When Legitimate Tools Become Weapons: The Escalating Threat to State Government Networks

Public Sector

Published on

April 28, 2026

Table of Contents

Threat Assessment Level: ELEVATED The threat environment for U.S. state government remains at ELEVATED — unchanged from the prior cycle — driven by a convergence of identity-based attacks, supply chain tool abuse, and critical vulnerability exploitation. No single catastrophic event triggered this assessment; rather, the simultaneous escalation across multiple attack vectors targeting government infrastructure demands sustained defensive attention from state IT leadership. <h2> Executive Summary                     </h2> State government networks are facing a coordinated surge of threats that exploit the very tools agencies rely on to operate. In the past 72 hours, threat actors have weaponized at least four legitimate remote management tools in a single phishing campaign family, a financially motivated group is hunting senior government executives through Microsoft Teams with a purpose-built malware framework, and a newly documented AWS persistence technique has rendered a standard incident response step ineffective. Meanwhile, CISA has confirmed active exploitation of Samsung digital signage software deployed in government buildings nationwide, and a Cisco SD-WAN vulnerability scoring a perfect 10.0 on the CVSS scale threatens the backbone of state agency networking. This is not a theoretical risk assessment. These campaigns are active, evolving daily, and specifically designed to bypass the security controls most state agencies have in place. <h2> What Changed This Week                        </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> 22 Apr </td> <td> New ClickFix variant abandons PowerShell for cmdkey.exe and regsvr32.exe LOLBins </td> <td> Most existing SOC detection rules for ClickFix are now ineffective </td> </tr> <tr> <td> 23 Apr </td> <td> CISA publishes joint advisory on Volt Typhoon and Flax Typhoon China-nexus compromised-device relay networks </td> <td> Confirms active pre-positioning in critical infrastructure; state energy, water, and transportation networks are in scope </td> </tr> <tr> <td> 24 Apr </td> <td> CISA adds CVE-2024-7399 (Samsung MagicINFO 9 Server) to KEV catalog; Arctic Wolf confirms active exploitation </td> <td> Digital signage servers in government lobbies and public facilities are being targeted with system-level file write exploits </td> </tr> <tr> <td> 24 Apr </td> <td> Google Mandiant publishes full UNC6692 SNOW malware framework analysis </td> <td> Confirms 77% of victims are senior employees; three-component malware designed for complete domain takeover </td> </tr> <tr> <td> 25 Apr </td> <td> Active exploitation campaign tracked against CVE-2026-20127 (Cisco SD-WAN, CVSS 10.0) </td> <td> Cisco SD-WAN is backbone networking for many state agencies; no patch delay is acceptable at this severity level </td> </tr> <tr> <td> 26 Apr </td> <td> APT28 / Fancy Bear EVILTOSS malware family updated in threat intelligence feeds without accompanying new campaign activity </td> <td> Malware refresh without campaign activity may indicate a preparation phase targeting government networks </td> </tr> <tr> <td> 27 Apr </td> <td> Iranian espionage campaign (aerospace/government targeting) updated with new activity indicators </td> <td> Escalation risk to U.S. state government targets exists as geopolitical tensions persist </td> </tr> <tr> <td> 28 Apr </td> <td> Three new phishing variants detected in 24 hours delivering Tiflux RAT, UltraVNC, Splashtop, and Datto RMM </td> <td> Datto RMM — a Kaseya product with free trial — may be whitelisted in state environments, creating a critical detection blind spot </td> </tr> <tr> <td> 28 Apr </td> <td> CrowdStrike documents AWS federation token persistence technique </td> <td> Standard IR procedure of deactivating IAM API keys confirmed insufficient to contain compromised accounts </td> </tr> </tbody> </table> <h2> Threat Timeline: Active Campaigns Targeting Government </h2> <table> <thead> <tr> <th> Timeframe </th> <th> Actor / Campaign </th> <th> Target </th> <th> Status </th> </tr> </thead> <tbody> <tr> <td> Ongoing since Mar 2026 </td> <td> UNC6692 (SNOW malware framework) </td> <td> Senior employees, executives, privileged users across sectors including government </td> <td> Active — 77% of incidents target senior staff via Microsoft Teams impersonation </td> </tr> <tr> <td> Ongoing since Apr 2026 </td> <td> Unknown (Tiflux/UltraVNC/Datto RMM phishing) </td> <td> Broad targeting; government at risk due to RMM tool whitelisting </td> <td> Actively iterating — 3 new variants in 24 hours </td> </tr> <tr> <td> Ongoing </td> <td> APT28 / Fancy Bear (Russia/GRU) </td> <td> Government, defense, critical infrastructure </td> <td> Preparation phase suspected — EVILTOSS malware updated but no new campaign activity observed </td> </tr> <tr> <td> Ongoing </td> <td> Volt Typhoon, Flax Typhoon (China/PLA-MSS) </td> <td> Critical infrastructure, government networks </td> <td> Active — CISA advisory on compromised device networks published </td> </tr> <tr> <td> Ongoing </td> <td> Nightspire, Rhysida, Qilin, Play, Medusa, LockBit3, and others </td> <td> State and local government </td> <td> Active — multiple groups showing updated activity; no new confirmed state gov victim this cycle </td> </tr> <tr> <td> Updated 27 Apr </td> <td> Iranian espionage campaign (multi-vertical) </td> <td> Aerospace, government </td> <td> Monitoring — updated indicators, escalation risk to U.S. state targets </td> </tr> <tr> <td> 24 Apr </td> <td> Unknown (CVE-2024-7399 exploitation) </td> <td> Samsung MagicINFO 9 Server deployments </td> <td> Active exploitation confirmed by CISA KEV and Arctic Wolf </td> </tr> </tbody> </table> <h2> Key Threat Analysis                                </h2> <h3> 1. The RMM Tool Weaponization Surge: Your Approved Software Is the Attack Vector </h3> Three distinct phishing variants were detected within a single 24-hour window, all part of the same campaign family using invitation and notification lures. What makes this campaign uniquely dangerous for state government is the payload: four different legitimate remote management tools — Tiflux RAT, UltraVNC, Splashtop, and now Datto RMM — delivered through social engineering. Why Datto RMM changes the equation: Datto RMM is a Kaseya product widely used by Managed Service Providers (MSPs) serving state agencies. It offers a free trial supporting 500 devices, making it trivially easy for threat actors to obtain legitimate licenses. If any state agency or its MSP uses Datto RMM, the tool’s network traffic to centrastage[.]net and rmm[.]datto[.]com is likely whitelisted in firewalls, proxies, and endpoint protection — meaning a malicious installation would generate zero alerts. The campaign uses multiple delivery mechanisms: - Variant A uses party invitation lures via clientpartyinvitationviberm[.]de - Variant B uses DocuSign-themed lures via foxerin[.]cfd with Cloudflare R2 storage for payload hosting and Telegram bot API for command-and-control exfiltration - Variant C uses “Save the Date” lures delivering Datto RMM via compromised WordPress sites (virtualaiconsultant[.]com) and dedicated hosting (upparby[.]com) The structural problem: State government’s decentralized agency model means each agency may authorize different RMM tools. Without a centralized inventory of approved remote access software, security teams cannot distinguish a legitimate Datto RMM installation from a weaponized one. Relevant ATT&CK Techniques: T1566.002 (Spearphishing Link), T1204.001 (User Execution: Malicious Link), T1219 (Remote Access Software), T1105 (Ingress Tool Transfer), T1567 (Exfiltration Over Web Service) <h3> 2. UNC6692 SNOW: Hunting Executives Through Microsoft Teams </h3> UNC6692 is a financially motivated threat group operating a sophisticated three-component malware framework purpose-built for domain takeover. Google Mandiant and Microsoft’s joint analysis reveals that 77% of UNC6692 incidents in March–April 2026 targeted senior employees — executives, CISOs, and users with privileged access. The attack chain: 1. Email bombing — the victim’s inbox is flooded with subscription confirmations and notifications 2. Teams impersonation — an attacker posing as IT