When Three Nation-States Come Knocking: A Critical Week for State Government Cybersecurity

Public Sector

Published on

April 29, 2026

Table of Contents

Threat Assessment Level: HIGH Elevated from ELEVATED (prior assessment, 28 April 2026). Justification: Two new CISA Known Exploited Vulnerabilities (KEV) entries directly targeting state government infrastructure; confirmed APT28 exploitation of a zero-click Windows credential theft vulnerability; Qilin ransomware's EDR-killing capability promoted to high confidence with multi-source validation; and new Sandworm persistence tradecraft specifically designed to evade standard government network defenses. <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demands immediate executive attention. Russia's APT28 is actively exploiting a Windows vulnerability that steals credentials without any user interaction. China-linked operators are weaponizing a remote management tool — ConnectWise ScreenConnect — that many state agencies and their managed service providers rely on daily. Russia's Sandworm group has unveiled a new persistence technique that tunnels through Tor to maintain hidden access to government networks. And the Qilin ransomware operation has deployed a capability that can disable more than 300 endpoint security products. This is not a theoretical risk briefing. These are active campaigns, confirmed by CISA, Microsoft, Cisco Talos, and Europol — all converging in the same operational window. If your agency has unpatched Windows systems, ConnectWise ScreenConnect deployments, or relies solely on endpoint detection and response (EDR) as your last line of defense, you are exposed right now. <h2> What Changed </h2> The past 72 hours brought a sharp escalation in both the volume and severity of threats relevant to state government networks: <ul> <li> 27–28 April: Microsoft confirmed active exploitation of CVE-2026-32202 , a Windows Shell vulnerability enabling zero-click NTLM credential theft. CISA added it to the KEV catalog on 28 April. APT28 (Fancy Bear) , Russia's GRU-affiliated threat actor, is the confirmed operator. </li> <li> 28 April: CISA simultaneously added CVE-2024-1708 , a ConnectWise ScreenConnect path traversal flaw, to the KEV catalog. Microsoft attributed exploitation to Storm-1175 (China-linked), which is deploying Medusa ransomware through compromised MSP infrastructure. The federal patch deadline is 12 May 2026 . </li> <li> 28 April: CISA published ICS Advisory ICSA-26-118-01 for CVE-2026-6807 , an XML External Entity (XXE) vulnerability in NSA GRASSMARLIN v3.2.1 , an open-source ICS/OT network mapping tool used by some state agencies for critical infrastructure visibility. </li> <li> Late April: 360 Advanced Threat Research Institute published analysis of Sandworm (APT44) deploying dual-layer SSH-over-Tor tunnels for persistent hidden access to government and energy networks — a significant evolution in Russian persistence tradecraft. </li> <li> April 2026: Cisco Talos published detailed analysis of Qilin ransomware's EDR killer module — a trojanized DLL using Bring Your Own Vulnerable Driver (BYOVD) techniques to terminate 300+ endpoint security products before encrypting systems. </li> <li> Ongoing: An active phishing campaign spoofing IRS taxpayer alerts is delivering ConnectWise ScreenConnect RAT to U.S. targets, creating a second distinct attack vector through the same remote access tool. </li> <li> Ongoing: CVE-2026-42208 (CVSS 9.3), a pre-authentication SQL injection in LiteLLM AI proxy software, was weaponized within 36 hours of disclosure. State agencies piloting AI tools using LiteLLM-style proxies face credential exposure across multiple cloud AI providers. </li> <li> 23 April: CISA confirmed Volt Typhoon and Flax Typhoon (China/PLA-MSS and Integrity Technology Group/MSS) pre-positioning in U.S. critical infrastructure remains active and unresolved — Chinese actors may already hold persistent access to state network infrastructure. </li> </ul> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor / Source </th> <th> Impact to State Government </th> </tr> </thead> <tbody> <tr> <td> Dec 2025 – Present </td> <td> APT28 campaign exploiting NTLM credential theft via LNK files </td> <td> APT28 / Fancy Bear (Russia/GRU) </td> <td> Zero-click credential theft on all unpatched Windows systems </td> </tr> <tr> <td> Feb 2026 </td> <td> Microsoft patches CVE-2026-21510 (incomplete fix) </td> <td> Microsoft </td> <td> Patch proved insufficient; residual