When One Phishing Click Costs 1.3 Million Records: The Converging Threats State Governments Cannot Ignore

Public Sector

Published on

October 7, 2026

Table of Contents

Threat Assessment Level: ELEVATED (trending toward HIGH) Changed from baseline ELEVATED. The convergence of a critical Veeam Backup RCE (CVSS 9.4), two Chrome sandbox-escape zero-days (CVSS 9.6), confirmed PeopleSoft exploitation against a federal government contractor, and a catastrophic state court system breach collectively push the threat environment toward the HIGH threshold. The prior cycle's triple Citrix NetScaler zero-day and actively exploited FortiMail vulnerability remain unresolved for many organizations. <h2>Introduction</h2> This week, the FBI fired a contractor after a missed Oracle PeopleSoft patch handed the ShinyHunters criminal group terabytes of sensitive data — including the home addresses of HUMINT operatives. A state governments court system disclosed that a single employee clicking a malicious link led to the theft of 1.3 million records spanning three decades of court data, orders of protection, and foster care reports. And Veeam just disclosed a CVSS 9.4 remote code execution vulnerability in its Backup & Replication product — the same product ransomware operators target first to eliminate your ability to recover. These are not abstract threats. They are confirmed incidents and active vulnerabilities that map directly to the technology stacks, data holdings, and operational realities of state government IT. If your state runs PeopleSoft for HR and payroll, Veeam for backup, Chrome on endpoints, or Citrix for remote access, this report demands your immediate attention. <h2>What Changed This Week</h2> <table border="0" rules="all"> <thead> <tr> <td> Date </td> <td> Event </td> <td> Severity </td> <td> State Gov Impact </td> </tr> </thead> <tbody> <tr> <td> Oct 1–3 </td> <td> Three Citrix NetScaler zero-days (CVE-2026-88771, CVE-2026-88772, CVE-2026-88779) actively exploited; CISA KEV deadline Oct 7 </td> <td> CRITICAL </td> <td> Citrix widely used for remote access across state agencies </td> </tr> <tr> <td> Oct 4–6 </td> <td> Fortinet confirms active exploitation of FortiMail CVE-2026-104286 (CVSS 9.8) via dynamic linker hijacking; patches still pending for some branches </td> <td> CRITICAL </td> <td> FortiMail deployed in many state email security stacks </td> </tr> <tr> <td> Oct 6 </td> <td> Veeam discloses CVE-2025-64393 (CVSS 9.4) — Backup Viewer role → SYSTEM RCE via insecure deserialization </td> <td> CRITICAL </td> <td> Veeam is the dominant backup platform in state data centers </td> </tr> <tr> <td> Oct 6 </td> <td> Google Chrome 154.0.8037.39+ patches CVE-2026-106197 and CVE-2026-106358 (CVSS 9.6 each) — sandbox-escape use-after-free flaws </td> <td> HIGH </td> <td> Chrome is the standard browser across most state agencies </td> </tr> <tr> <td> Oct 6 </td> <td> CISA publishes six ICS advisories affecting Hitachi Energy (REB500, RTU500, SOI, Asset Suite), Johnson Controls EasyIO FG, and Savannah lwIP SMTP </td> <td> HIGH </td> <td> Directly affects state-owned utility, building automation, and transportation infrastructure </td> </tr> <tr> <td> Oct 7 </td> <td> Arizona court system breach disclosed — 1.3M records stolen via phishing; intrusion began Sep 24 </td> <td> HIGH </td> <td> Direct analog to every state judiciary IT environment </td> </tr> <tr> <td> Oct 7 </td> <td> FBI drops Accenture contractor after ShinyHunters exploited unpatched PeopleSoft, stealing 2–3 TB of sensitive data </td> <td> HIGH </td> <td> Many states run PeopleSoft for HR, finance, and payroll </td> </tr> <tr> <td> Oct 7 </td> <td> CERT-UA identifies UAC-0277 operating 100+ compromised sites delivering LUNEXSTEALER via ClickFix technique with blockchain-backed C2 </td> <td> MODERATE-HIGH </td> <td> State employees using search engines are at risk of drive-by compromise </td> </tr> <tr> <td> Oct 7 </td> <td> BlueKit PhaaS platform reaches 1,000+ customers; offers AI-generated phishing templates targeting Citrix, Salesforce, and enterprise SSO </td> <td> HIGH </td> <td> Templates directly target state government technology stack </td> </tr> <tr> <td> Oct 7 </td> <td> Volt Typhoon and Salt Typhoon both show anomalous 7+ day absence from reporting — likely improved OPSEC, not cessation of activity </td> <td> HIGH </td> <td> These groups maintain documented pre-positioning in U.S. government and critical infrastructure networks </td> </tr> <tr> <td> Sep 30 </td> <td> Europol's Operation KillSwitch dismantles KillSec ransomware — first law-enforcement-validated AI-built ransomware infrastructure </td> <td> MODERATE </td> <td> Confirms AI is accelerating ransomware development lifecycle </td> </tr> <tr> <td> Within 7-day window </td> <td> Elastic/Kibana CVE-2026-102406 (CVSS 8.8) — cross-tenant data interception; patched in 8.19.22, 9.4.7, 9.5.4 </td> <td> MODERATE-HIGH </td> <td> Elastic/Kibana widely used in state SIEM and log analytics deployments </td> </tr> </tbody> </table> <h2>Threat Timeline: September 24 – October 7, 2026</h2> <table