helpdesk contacts the victim via Microsoft Teams, offering to “fix” the email problem 3. Credential harvest — the victim is directed to install a fake “Mailbox Repair Utility” that captures credentials using a double-entry trick 4. Malware deployment — three components are installed: - SnowBelt : A Chromium browser extension (named “MS Heartbeat” or “System Heartbeat”) providing persistent access - SnowGlaze : A Python-based WebSocket tunneler enabling cross-platform command-and-control - SnowBasin : A local HTTP backdoor listening on port 8000 5. Domain takeover — LSASS memory dumping, pass-the-hash attacks, and Active Directory database (NTDS) theft lead to complete domain compromise Why this matters for state government: State CIOs, CISOs, and agency directors are high-value targets. A compromised executive account in a state environment could provide access to inter-agency trust relationships, federal network connections, and databases containing millions of residents’ PII. Microsoft classifies this as “cross-tenant helpdesk impersonation,” meaning the attack originates from outside your Microsoft 365 tenant — external Teams federation is the entry point. Relevant ATT&CK Techniques: T1534 (Internal Spearphishing via Teams), T1176 (Browser Extensions), T1572 (Protocol Tunneling), T1059.006 (Python), T1571 (Non-Standard Port), T1003.001 (LSASS Memory), T1550.002 (Pass the Hash), T1003.003 (NTDS) <h3> 3. AWS Federation Token Persistence: Your IR Playbook Has a Gap </h3> CrowdStrike has documented a technique where adversaries use sts:GetFederationToken to maintain access to AWS environments even after the standard incident response step of deactivating the compromised IAM user’s API keys. The federated session inherits all permissions of the base IAM user and survives key deactivation — meaning containment actions that security teams believe are effective are not. Key findings: - Federated sessions can access the AWS Management Console even if the IAM user has no password - IAM action restrictions for federated sessions do not apply to console usage - AWS has updated its documentation based on these findings, but existing IR playbooks across most organizations have not been updated Why this matters for state government: Cloud-first initiatives are accelerating across state agencies. AWS is increasingly used for citizen-facing applications, data analytics, and disaster recovery. If a state agency’s AWS environment is compromised and the IR team follows the standard playbook of deactivating API keys, the attacker retains access through the federated session — potentially for hours or days while the team believes the incident is contained. Relevant ATT&CK Techniques: T1078.004 (Valid Accounts: Cloud Accounts), T1098 (Account Manipulation), T1550.001 (Application Access Token) <h3> 4. Critical Vulnerabilities Demanding Immediate Attention </h3> <table> <thead> <tr> <th> CVE </th> <th> Product </th> <th> CVSS </th> <th> Status </th> <th> State Gov Relevance </th> </tr> </thead> <tbody> <tr> <td> CVE-2026-20127 </td> <td> Cisco SD-WAN </td> <td> 10.0 </td> <td> Active exploitation campaign tracked </td> <td> CRITICAL — Cisco SD-WAN is backbone networking for many state agencies </td> </tr> <tr> <td> CVE-2024-7399 </td> <td> Samsung MagicINFO 9 Server </td> <td> 8.8 </td> <td> CISA KEV — Active exploitation confirmed </td> <td> HIGH — Digital signage in government buildings, lobbies, public facilities </td> </tr> <tr> <td> CVE-2026-2789 </td> <td> Mozilla Firefox </td> <td> 9.8 </td> <td> Use-after-free vulnerability </td> <td> HIGH — Firefox is a common browser in government environments </td> </tr> <tr> <td> CVE-2026-31674 </td> <td> Linux Kernel </td> <td> 7.1 </td> <td> Patch available </td> <td> MODERATE — Linux servers in state data centers </td> </tr> <tr> <td> CVE-2026-3298 </td> <td> Python asyncio </td> <td> N/A </td> <td> Out-of-bounds write </td> <td> MODERATE — Python-based internal tooling on Windows servers </td> </tr> </tbody> </table> <h3> 5. Nation-State Actor Landscape </h3> The nation-state threat to state government remains persistent across multiple adversaries: <ul> <li> Volt Typhoon and Flax