your Ivanti EPMM instance is internet-facing, check web server access logs for exploitation attempts against the vulnerable endpoints. Alert on any new device enrollment or policy push that was not initiated by MDM administrators. (T1190)</li> <li>ATT&CK: T1190 — Exploit Public-Facing Application</li> </ul> <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services (State Treasury, Revenue, Pension Systems)</h3> State financial systems are high-value targets for both ransomware operators (Pay2Key’s $8M+ in collections demonstrates the financial incentive) and nation-state actors seeking economic disruption. <ul> <li>Priority 1: Ensure all payment processing and treasury management systems have offline backup capability tested within the last 30 days. Pay2Key’s 3-hour encryption timeline means backup integrity is the last line of defense.</li> <li>Priority 2: Tax-season phishing campaigns delivering ScreenConnect malware are intensifying through April 15. Deploy additional email filtering rules for tax-themed lures and monitor for ScreenConnect installations on finance department endpoints.</li> <li>Priority 3: Audit all third-party financial software dependencies for TeamPCP-compromised packages, particularly Python-based analytics and reporting tools.</li> </ul> <h3>Energy (State-Regulated Utilities, Energy Commission)</h3> Iranian threat actors have demonstrated sustained interest in energy sector OT systems, and the convergence of four active Iranian groups (Pay2Key, Handala, MuddyWater (MOIS), and the OT pre-positioning campaign) elevates the risk. <ul> <li>Priority 1: Review CISA ICS advisory ICSA-26-083-02 (Schneider Electric EcoStruxure Foxboro DCS) for applicability to state-regulated utility SCADA environments. Apply patches or network segmentation controls.</li> <li>Priority 2: Verify that OT networks are segmented from IT networks with monitored jump hosts. Iranian pre-positioning campaigns target the IT-OT boundary.</li> <li>Priority 3: Ensure energy sector partners and regulated utilities have incident response plans that account for a 3-hour encryption scenario.</li> </ul> <h3>Healthcare (State Health Agencies, Medicaid Systems, Public Health)</h3> Pay2Key’s most recent confirmed victim was a U.S. healthcare provider. State health agencies managing Medicaid enrollment, public health surveillance, and vital records are directly in the target set. <ul> <li>Priority 1: Validate that all healthcare-adjacent systems have endpoint detection and response (EDR) deployed and functioning. Pay2Key’s “No Defender” toolkit specifically targets security tool removal.</li> <li>Priority 2: Ensure HIPAA-regulated systems have immutable backups that cannot be encrypted or deleted by ransomware. Test restoration procedures.</li> <li>Priority 3: Brief clinical and public health staff on the heightened phishing risk — healthcare workers are frequently targeted with credential harvesting campaigns that exploit urgency and authority.</li> </ul> <h3>Government (All State Agencies)</h3> State government remains the #1 target sector for ransomware, and this week’s intelligence shows threats arriving from every vector simultaneously: supply chain, nation-state espionage, mobile exploitation, and direct infrastructure attacks. <ul> <li>Priority 1: Patch Ivanti EPMM immediately if used for mobile device management (CVE-2026-1281, CVE-2026-1340 — CVSS 9.8, active exploitation, government explicitly targeted). If patching is not possible within 48 hours, isolate the EPMM server from the network.</li> <li>Priority 2: Verify all state-issued iOS devices are running iOS 18.8 or later. Devices on earlier versions are vulnerable to publicly available exploit chains that enable full device takeover.</li> <li>Priority 3: Audit MSP access. If your agency uses managed service providers that deploy ConnectWise ScreenConnect, verify agent integrity, ensure ScreenConnect servers are patched to version 26.1+, and confirm that MSP access is logged and monitored.</li> </ul> <h3>Aviation and Logistics (State DOT, Port Authorities, Airport Operations)</h3> Transportation and logistics systems face compounding risk from both OT vulnerabilities and supply chain compromise. <ul> <li>Priority 1: Review CISA ICS advisories for Automated Logic WebCTRL (ICSA-26-078-08) — building automation systems in airports, transit facilities, and port buildings may be affected.</li> <li>Priority 2: Ensure that operational technology networks supporting traffic management, port operations, and airport systems are segmented and monitored independently from enterprise IT.</li> <li>Priority 3: Audit any CI/CD pipelines or custom software development supporting logistics and transportation management for TeamPCP-compromised dependencies.</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>Immediate (Within 24 Hours)</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IMMEDIATE </td> <td> IT Operations </td> <td> Patch Ivanti EPMM against CVE-2026-1281 and CVE-2026-1340 (CVSS 9.8, unauthenticated RCE). If patching is not possible within 24 hours, isolate the EPMM server from the network. Government is an explicitly targeted sector. </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Block Kimsuky IOCs — retrieve current malicious hash indicators for the Kimsuky ConnectWise/PowerShell campaign from Anomali ThreatStream Next-Gen and deploy to endpoint protection blocklists immediately. </td> </tr> <tr> <td> IMMEDIATE </td> <td> DevOps / IT Operations </td> <td> Audit all Python environments for LiteLLM versions 1.82.7 or 1.82.8. Remove immediately and pin to a verified clean version. Rotate all credentials in any environment where these versions were installed. