When Hacktivists Start Acting Like Nation-States: The Converging Threats Facing State Government Networks

Public Sector

Published on

April 8, 2026

Table of Contents

Threat Assessment Level: ELEVATED — Trending HIGH Changed from ELEVATED (prior cycle, April 7). The threat level remains ELEVATED but continues to trend toward HIGH based on new evidence of Iranian APT exploitation of U.S. critical infrastructure PLCs (CISA AA26-097A), a confirmed pro-Iran hacktivist compromise of a U.S. county government, APT28’s global router credential-harvesting campaign, and active exploitation of a CVSS 10.0 vulnerability in an AI development platform. The convergence of state-sponsored, hacktivist, and criminal threats against government infrastructure in a single 24-hour cycle justifies the upward trend. <h2>Introduction                                    </h2> If you lead IT or cybersecurity for a state agency, the last 48 hours should have your full attention. On April 7, CISA published an urgent advisory warning that Iranian-affiliated threat actors are actively manipulating programmable logic controllers (PLCs) at U.S. government facilities, water systems, and energy sites. The same day, we confirmed that a pro-Iran hacktivist group — one that used to limit itself to website defacements — had spent months inside a U.S. county government’s IT infrastructure before exfiltrating two terabytes of data. Meanwhile, Russia’s APT28 is compromising routers across 120 countries to steal credentials and bypass multi-factor authentication, and a critical vulnerability in an AI platform that many organizations have deployed is being actively exploited in the wild. These are not theoretical risks. They are confirmed, active operations targeting the exact types of systems that state governments operate. This blog provides the intelligence picture, the specific threats, and — most importantly — what your teams should do about them this week. <h2>What Changed (April 7–8, 2026)         </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> March 19, 2026 </td> <td> DOJ seized Iranian cyber infrastructure </td> <td> Triggered confirmed retaliatory pre-positioning in U.S. critical infrastructure by CyberAv3ngers (IRGC-CEC) </td> </tr> <tr> <td> April 1, 2026 </td> <td> Handala Hack published St. Joseph County, Indiana breach claim </td> <td> 2TB exfiltrated from U.S. county government after months of reconnaissance — discovered April 8 </td> </tr> <tr> <td> April 6, 2026 </td> <td> FortiClient EMS CVE-2026-35616 (CVSS 9.8) confirmed under active exploitation </td> <td> EvilTokens PhaaS deploying 1,000+ domains against M365 authentication simultaneously </td> </tr> <tr> <td> April 7, 2026 </td> <td> CISA Advisory AA26-097A: Iranian APT exploiting Rockwell Automation PLCs </td> <td> Active exploitation at U.S. government facilities, water/wastewater, and energy sites </td> </tr> <tr> <td> April 7, 2026 </td> <td> ClickFix/AMOS macOS credential-theft campaign discovered </td> <td> Poisoned Google Ads targeting AI tool users for credential harvesting </td> </tr> <tr> <td> April 7, 2026 </td> <td> OpenSSL CVE-2026-31790 disclosed </td> <td> RSA KEM memory leak affecting OpenSSL 3.0–3.6; moderate severity </td> </tr> <tr> <td> April 7, 2026 </td> <td> Huntress publishes NightSpire ransomware incident analysis </td> <td> New RaaS family using RDP + legitimate tools for access and exfiltration </td> </tr> <tr> <td> April 8, 2026 </td> <td> APT28 global router compromise campaign confirmed </td> <td> 18,000+ MikroTik/TP-Link devices across ~120 countries; credential theft bypassing 2FA </td> </tr> <tr> <td> April 8, 2026 </td> <td> Flowise CVE-2025-59528 (CVSS 10.0) confirmed under active exploitation </td> <td> 12,000–15,000 internet-exposed AI platform instances at risk </td> </tr> </tbody> </table> <h2>Threat 1: Iranian APT Exploitation of Industrial Control Systems</h2> Actors: Iranian state-sponsored APT (linked to prior IRGC campaigns against Unitronics PLCs) Advisory: CISA AA26-097A This is the most operationally significant threat in today’s cycle. CISA confirmed that Iranian-affiliated actors are using Rockwell Automation Studio 5000 Logix Designer to establish accepted connections to internet-facing Allen-Bradley PLCs at U.S. government facilities, water/wastewater treatment plants, and energy sites. The campaign has been active since at least March 2026. The