vulnerability remained </td> </tr> <tr> <td> 2 Apr 2026 </td> <td> Cisco Talos publishes Qilin EDR killer analysis </td> <td> Qilin / WARLOCK SPIDER </td> <td> EDR products across state agencies can be disabled pre-encryption </td> </tr> <tr> <td> 6 Apr 2026 </td> <td> Security Arsenal confirms Qilin BYOVD technique </td> <td> Independent corroboration </td> <td> High-confidence threat to endpoint protection </td> </tr> <tr> <td> 7 Apr 2026 </td> <td> CISA Iranian PLC advisory (aa26-097a) issued </td> <td> CISA </td> <td> State-managed water/wastewater SCADA systems at risk </td> </tr> <tr> <td> 23 Apr 2026 </td> <td> CISA joint advisory: Volt Typhoon & Flax Typhoon pre-positioning </td> <td> China / PLA-MSS </td> <td> Confirmed Chinese pre-positioning in U.S. critical infrastructure </td> </tr> <tr> <td> 24 Apr 2026 </td> <td> CISA adds CVE-2024-7399 (Samsung MagicINFO) to KEV </td> <td> CISA </td> <td> Digital signage and display systems in government facilities </td> </tr> <tr> <td> 24 Apr 2026 </td> <td> Mandiant publishes UNC6692 SNOW malware framework analysis </td> <td> UNC6692 </td> <td> Senior employees targeted via Microsoft Teams impersonation </td> </tr> <tr> <td> 27 Apr 2026 </td> <td> Microsoft confirms active exploitation of CVE-2026-32202 </td> <td> APT28 (Russia/GRU) </td> <td> All unpatched Windows endpoints exposed </td> </tr> <tr> <td> 28 Apr 2026 </td> <td> CISA adds CVE-2026-32202 and CVE-2024-1708 to KEV </td> <td> CISA </td> <td> Emergency patching required; federal deadline 12 May </td> </tr> <tr> <td> 28 Apr 2026 </td> <td> CISA ICS Advisory for GRASSMARLIN CVE-2026-6807 </td> <td> CISA </td> <td> OT network mapping tool compromised </td> </tr> <tr> <td> Late Apr 2026 </td> <td> Sandworm SSH-over-Tor persistence campaign published </td> <td> Sandworm / APT44 (Russia/GRU) </td> <td> New evasion technique targeting government networks </td> </tr> <tr> <td> Apr 2026 </td> <td> Europol IOCTA 2026: 22% increase in ransomware leak-site posts </td> <td> Europol </td> <td> 2,638 victims posted in Q1 2026; government in target set </td> </tr> <tr> <td> Apr 2026 </td> <td> LiteLLM CVE-2026-42208 exploited within 36 hours </td> <td> Unknown </td> <td> AI proxy infrastructure exposing cloud API keys </td> </tr> <tr> <td> Ongoing </td> <td> IRS-spoofing ConnectWise RAT phishing campaign </td> <td> Unknown (criminal) </td> <td> State employees targeted with tax-themed lures </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. APT28 Zero-Click NTLM Credential Theft (CVE-2026-32202) </h3> Actor: APT28 / Fancy Bear / Forest Blizzard — Russia's GRU Unit 26165 This is the most immediately dangerous threat in today's landscape. CVE-2026-32202 is an incomplete patch for CVE-2026-21510 (February 2026). The attack is devastatingly simple: a malicious .LNK shortcut file containing a UNC path is delivered via spearphishing. When a user merely browses to the folder containing the file — no click required — Windows automatically attempts NTLM authentication to the attacker-controlled server, transmitting the user's credential hash. For state government environments, this is particularly dangerous because: <ul> <li> NTLM remains widely deployed in legacy state applications, inter-agency authentication, and older Active Directory configurations </li> <li> Domain-joined Windows endpoints are the standard across state agencies </li> <li> The attack requires zero user interaction beyond navigating to a folder — no macro, no executable, no "Enable Content" prompt </li> </ul> APT28 has been running this campaign against government targets since December 2025, initially focused on Ukraine and EU governments. The technique is trivial to replicate once understood, meaning secondary actors will adopt it rapidly. Key CVEs: CVE-2026-32202, CVE-2026-21510, CVE-2026-21513 <h3> 2. ConnectWise ScreenConnect: Two Attack Vectors, One Tool </h3> Actors: Storm-1175 (China-linked) deploying Medusa ransomware; unknown criminal operators running IRS phishing ConnectWise ScreenConnect appeared in two separate threat streams on the same day — a rare and concerning convergence: Vector 1 — Nation-State Ransomware: CISA added CVE-2024-1708 (path traversal, CVSS 8.4) to the KEV catalog. This vulnerability chains with CVE-2024-1709 (authentication bypass, CVSS 10.0). Microsoft attributed exploitation to Storm-1175, a China-based group deploying Medusa ransomware through compromised ScreenConnect instances. For state agencies that rely on MSPs using