When Supply Chains, Zero-Days, and Ransomware Converge: A Threat Briefing for State Government IT Leaders

Public Sector

Published on

April 21, 2026

Table of Contents

Threat Assessment Level: ELEVATED (Trending HIGH) Changed from MODERATE (April 20) to ELEVATED (April 21). Rationale: Simultaneous CISA supply chain alert, accelerating KEV additions (18 in 8 days), multi-actor exploitation of government mobile device management platforms, and a ransomware group posting six victims in a single day including major U.S. financial institutions. <h2>Introduction                           </h2> State government technology leaders face a compounding threat picture this week. On April 20, CISA issued a supply chain compromise alert for a JavaScript library embedded in thousands of web applications — including many serving constituents — while simultaneously adding eight new vulnerabilities to its Known Exploited Vulnerabilities catalog. At the same time, five separate threat actor campaigns are now exploiting Ivanti mobile device management software used across government agencies, deploying a previously unknown malware family called MISTBRICK. And the Everest ransomware group — which explicitly lists government-public-services among its targets — posted six new victims in a single day, including two major U.S. banks. These are not isolated events. They represent a convergence: a single supply chain compromise is simultaneously a nation-state operation, a vulnerability management crisis, and a potential incident response scenario. State agencies that treat these as separate problems will miss the full picture. This briefing provides the specific intelligence your teams need to act — today, this week, and this month. <h2>What Changed                               </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> April 21 </td> <td> Lazarus Group "Mach-O Man" macOS campaign detailed by ANY.RUN </td> <td> North Korean actors distributing macOS malware via fake Zoom/Teams/Meet invitations. Relevant to any executive or senior staff using Apple devices. </td> </tr> <tr> <td> April 21 </td> <td> PUNK SPIDER / Akira ransomware actor profile updated </td> <td> Continued ransomware operational tempo against U.S. targets. </td> </tr> <tr> <td> April 20 </td> <td> CISA issues Axios npm supply chain compromise alert </td> <td> DPRK-nexus actors trojanized the widely-used Axios HTTP client library. Any state web application using Axios may be compromised. </td> </tr> <tr> <td> April 20 </td> <td> CISA adds 8 new CVEs to KEV catalog (18 KEVs in 8 days) </td> <td> Accelerating exploitation tempo. BOD 22-01 compliance timelines apply to all FCEB agencies; state agencies should mirror these timelines. </td> </tr> <tr> <td> April 20 </td> <td> Everest ransomware posts 6 victims in one day (Citizens Bank, Frost Bank, others) </td> <td> Group explicitly targets government-public-services. Uses RMM tools commonly whitelisted in state environments. </td> </tr> <tr> <td> April 19 </td> <td> Ivanti EPMM exploitation expands to 5 campaigns, MISTBRICK malware deployed </td> <td> CVE-2026-1281 and CVE-2026-1340 (both CVSS 9.8) now exploited by multiple unrelated threat actors against government targets across 6+ countries. </td> </tr> <tr> <td> April 19 </td> <td> Iranian espionage campaign broadens to 17 countries </td> <td> MuddyWater (MOIS) custom backdoors and legitimate remote access tools targeting government, energy, utilities, education, and telecommunications. </td> </tr> <tr> <td> April 19 </td> <td> CyberAv3ngers (IRGC-CEC) continues Rockwell PLC exploitation at U.S. water facilities </td> <td> Ongoing destructive Iranian ICS campaign against U.S. water and wastewater infrastructure. (Carried from prior cycle — remains active.) </td> </tr> <tr> <td> April 19 </td> <td> APT28 (Russia/GRU) Outlook CVE-2023-23397 credential harvesting campaign updated </td> <td> Russian intelligence service credential theft targeting government. (Carried from prior cycle — remains active.) </td> </tr> <tr> <td> April 19 </td> <td> Cisco Catalyst SD-WAN CVE-2026-20127 (CVSS 10.0) confirmed exploited against government </td> <td> Full network fabric takeover capability. (Carried from prior cycle — remains active.) </td> </tr> <tr> <td> April 17 </td> <td> BeyondTrust CVE-2026-1731 (CVSS 9.8) exploitation delivering Meterpreter into government environments </td> <td> Privileged access management