attackers are not just gaining access — they are manipulating HMI/SCADA displays and project files, meaning operators may not see accurate readings of what physical systems are doing. They deploy Dropbear SSH on victim endpoints for persistent remote access. Why this matters for state government: Many state agencies operate or oversee water treatment facilities, transportation SCADA systems, and energy grid coordination. If any of these systems use Rockwell Automation PLCs with internet connectivity, they are in the target set right now. Key ports to monitor: 44818, 2222, 102, 22, 502 <h2>Threat 2: Handala Hack — When Hacktivists Become APTs</h2> Actor: Handala Hack (pro-Iran hacktivist group) Victim: St. Joseph County, Indiana (U.S. county government) This incident represents a disturbing evolution. Handala Hack — previously known for defacement and DDoS operations — conducted a months-long reconnaissance campaign against St. Joseph County’s centralized IT infrastructure before achieving full compromise and exfiltrating over 2TB of data. Simultaneously, Handala claimed a separate attack on Israeli defense contractor PSK WIND Technologies. This is not typical hacktivism. The patience, scope, and sophistication of this operation mirror state-sponsored APT tradecraft. It raises a critical question: is Handala operating independently, or is it a front for Iranian state-sponsored operations? Regardless of the answer, the operational impact is the same. A U.S. county government — with infrastructure architecturally identical to many state agencies — was fully compromised by a group that most defenders would have categorized as a low-sophistication nuisance. Handala joins an expanding pro-Iran hacktivist coalition that includes the Conquerors Electronic Army and 313 Team, which collectively executed 1,583 verified incidents across 14 countries under Operation Epic Fury, escalating to destructive and wiper operations in April 2026. Actor claim site:handala-hack[.]tw <h2>Threat 3: APT28 Global Router Compromise</h2> Actor: APT28 / Fancy Bear / GRU Unit 26165 (Russia) APT28 is conducting a global campaign compromising outdated MikroTik and TP-Link routers — at least 18,000 devices across approximately 120 countries, including the United States. The attackers modify router configurations to redirect traffic to attacker-controlled infrastructure, enabling them to intercept credentials and access tokens, effectively bypassing two-factor authentication. Microsoft has notified over 200 organizations and 5,000 consumer devices. The FBI is expected to announce domain seizures. Targets explicitly include government agencies and law enforcement. Why this matters for state government: State networks often include MikroTik or TP-Link devices at field offices, remote facilities, and smaller agency locations where enterprise-grade equipment may not be deployed. A single compromised router can provide APT28 with credential access to the broader state network. This campaign reinforces a finding from prior cycles: MFA alone is insufficient against current session-hijacking and token-replay techniques. APT28 is stealing tokens downstream of the authentication event, rendering the second factor irrelevant. <h2>Threat 4: NightSpire Ransomware — A New RaaS Entrant</h2> Actor: NightSpire (likely operating as Ransomware-as-a-Service) Huntress published a detailed incident analysis of a NightSpire ransomware deployment observed in late March 2026. NightSpire, first discovered in February 2025, appears to be maturing into a RaaS operation. The affiliate’s playbook is notable for its heavy reliance on legitimate tools: <table> <thead> <tr> <th> Stage </th> <th> Tool Used </th> </tr> </thead> <tbody> <tr> <td> Initial Access </td> <td> RDP (T1021.001) </td> </tr> <tr> <td> Persistence / Remote Access </td> <td> Chrome Remote Desktop, AnyDesk (T1219) </td> </tr> <tr> <td> Discovery </td> <td> Everything / voidtools (T1083) </td> </tr> <tr> <td> Staging </td> <td> 7-Zip (T1560.001) </td> </tr> <tr> <td> Exfiltration </td> <td> MEGASync (T1567.002) </td> </tr> <tr> <td> Impact </td> <td> NightSpire ransomware — .nspire extension (T1486) </td> </tr> </tbody> </table> The affiliate claimed 2.5TB of data exfiltration. NightSpire’s use of tools already present in many enterprise environments makes detection challenging without specific behavioral analytics. State and local government