border="0" rules="all"> <thead> <tr> <td> Date </td> <td> Actor / Campaign </td> <td> Action </td> <td> Target </td> </tr> </thead> <tbody> <tr> <td> Sep 24 </td> <td> Unattributed </td> <td> Phishing email clicked by Arizona court employee; intrusion begins </td> <td> Arizona Judiciary </td> </tr> <tr> <td> Sep 24 </td> <td> Arizona court IT </td> <td> Intrusion detected on backup server; shut down within ~2 hours </td> <td> — </td> </tr> <tr> <td> Sep 30 </td> <td> Europol </td> <td> Operation KillSwitch dismantles KillSec ransomware group </td> <td> KillSec infrastructure </td> </tr> <tr> <td> Oct 1 </td> <td> Unattributed </td> <td> Active exploitation of Citrix NetScaler CVE-2026-88771 begins </td> <td> Internet-facing NetScaler appliances </td> </tr> <tr> <td> Oct 1 </td> <td> CISA </td> <td> FortiMail CVE-2026-104286 added to KEV catalog </td> <td> FortiMail deployments </td> </tr> <tr> <td> Oct 1–3 </td> <td> Unattributed </td> <td> CVE-2026-88772 and CVE-2026-88779 exploitation confirmed </td> <td> Citrix NetScaler </td> </tr> <tr> <td> Oct 4 </td> <td> CISA </td> <td> CVE-2026-88779 added to KEV; federal remediation deadline set for Oct 7 </td> <td> Federal/state Citrix deployments </td> </tr> <tr> <td> Oct 4–6 </td> <td> Fortinet </td> <td> Confirms active exploitation of CVE-2026-104286 (CVSS 9.8) with persistence via dynamic linker hijacking </td> <td> FortiMail appliances </td> </tr> <tr> <td> Oct 6 </td> <td> Veeam </td> <td> Emergency patch for CVE-2025-64393 (CVSS 9.4) — Backup Viewer → SYSTEM RCE </td> <td> Veeam B&R v12 through 12.3.2.4854 </td> </tr> <tr> <td> Oct 6 </td> <td> Google </td> <td> Chrome 154.0.8037.39+ released with 247 fixes including 4 Critical (CVE-2026-106197, CVE-2026-106358 at CVSS 9.6) </td> <td> All Chrome users </td> </tr> <tr> <td> Oct 6 </td> <td> CISA </td> <td> Six ICS advisories: Hitachi Energy REB500/RTU500/SOI/Asset Suite, Johnson Controls EasyIO FG, Savannah lwIP SMTP </td> <td> Critical infrastructure operators </td> </tr> <tr> <td> Oct 7 </td> <td> ShinyHunters </td> <td> FBI confirms PeopleSoft exploitation led to catastrophic data breach; Accenture contractor terminated </td> <td> FBI (via contractor) </td> </tr> <tr> <td> Oct 7 </td> <td> UAC-0277 </td> <td> CERT-UA identifies 100+ compromised websites delivering LUNEXSTEALER via ClickFix + blockchain C2 </td> <td> Windows users via search engines </td> </tr> <tr> <td> Oct 7 </td> <td> "petrushka" </td> <td> BlueKit PhaaS platform documented with 1,000+ customers, 97 brands, AI-generated content, US smishing numbers </td> <td> Enterprise SSO, Citrix, Salesforce </td> </tr> <tr> <td> Oct 7 </td> <td> Arizona Courts </td> <td> Public disclosure: 1.3M records stolen including 30 years of court data, protection orders, foster care records </td> <td> Arizona Judiciary </td> </tr> </tbody> </table> <h2>Key Threat Analysis</h2> <h3>1. PeopleSoft Under Active Exploitation — The ShinyHunters Government Campaign</h3> The FBI's decision to terminate its Accenture contractor is an extraordinary event that underscores a simple, devastating truth: unpatched ERP systems in government environments are being actively exploited by sophisticated criminal groups. ShinyHunters — a well-known data theft and extortion group — exploited a PeopleSoft vulnerability for which Oracle had released a patch in June 2026. The contractor failed to apply it. The result: 2–3 terabytes of stolen data including counterintelligence roles, home addresses of HUMINT operatives, and medical/psychiatric records. Why this matters for state government: Oracle PeopleSoft is the backbone of HR, finance, and payroll operations for numerous state agencies. The same vulnerability class — exploitation of public-facing applications (ATT&CK T1190) followed by credential abuse (T1078) and mass data exfiltration (T1567) — applies to any unpatched PeopleSoft instance. If your state's June Oracle Critical Patch Update has not been applied, you face the same risk the FBI just experienced. Relevant ATT&CK Techniques:T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts), T1530 (Data from Cloud Storage Object), T1567 (Exfiltration Over Web Service) <h3>2. Veeam Backup RCE — The 48-Hour Ransomware Window</h3> CVE-2025-64393 is a CVSS 9.4 insecure deserialization vulnerability in Veeam Backup & Replication that allows any user with the Backup Viewer role to execute arbitrary code as SYSTEM on the backup server. It affects all v12 builds through 12.3.2.4854. This is not a theoretical concern. Ransomware operators — including LockBit (BITWISE SPIDER) and Qilin (REVENANT SPIDER) — have a documented pattern of weaponizing Veeam vulnerabilities within 48–72 hours of patch disclosure. Their operational playbook is consistent: compromise backup infrastructure first, then deploy ransomware, eliminating the victim's ability to recover without paying. Three additional Veeam CVEs were patched simultaneously: 1. CVE-2026-58069 (CVSS 8.3) — Cloud Connect file read 2. CVE-2026-93026 (CVSS 6.1) — Master key modification 3. CVE-2025-64392 (CVSS 4.8) — Enterprise Manager