Typhoon (China/PLA-MSS and Integrity Technology Group/MSS): CISA published a joint advisory on China-nexus networks of compromised devices being used as operational relay infrastructure. These groups maintain pre-positioned access in critical infrastructure for potential disruption during a geopolitical crisis. </li> <li> APT28 / Fancy Bear (Russia/GRU): The EVILTOSS malware family was updated in threat intelligence feeds this cycle, but no new campaign activity was observed. The malware refresh without accompanying campaign intelligence may indicate a preparation phase — this warrants continued monitoring. </li> <li> APT41 (China/MSS): Continues to operate across espionage and financially motivated campaigns. Active campaigns against government and technology sectors remain tracked. </li> <li> Iranian Espionage (Multi-Vertical): An active campaign targeting aerospace and government was updated on 27 April. While currently focused on Middle Eastern governments and aerospace targets, escalation risk to U.S. state government exists given ongoing geopolitical tensions. </li> <li> Ransomware Operators Targeting Government: At least 14 ransomware groups show active government-targeting profiles: Nightspire, Payload, Rhysida (VICE SPIDER), Qilin (REVENANT SPIDER), TheGentlemen, Interlock, Play, Medusa, CoinbaseCartel, RansomHouse, LockBit3, FunkSec, Beast, and LAPSUS$ . No new confirmed state government victim was identified this cycle, but multiple groups updated their activity indicators between 24–27 April. </li> </ul> Notable absence: Salt Typhoon, the China-nexus group targeting telecommunications infrastructure, has been quiet across multiple intelligence collection cycles. This could indicate an operational pause, retooling, or a collection gap — it should not be interpreted as a reduced threat. <h2> Predictive Analysis: What to Expect in the Next 7–14 Days </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Continued Tiflux/Datto RMM phishing variants with new lures and payloads </td> <td> HIGH (>70%) </td> <td> Campaign is actively iterating — 3 variants in 24 hours demonstrates rapid development cycle </td> </tr> <tr> <td> UNC6692 SNOW campaign produces a confirmed government sector victim </td> <td> MODERATE (40–60%) </td> <td> 77% senior-employee targeting rate and cross-tenant Teams abuse create high-efficiency attack; government is a target-rich environment for this TTP </td> </tr> <tr> <td> CISA adds CVE-2026-20127 (Cisco SD-WAN, CVSS 10.0) to KEV catalog </td> <td> MODERATE (40–60%) </td> <td> Active exploitation campaign already tracked; CVSS 10.0 score and government prevalence make KEV addition likely </td> </tr> <tr> <td> Additional ransomware group claims a state or local government victim </td> <td> MODERATE (40–60%) </td> <td> 14 active groups with government targeting profiles; ransomware groups often delay victim disclosure by days or weeks </td> </tr> <tr> <td> Iran conflict cyber activity spills over to U.S. state government targets </td> <td> LOW (20–30%) </td> <td> Currently focused on aerospace and Middle Eastern governments; escalation would require significant geopolitical trigger </td> </tr> <tr> <td> APT28/Fancy Bear launches new campaign using refreshed EVILTOSS malware </td> <td> LOW (20–30%) </td> <td> Malware update without campaign activity suggests preparation, but timing is uncertain </td> </tr> </tbody> </table> <h2> SOC Operational Guidance                  </h2> <h3> Detection Priorities </h3> Priority 1 — Legitimate RMM Tool Abuse (T1219) Hunting Hypothesis: Threat actors are deploying legitimate remote management tools (Tiflux, UltraVNC, Splashtop, Datto RMM) via phishing to establish persistent remote access that blends with authorized IT operations. <ul> <li> Monitor: New installations of RMM software not deployed through official channels. Key indicators include Datto RMM components (CagService.exe, Gui.exe) installed via Nullsoft installers, UltraVNC (winvnc.exe) appearing on endpoints without IT ticket correlation, and Splashtop relay connections to IP ranges outside your authorized deployment. </li> <li> Detect: Network connections to agent[.]tiflux[.]com, centrastage[.]net, and