ConnectWise, this is a direct supply chain threat. Vector 2 — Phishing RAT Delivery: A separate campaign uses IRS taxpayer alert lures ("IRS Taxpayer Alert: alert notice," "IRS Taxpayer Alert: submission notice") to deliver ScreenConnect client MSI installers. Because ScreenConnect is a legitimate remote management tool, it may be whitelisted in many state environments — creating a critical detection blind spot. Key CVEs: CVE-2024-1708, CVE-2024-1709 <h3> 3. Sandworm's SSH-over-Tor Persistence — A New Evasion Paradigm </h3> Actor: Sandworm / APT44 / FROZENBARENTS — Russia's GRU Unit 74455 Sandworm has deployed a sophisticated persistence mechanism that chains SSH tunneling with Tor onion routing and obfs4 traffic shaping. The attack begins with a spearphishing ZIP containing a malicious LNK file. Once executed, the malware: <ul> <li> Installs persistence via scheduled tasks masquerading as legitimate applications (OperaGX, Dropbox, Safari, OBS Studio) </li> <li> Maps critical internal ports — SMB (445) and RDP (3389) — to .onion addresses </li> <li> Uses obfs4 pluggable transports to make Tor traffic appear as normal HTTPS </li> </ul> This technique defeats signature-based detection, protocol-based detection, and most standard firewall configurations. The targets documented so far are government agencies, energy companies, and diplomatic departments. <h3> 4. Qilin Ransomware EDR Killer — Your Endpoint Protection May Not Protect You </h3> Actor: Qilin / WARLOCK SPIDER (Ransomware-as-a-Service) Cisco Talos and Security Arsenal independently confirmed that Qilin ransomware deploys a trojanized msimg32.dll that uses BYOVD (Bring Your Own Vulnerable Driver) techniques to terminate more than 300 EDR and antivirus products before beginning encryption. This includes major vendors that state agencies commonly deploy. Combined with Europol's IOCTA 2026 report documenting a 22% increase in ransomware leak-site postings (2,638 victims in Q1 2026 alone) and government explicitly listed in Qilin's target set, this represents a material escalation in ransomware capability against state networks. Additional ransomware groups actively targeting government: Nightspire, Rhysida, Play, APT73, Medusa, LockBit5. <h3> 5. AI Infrastructure as a New Attack Surface (CVE-2026-42208) </h3> State agencies increasingly deploying AI proxy tools like LiteLLM to centralize access to large language model APIs. CVE-2026-42208 (CVSS 9.3) is a pre-authentication SQL injection that was exploited in the wild within 36 hours of disclosure. Attacker IPs 65.111.27[.]132 and 65.111.25[.]67 were observed conducting exploitation. The critical risk: LiteLLM-style proxies aggregate API keys for multiple cloud AI providers (OpenAI, Anthropic, AWS Bedrock) in a single database. A single SQL injection exposes credentials across all connected services simultaneously — a credential concentration risk that most state agencies have not yet accounted for in their security architectures. <h3> 6. Persistent Nation-State Pre-Positioning </h3> The CISA joint advisory from 23 April confirming Volt Typhoon and Flax Typhoon (China/PLA-MSS and Integrity Technology Group/MSS) pre-positioning in U.S. critical infrastructure remains active and unresolved. An Iranian espionage campaign with escalation risk to U.S. state targets (CISA advisory aa26-097a, 7 April) continues, particularly threatening state-managed water and wastewater systems. Notable absence: Salt Typhoon activity was expected following the 23 April advisory on China-nexus compromised device networks but has not been observed. This silence should not be interpreted as safety — it may indicate operational security improvements by the actor or gaps in current collection. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional actors beyond APT28 exploit CVE-2026-32202 for NTLM credential theft </td> <td> HIGH (>70%) </td> <td> 7–14 days </td> <td> Technique is trivial (LNK + UNC path); PoC is effectively public through the advisory details </td> </tr> <tr> <td> Qilin or affiliated ransomware operators target a U.S. state/local government entity using the EDR killer chain </td> <td> MODERATE (40–60%) </td> <td> 14–30 days </td> <td> 22% increase in leak-site activity; government in target set; EDR killer removes primary defensive barrier </td> </tr> <tr> <td> SLSH alliance (Scattered Spider + ShinyHunters + LAPSUS$) attempts social engineering against a government IT helpdesk </td> <td> MODERATE (40–60%) </td> <td> 30 days </td> <td> Europol-documented