XSS Relevant ATT&CK Techniques:T1485 (Data Destruction), T1490 (Inhibit System Recovery) The clock is ticking. Veeam has warned that attackers could reverse-engineer the patch to develop exploits. Every hour of delay increases the probability that ransomware operators will reach your backup servers before your patch team does. <h3>3. Chrome Sandbox Escapes — Drive-By Compromise at Scale</h3> Google's October 6 Chrome release patched 247 security vulnerabilities, including two Critical sandbox-escape flaws: <table border="0" rules="all"> <thead> <tr> <td> CVE </td> <td> CVSS </td> <td> Component </td> <td> Impact </td> </tr> </thead> <tbody> <tr> <td> CVE-2026-106197 </td> <td> 9.6 </td> <td> Browser (use-after-free) </td> <td> Code execution outside sandbox — full OS compromise </td> </tr> <tr> <td> CVE-2026-106358 </td> <td> 9.6 </td> <td> Navigation (use-after-free) </td> <td> Code execution outside sandbox — full OS compromise </td> </tr> <tr> <td> CVE-2026-106240 </td> <td> 8.8 </td> <td> V8 JavaScript (type confusion) </td> <td> Code execution inside sandbox </td> </tr> </tbody> </table> Sandbox escapes are the most valuable class of browser vulnerability because they convert a simple website visit into full operating system compromise — no additional exploitation steps required (ATT&CK T1189: Drive-by Compromise). A state employee visiting a compromised vendor portal, a constituent-facing website, or clicking a link in a phishing email could have their workstation fully compromised. <h3>4. Arizona Court Breach — A Warning to Every State Judiciary</h3> The Arizona court system breach is the most operationally relevant event in this report for state government leaders because it is not a hypothetical — it is a confirmed attack against a peer organization with an architecture that mirrors most state judiciaries. What happened: An employee clicked a malicious link in an email (T1566.001). Attackers pivoted to a backup server (T1530) and exfiltrated: 4. 1.3 million records of individuals with unpaid court fees/fines/restitution spanning 30 years 5. ~30,000 active and inactive orders of protection — domestic violence victims, stalking victims 6. 150,000 foster care review board reports dating to 2010 Court technology staff detected the intrusion within approximately two hours on September 24 and shut down the affected server. Despite the rapid detection, the volume of data stolen was catastrophic. The structural problem: State court systems typically maintain decades of records in legacy databases with long retention requirements. They hold some of the most sensitive PII in government — protection orders reveal the identities and locations of domestic violence survivors. The combination of legacy architecture, long data retention, and sensitive data makes judiciary systems uniquely high-value targets. <h3>5. ClickFix and LUNEXSTEALER — Social Engineering Evolves</h3> CERT-UA has identified threat actor UAC-0277 operating over 100 compromised legitimate websites that inject malicious JavaScript presenting fake Cloudflare verification pages. When a Windows user arrives via a search engine, the ClickFix technique tricks them into running a command that downloads an MSI package delivering LUNEXSTEALER (also known as Psychedelic Stealer). What makes this campaign technically notable: 7. Blockchain-backed C2 (EtherHiding): UAC-0277 stores C2 configuration in Polygon/Ethereum smart contracts. Traditional takedown methods — domain seizure, IP blocking — are ineffective against immutable blockchain storage. This is a significant evolution in C2 resilience. 8. Three MSI delivery variants: Direct install, BYOVD using CVE-2023-20598 (AMD driver vulnerability that can bypass EDR), and DLL sideloading via FnHotkeyUtility.exe + spkvol.dll. 9. LUNARAXE browser extension: Masquerades as "Microsoft Office Word Editor" and provides full browser remote control, enabling session hijacking (T1185). We are now tracking two distinct ClickFix campaigns — UAC-0277 with LUNEXSTEALER and UNC6924/UNC7032 with FleetDeck/ScreenConnect remote management tools. The technique's proven success rate means additional threat actors will adopt it. Relevant ATT&CK Techniques:T1189, T1204.002, T1059.001, T1218.007, T1068, T1574.002, T1555, T1185, T1102 <h3>6. BlueKit PhaaS — AI-Powered Credential Harvesting at Industrial Scale</h3> BlueKit is a subscription-based Phishing-as-a-Service platform operated by a Russian-speaking threat actor known as "petrushka." First observed in April 2026, it now serves over 1,000 customers and offers 97 brand templates across 176 phishing variants. The enterprise SSO templates are what should concern state IT leaders most: <table border="0" rules="all"> <thead> <tr> <td> Template Category </td> <td> Targeted Brands </td> </tr> </thead> <tbody> <tr> <td> Enterprise SSO / Remote Access </td> <td> Citrix, Cloudflare, Cisco, Check Point </td> </tr> <tr> <td> CRM / Cloud Platforms </td> <td> Salesforce, HubSpot, GitHub </td> </tr> <tr> <td> Generative AI Platforms </td> <td> OpenAI, Anthropic </td> </tr> <tr> <td> Financial / Consumer </td> <td> Multiple banking and crypto brands </td> </tr> </tbody> </table> Key capabilities that elevate this threat: 10. AI-assisted phishing content generation — grammatically perfect, contextually appropriate lures 11. SMS sender with local US phone numbers — smishing campaigns that appear to originate domestically 12. Digital fingerprinting — victim profiling to tailor the attack 13. Single-dashboard campaign management — lowering the barrier to entry for less sophisticated attackers When combined with the EvilTokens platform (tracked since the prior cycle, targeting Microsoft 365 via device code phishing by Storm-2992), state agencies now face two concurrent PhaaS platforms specifically designed to harvest enterprise credentials at scale. Relevant ATT&CK Techniques:T1566.001, T1598.003, T1539, T1528 <h3>7. Critical Infrastructure — Six ICS Advisories in 24 Hours</h3> CISA published six ICS advisories on October 6 affecting products commonly deployed in state government facilities: <table border="0" rules="all"> <thead> <tr> <td> Vendor </td> <td> Product </td> <td> Relevance to State Gov </td> </tr> </thead> <tbody> <tr> <td> Hitachi Energy </td> <td> REB500 </td> <td> Substation automation — state-owned utility infrastructure </td> </tr> <tr> <td> Hitachi Energy </td> <td> RTU500 </td> <td> Remote terminal units — water treatment, transportation </td> </tr> <tr> <td> Hitachi Energy </td> <td> SOI (System Operation Interface) </td> <td> Grid operations </td> </tr> <tr> <td> Hitachi Energy </td> <td> Asset Suite </td> <td> Asset management for utilities </td> </tr> <tr> <td> Johnson Controls </td> <td> EasyIO FG </td> <td> Building automation — state office buildings, data centers </td> </tr> <tr> <td> Savannah </td> <td> lwIP SMTP </td> <td> Lightweight IP stack — embedded devices </td> </tr> </tbody> </table> These advisories arrive alongside the still-active FortiMail CVE-2026-104286 (CVSS 9.8), which Fortinet has confirmed is being exploited in the wild with persistence achieved through dynamic linker hijacking. Patches for some FortiMail branches remain pending. <h3>8. Persistent Nation-State Threat Landscape</h3> While no new Volt Typhoon, Salt Typhoon, or APT28 activity was attributed in this cycle, the broader nation-state threat picture remains active: <table border="0" rules="all"> <thead> <tr> <td> Actor </td> <td> Origin </td> <td> Recent Activity </td> <td> State Gov Relevance </td> </tr> </thead> <tbody> <tr> <td> APT41 </td> <td> China (state-affiliated) </td> <td> Persistent targeting of government networks </td> <td> HIGH — espionage against state databases </td> </tr> <tr> <td> Volt Typhoon </td> <td> China (state-affiliated) </td> <td> Anomalous 7+ day reporting absence — may indicate improved OPSEC, not cessation </td> <td> CRITICAL — pre-positioned in US critical infrastructure </td> </tr> <tr> <td> Salt Typhoon </td> <td> China (state-affiliated) </td> <td> Anomalous 7+ day reporting absence </td> <td> HIGH — telecommunications targeting </td> </tr> <tr> <td> Longlegs / Storm-2603 </td> <td> China (state-affiliated) </td> <td> Active campaigns </td> <td> MODERATE-HIGH </td> </tr> <tr> <td> APT28 (GRU) </td> <td> Russia (military intelligence) </td> <td> Persistent operations </td> <td> HIGH — government targeting </td> </tr> <tr> <td> APT29 (SVR) </td> <td> Russia (foreign intelligence) </td> <td> Persistent operations </td> <td> HIGH — government targeting </td> </tr> <tr> <td> PRIMITIVEBEAR (FSB-linked) </td> <td> Russia </td> <td> Active campaigns </td> <td> MODERATE </td> </tr> <tr> <td> UNC6916 </td> <td> Unattributed </td> <td> DERBSPARK campaigns targeting government (updated Oct 7) </td> <td> HIGH </td> </tr> <tr> <td> UNC6727 </td> <td> China-origin </td> <td> SUNBRICKED targeting government </td> <td> HIGH </td> </tr> <tr> <td> UNC7072 </td> <td> Unattributed </td> <td> CLOUDHAZE discovery activity in education/government </td> <td> MODERATE-HIGH </td> </tr> <tr> <td> ShinyHunters </td> <td> Cybercriminal </td> <td> Confirmed PeopleSoft exploitation against government </td> <td> CRITICAL — active exploitation </td> </tr> </tbody> </table> Critical absence note: The 7+ day silence from Volt Typhoon and Salt Typhoon is anomalous. These Chinese state-affiliated groups have been persistently active against U.S. government networks throughout 2026. Their absence from reporting more likely reflects improved operational security than a cessation of activity. State agencies should not reduce vigilance. <h2>Predictive Analysis: Next 7 Days</h2> <table border="0" rules="all"> <thead> <tr> <td> Prediction </td> <td> Probability </td> <td> Basis </td> </tr> </thead> <tbody> <tr> <td> Veeam CVE-2025-64393 weaponized by ransomware operators </td> <td> >75% (HIGH) </td> <td> Historical pattern: LockBit/BITWISE SPIDER and Qilin/REVENANT SPIDER weaponize Veeam vulnerabilities within 48–72 hours of disclosure. Patch was released Oct 6. </td> </tr> <tr> <td> Chrome sandbox escapes incorporated into exploit kits </td> <td> 50–75% (MODERATE) </td> <td> CVSS 9.6 sandbox escapes