rmm[.]datto[.]com from endpoints where these tools are not authorized. Alert on any .msi installer downloaded from Cloudflare R2 storage (pub-*.r2[.]dev). </li> <li> Investigate: Any Telegram bot API calls (api[.]telegram[.]org/bot*) from internal endpoints — this is the C2 exfiltration channel for Variant B of the current campaign. </li> <li> Block: Domains clientpartyinvitationviberm[.]de, foxerin[.]cfd, upparby[.]com, virtualaiconsultant[.]com, and URL shortener redirects from shorturl[.]at associated with this campaign. </li> </ul> Priority 2 — Microsoft Teams Cross-Tenant Social Engineering (T1534, T1176) Hunting Hypothesis: UNC6692 is impersonating IT helpdesk staff via Microsoft Teams external federation to deploy the SNOW malware framework against senior employees. <ul> <li> Monitor: Microsoft Teams external message activity, particularly messages from unrecognized tenants directed at executives, agency directors, and privileged account holders. Watch for email bombing patterns (sudden spike in subscription confirmations) preceding Teams contact. </li> <li> Detect: Chromium browser extensions named “MS Heartbeat” or “System Heartbeat” not sourced from the Chrome Web Store. Python-based WebSocket connections from endpoints (SnowGlaze). Local HTTP listeners on port 8000 (SnowBasin). LSASS memory access by non-standard processes (T1003.001). </li> <li> Investigate: Any helpdesk interaction initiated via Teams where the requestor asks the user to install software or run a “Mailbox Repair Utility.” Verify all such requests through out-of-band communication (phone call to known number). </li> <li> Block: If feasible, restrict Microsoft Teams external federation to approved partner domains only. </li> </ul> Priority 3 — Cloud Identity Abuse (T1078.004, T1528, T1550.001) Hunting Hypothesis: Adversaries are exploiting cloud identity mechanisms — AWS federation tokens, OAuth device codes, and application consent flows — to establish persistent access that survives standard credential rotation. <ul> <li> Monitor: AWS CloudTrail for sts:GetFederationToken API calls, particularly from IAM users that are not expected to use federation. Azure AD sign-in logs for OAuth device code authentication flows (T1528). Unusual OAuth application consent grants. </li> <li> Detect: AWS console access from federated sessions where the base IAM user’s API keys have been deactivated — this is a direct indicator of the persistence technique documented by CrowdStrike. OAuth tokens with unusually broad scopes or long-lived refresh tokens. </li> <li> Investigate: Any IAM user with sts:GetFederationToken permissions that are not operationally required. Review Azure AD enterprise application registrations for unrecognized or overprivileged OAuth grants. </li> </ul> Priority 4 — Network Appliance Exploitation (T1190) Hunting Hypothesis: Threat actors are exploiting critical vulnerabilities in Cisco SD-WAN (CVE-2026-20127) and Samsung MagicINFO (CVE-2024-7399) to gain initial access to government networks. <ul> <li> Monitor: Cisco SD-WAN management plane for anomalous API calls or configuration changes. Samsung MagicINFO server logs for unexpected file write operations or new file creation in system directories. </li> <li> Detect: Post-exploitation indicators on Samsung MagicINFO servers — the vulnerability allows arbitrary file write as SYSTEM, so watch for new executables, scheduled tasks, or web shells in signage server directories. </li> <li> Investigate: Any Samsung MagicINFO 9 Server running versions below v21.1050. Any Cisco SD-WAN deployment that has not applied patches for CVE-2026-20127. </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits Systems) </h3> State treasury and revenue agencies process millions of financial transactions and hold taxpayer PII that makes them prime targets for both ransomware operators and credential theft campaigns. <ul> <li> Immediate concern: The UNC6692 SNOW campaign’s 77% senior-employee targeting rate is directly relevant to treasury and revenue leadership. Finance executives with access to payment systems and fund transfer authorities are high-value targets for business email