alliance formation (Aug 2025); SIM swapping and insider recruitment TTPs align with helpdesk targeting </td> </tr> <tr> <td> Secondary actors weaponize ConnectWise ScreenConnect CVE chain for ransomware delivery via MSPs </td> <td> MODERATE-HIGH (50–70%) </td> <td> 7–21 days </td> <td> KEV listing confirms active exploitation; MSP supply chain is a proven ransomware delivery mechanism </td> </tr> <tr> <td> Sandworm SSH-over-Tor technique observed targeting U.S. state government specifically </td> <td> LOW (<30%) </td> <td> 30–60 days </td> <td> Current targeting focused on Eastern European/diplomatic targets; U.S. state government not yet in observed victimology </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Priority Detection Rules </h3> <ol> <li> NTLM Credential Exfiltration (CVE-2026-32202) </li> </ol> <ul> <li> Hunt Hypothesis: Attackers are delivering LNK files with embedded UNC paths to coerce NTLM authentication to external servers. </li> <li> ATT&CK Techniques: T1187 (Forced Authentication), T1003.001 (LSASS Memory), T1557.001 (LLMNR/NBT-NS Poisoning), T1566.001 (Spearphishing Attachment), T1204.002 (Malicious File) </li> <li> Detection: Monitor for outbound SMB (TCP 445) and NTLM authentication attempts to external IP addresses. Alert on any .LNK file creation in email attachment directories or user Downloads folders containing UNC paths (\\<external-IP>\). Monitor Windows Security Event ID 4648 (logon with explicit credentials) for anomalous target servers. </li> <li> Block: Outbound SMB (TCP 445) at the perimeter firewall immediately. Enable SMB signing on all domain controllers. </li> </ul> <ol start="2"> <li> Unauthorized ConnectWise ScreenConnect Installations </li> </ol> <ul> <li> Hunt Hypothesis: Attackers are delivering ScreenConnect MSI installers via phishing or exploiting unpatched ScreenConnect servers to deploy ransomware. </li> <li> ATT&CK Techniques: T1219 (Remote Access Software), T1190 (Exploit Public-Facing Application), T1566.002 (Spearphishing Link), T1105 (Ingress Tool Transfer) </li> <li> Detection: Alert on any ScreenConnect.ClientSetup.msi installation where the relay hostname does not match your authorized ConnectWise instance list. Specifically, flag connections to instance-udzn2c-relay[.]screenconnect[.]com — this is a confirmed malicious relay. Monitor for msiexec.exe spawning ScreenConnect processes outside of approved change windows. </li> <li> Block: Domains certifysubmited[.]com and onlinepaperfile[.]com at web proxy and email gateway. </li> </ul> <ol start="3"> <li> Sandworm SSH-over-Tor Persistence </li> </ol> <ul> <li> Hunt Hypothesis: Attackers are establishing persistent SSH tunnels through Tor, masquerading as legitimate applications, to maintain covert access to government networks. </li> <li> ATT&CK Techniques: T1053.005 (Scheduled Task), T1036.005 (Masquerading), T1572 (Protocol Tunneling), T1090.003 (Multi-hop Proxy), T1021.001 (Remote Services: RDP), T1021.002 (Remote Services: SMB) </li> <li> Detection: Search for scheduled tasks named OperagxRepairTask or DropboxRepairTask. Hunt for executables named operagx.exe, dropbox.exe, safari.exe, or obsstudio.exe running from AppData directories. Monitor for SSH processes listening on non-standard ports (e.g., localhost:20321). Detect Tor bootstrap DNS queries and connections to known Tor directory authorities. </li> <li> Investigate: Any outbound connections on port 443 from servers that do not normally make HTTPS connections — obfs4 traffic shaping makes Tor look like HTTPS. </li> </ul> <ol start="4"> <li> Qilin EDR Killer (BYOVD) </li> </ol> <ul> <li> Hunt Hypothesis: Ransomware operators are loading vulnerable kernel drivers to terminate endpoint security products before encrypting systems. </li> <li> ATT&CK Techniques: T1562.001 (Disable or Modify Tools), T1574.001 (DLL Search Order Hijacking), T1068 (Exploitation for Privilege Escalation), T1486 (Data Encrypted for Impact) </li> <li> Detection: Monitor for loading of known vulnerable drivers (cross-reference with the LOLDrivers project). Alert on msimg32.dll loaded from non-standard paths. Detect mass termination of security service processes. Implement tamper protection and monitor for EDR agent heartbeat failures — a sudden loss of EDR telemetry from multiple endpoints is itself an indicator. </li> <li> Resilience: Ensure logging flows to a cloud-based or network-isolated SIEM that cannot be disabled by endpoint-level attacks. </li> </ul> <ol start="5"> <li> LiteLLM