remains a top-3 targeted vertical for ransomware. Active ransomware groups with confirmed government targeting that were refreshed in intelligence feeds this cycle include: DragonForce, Qilin, Akira, CHATTY SPIDER, MASKED SPIDER, and TRAVELING SPIDER. <h2>Threat 5: Flowise AI Platform — CVSS 10.0 Under Active Exploitation</h2> CVE: CVE-2025-59528 (CVSS 10.0) Additional CVEs under exploitation: CVE-2025-8943, CVE-2025-26319 Flowise, an open-source AI agent builder, has a critical remote code execution vulnerability in its CustomMCP node that allows arbitrary JavaScript execution via the Function() constructor with full Node.js privileges. VulnCheck confirmed active exploitation from at least one IP address. Between 12,000 and 15,000 Flowise instances are internet-exposed. This is the second AI/LLM orchestration platform with a confirmed critical RCE this cycle (following Langflow earlier). A pattern is emerging: AI development platforms are being deployed with minimal security hardening and are becoming a significant new attack surface. State agencies are increasingly adopting AI tools for citizen services, document processing, and internal chatbots. If any agency — or any vendor serving state agencies — has deployed Flowise, this requires immediate action. Patched in version 3.0.6; current version is 3.1.1. <h2>Threat 6: OpenSSL Memory Leak (CVE-2026-31790)</h2> CVE: CVE-2026-31790 (Moderate severity) Affected versions: OpenSSL 3.0–3.6 and their FIPS modules Not affected: OpenSSL 1.0.2 and 1.1.1 OpenSSL disclosed a flaw in RSA KEM (RSASVE) encapsulation where improper return-value checking in RSA_public_encrypt() causes the system to treat encryption failures as successes. An attacker who supplies an invalid RSA public key can potentially receive uninitialized memory contents — which may contain sensitive data from prior cryptographic operations. While not yet exploited in the wild, this affects a foundational library present across virtually all Linux-based state government web servers and middleware. Patched versions: 3.0.20, 3.3.7, 3.4.5, 3.5.6, 3.6.2 Workaround: Call EVP_PKEY_public_check() or EVP_PKEY_public_check_quick() before EVP_PKEY_encapsulate() <h2>Continuing Threats From Prior Cycles</h2> The following threats from previous reporting periods remain active and relevant: <ul> <li>APT42 (IRGC-IO), MuddyWater (MOIS), and CyberAv3ngers (IRGC-CEC) continue pre-positioning operations in U.S. critical infrastructure following the March 19 DOJ seizure of Iranian cyber infrastructure</li> <li>TA416 / Mustang Panda (China) — fresh IOCs for BobbyCar and CoolClient malware families were refreshed in intelligence feeds on April 8</li> <li>FortiClient EMS CVE-2026-35616 (CVSS 9.8) remains under active exploitation</li> <li>EvilTokens PhaaS continues deploying 1,000+ domains against M365 authentication</li> <li>Volt Typhoon and Salt Typhoon (China) — notably silent this cycle despite escalating U.S.-China trade tensions. This absence is anomalous and may indicate an operational pause before escalation or a shift to undetected infrastructure</li> </ul> <h2>Predictive Analysis: Next 7 Days</h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> CISA publishes follow-on IOCs and detection signatures for Iranian PLC campaign (AA26-097A) </td> <td> HIGH (>70%) </td> <td> Standard CISA advisory lifecycle; initial advisory typically followed by detailed IOC release </td> </tr> <tr> <td> Handala or affiliated pro-Iran groups claim additional U.S. government victims </td> <td> MODERATE (40–60%) </td> <td> St. Joseph County breach was published April 1 but only discovered April 8 — undisclosed victims likely exist </td> </tr> <tr> <td> Flowise exploitation expands as exploit code circulates </td> <td> MODERATE (40–60%) </td> <td> CVSS 10.0 with 12K–15K exposed instances; currently single-source exploitation will likely broaden </td> </tr> <tr> <td> Volt Typhoon or Salt Typhoon activity resurfaces amid U.S.