compromise escalation following domain takeover. </li> <li> Action: Enforce hardware MFA (FIDO2 keys) for all treasury and revenue staff with payment authorization. Restrict Microsoft Teams external federation for finance-facing tenants. Implement transaction velocity monitoring to detect anomalous fund transfers following potential account compromise. </li> <li> Ransomware watch: Rhysida, Qilin, and Play have all demonstrated targeting of financial government functions. Ensure offline backups of financial databases are tested monthly. </li> </ul> <h3> Energy (State-Regulated Utilities, Grid Management) </h3> State energy regulators and publicly owned utilities face supply chain risk from vendor compromises and direct targeting by nation-state actors focused on critical infrastructure pre-positioning. <ul> <li> Immediate concern: The Itron unauthorized access disclosure (13 April) remains relevant — Itron provides smart meter and grid management systems to state water and energy utilities. Volt Typhoon’s documented strategy of pre-positioning in critical infrastructure for potential disruption during a geopolitical crisis makes energy a persistent target. </li> <li> Action: Audit all Itron system integrations for indicators of compromise. Segment SCADA/ICS networks from enterprise IT with unidirectional gateways where possible. Review vendor remote access — if Splashtop or Datto RMM is used by energy vendors for remote maintenance, verify all installations are authorized and monitored. </li> <li> Vulnerability priority: CVE-2026-20127 (Cisco SD-WAN, CVSS 10.0) — if SD-WAN connects utility operational networks, patch immediately. </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> State health agencies manage Medicaid enrollment, public health surveillance, and vital records — all containing protected health information (PHI) subject to HIPAA. <ul> <li> Immediate concern: Ransomware groups including Rhysida and Medusa have demonstrated healthcare targeting. The Tiflux/Datto RMM phishing campaign’s use of invitation lures could easily be adapted to healthcare conference or training notification themes. </li> <li> Action: Ensure all health agency endpoints have application control policies that block unauthorized RMM tool installations. Implement data loss prevention (DLP) rules for PHI exfiltration via Telegram bot API and cloud storage services. Verify that Medicaid Management Information Systems (MMIS) are segmented from general agency networks. </li> <li> Cloud priority: If health agencies use AWS for data analytics or HIPAA-compliant workloads, immediately review IAM policies for sts:GetFederationToken permissions and update IR playbooks per the CrowdStrike findings. </li> </ul> <h3> Government (Executive Branch Agencies, Legislature, Courts) </h3> Core government functions — executive agencies, legislative systems, and court administration — are the primary targets for both nation-state espionage and ransomware. <ul> <li> Immediate concern: UNC6692’s Teams-based social engineering is optimized for government environments where helpdesk interactions are routine and trusted. The 77% senior-employee targeting rate means agency directors, deputy secretaries, and CIO/CISO staff are in the crosshairs. APT28’s EVILTOSS malware refresh without campaign activity suggests a preparation phase that could target government networks. </li> <li> Action: Implement conditional access policies requiring compliant devices for all executive branch M365 access. Deploy privileged access workstations (PAWs) for all Tier 0 and Tier 1 administrators. Brief agency directors on the Teams impersonation threat — provide a one-page awareness document with the specific attack pattern (email bombing → Teams contact → fake utility installation). </li> <li> Samsung MagicINFO priority: Government buildings commonly use digital signage in lobbies, hearing rooms, and public service centers. Identify and patch all MagicINFO 9 Server installations to v21.1050+ immediately — CVE-2024-7399 is on the CISA KEV with confirmed active exploitation. </li> </ul> <h3> Aviation / Logistics (State DOT, Airports, Port Authorities) </h3> State departments of