compromise. (Carried from prior cycle — remains active.) </td> </tr> <tr> <td> April 16 </td> <td> CISA adds Ivanti EPMM CVEs to KEV catalog </td> <td> Formal confirmation of active exploitation; BOD 22-01 remediation deadlines triggered. </td> </tr> </tbody> </table> <h2>Threat Timeline                              </h2> <table> <thead> <tr> <th> Date </th> <th> Actor / Campaign </th> <th> Target Sector </th> <th> Key Detail </th> </tr> </thead> <tbody> <tr> <td> April 16 </td> <td> Multiple actors </td> <td> Government, Commercial </td> <td> CISA adds Ivanti EPMM CVE-2026-1281 / CVE-2026-1340 to KEV catalog </td> </tr> <tr> <td> April 17 </td> <td> Unknown </td> <td> Government </td> <td> BeyondTrust CVE-2026-1731 exploitation confirmed — Meterpreter payloads delivered </td> </tr> <tr> <td> April 17 </td> <td> SafePay ransomware </td> <td> Multiple </td> <td> Actor profile updated — continued operations </td> </tr> <tr> <td> April 17 </td> <td> DragonForce ransomware </td> <td> Multiple </td> <td> Actor profile updated — continued operations </td> </tr> <tr> <td> April 19 </td> <td> Multiple (5 campaigns) </td> <td> Government, Financial, Transportation </td> <td> Ivanti EPMM exploitation expands; MISTBRICK malware deployed against government </td> </tr> <tr> <td> April 19 </td> <td> MuddyWater (Iranian MOIS) </td> <td> Government, Energy, Utilities (17 countries) </td> <td> Custom backdoors + legitimate RAT abuse for espionage </td> </tr> <tr> <td> April 19 </td> <td> APT28 (Russia/GRU) </td> <td> Government </td> <td> Outlook CVE-2023-23397 credential harvesting campaign updated </td> </tr> <tr> <td> April 19 </td> <td> Sapphire Sleet (DPRK) </td> <td> Government, Healthcare, Energy, Aerospace (13 countries) </td> <td> Axios npm supply chain backdoor confirmed </td> </tr> <tr> <td> April 20 </td> <td> CISA </td> <td> All sectors </td> <td> 8 new KEVs added (18 total in 8 days) + Axios npm supply chain alert published </td> </tr> <tr> <td> April 20 </td> <td> Everest ransomware </td> <td> Financial Services, Manufacturing </td> <td> 6 victims posted in single day including Citizens Bank, Frost Bank </td> </tr> <tr> <td> April 21 </td> <td> Lazarus Group (DPRK) </td> <td> Fintech, Crypto (expanding) </td> <td> "Mach-O Man" macOS ClickFix campaign via fake meeting invitations </td> </tr> <tr> <td> April 21 </td> <td> CyberAv3ngers (Iranian IRGC-CEC) </td> <td> Water/Wastewater </td> <td> Ongoing Rockwell PLC exploitation at U.S. water facilities (carried from prior cycle) </td> </tr> </tbody> </table> <h2>Key Threat Analysis                      </h2> <h3>1. Axios npm Supply Chain Compromise — DPRK Operation with Government in the Crosshairs</h3> On April 20, CISA published a formal alert confirming that North Korean-nexus actors (tracked as Sapphire Sleet) trojanized the Axios HTTP client library — one of the most widely downloaded npm packages in the JavaScript ecosystem. The compromised package deployed a backdoor enabling persistent access and data exfiltration. This is not a theoretical risk. Intelligence confirms two separate campaigns: one targeting government, healthcare, energy, and aerospace sectors across 13 countries, attributed to a DPRK state-sponsored financial gain actor. State government web applications — constituent portals, online tax filing, benefits enrollment, licensing systems — commonly use Axios for API calls. A compromised dependency in any of these applications could provide a persistent backdoor into state networks. The convergence problem: This single event simultaneously represents a supply chain compromise, a nation-state espionage operation, and a vulnerability management challenge. Agencies that route this to "the web team" without involving the SOC and CISO office will miss the full scope. <h3>2. Ivanti EPMM: From Single Exploit to Multi-Actor Feeding Frenzy</h3> What began as a pair of critical vulnerabilities (CVE-2026-1281 and CVE-2026-1340, both CVSS 9.8) in Ivanti Endpoint Manager Mobile has escalated into a multi-actor exploitation campaign. Intelligence now tracks five separate campaigns exploiting these CVEs, with the newest deploying a previously unknown malware family called MISTBRICK specifically against government and commercial targets across six countries. Both vulnerabilities enable unauthenticated remote code execution — meaning no credentials are required to compromise an exposed Ivanti EPMM instance. For