-China tensions </td> <td> LOW-MODERATE (25–40%) </td> <td> Current silence is anomalous given geopolitical context; may indicate pre-positioning rather than inactivity </td> </tr> <tr> <td> NightSpire ransomware claims a state or local government victim </td> <td> MODERATE (30–50%) </td> <td> RaaS maturation + government as top-3 ransomware target vertical + RDP-based initial access widely available </td> </tr> <tr> <td> APT28 router campaign leads to confirmed credential compromise at a U.S. government entity </td> <td> MODERATE (40–60%) </td> <td> 18,000+ compromised devices; FBI domain seizures expected, suggesting active investigation of government impact </td> </tr> </tbody> </table> <h2>SOC Operational Guidance                  </h2> <h3>Immediate Hunting Hypotheses</h3> Hypothesis 1: Iranian PLC Manipulation - Hunt for: Connections to Rockwell Automation PLCs (port 44818) from external or unexpected internal IPs; Dropbear SSH installations on OT-adjacent endpoints; Studio 5000 Logix Designer sessions initiated from non-engineering workstations - ATT&CK techniques: T1190, T0831, T0836, T0855, T1021.004, T1133 - Data sources: OT network flow logs, firewall logs for ports 44818/2222/102/22/502, endpoint detection on engineering workstations Hypothesis 2: NightSpire Affiliate Tooling - Hunt for: Unauthorized installations of Chrome Remote Desktop, AnyDesk, Everything (voidtools[.]com), MEGASync, or WPS Office; RDP sessions from unexpected sources followed by RMM tool deployment; files with .nspire extension; Volume Shadow Copy deletion commands - ATT&CK techniques: T1021.001, T1219, T1083, T1560.001, T1567.002, T1486, T1490 - Data sources: EDR telemetry (process creation, file writes), RDP authentication logs, outbound connection logs to MEGASync infrastructure Hypothesis 3: APT28 Router Compromise - Hunt for: DNS configuration changes on MikroTik/TP-Link routers; unexpected routing table modifications; traffic redirection to unfamiliar external IPs; authentication token replay (sessions appearing from geographically impossible locations) - ATT&CK techniques: T1557, T1539, T1584.008, T1020, T1556 - Data sources: Router configuration backups (diff against known-good), NetFlow/sFlow data, SIEM correlation of authentication events with impossible travel Hypothesis 4: Flowise/AI Platform Exploitation - Hunt for: Internet-exposed Flowise instances (Shodan/Censys query or internal asset scan); Node.js child process spawning from Flowise application directories; unexpected outbound connections from AI platform servers - ATT&CK techniques: T1190, T1059.007, T1059 - Data sources: Web application firewall logs, application server process monitoring, network segmentation logs <h3>Detection Priorities</h3> <table> <thead> <tr> <th> Priority </th> <th> Detection Rule </th> <th> ATT&CK ID </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> Alert on any external connection to OT/ICS ports (44818, 2222, 102, 502) </td> <td> T1190, T0855 </td> </tr> <tr> <td> CRITICAL </td> <td> Alert on Dropbear SSH binary presence on non-Linux-server endpoints </td> <td> T1021.004 </td> </tr> <tr> <td> HIGH </td> <td> Alert on unauthorized RMM tools (AnyDesk, Chrome Remote Desktop) on endpoints </td> <td> T1219 </td> </tr> <tr> <td> HIGH </td> <td> Alert on MEGASync or similar cloud sync tool outbound connections >1GB </td> <td> T1567.002 </td> </tr> <tr> <td> HIGH </td> <td> Alert on router configuration changes outside maintenance windows </td> <td> T1584.008 </td> </tr> <tr> <td> HIGH </td> <td> Alert on authentication events with impossible geographic travel </td> <td> T1539, T1556 </td> </tr> <tr> <td> MEDIUM </td> <td> Alert on Everything.exe (voidtools) execution on servers </td> <td> T1083 </td> </tr> <tr> <td> MEDIUM </td> <td> Alert on .nspire file extension creation </td> <td> T1486 </td> </tr> </tbody> </table> <h3>Blocking Guidance</h3> <ul> <li>Block inbound traffic on ports 44818, 2222, 102, 22, 502 from all non-whitelisted external IPs at the perimeter firewall — particularly for any OT/ICS network segments</li> <li>Block or alert on outbound connections to handala-hack[.]tw</li> <li>Block unauthorized RMM tools via application control policy (Chrome Remote Desktop, AnyDesk) unless explicitly approved</li> <li>Block MEGASync at the proxy/firewall level unless business-justified</li> </ul> <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services (State Treasury, Revenue, Tax Systems)</h3> State revenue and tax systems process millions of citizen financial records. The Kaspersky financial threat report (referenced in this cycle’s intelligence) confirms a surge in infostealer activity targeting financial platforms. Combined with EvilTokens PhaaS deploying 1,000+ domains against M365 authentication: <ul> <li>Priority: Harden M365 authentication with conditional access policies requiring