are premium exploit commodities. Drive-by compromise campaigns targeting government employees during normal browsing are likely. </td> </tr> <tr> <td> ClickFix campaigns expand to target .gov domains or government-adjacent websites </td> <td> 50–75% (MODERATE) </td> <td> Two distinct actor groups (UAC-0277, UNC6924/UNC7032) already using the technique at scale. Government-themed lures are a logical next step. </td> </tr> <tr> <td> Additional PeopleSoft exploitation attempts against government targets </td> <td> 50–75% (MODERATE) </td> <td> ShinyHunters' success against the FBI contractor validates the attack path. Other criminal groups will attempt the same. </td> </tr> <tr> <td> Volt Typhoon / Salt Typhoon activity resurfaces in reporting </td> <td> 25–50% (LOW-MODERATE) </td> <td> Current absence is anomalous. Activity likely continues but with improved OPSEC. </td> </tr> <tr> <td> BlueKit PhaaS campaigns targeting state government SSO portals </td> <td> 50–75% (MODERATE) </td> <td> 1,000+ customers with Citrix and Salesforce templates; state agencies are natural targets. </td> </tr> <tr> <td> Ransomware group targets a state or local government entity using Veeam as the initial pivot </td> <td> 25–50% (LOW-MODERATE) </td> <td> Dependent on patch adoption speed. Agencies that delay patching face elevated risk. </td> </tr> </tbody> </table> <h2>SOC Operational Guidance</h2> <h3>Immediate Detection Priorities</h3> 1. Veeam Exploitation Indicators (CVE-2025-64393) 14. Hunt hypothesis: An attacker with compromised Backup Viewer credentials exploits insecure deserialization in the Veeam Mount Service to achieve SYSTEM-level code execution on backup servers. 15. Monitor: Anomalous process execution originating from Veeam Backup & Replication services, particularly the Mount Service. Watch for unexpected child processes of Veeam services (cmd.exe, powershell.exe, certutil.exe). 16. Detect: Audit Backup Viewer role assignments — any account with this role that should not have it is a pre-exploitation indicator. Alert on new Backup Viewer role grants. 17. ATT&CK:T1485 (Data Destruction), T1490 (Inhibit System Recovery) 18. Defensive guidance: Isolate Veeam management interfaces from general network access. Verify backup integrity and test restore procedures. Ensure immutable/air-gapped backup copies exist. 2. PeopleSoft Exploitation (ShinyHunters TTPs) 19. Hunt hypothesis: An external attacker exploits an unpatched PeopleSoft web interface to gain initial access, then uses valid credentials to move laterally and exfiltrate HR/finance data. 20. Monitor: Unusual HTTP requests to PeopleSoft web server endpoints, particularly those matching known exploitation patterns. Watch for bulk data queries against PeopleSoft databases outside normal business hours. 21. Detect: Alert on large data exports from PeopleSoft (T1530), new or modified database queries, and authentication anomalies on PeopleSoft accounts (T1078). 22. ATT&CK:T1190 (Exploit Public-Facing Application), T1078 (Valid Accounts), T1567 (Exfiltration Over Web Service) 23. Defensive guidance: Verify June 2026 Oracle Critical Patch Update is applied. Place PeopleSoft behind WAF with virtual patching rules. Restrict database-level access to least privilege. 3. LUNEXSTEALER / ClickFix Campaign (UAC-0277) 24. Hunt hypothesis: A state employee visits a compromised legitimate website via search engine, encounters a fake Cloudflare verification page, and executes a command that downloads LUNEXSTEALER via msiexec. 25. Block IOCs: <table border="0" rules="all"> <thead> <tr> <td> Type </td> <td> Value </td> <td> Context </td> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 107[.]175.82.242 </td> <td> C2/delivery server </td> </tr> <tr> <td> IPv4 </td> <td> 193[.]178.158.61 </td> <td> C2/delivery server </td> </tr> <tr> <td> IPv4 </td> <td> 193[.]178.159.128 </td> <td> C2/delivery server </td> </tr> <tr> <td> IPv4 </td> <td> 109[.]238.86.112 </td> <td> C2/delivery server </td> </tr> <tr> <td> IPv4 </td> <td> 109[.]238.86.113 </td> <td> C2/delivery server </td> </tr> </tbody> </table> 26. Monitor for persistence indicators: – Scheduled task named psychedelicloveUtils – DLL sideloading: FnHotkeyUtility.exe loading spkvol.dll in %PROGRAMDATA% subdirectories (e.g., SalmonLightSlateGray, SlateGrayChocolate, GrayLightCyan) – Browser extension claiming to be "Microsoft Office Word Editor" (LUNARAXE) 27. Detect: Alert on msiexec.exe commands containing URLs (msiexec /i http...) — this is the primary ClickFix execution vector (T1218.007). Monitor for PowerShell execution triggered by the Windows Run dialog (T1059.001). 28. ATT&CK:T1189, T1204.002, T1059.001, T1218.007, T1068, T1574.002, T1555, T1185, T1102 29. Defensive guidance: Restrict Windows Run dialog via GPO for standard users. Enforce browser extension allowlists. Block msiexec network fetches at the proxy/firewall level. Add blockchain RPC endpoints (Polygon, Ethereum mainnet) to network monitoring watchlists to detect EtherHiding C2 callbacks. 