state agencies using Ivanti for mobile device management (managing employee phones, tablets, and field devices), an unpatched instance is effectively an open door. The progression is textbook: vulnerability disclosed → CISA adds to KEV → single actor exploits → multiple actors adopt → new malware families emerge. State agencies still running unpatched Ivanti EPMM are now facing not one threat actor, but at least five. <h3>3. Everest Ransomware: Government-Adjacent Targeting at Scale</h3> The Everest ransomware group posted six new victims on April 20 alone, including two major U.S. financial institutions (Citizens Bank and Frost Bank). Since 2021, Everest claims 350 total victims, with the United States as the primary target (93 victims). The group explicitly lists government-public-services among its target sectors. What makes Everest particularly dangerous for state government environments is its tooling: the group simultaneously deploys AnyDesk, Atera, and Splashtop — three legitimate remote monitoring and management (RMM) tools that are commonly whitelisted in state IT environments for helpdesk and remote support purposes. This triple-RMM approach creates a significant detection blind spot: each tool individually appears legitimate, and security teams may not flag their presence. Additional tools in Everest's arsenal include Cobalt Strike (BEACON), Metasploit/Meterpreter, SoftPerfect NetScan for network discovery, and ProcDump for credential dumping from LSASS memory. The financial institution targeting is also relevant: state treasury and revenue agencies maintain banking relationships with institutions like those Everest has compromised. While no direct state government victim has been confirmed in the past 24 hours, the group's operational tempo and explicit government targeting make this a matter of when, not if. <h3>4. Lazarus Group macOS Campaign: Executives Are the Target</h3> A new Lazarus Group campaign distributes Go-based macOS malware ("Mach-O Man") through a social engineering technique called ClickFix. The attack chain: a victim receives a Telegram message from a compromised trusted contact → is directed to a fake Zoom, Teams, or Meet page → is prompted to paste a command into their terminal → a stager (teamsSDK.bin) downloads a fake application → the malware prompts for the user's password three times → harvests the macOS Keychain (stored passwords, certificates, tokens), browser sessions, and credentials → exfiltrates everything via Telegram. While primary targets are currently fintech and cryptocurrency firms, the technique is sector-agnostic. Senior state government leaders — CIOs, CISOs, agency directors — increasingly use macOS devices and regularly join video meetings with external parties. The social engineering vector (a message from a compromised trusted contact with a meeting link) is exactly the kind of communication that bypasses suspicion. This campaign also connects to earlier intelligence on BlueNoroff (a Lazarus sub-group) registering fresh command-and-control domains mimicking Zoom, Teams, and Meet platforms — infrastructure preparation that preceded this operational campaign. <h3>5. Iranian Espionage: Broadening Scope Across Government and Critical Infrastructure</h3> Two Iranian threat campaigns remain active and expanding: <ul> <li>MuddyWater (Iranian Ministry of Intelligence and Security — MOIS) continues espionage operations using custom backdoors and legitimate remote access tools across 17 countries, targeting government, energy, utilities, education, and telecommunications sectors.</li> <li>CyberAv3ngers (Iranian Islamic Revolutionary Guard Corps — Cyber Electronic Command, IRGC-CEC) continues exploiting Rockwell PLCs at U.S. water and wastewater facilities.</li> </ul> For state agencies operating water treatment, wastewater, and pipeline SCADA systems, the Iranian threat is not abstract — it is operational and confirmed against U.S. targets. Four new ICS advisories were published this cycle covering AVEVA Pipeline Simulation, Delta Electronics ASDA-Soft, Horner Cscape/XL PLC, and Anviz products. <h3>6. Ongoing Critical Exploits (Carried from Prior Cycle)</h3> Three critical exploitation campaigns from the prior cycle remain active and unresolved: <ul> <li>Cisco Catalyst SD-WAN CVE-2026-20127 (CVSS 10.0): Confirmed active exploitation against government targets enabling full network fabric takeover. Any state agency using Cisco Catalyst SD-WAN must verify patch status immediately.