compliant devices — not just MFA, which is being bypassed via token theft (T1539)</li> <li>Priority: Monitor for anomalous bulk data access patterns in tax/revenue databases, particularly as the April 15 tax deadline approaches</li> <li>Priority: Ensure all FortiClient EMS instances protecting financial system VPN access are patched against CVE-2026-35616</li> </ul> <h3>Energy (State-Operated or Overseen Utilities)</h3> The CISA AA26-097A advisory directly targets energy sites. States that operate or regulate energy infrastructure face the most acute risk in this cycle. <ul> <li>Priority: Conduct emergency audit of all Rockwell Automation/Allen-Bradley PLC internet exposure. Verify physical key switches are in RUN (not REMOTE) position</li> <li>Priority: Implement network segmentation between IT and OT — if Studio 5000 Logix Designer sessions can be initiated from IT network segments, the architecture is vulnerable</li> <li>Priority: Deploy OT-specific monitoring (e.g., Dragos, Claroty, Nozomi) if not already in place; IT EDR tools do not provide adequate visibility into PLC manipulation</li> </ul> <h3>Healthcare (State Health Agencies, Medicaid Systems)</h3> State health agencies manage Medicaid data, vital records, and public health surveillance systems — high-value targets for both ransomware operators and nation-state actors. <ul> <li>Priority: NightSpire ransomware’s RDP-based initial access vector is particularly relevant to healthcare environments where RDP is commonly used for clinical application access. Restrict RDP to jump servers with MFA; disable direct RDP to endpoints</li> <li>Priority: Audit all AI/chatbot deployments in citizen-facing health portals — if any use Flowise or similar platforms, patch or isolate immediately</li> <li>Priority: Ensure offline backups of Medicaid enrollment and vital records databases are current and tested</li> </ul> <h3>Government (Executive Agencies, Public Safety, Courts)</h3> The Handala Hack compromise of St. Joseph County demonstrates that government IT centralization is both a strength and a single point of failure. When centralized IT is compromised, every agency function is affected. <ul> <li>Priority: Review privileged access to centralized IT management systems (Active Directory, SCCM, Azure AD Connect). Implement tiered administration — Tier 0 (identity), Tier 1 (servers), Tier 2 (workstations) — with separate credentials for each</li> <li>Priority: Establish data exfiltration detection thresholds. Handala exfiltrated 2TB — this volume of outbound data transfer should trigger automated alerts</li> <li>Priority: Conduct tabletop exercise specifically modeling a hacktivist-to-APT scenario: extended reconnaissance → full infrastructure compromise → data exfiltration → public leak</li> </ul> <h3>Aviation / Logistics (State DOT, Airport Authorities, Port Systems)</h3> State transportation agencies operate SCADA systems for traffic management, bridge controls, and airport infrastructure that share architectural similarities with the water/energy PLCs targeted in CISA AA26-097A. <ul> <li>Priority: Extend the PLC audit (ports 44818, 2222, 102, 502) to transportation SCADA systems — traffic signal controllers, bridge SCADA, tunnel ventilation systems</li> <li>Priority: Audit MikroTik/TP-Link routers at remote transportation facilities (weigh stations, rest areas, field offices) for APT28 compromise indicators</li> <li>Priority: Review supply chain security for logistics software vendors — Flowise and similar AI tools are increasingly embedded in logistics optimization platforms</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>IMMEDIATE (Within 24 Hours)</h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Audit all Rockwell Automation/Allen-Bradley PLC internet exposure. Block inbound traffic on ports 44818, 2222, 102, 22, 502 from non-whitelisted IPs. Verify physical mode switches are in RUN position. Query logs for overseas IP connections to OT segments. </td> <td> OT Security + Network Ops </td> </tr> <tr> <td> Hunt for unauthorized installations of Chrome Remote Desktop, AnyDesk, MEGASync, and Everything (voidtools) across all endpoints. Any unauthorized RMM tool triggers immediate investigation. </td> <td> SOC </td> </tr> <tr> <td> Audit all agency-deployed AI/LLM platforms. If Flowise is present anywhere in the environment (including vendor-managed instances), upgrade to ≥3.0.6 