transportation, airport authorities, and port operations manage critical logistics infrastructure with increasing digital dependencies. <ul> <li> Immediate concern: Cisco SD-WAN (CVE-2026-20127, CVSS 10.0) is widely deployed in transportation and logistics networks for connecting distributed facilities. The active exploitation campaign tracked in threat intelligence makes this the highest-priority vulnerability for this sector. </li> <li> Action: Prioritize emergency patching of all Cisco SD-WAN deployments. If patching cannot be completed within 48 hours, implement compensating controls: restrict management plane access to jump hosts only, enable enhanced logging, and monitor for anomalous configuration changes. Review network segmentation between transportation management systems and general IT networks. </li> <li> Supply chain consideration: Transportation agencies often rely on MSPs for distributed facility IT support. Verify that MSP remote access tools are inventoried and that only authorized RMM platforms are permitted on the network. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> Immediate (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC / Network Ops </td> <td> Block phishing infrastructure at web proxy and DNS: clientpartyinvitationviberm[.]de, foxerin[.]cfd, upparby[.]com, virtualaiconsultant[.]com. Add all MD5 hashes from the IOC table above to EDR blocklists. </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Deploy detection for Telegram bot C2 exfiltration: Alert on any internal endpoint connecting to api[.]telegram[.]org/bot* — this is the active exfiltration channel for the Tiflux RAT campaign. </td> </tr> <tr> <td> 3 </td> <td> IT Ops / All Agencies </td> <td> Verify Datto RMM authorization status across all state agencies. If Datto RMM is not an approved tool, block centrastage[.]net and rmm[.]datto[.]com at the proxy and add to application control deny lists. If it IS authorized by any agency, audit all installations for unexpected deployments not correlated to IT service tickets. </td> </tr> <tr> <td> 4 </td> <td> IT Ops / M365 Admin </td> <td> Restrict Microsoft Teams external federation to approved domains only. If full restriction is operationally infeasible, enable external access notifications and issue an immediate advisory to all helpdesk staff: verify identity via phone callback before providing any remote assistance initiated through Teams. </td> </tr> <tr> <td> 5 </td> <td> Executive Leadership </td> <td> Brief all agency directors and senior staff on the UNC6692 Teams impersonation attack pattern. Provide a one-page awareness document: email bombing followed by Teams “helpdesk” contact is the attack signature. No legitimate IT support will ask you to install a “Mailbox Repair Utility.” </td> </tr> </tbody> </table> <h3> 7-Day Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 6 </td> <td> IT Ops / Facilities </td> <td> Patch Samsung MagicINFO 9 Server to v21.1050+ on all digital signage management servers in government buildings, lobbies, and public facilities. CVE-2024-7399 is on the CISA KEV with confirmed active exploitation — arbitrary file write as SYSTEM. </td> </tr> <tr> <td> 7 </td> <td> Cloud / DevOps </td> <td> Update AWS incident response playbooks: Add an explicit step to attach a deny-all IAM policy to compromised IAM users instead of only deactivating API keys. Audit all IAM users with sts:GetFederationToken permissions and restrict to operational minimum. </td> </tr> <tr> <td> 8 </td> <td> SOC </td> <td> Deploy UNC6692 SNOW detection rules: Monitor for Chromium extensions named “MS Heartbeat” or “System Heartbeat” not sourced from Chrome Web Store. Alert on Python-based WebSocket tunneling from endpoints (SnowGlaze). Alert on local HTTP listeners on port 8000 (SnowBasin). Monitor for LSASS memory access by non-standard processes. </td> </tr> <tr> <td> 9 </td> <td> Network Ops </td> <td> Emergency patch Cisco SD-WAN for CVE-2026-20127 (CVSS 10.0). If patching requires a maintenance window beyond 7 days, implement compensating controls: restrict management plane to jump hosts, enable enhanced logging, and monitor for configuration anomalies. </td> </tr> <tr> <td> 