</li> <li>BeyondTrust CVE-2026-1731 (CVSS 9.8): Exploitation confirmed delivering Meterpreter payloads into government environments. State agencies using BeyondTrust for privileged access management face a particularly dangerous scenario: compromise of the PAM solution itself.</li> <li>APT28 (Russia/GRU) Outlook CVE-2023-23397: Credential harvesting campaign updated as of April 19. Russian intelligence service actors continue targeting government entities via this well-documented NTLM credential theft vulnerability.</li> </ul> <h2>Predictive Analysis: What Comes Next</h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional threat actors adopt Ivanti EPMM exploitation; campaign count exceeds 5 </td> <td> HIGH (>75%) </td> <td> 7 days </td> <td> Pattern of rapid multi-actor adoption once CVEs hit KEV; 5 campaigns already confirmed </td> </tr> <tr> <td> Axios npm supply chain impact expands as organizations discover compromised dependencies </td> <td> MODERATE-HIGH (50–75%) </td> <td> 7–14 days </td> <td> CISA alert will trigger audits; many organizations have not yet checked </td> </tr> <tr> <td> Everest ransomware posts government-sector victims </td> <td> MODERATE-HIGH (50–75%) </td> <td> 14 days </td> <td> 6-victim day demonstrates sustained tempo; government explicitly in target set; 93 U.S. victims to date </td> </tr> <tr> <td> CISA issues dedicated Ivanti EPMM advisory (beyond KEV listing) </td> <td> MODERATE (50–75%) </td> <td> 7 days </td> <td> Multi-actor exploitation of government targets typically triggers standalone advisory </td> </tr> <tr> <td> Lazarus ClickFix / Mach-O Man campaign expands beyond fintech to government executives </td> <td> LOW-MODERATE (25–50%) </td> <td> 30 days </td> <td> DPRK campaigns historically broaden targeting over time; technique is sector-agnostic </td> </tr> <tr> <td> PRC actors (Volt Typhoon / Salt Typhoon) surface with new pre-positioning activity against state infrastructure </td> <td> LOW-MODERATE (25–50%) </td> <td> 30 days </td> <td> No current intelligence (notable absence); these actors operate on long timelines with periodic bursts </td> </tr> <tr> <td> State agency compromised via Axios supply chain backdoor </td> <td> LOW-MODERATE (25–50%) </td> <td> 14 days </td> <td> Depends on Axios adoption in state web applications; many citizen-facing portals use JavaScript frameworks with Axios dependencies </td> </tr> </tbody> </table> <h2>SOC Operational Guidance                 </h2> <h3>Detection Priorities</h3> Priority 1 — Unauthorized RMM Tool Detection (Everest Ransomware) <ul> <li>ATT&CK: T1219 (Remote Access Software), T1486 (Data Encrypted for Impact)</li> <li>Hunting hypothesis: Everest deploys AnyDesk, Atera, and Splashtop simultaneously. If your agency uses one of these legitimately, the other two should never appear. If none are authorized, any instance is suspicious.</li> <li>Detection logic: Alert on execution of AnyDesk.exe, Atera*.exe, SplashtopStreamer.exe, or their service installations outside of approved IT support asset groups. Correlate with SoftPerfect NetScan execution (T1018) and ProcDump targeting LSASS (T1003.001) — these indicate active Everest operations.</li> <li>Additional indicators: Cobalt Strike BEACON C2 traffic (T1071), Meterpreter sessions, and lateral movement via RMM tools to domain controllers.</li> </ul> Priority 2 — Ivanti EPMM Exploitation and MISTBRICK Post-Exploitation <ul> <li>ATT&CK: T1190 (Exploit Public-Facing Application), T1059 (Command and Scripting Interpreter), T1105 (Ingress Tool Transfer)</li> <li>Hunting hypothesis: If your state uses Ivanti EPMM, check for unexpected outbound connections from the EPMM server, new scheduled tasks, or unfamiliar binaries in web-accessible directories. MISTBRICK is a new malware family — signatures may not yet exist in your EDR.</li> <li>Detection logic: Monitor Ivanti EPMM server logs for unauthenticated API calls, unexpected file writes, and outbound connections to unfamiliar IPs. Alert on any new binary execution on the EPMM host that does not match the Ivanti software manifest.</li> <li>Immediate action: If Ivanti EPMM is unpatched, assume compromise and initiate threat hunting on the host before patching.