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Operations / MDM Team </td> <td> Verify all state-issued iPhones and iPads are running iOS 18.8 or later. Devices on iOS 13.0–18.7 are vulnerable to DarkSword/Coruna exploit chains now publicly available. Prioritize executive and field staff devices. </td> </tr> <tr> <td> IMMEDIATE </td> <td> Executive / CISO </td> <td> Brief senior leadership on the Pay2Key ransomware threat and the 3-hour encryption timeline. Ensure incident response plans include a scenario where full encryption occurs before the SOC can respond. Verify that ransomware tabletop exercises have been conducted within the last 90 days. </td> </tr> </tbody> </table> <h3>7-Day Actions</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Deploy Pay2Key detection rules — monitor for TeamViewer connections from unauthorized sources, Mimikatz/LaZagne/ExtPassword execution, dsa.msc launched from non-admin workstations, ns.exe (NetScan) execution, and self-extracting 7zip archives in temp directories. </td> </tr> <tr> <td> 7-DAY </td> <td> IT Operations </td> <td> Audit all ConnectWise ScreenConnect instances managed by MSPs serving state agencies. Verify agent binary integrity against ConnectWise-published hashes. Ensure ScreenConnect servers are patched to version 26.1+ (CVE-2026-3564). Review and restrict MSP access permissions to least-privilege. </td> </tr> <tr> <td> 7-DAY </td> <td> Facilities / OT Security </td> <td> Review CISA ICS advisories ICSA-26-083-02 (Schneider Electric Foxboro DCS), ICSA-26-083-03 (Schneider Electric Plant iT), and ICSA-26-078-08 (Automated Logic WebCTRL) for applicability to state building management systems. Apply vendor patches or implement compensating network segmentation controls. </td> </tr> <tr> <td> 7-DAY </td> <td> SOC / Identity Team </td> <td> Harden Microsoft 365 against AiTM attacks. The Tycoon2FA phishing-as-a-service platform remains operational despite a partial takedown. Enforce phishing-resistant MFA (FIDO2/passkeys) for all privileged accounts. Review conditional access policies to block legacy authentication and require compliant devices. </td> </tr> <tr> <td> 7-DAY </td> <td> IR Team </td> <td> Update incident response playbooks to account for a 3-hour ransomware encryption scenario. Ensure automated containment actions (network isolation, account lockout) can be triggered without waiting for human approval. Test backup restoration from immutable/offline copies. </td> </tr> </tbody> </table> <h3>30-Day Actions</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 30-DAY </td> <td> CISO / CIO </td> <td> Engage state legislature on cybersecurity funding. CISA’s operational capacity continues to degrade, creating a federal-to-state risk transfer. Georgia’s $10M cybersecurity grant program offers a replicable model. The legislative silence on cybersecurity — despite escalating ransomware incidents and nation-state targeting — is itself a risk that requires executive advocacy. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO / DevOps </td> <td> Commission a software supply chain risk assessment. The TeamPCP campaign has demonstrated that a single CI/CD compromise can cascade across 7+ ecosystems. Assess state agency exposure to open-source dependency risks. Establish a software bill of materials (SBOM) program and dependency pinning policy for all agency development teams. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO / IT Operations </td> <td> Conduct a comprehensive MSP security review. ScreenConnect has become a convergence point for Kimsuky espionage, tax-season malware delivery, and direct vulnerability exploitation. Review all MSP contracts for security requirements, access logging, and incident notification obligations. Consider requiring MSPs to use state-managed remote access tools rather than their own. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Reassess mobile device security architecture. The democratization of iOS exploitation via Coruna/DarkSword represents a structural shift. Evaluate whether current MDM policies, device refresh cycles, and patching timelines are adequate given that commodity threat actors now have access to government-grade exploit chains. Consider mobile threat defense (MTD) solutions for high-risk users. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO / CIO </td> <td> Develop a state-level election security contingency plan for the 2026 midterms. With CISA’s election security programs defunded and the Cybersecurity Information Sharing Act lapsed, states bear primary responsibility. Identify alternative sources of threat intelligence, incident response support, and security assessment for election infrastructure. </td> </tr> </tbody> </table> <h2>The Bottom Line                            </h2> The threat environment facing state government IT is defined by three structural shifts that are unlikely to reverse in the near term: First, the supply chain attack surface is expanding faster than defensive capacity. TeamPCP’s progression through seven developer ecosystems demonstrates that a single CI/CD compromise can cascade across the entire modern software supply chain. State agencies that consume open-source tooling in any capacity — and nearly all do — need to treat software supply chain risk as a first-order security concern, not an edge case. Second, the line between nation-state operations and criminal ransomware is dissolving. Pay2Key’s Iranian origins, possible Russian-speaking operators, and explicit willingness to prioritize destruction over profit represent a new category of threat that does not fit neatly into traditional “nation-state” or “criminal” frameworks. When the same group may be conducting state-directed sabotage on Monday and profit-motivated extortion on Tuesday, defenders cannot afford to treat these as separate problems. Third, the federal cybersecurity safety net is fraying. CISA’s capacity degradation is not a temporary budget dispute — it represents a structural shift in who is responsible for state and local government cybersecurity. States that wait for federal guidance or support may find themselves waiting through an incident. The threats described in this briefing are not theoretical. Foster City is still operating under a state of emergency. Over 1,000 SaaS environments are compromised. Government-grade iPhone exploits are on GitHub. The decisions that state IT leaders make this week — on patching, on MSP oversight, on legislative engagement, on incident response readiness — will determine whether these threats remain intelligence findings or become incident reports.

FEATURED RESOURCES

March 26, 2026

Anomali Cyber Watch

When Ransomware Meets Statecraft: Iran's Cyber War Enters Its Most Dangerous Phase

March 26, 2026

Public Sector

Anomali Cyber Watch

When Every Door Opens at Once: The Converging Cyber Threats State Government Leaders Cannot Afford to Ignore

March 26, 2026

ThreatStream

Threat Intelligence Platform

Introducing ThreatStream Next-Gen: New AI-Powered Capabilities to Sharpen Your Intelligence Operations

Explore All