10 </td> <td> IT Ops / All Agencies </td> <td> Build a centralized RMM tool inventory. Survey all agencies to identify every authorized remote management tool (Datto, Splashtop, ConnectWise, TeamViewer, AnyDesk, etc.). Publish an approved RMM list. Any tool not on the list should generate an EDR alert upon installation. </td> </tr> </tbody> </table> <h3> 30-Day Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 11 </td> <td> CISO / Identity Team </td> <td> Commission a review of OAuth application consent policies in Azure AD. Restrict user consent to verified publishers only. Enable admin consent workflow. Audit all existing OAuth grants for overprivileged or unrecognized applications. </td> </tr> <tr> <td> 12 </td> <td> CISO / IR Team </td> <td> Conduct a tabletop exercise simulating the UNC6692 SNOW attack chain — email bombing, Teams impersonation, credential harvest, domain takeover. Test whether current IR procedures detect and contain each phase. Include AWS federation token persistence as a scenario variant. </td> </tr> <tr> <td> 13 </td> <td> CISO </td> <td> Evaluate creating a dedicated Cloud Identity Abuse monitoring program. Three of the six major threats this cycle (UNC6692/Teams, AWS federation persistence, OAuth phishing) target cloud identity systems. Current monitoring may be fragmented across M365, AWS, and on-premises AD teams. A unified identity threat detection capability is a strategic priority. </td> </tr> <tr> <td> 14 </td> <td> CISO / Policy </td> <td> Address the cybersecurity legislation monitoring gap. Assign an analyst to manually monitor the NCSL cybersecurity legislation tracker, StateScoop, and GovTech on a weekly basis. Automated collection of legislative intelligence has been degraded for multiple cycles — manual coverage is needed until the gap is resolved. </td> </tr> </tbody> </table> <h2> The Bottom Line                              </h2> The threat landscape facing state government is defined by three converging trends that demand leadership attention: First, your approved tools are being turned against you. The weaponization of four legitimate remote management tools in a single campaign family is not an anomaly — it is the new normal. Every RMM tool, every cloud service, every collaboration platform in your environment is a potential attack vector. If you do not have a centralized inventory of authorized remote access tools across all agencies, you have a blind spot that threat actors are actively exploiting today. Second, your executives are the targets. UNC6692’s 77% senior-employee targeting rate through Microsoft Teams is a deliberate strategy. These attackers are not casting a wide net — they are precision-targeting the people with the most access and the least time to verify a helpdesk request. A single compromised agency director account can lead to complete domain takeover, access to inter-agency systems, and exposure of millions of residents’ personal data. Third, your incident response playbooks may already be outdated. The AWS federation token persistence technique documented this week means that a standard containment step — deactivating compromised API keys — no longer works. If your cloud IR procedures have not been updated to account for this, you are operating with a false sense of containment. The threat assessment remains at ELEVATED . No single event warrants escalation to HIGH, but the simultaneous pressure across identity, supply chain, and infrastructure domains creates cumulative risk that demands immediate, coordinated action across all state agencies. The three decisions that cannot wait: confirm Datto RMM authorization status, restrict Teams external federation, and update AWS IR playbooks. Everything else flows from there.

FEATURED RESOURCES

April 28, 2026

Anomali Cyber Watch

When the Ceasefire Holds but the Hackers Don’t: Iran’s Cyber War Enters Its Ninth Week

April 28, 2026

Anomali Cyber Watch

Public Sector

When Legitimate Tools Become Weapons: The Escalating Threat to State Government Networks

April 27, 2026

Anomali Cyber Watch

Ceasefire That Isn’t: Day 59 of Iran’s Cyber War on U.S. Critical Infrastructure

Explore All