</li> </ul> Priority 3 — Axios npm Supply Chain Indicators <ul> <li>ATT&CK: T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain), T1071.001 (Application Layer Protocol: Web Protocols)</li> <li>Hunting hypothesis: Compromised Axios packages may beacon to attacker infrastructure. State web applications using Axios could be exfiltrating data without visible symptoms.</li> <li>Detection logic: Block and alert on DNS queries or HTTP connections to sfrclak[.]com. Search web application dependency files (package-lock.json, yarn.lock) for references to this domain. Monitor for unexpected outbound data transfers from web application servers.</li> <li>IOC to block: Domain sfrclak[.]com; SHA-1 3b8855190bfd44f2fc5f93c31f81646ce2c77f68</li> </ul> Priority 4 — macOS ClickFix / Lazarus Mach-O Man <ul> <li>ATT&CK: T1204.002 (User Execution: Malicious File), T1059.004 (Unix Shell), T1555.001 (Keychain), T1539 (Steal Web Session Cookie), T1036.005 (Masquerading)</li> <li>Hunting hypothesis: Senior staff receiving meeting invitations via Telegram or unfamiliar channels may be targeted. The attack requires the user to paste a command into Terminal.</li> <li>Detection logic: Monitor macOS endpoints for Terminal.app or iTerm2 executing curl or wget commands that download .bin or .app files. Alert on codesign --force --sign - commands (ad-hoc code signing of downloaded binaries). Monitor for Keychain access by non-standard processes. Watch for Telegram API connections from endpoints that don't have Telegram installed as an approved application.</li> <li>Indicators to watch: Files named teamsSDK.bin; Cloudflare Workers domains (*.workers[.]dev) used as C2 proxies.</li> </ul> Priority 5 — Iranian Espionage via Legitimate Remote Access Tools <ul> <li>ATT&CK: T1133 (External Remote Services), T1078 (Valid Accounts), T1105 (Ingress Tool Transfer)</li> <li>Hunting hypothesis: MuddyWater (MOIS) uses legitimate RATs to blend with normal administrative traffic. Look for remote access tool installations that were not provisioned by IT.</li> <li>Detection logic: Baseline all authorized remote access tools. Alert on any new remote access software installation or execution that deviates from the baseline. Correlate with logins from unusual geographies or at unusual hours.</li> </ul> <h3>Threat Hunting Queries to Prioritize This Week</h3> <ol> <li>RMM tool audit: Enumerate all installations of AnyDesk, Atera, Splashtop, and similar RMM tools across the enterprise. Compare against the authorized software list. Investigate any unauthorized instances.</li> <li>Ivanti EPMM host forensics: If Ivanti EPMM is deployed, conduct a forensic review of the host for indicators of exploitation — new files, modified configurations, unexpected network connections.</li> <li>JavaScript dependency audit: Scan all state web application repositories for Axios package references. Identify version numbers and check against CISA's clean version guidance.</li> <li>macOS Keychain access review: On managed macOS endpoints, review Keychain access logs for non-standard process access patterns.</li> <li>Outbound connection anomaly detection: Review firewall and proxy logs for state web application servers making connections to unfamiliar domains, particularly sfrclak[.]com and *.workers[.]dev patterns.</li> </ol> <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services (State Treasury, Revenue, Comptroller)</h3> Everest ransomware's April 20 targeting of Citizens Bank and Frost Bank is a direct signal. State treasury and revenue agencies handle billions in transactions and maintain banking relationships with institutions in Everest's crosshairs. <ul> <li>Immediate: Verify that RMM tools (AnyDesk, Atera, Splashtop) are not installed on financial system endpoints unless explicitly authorized. Implement application whitelisting on systems processing financial transactions.</li> <li>7-Day: Review third-party banking partner security posture. Confirm that financial transaction systems are segmented from general agency networks. Ensure wire transfer authorization requires out-of-band verification.</li> <li>30-Day: Conduct tabletop exercise simulating ransomware encryption of financial systems during a peak processing period (e.g., tax season, payroll cycle).</li> </ul> <h3>Energy and Critical Infrastructure (Water, Wastewater, Pipeline, Transportation)</h3> Iranian threat actors — both MuddyWater/MOIS (espionage) and CyberAv3ngers/IRGC-CEC (destructive) — are actively targeting energy, utilities, and water systems. Four new ICS advisories cover products commonly deployed in state-operated facilities. <ul> <li>Immediate: Verify network segmentation between IT and OT/SCADA environments. Confirm that Rockwell PLC firmware is current and that CyberAv3ngers mitigations from prior CISA advisories are in place.