4. BlueKit / EvilTokens Credential Harvesting 30. Hunt hypothesis: State employees receive AI-generated phishing emails or SMS messages (from US local numbers) directing them to credential harvesting pages mimicking Citrix, Salesforce, or SSO login portals. 31. Monitor: Conditional Access logs for impossible-travel or anomalous device-code authentication flows. Watch for new OAuth app consents in Azure AD/Entra ID. Monitor for MFA fatigue patterns (repeated push notifications). 32. Detect: Alert on authentication from unfamiliar ASNs immediately following password entry on external sites. Monitor for session token replay from new IP addresses (T1539). 33. ATT&CK:T1566.001, T1598.003, T1539, T1528 34. Defensive guidance: Deploy FIDO2/passkey authentication for privileged accounts — hardware-bound credentials defeat credential harvesting entirely. Implement token binding where supported. Review Conditional Access policies to require compliant devices. 5. Chrome Sandbox Escape Exploitation 35. Hunt hypothesis: A state employee visits a malicious or compromised website that exploits CVE-2026-106197 or CVE-2026-106358 to escape the Chrome sandbox and execute code on the underlying OS. 36. Monitor: EDR alerts for unexpected child processes spawned by chrome.exe (particularly cmd.exe, powershell.exe, rundll32.exe, or any process writing to disk outside the Chrome profile directory). 37. Detect: Browser crash reports correlated with network connections to unfamiliar domains. Unusual Chrome renderer process behavior. 38. ATT&CK:T1189 (Drive-by Compromise), T1203 (Exploitation for Client Execution) 39. Defensive guidance: Push Chrome updates immediately. Enable Chrome's Enhanced Safe Browsing. Consider site isolation policies for high-risk browsing. <h3>Additional IOCs from Collection</h3> <table border="0" rules="all"> <thead> <tr> <td> Type </td> <td> Value </td> <td> Context </td> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 188[.]135.15.49 </td> <td> Associated with threat activity in collection </td> </tr> <tr> <td> Domain </td> <td> c0ce[.]org </td> <td> Suspicious domain from collection </td> </tr> <tr> <td> Domain </td> <td> p7cp[.]org </td> <td> Suspicious domain from collection </td> </tr> <tr> <td> Domain </td> <td> w3a01[.]net </td> <td> Suspicious domain from collection </td> </tr> <tr> <td> Domain </td> <td> f91j[.]org </td> <td> Suspicious domain from collection </td> </tr> <tr> <td> Domain </td> <td> gov-by[.]com </td> <td> Government domain impersonation </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services (State Treasury, Revenue, Comptroller)</h3> 40. Priority threat: ShinyHunters PeopleSoft exploitation. State financial agencies running PeopleSoft for payroll and accounting face the identical attack path that compromised the FBI contractor. Verify Oracle June 2026 patch immediately. 41. Secondary threat: BlueKit PhaaS templates target financial brands and SSO gateways. Treasury and revenue staff handling sensitive financial data are high-value phishing targets. 42. Action: Audit PeopleSoft patch status. Implement database activity monitoring on financial databases. Deploy FIDO2 for treasury staff with wire transfer authority. <h3>Energy and Utilities (State-Owned or Regulated)</h3> 43. Priority threat: Six CISA ICS advisories (Oct 6) affect Hitachi Energy products (REB500, RTU500, SOI, Asset Suite) used in substation automation, remote terminal units, and grid operations. Johnson Controls EasyIO FG affects building automation. 44. Secondary threat: Volt Typhoon's documented pre-positioning in U.S. critical infrastructure. Their 7+ day reporting absence does not indicate reduced risk. 45. Action: Inventory Hitachi Energy and Johnson Controls deployments. Apply ICS patches per CISA advisories. Segment OT networks from IT networks. Conduct tabletop exercise for Volt Typhoon-style pre-positioning scenario. <h3>Healthcare (State Health Agencies, Medicaid, Public Health)</h3> 46. Priority threat: Arizona court breach included foster care review board reports — health-adjacent PII. State health agencies hold similarly sensitive data (Medicaid records, mental health records, vital statistics). 47. Secondary threat: Ransomware groups targeting backup infrastructure (Veeam CVE-2025-64393) could cripple health IT systems during a public health emergency. 48. Action: Patch Veeam immediately. Audit access controls on Medicaid and vital statistics databases. Ensure HIPAA breach notification procedures are current. Verify immutable backup copies of critical health data. <h3>Government (Executive Agencies, Legislature, Elections)</h3> 49. Priority threat: ClickFix social engineering campaigns (UAC-0277 and UNC6924/UNC7032) targeting government employees via compromised legitimate websites. State employees researching policy, legislation, or vendor information via search engines are at risk. 50. Secondary threat: BlueKit PhaaS with Citrix and SSO templates directly targets the remote access infrastructure government agencies depend on. 51. Action: Deploy GPO restrictions on Windows Run dialog for standard users. Enforce browser extension allowlists. Conduct targeted security awareness training on fake browser verification prompts. Implement Conditional Access policies requiring compliant/managed devices for all Citrix and SSO access. <h3>Aviation and Logistics (State DOT, Ports, Transit Authorities)</h3> 52. Priority threat: ICS/SCADA vulnerabilities in Hitachi Energy RTU500 (remote terminal units used in transportation infrastructure) and Johnson Controls EasyIO FG (building automation in transit facilities). 