immediately or remove from internet exposure. </td> <td> IT Operations + Application Owners </td> </tr> <tr> <td> Verify FortiClient EMS instances are patched against CVE-2026-35616 (CVSS 9.8, confirmed active exploitation from prior cycle). </td> <td> IT Operations </td> </tr> </tbody> </table> <h3>7-DAY</h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Inventory all MikroTik and TP-Link routers across state network infrastructure, including field offices and remote sites. Verify firmware is current. Diff router configurations against known-good baselines to detect unauthorized DNS/routing changes. </td> <td> Network Operations </td> </tr> <tr> <td> Patch OpenSSL to 3.0.20 / 3.3.7 / 3.4.5 / 3.5.6 / 3.6.2 on all Linux web servers and middleware. If immediate patching is not possible, implement EVP_PKEY_public_check() workaround. </td> <td> IT Operations + DevOps </td> </tr> <tr> <td> Develop and deploy detection signatures for bulk data exfiltration patterns (>500GB outbound from government network segments) — directly informed by Handala’s 2TB exfiltration from St. Joseph County. </td> <td> SOC + Detection Engineering </td> </tr> <tr> <td> Review and harden M365 conditional access policies. Require compliant/managed devices for all authentication — MFA alone is insufficient against current token-theft techniques used by APT28 and EvilTokens PhaaS. </td> <td> Identity & Access Management </td> </tr> </tbody> </table> <h3>30-DAY</h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Commission a comprehensive inventory of all AI agent and LLM platform deployments across state agencies, including vendor-managed AI tools embedded in SaaS platforms. Evaluate adoption of Microsoft’s Agent Governance Toolkit for M365 Copilot and Azure AI workloads. </td> <td> CISO + Agency IT Directors </td> </tr> <tr> <td> Conduct a tabletop exercise modeling the Handala scenario: extended reconnaissance → centralized IT compromise → multi-terabyte exfiltration → public data leak. Test incident response, communication, and recovery procedures. </td> <td> CISO + Incident Response </td> </tr> <tr> <td> Implement or validate OT/IT network segmentation. Ensure engineering workstations with Studio 5000 or equivalent PLC programming tools cannot be reached from general IT network segments. </td> <td> Network Architecture + OT Security </td> </tr> <tr> <td> Proactively research current federal and state cybersecurity legislation in progress. Legislative intelligence has been a blind spot for three consecutive collection cycles — this gap needs active remediation. </td> <td> CISO + Legislative Liaison </td> </tr> <tr> <td> Evaluate adding dedicated OT/ICS intelligence feeds (ICS-CERT, Dragos WorldView) to the state’s threat intelligence program. Current collection is IT-centric and inadequately covers the OT threat landscape highlighted by CISA AA26-097A. </td> <td> CTI Program Manager </td> </tr> </tbody> </table> <h2>The Bottom Line                       </h2> The threat environment facing state government networks is defined by convergence. The lines between hacktivism and state-sponsored operations are dissolving — Handala’s months-long compromise of a U.S. county government proves that. Nation-state actors from Iran, Russia, and China are simultaneously active against government infrastructure through different vectors: PLCs, routers, and identity platforms. Criminal ransomware operators continue to view state and local government as a preferred target. And a new attack surface — AI platforms deployed without adequate security — is being actively exploited. The good news: every threat in this report has specific, actionable defensive steps. The PLC audit, the router inventory, the AI platform review, the RMM tool hunt — these are concrete actions your teams can execute this week. The question is not whether these threats are real. CISA has confirmed them. The question is whether your agency will act on the intelligence before it becomes an incident.

FEATURED RESOURCES

April 8, 2026

Anomali Cyber Watch

Iran’s Cyber War Didn’t Stop With the Ceasefire — It Just Went Underground

April 8, 2026

Public Sector

Anomali Cyber Watch

When Hacktivists Start Acting Like Nation-States: The Converging Threats Facing State Government Networks

April 7, 2026

Anomali Cyber Watch

The 48-Hour Window: Iran's Cyber-Kinetic War Machine Reaches Maximum Threat Posture

Explore All