</li> <li>7-Day: Review patch status for AVEVA Pipeline Simulation, Delta Electronics ASDA-Soft, Horner Cscape/XL PLC, and Anviz products against the new ICS advisories. Disable unnecessary remote access to ICS/SCADA systems.</li> <li>30-Day: Commission an independent assessment of ICS/SCADA security posture across all state-operated water, wastewater, and transportation control systems. Evaluate whether current monitoring covers OT network traffic anomalies.</li> </ul> <h3>Healthcare (Medicaid, Public Health, State Hospitals)</h3> The Axios npm supply chain compromise explicitly targets healthcare among its 13-country victim set. State Medicaid portals, public health reporting systems, and hospital information systems frequently use JavaScript frameworks with Axios dependencies. <ul> <li>Immediate: Audit all healthcare-facing web applications for Axios npm dependencies. Prioritize Medicaid enrollment portals and public health reporting systems.</li> <li>7-Day: Review access controls on systems containing Protected Health Information (PHI). Ensure that web application servers cannot make arbitrary outbound connections.</li> <li>30-Day: Evaluate web application firewall (WAF) coverage for all citizen-facing healthcare portals. Implement Content Security Policy (CSP) headers to restrict script execution sources.</li> </ul> <h3>Government Operations (All Agencies)</h3> State agencies are in the crosshairs of multiple threat vectors simultaneously: Ivanti EPMM exploitation (mobile device management), BeyondTrust exploitation (privileged access management), Cisco SD-WAN exploitation (network infrastructure), and ransomware groups explicitly targeting government. <ul> <li>Immediate: Confirm patch status for Ivanti EPMM (CVE-2026-1281, CVE-2026-1340), BeyondTrust (CVE-2026-1731), and Cisco Catalyst SD-WAN (CVE-2026-20127) across all agencies. These are the three highest-severity actively exploited vulnerabilities affecting government this week.</li> <li>7-Day: Cross-reference the 18 KEVs added in the past 8 days against the state asset inventory. Prioritize remediation per BOD 22-01 timelines. Deploy detection rules for unauthorized RMM tool installations statewide.</li> <li>30-Day: Conduct a statewide review of internet-facing appliance inventory. The dominant initial access vector has shifted from phishing to direct exploitation of perimeter appliances — VPNs, MDM servers, SD-WAN controllers, and PAM solutions. Any unpatched internet-facing appliance is now a primary attack surface.</li> </ul> <h3>Aviation and Logistics (State DOT, Airports, Port Authorities)</h3> Ivanti EPMM exploitation campaigns now include transportation in their target set. State departments of transportation managing traffic control systems, airport authorities, and port operations face both the Ivanti MDM risk and the broader Iranian espionage campaign targeting transportation infrastructure. <ul> <li>Immediate: Verify Ivanti EPMM patch status for any mobile device management deployments supporting field operations (DOT inspectors, airport security, port operations).</li> <li>7-Day: Review remote access configurations for transportation control systems. Ensure that field device management does not create a bridge between corporate IT and operational technology networks.</li> <li>30-Day: Assess supply chain risk for logistics and transportation management software. The Axios npm compromise demonstrates that widely-used software libraries can be weaponized — transportation scheduling, fleet management, and cargo tracking systems may have similar dependencies.</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>IMMEDIATE (Within 24 Hours)</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Operations </td> <td> Verify all Ivanti EPMM instances are patched against CVE-2026-1281 and CVE-2026-1340. Five threat actor campaigns are now exploiting these vulnerabilities with a new malware family (MISTBRICK) specifically targeting government. If unpatched, assume compromise and initiate forensic review before patching. </td> </tr> <tr> <td> 2 </td> <td> Development / DevOps </td> <td> Audit all state web applications for Axios npm package dependency. Pin to the verified clean version per CISA alert guidance. Search package-lock.json and yarn.lock files for references to sfrclak[.]com. Block sfrclak[.]com at DNS and web proxy. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Deploy detection rules for unauthorized RMM tool installations — specifically AnyDesk, Atera, and Splashtop binaries executing outside approved IT support contexts. Everest ransomware uses all three simultaneously for persistence and lateral movement. </td> </tr> <tr> <td> 4 </td> <td> IT Operations </td> <td> Confirm patch status for Cisco Catalyst SD-WAN (CVE-2026-20127, CVSS 10.0) and BeyondTrust (CVE-2026-1731, CVSS 9.8). Both are under active exploitation against government targets. </td> </tr> <tr> <td> 5 </td> <td> SOC </td> <td> Block the following IOCs at network boundary: Domain sfrclak[.]com (DNS sinkhole + proxy block); SHA-1 3b8855190bfd44f2fc5f93c31f81646ce2c77f68 (endpoint detection block). </td> </tr> </tbody> </table> <h3>7-DAY</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 6 </td> <td> SOC </td> <td> Deploy macOS-specific detection for the ClickFix attack pattern: monitor for Terminal.app or iTerm2 executing curl/wget commands downloading .bin or .app files, followed by codesign --force --sign - commands. Brief executive staff on fake meeting invitation social engineering via Telegram and unfamiliar channels. </td> </tr> <tr> <td> 7 </td> <td> IT Operations </td> <td> Cross-reference the 18 CISA KEV additions from the past 8 days against the statewide asset inventory. Prioritize remediation per BOD 22-01 timelines. The accelerating KEV tempo (18 in 8 days) indicates a broad exploitation wave. </td> </tr> <tr> <td> 8 </td> <td> SOC </td> <td> Implement Axios supply chain IOC blocking at the endpoint layer: SHA-1 3b8855190bfd44f2fc5f93c31f81646ce2c77f68. Add sfrclak[.]com to DNS sinkhole if not already completed. </td> </tr> <tr> <td> 9 </td> <td> IT Operations </td> <td> Review ICS/SCADA vendor patch status for the four new advisories: AVEVA Pipeline Simulation, Delta Electronics ASDA-Soft, Horner Cscape/XL PLC, and Anviz products. Coordinate with facility operators for maintenance window scheduling. </td> </tr> <tr> <td> 10 </td> <td> All Agency IT </td> <td> Conduct statewide RMM tool inventory. Enumerate all installations of remote access and monitoring software. Remove unauthorized instances. Establish an approved RMM tool list and enforce via application control policies. </td> </tr> </tbody> </table> <h3>30-DAY</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 11 </td> <td> CISO </td> <td> Commission an independent assessment of ICS/SCADA security posture across state-operated water, wastewater, pipeline, and transportation control systems. Iranian threat actors (MuddyWater/MOIS for espionage, CyberAv3ngers/IRGC-CEC for destructive operations) are actively targeting these systems. </td> </tr> <tr> <td> 12 </td> <td> CISO </td> <td> Evaluate macOS endpoint visibility. The Lazarus Mach-O Man campaign demonstrates that macOS devices used by executives and senior staff are viable attack vectors. Assess whether current EDR coverage includes macOS Keychain access monitoring, unsigned binary execution detection, and Telegram API exfiltration detection. </td> </tr> <tr> <td> 13 </td> <td> CISO </td> <td> Conduct a statewide internet-facing appliance audit. The dominant initial access vector has shifted from phishing to direct exploitation of perimeter appliances — VPN concentrators, MDM servers, SD-WAN controllers, and PAM solutions. Catalog all internet-facing appliances, verify patch currency, and evaluate whether each must be internet-exposed. </td> </tr> <tr> <td> 14 </td> <td> CISO / CIO </td> <td> Tabletop exercise: ransomware during peak operations. Simulate an Everest-style ransomware attack encrypting financial transaction systems during a peak processing period. Test backup restoration, communication protocols, and decision-making under pressure. Include the scenario of RMM tools being used as the attack vector. </td> </tr> <tr> <td> 15 </td> <td> CISO / Legal </td> <td> Review state cybersecurity legislation compliance posture. Legislative intelligence has been limited in recent collection cycles. Proactively review the NCSL Cybersecurity Legislation Tracker and NASCIO resources for pending state and federal requirements that may affect budget, staffing, or compliance