53. Secondary threat: Chinese APT groups (APT41, Volt Typhoon) have documented interest in transportation infrastructure for both espionage and pre-positioning. 54. Action: Inventory ICS/SCADA systems in transportation facilities. Apply CISA ICS advisory patches. Segment building automation systems from IT networks. Review remote access to OT systems — eliminate any direct internet exposure. <h2>Prioritized Defense Recommendations</h2> <h3>IMMEDIATE (Within 24 Hours)</h3> <table border="0" rules="all"> <thead> <tr> <td> Priority </td> <td> Team </td> <td> Action </td> </tr> </thead> <tbody> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Verify Oracle PeopleSoft patch status across all state agencies. The June 2026 Oracle Critical Patch Update must be applied. The FBI/ShinyHunters breach confirms this exact vulnerability is being actively exploited against government PeopleSoft deployments. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Apply Veeam Backup & Replication patch to build 12.3.2.4934 (12.3.2 P4) on all Veeam servers. CVE-2025-64393 allows Backup Viewer → SYSTEM RCE. Audit all accounts with Backup Viewer role and remove unnecessary grants. Ransomware weaponization expected within 48–72 hours. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Push Google Chrome update to 154.0.8037.39+ (Windows/Mac) or 155.0.8059.39+ (Linux) across all managed endpoints. CVE-2026-106197 and CVE-2026-106358 (CVSS 9.6) enable OS-level code execution via a single website visit. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Verify Citrix NetScaler remediation — CISA KEV deadline is today (Oct 7) for CVE-2026-88779. Confirm CVE-2026-88771 and CVE-2026-88772 are also patched. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Ops </td> <td> Verify FortiMail patching for CVE-2026-104286 (CVSS 9.8). Active exploitation confirmed with persistence via dynamic linker hijacking. Apply available patches; isolate unpatched appliances. </td> </tr> </tbody> </table> <h3>7-DAY</h3> <table border="0" rules="all"> <thead> <tr> <td> Priority </td> <td> Team </td> <td> Action </td> </tr> </thead> <tbody> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Deploy LUNEXSTEALER IOCs to SIEM/EDR blocklists (IPs: 107[.]175.82.242, 193[.]178.158.61, 193[.]178.159.128, 109[.]238.86.112, 109[.]238.86.113). Hunt for scheduled task psychedelicloveUtils and DLL sideloading via FnHotkeyUtility.exe + spkvol.dll. </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Block msiexec.exe network fetches — alert on or block msiexec /i http... commands. Restrict Windows Run dialog via GPO for standard users. Enforce browser extension allowlists to prevent LUNARAXE-style malicious extensions. </td> </tr> <tr> <td> 7-DAY </td> <td> IT Ops </td> <td> Upgrade Elastic/Kibana to 8.19.22, 9.4.7, or 9.5.4 to remediate CVE-2026-102406 (cross-tenant data interception, CVSS 8.8). Audit Fleet package upload history for unauthorized packages. </td> </tr> <tr> <td> 7-DAY </td> <td> CISO </td> <td> Brief judiciary IT leadership on the Arizona court system breach. Recommend audit of court case management system access controls, backup server network segmentation, and phishing resilience assessment for court staff. </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Add blockchain RPC monitoring — watch for outbound connections to Polygon and Ethereum mainnet RPC endpoints from state network endpoints. This detects EtherHiding C2 callbacks used by LUNEXSTEALER. </td> </tr> </tbody> </table> <h3>30-DAY</h3> <table border="0" rules="all"> <thead> <tr> <td> Priority </td> <td> Team </td> <td> Action </td> </tr> </thead> <tbody> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Evaluate FIDO2/passkey deployment for high-value accounts to defeat credential harvesting by BlueKit and EvilTokens PhaaS platforms. Hardware-bound credentials are the only reliable defense against AI-generated phishing at scale. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Commission phishing resilience assessment specifically testing AI-generated phishing content and ClickFix-style fake browser verification prompts. Traditional phishing simulations may not reflect the current threat. </td> </tr> <tr> <td> 30-DAY </td> <td> IT Ops </td> <td> Review ICS/SCADA patching posture for Hitachi Energy (REB500, RTU500, SOI, Asset Suite) and Johnson Controls (EasyIO FG) products deployed in state facilities. Six CISA ICS advisories published Oct 6. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Conduct state-wide PeopleSoft inventory and patch compliance audit. The FBI/ShinyHunters incident reveals that even sophisticated organizations fail to patch ERP systems promptly. State agencies with less mature patch management are at higher risk. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Procure secondary OSINT intelligence source (e.g., Recorded Future, GreyNoise) to eliminate single-vendor dependency in threat intelligence collection. Current single-source dependency degrades corroboration capability and represents an unacceptable intelligence gap. </td> </tr> </tbody> </table> <h3>Executive and IR Preparedness</h3> <table border="0" rules="all"> <thead> <tr> <td> Priority </td> <td> Team </td> <td> Action </td> </tr> </thead> <tbody> <tr> <td> IMMEDIATE </td> <td> CISO </td> <td> Confirm PeopleSoft patch status across all state agencies and report to CIO. This is a confirmed, active exploitation path against government targets. </td> </tr> <tr> <td> IMMEDIATE </td> <td> CISO </td> <td> Authorize emergency Veeam patching window. The 48–72 hour weaponization timeline means standard change management processes may be too slow. </td> </tr> <tr> <td> 7-DAY </td> <td> CISO </td> <td> Direct judiciary IT to conduct phishing resilience assessment and backup server segmentation review, informed by the Arizona court breach. </td> </tr> <tr> <td> 7-DAY </td> <td> IR Team </td> <td> Update incident response playbooks to include Veeam compromise as a ransomware precursor scenario. Verify that backup recovery procedures work when the Veeam server itself is compromised. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Tabletop exercise: Simulate a scenario where ransomware operators exploit Veeam CVE-2025-64393 to destroy backups before deploying ransomware across state agency infrastructure. Test recovery from immutable/air-gapped copies. </td> </tr> </tbody> </table> <h2>The Convergence Pattern</h2> The most important strategic takeaway from this week's intelligence is not any single vulnerability or breach — it is the convergence of multiple threat vectors targeting the same infrastructure simultaneously. Consider the attack chain a sophisticated adversary could construct today: 55. Initial access via BlueKit-generated phishing targeting Citrix SSO credentials (T1566.001) 56. Credential harvesting through AI-generated, contextually perfect phishing pages (T1539) 57. Lateral movement to PeopleSoft via harvested credentials on an unpatched instance (T1190, T1078) 58. Backup destruction via Veeam CVE-2025-64393 — Backup Viewer to SYSTEM (T1490) 59. Ransomware deployment with no recovery option available Each link in this chain has a corresponding confirmed threat or active vulnerability documented in this report. The defense must be equally comprehensive. <h2>Bottom Line</h2> Three facts define this threat cycle: 60. A peer organization lost 1.3 million records to a single phishing click. The Arizona court breach is not a cautionary tale about exotic tradecraft — it is a reminder that the most basic social engineering technique remains devastatingly effective against government infrastructure. 61. The FBI terminated a major contractor over an unpatched ERP system. The June 2026 Oracle patch that would have prevented the ShinyHunters breach has been available for months. If your PeopleSoft patch status is unknown, it must be verified today. 62. A CVSS 9.4 backup RCE was disclosed 24 hours ago, and ransomware operators are already working to weaponize it. Veeam CVE-2025-64393 is not a future risk — it is an active countdown. The 48–72 hour weaponization window closes before most standard change management cycles complete. The adversaries in this report are not waiting for your next maintenance window. The minimum acceptable response is: verify PeopleSoft patches, deploy the Veeam fix, push Chrome updates, and confirm Citrix and FortiMail remediation — today. <h2>Closing</h2> The events of this week leave no room for complacency. A peer state judiciary lost 1.3 million records to a single phishing click. The FBI terminated a major contractor over an unpatched ERP system. A CVSS 9.4 vulnerability in the backup software that protects your ability to recover from ransomware was disclosed 24 hours ago, and the clock is running. State government IT leaders face a narrow window of action. The PeopleSoft patch has been available since June — verify it today. The Veeam patch was released yesterday — deploy it now. Chrome updates are available — push them across your enterprise. These are not aspirational recommendations. They are the minimum actions required to maintain an acceptable security posture given the current threat environment. The adversaries documented in this report — from ShinyHunters exploiting government ERP systems to UAC-0277 weaponizing 100+ legitimate websites to BlueKit's 1,000+ customers generating AI-powered phishing campaigns — are not waiting for your next change management window. Neither should you. Anomali CTI Desk — 2026-10-07 For questions or additional IOC feeds, contact your Anomali representative or access indicators directly via ThreatStream Next-Gen.

FEATURED RESOURCES

October 7, 2026

Anomali Cyber Watch

Public Sector