SQL Injection (CVE-2026-42208) </li> </ol> <ul> <li> Hunt Hypothesis: Attackers are exploiting pre-authentication SQL injection in AI proxy tools to extract cloud provider API keys. </li> <li> Detection: Monitor for connections from 65.111.27[.]132 and 65.111.25[.]67. Review web application logs for LiteLLM instances for SQL injection patterns. Audit API key usage across cloud AI providers for anomalous consumption or access from unexpected IP ranges. </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits Systems) </h3> State treasury and revenue systems process millions of financial transactions and hold taxpayer PII — making them prime targets for both ransomware (data extortion) and credential theft (fraud). <ul> <li> Priority 1: The IRS-themed ConnectWise RAT phishing campaign directly targets tax-related workflows. Revenue and benefits agency staff should receive immediate targeted awareness alerts about IRS-spoofing emails with subject lines containing "IRS Taxpayer Alert." </li> <li> Priority 2: CVE-2026-32202 NTLM credential theft is especially dangerous for financial systems that still use NTLM for inter-application authentication. Audit NTLM dependencies in treasury and ERP systems and enforce SMB signing immediately. </li> <li> Priority 3: Qilin and Medusa ransomware both target financial data for double extortion. Verify that financial system backups are immutable, offline, and tested for restoration within your RTO. </li> </ul> <h3> Energy (State-Managed Utilities, Grid Coordination) </h3> State energy agencies coordinating with utilities and managing grid infrastructure face threats from both Sandworm (Russia) and Iranian actors. <ul> <li> Priority 1: Sandworm's SSH-over-Tor persistence campaign explicitly targets energy companies. Implement outbound connection allowlisting on OT network segments — no server in an energy control environment should initiate arbitrary outbound connections. </li> <li> Priority 2: If your OT team uses GRASSMARLIN v3.2.1 for ICS network mapping, restrict network access to the tool immediately and monitor for XXE exploitation attempts (CVE-2026-6807). Consider isolating GRASSMARLIN to an air-gapped analysis workstation. </li> <li> Priority 3: The CISA Iranian PLC advisory (aa26-097a, 7 April) remains active. Verify that all programmable logic controllers in state-managed water treatment and power distribution systems have default credentials changed and are not exposed to the internet. </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> State health agencies managing Medicaid, public health surveillance, and hospital coordination are high-value ransomware targets due to the sensitivity of health data and operational urgency. <ul> <li> Priority 1: Qilin's EDR killer capability is particularly threatening to healthcare environments where endpoint protection is often the primary security control. Implement network-level detection (NDR) as a backup detection layer and ensure SIEM logging is isolated from endpoint compromise. </li> <li> Priority 2: The SLSH alliance (Scattered Spider + ShinyHunters + LAPSUS$) has documented healthcare targeting. Brief IT helpdesk staff on social engineering tactics including SIM swapping, callback phishing, and insider recruitment attempts. </li> <li> Priority 3: Medusa ransomware (deployed via ConnectWise by Storm-1175) has historically targeted healthcare. Verify that any MSP providing services to health agencies has patched ConnectWise ScreenConnect to version 23.9.8 or later. </li> </ul> <h3> Government (Executive Agencies, Legislative Systems, Elections) </h3> Core state government systems — identity management, email, Active Directory, legislative platforms — are the primary targets for nation-state espionage and the backbone that all other sectors depend on. <ul> <li> Priority 1: CVE-2026-32202 emergency patching is non-negotiable. Every unpatched Windows endpoint in the state enterprise is a zero-click credential theft target for APT28. Prioritize domain controllers, privileged access workstations, and systems with access to sensitive data stores. </li> <li> Priority 2: Begin a 30-day NTLM deprecation assessment. CVE-2026-32202 is the third NTLM-related credential theft vector in 12 months. Identify all services and applications still requiring NTLM and develop a migration roadmap to Kerberos or certificate-based authentication. </li> <li> Priority 3: Volt Typhoon and Flax Typhoon pre-positioning (confirmed 23 April) means Chinese