obligations. </td> </tr> </tbody> </table> <h3>Executive / IR Preparedness</h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Timeframe </th> </tr> </thead> <tbody> <tr> <td> Brief the CIO and agency heads on the Axios supply chain risk — this affects citizen-facing applications and requires cross-agency coordination </td> <td> CISO </td> <td> Immediate </td> </tr> <tr> <td> Confirm incident response retainer is active and the IR provider has current network diagrams and contact information </td> <td> CISO </td> <td> 7-Day </td> </tr> <tr> <td> Pre-authorize emergency patching windows for critical vulnerabilities without standard change control delays </td> <td> CIO </td> <td> 7-Day </td> </tr> <tr> <td> Review cyber insurance policy for supply chain compromise and ransomware coverage adequacy </td> <td> CISO / Legal / Risk </td> <td> 30-Day </td> </tr> <tr> <td> Establish communication protocol with CISA Region and MS-ISAC for coordinated response if a state agency is compromised via any of the active campaigns </td> <td> CISO </td> <td> 7-Day </td> </tr> </tbody> </table> <h2>IOC Blocking Table                       </h2> The following IOCs have been verified through intelligence collection and may be used for immediate blocking and detection: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> sfrclak[.]com </td> <td> Axios npm supply chain C2 infrastructure (DPRK/Sapphire Sleet) </td> <td> DNS sinkhole + proxy block </td> </tr> <tr> <td> SHA-1 </td> <td> 3b8855190bfd44f2fc5f93c31f81646ce2c77f68 </td> <td> Malicious Axios package hash (Kaspersky feed, confidence 100) </td> <td> Endpoint detection block </td> </tr> <tr> <td> Domain (pattern) </td> <td> *[.]workers[.]dev </td> <td> Cloudflare Workers used as C2 proxy in related DPRK campaigns </td> <td> Monitor — do not blanket-block (legitimate use is common); alert on connections from non-browser processes </td> </tr> <tr> <td> Onion </td> <td> ransomocmou6mnbquqz44ewosbkjk3o5qjsl3orawojexfook2j7esad[.]onion </td> <td> Everest ransomware data leak site </td> <td> Network monitoring indicator (Tor exit node detection) </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. MISTBRICK malware hashes have not yet been published in available feeds — monitor vendor advisories for updates. <h2>Bottom Line                                  </h2> The threat environment facing state government has shifted. The days when phishing emails were the primary concern are behind us. Today's adversaries — North Korean supply chain operators, Iranian infrastructure saboteurs, Russian intelligence services, and ransomware syndicates that explicitly target government — are exploiting the appliances, software libraries, and management tools that form the backbone of state IT operations. The convergence is the message. A single compromised JavaScript library is simultaneously a supply chain incident, a nation-state operation, and a patch management failure. An unpatched mobile device management server is not just a vulnerability — it is an invitation to five different threat actor groups. A whitelisted remote support tool is not just convenient — it is the exact tool a ransomware operator will use to move through your network. Three actions matter most right now: <ol> <li>Patch Ivanti EPMM today. Not this week. Today. Five campaigns. New malware. Government targets confirmed.</li> <li>Audit Axios dependencies today. Every state web application. Every package-lock.json. Block sfrclak[.]com at the network edge.</li> <li>Hunt for unauthorized RMM tools today. AnyDesk, Atera, Splashtop. If they are not on your approved list, they should not be on your network.</li> </ol> The threat actors are not waiting. Neither should we. Anomali CTI Desk — 2026-04-21For questions or to request additional intelligence on any topic covered in this briefing, contact your Anomali representative or the CTI Desk directly.IOCs and machine-readable indicators are available via Anomali ThreatStream Next-Gen.

FEATURED RESOURCES

April 21, 2026

Anomali Cyber Watch

Iran's Cyber War Didn't Stop When the Ceasefire Started — And the Next 72 Hours Are Critical

April 21, 2026

Anomali Cyber Watch

Public Sector

When Supply Chains, Zero-Days, and Ransomware Converge: A Threat Briefing for State Government IT Leaders

April 20, 2026

Anomali Cyber Watch

Iran’s Cyber War Didn’t Stop When the Bombs Did — Why the Ceasefire Is the Most Dangerous Phase Yet

Explore All