actors may already have persistent access to state network infrastructure. Conduct a focused hunt for anomalous network tunneling, living-off-the-land binaries (LOLBins), and dormant scheduled tasks on network appliances and edge devices. </li> </ul> <h3> Aviation / Logistics (State DOT, Airports, Port Authorities) </h3> State departments of transportation, airport authorities, and port operations manage both IT and OT systems critical to public safety and commerce. <ul> <li> Priority 1: ConnectWise ScreenConnect is widely used by MSPs supporting transportation and logistics IT. Verify all MSP-managed ScreenConnect instances are patched against CVE-2024-1708/CVE-2024-1709 — this is a direct supply chain entry point for Medusa ransomware. </li> <li> Priority 2: OT systems in transportation (traffic management, bridge controls, port SCADA) should be assessed against the Sandworm SSH-over-Tor persistence technique. Implement network segmentation that prevents any OT system from initiating outbound connections to the internet. </li> <li> Priority 3: GitHub Enterprise is increasingly used for transportation system DevOps. CVE-2026-3854 (RCE via push option injection) should be patched on any GitHub Enterprise Server instance supporting transportation or logistics applications. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> Immediate (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> IMMEDIATE </td> <td> IT Operations </td> <td> Apply April 2026 Patch Tuesday update to ALL Windows endpoints to remediate CVE-2026-32202 zero-click NTLM credential theft. APT28 is actively exploiting this vulnerability against government targets. Prioritize domain controllers and privileged access workstations. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Operations </td> <td> Verify all ConnectWise ScreenConnect instances are updated to version 23.9.8 or later to remediate CVE-2024-1708 and CVE-2024-1709. Contact all MSPs providing services to state agencies to confirm their patch status. CISA KEV deadline: 12 May 2026. </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Block domains certifysubmited[.]com , onlinepaperfile[.]com , and instance-udzn2c-relay[.]screenconnect[.]com at web proxy, DNS sinkhole, and email gateway. These are confirmed malicious infrastructure for the IRS-themed ConnectWise RAT campaign. </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Block outbound SMB (TCP 445) at the perimeter firewall to prevent NTLM hash exfiltration via CVE-2026-32202. This should be a permanent rule — there is no legitimate reason for outbound SMB to the internet. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Operations </td> <td> Inventory all LiteLLM proxy instances. If running versions 1.81.16 through 1.83.6, update to 1.83.7 immediately and rotate ALL stored LLM provider API keys (OpenAI, Anthropic, AWS Bedrock, Azure OpenAI). </td> </tr> </tbody> </table> <h3> 7-Day Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 7-DAY </td> <td> SOC / Identity </td> <td> Audit NTLM usage across the enterprise. Enable SMB signing on all domain controllers. Identify services still requiring NTLMv1 and begin migration planning. </td> </tr> <tr> <td> 7-DAY </td> <td> DevOps </td> <td> Update GitHub Enterprise Server to version 3.14.25, 3.15.20, 3.16.16, 3.17.13, 3.18.7, or 3.19.4+ to remediate CVE-2026-3854 (RCE via push option injection). </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Deploy detection rules for Sandworm persistence indicators: scheduled tasks named OperagxRepairTask or DropboxRepairTask; SSH processes running from AppData directories; executables named operagx.exe, dropbox.exe, safari.exe, or obsstudio.exe in non-standard paths. </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Implement EDR heartbeat monitoring. Configure alerts for any endpoint that stops reporting EDR telemetry for more than 15 minutes. Mass EDR agent failure is a primary indicator of Qilin's BYOVD EDR killer. </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Deploy Sigma detection rule for unauthorized ScreenConnect MSI installations. Alert on any ScreenConnect.ClientSetup.msi execution where the relay hostname does not match the agency's authorized ConnectWise instance list. </td> </tr> <tr> <td> 7-DAY </td> <td> IT Operations / OT </td> <td> Assess GRASSMARLIN deployment. If v3.2.1 is in use, restrict network access to the tool and move to an air-gapped analysis workstation until a patched version is available (CVE-2026-6807). </td> </tr> </tbody> </table> <h3> 30-Day Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 30-DAY </td> <td> CISO / Identity </td> <td> Develop an NTLM deprecation roadmap. CVE-2026-32202 is the third NTLM credential theft vector in 12 months. Plan migration of remaining NTLM-dependent services to Kerberos or certificate-based authentication. Present timeline and resource requirements to CIO. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO / SOC </td> <td> Implement defense-in-depth beyond EDR. Qilin's ability to disable 300+ EDR products means endpoint detection alone is insufficient. Deploy or enhance network detection and response (NDR), ensure SIEM logging flows to a cloud-based or network-isolated platform that cannot be disabled by endpoint compromise, and implement identity-based anomaly detection. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO / IT Operations </td> <td> Conduct MSP security assessment. ConnectWise ScreenConnect appearing in both a nation-state ransomware campaign and a phishing campaign on the same day demonstrates that MSP remote access tools are simultaneously defensive assets and attack surfaces. Require all MSPs to demonstrate patch compliance, MFA enforcement, and session logging for remote access tools. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Establish AI infrastructure security standards. As state agencies pilot AI tools, require that all LLM API keys be stored in dedicated secrets management platforms (HashiCorp Vault, AWS Secrets Manager) rather than in proxy application databases. Include AI gateway/proxy tools in vulnerability management scope. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO / IR </td> <td> Update incident response playbooks to account for EDR-blind scenarios (Qilin BYOVD), SSH-over-Tor persistence (Sandworm), and MSP supply chain compromise (ConnectWise/Medusa). Conduct a tabletop exercise simulating a ransomware attack that begins with EDR termination. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Commission a focused threat hunt for Volt Typhoon and Flax Typhoon pre-positioning indicators across state network infrastructure. Focus on network edge devices (firewalls, VPN concentrators, routers), dormant scheduled tasks, and anomalous living-off-the-land binary usage. </td> </tr> </tbody> </table> <h2> Bottom Line </h2> The threat level for state government networks has been raised to HIGH . This is not a drill and not a forecast — these are active campaigns by confirmed nation-state actors and sophisticated ransomware operators targeting the exact technologies and architectures that state agencies depend on. Three things make this week different: First , the convergence. Russia (APT28, Sandworm), China (Storm-1175, Volt Typhoon, Flax Typhoon), Iran, and multiple ransomware operations are all active simultaneously against government targets. This is not coordinated, but the cumulative effect is the same — defenders must respond on multiple fronts at once. Second , the erosion of defensive assumptions. Qilin can kill your EDR. Sandworm can tunnel through your firewall. APT28 can steal credentials without a click. ConnectWise — a tool you trust — is being weaponized by both nation-states and criminals. Each of these individually challenges a layer of defense that many state agencies treat as reliable. Third , the speed. CVE-2026-42208 was weaponized within 36 hours. CVE-2026-32202 went from patch to KEV in days. The window between disclosure and exploitation is collapsing, and state government patch cycles must accelerate to match. The recommendations in this brief are specific, prioritized, and actionable. The immediate items — patching CVE-2026-32202, securing ConnectWise ScreenConnect, blocking confirmed malicious infrastructure, and stopping outbound SMB — should be authorized today. The 30-day items — NTLM deprecation, defense-in-depth beyond EDR, MSP security assessments — are the structural changes that will determine whether your agency is resilient against the next wave. The adversaries are not waiting. Neither should we.

FEATURED RESOURCES

April 29, 2026

Anomali Cyber Watch

Iran’s Cyber War Isn’t Waiting for a Ceasefire — and Neither Should You

April 29, 2026

Anomali Cyber Watch

Public Sector

When Three Nation-States Come Knocking: A Critical Week for State Government Cybersecurity

April 28, 2026

Anomali Cyber Watch

When the Ceasefire Holds but the Hackers Don’t: Iran’s Cyber War Enters Its Ninth Week

Explore All