When Trust Becomes the Attack Surface: What State Government CISOs Need to Know This Week

Anomali Threat Research

Published on

April 14, 2026

Table of Contents

Threat Assessment Level: ELEVATED — Trending HIGH Elevated from baseline ELEVATED due to a convergence of actively exploited zero-days with imminent federal patching deadlines, confirmed nation-state operations against U.S. government infrastructure, and a new class of phishing that bypasses multi-factor authentication at scale. <h2>Executive Summary                          </h2> This week marks a turning point in the threat landscape facing state government IT. Three developments demand immediate leadership attention: a critical vulnerability in Fortinet’s endpoint management platform carries a federal patching deadline of April 16 — two days from now. The FBI and NSA publicly confirmed they disrupted a Russian military intelligence (GRU) operation that hijacked home routers to steal government Microsoft 365 credentials. And Microsoft’s own security team confirmed that a phishing-as-a-service kit called EvilTokens is compromising organizational M365 accounts at scale — completely bypassing MFA. These are not theoretical risks. They are confirmed, active operations targeting the exact technology stack most state agencies rely on: Microsoft 365, Fortinet endpoint management, and consumer-grade routers used by remote workers. Meanwhile, Iranian intelligence operatives are pioneering a new operational model — renting Russian criminal infrastructure and using blockchain technology to hide their command-and-control servers. And a fake AI tool installer impersonating Anthropic’s Claude is delivering Chinese-linked espionage malware to anyone who downloads it. The common thread: attackers are exploiting trusted infrastructure — legitimate cloud services, signed software binaries, and standard authentication flows. Reputation-based defenses alone are no longer sufficient. <h2>What Changed This Week            </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> Apr 7 </td> <td> CISA Advisory AA26-097A confirms CyberAv3ngers (IRGC-CEC) actively manipulating PLCs at U.S. water and energy facilities </td> <td> State agencies overseeing water treatment and utilities are directly in scope </td> </tr> <tr> <td> Apr 7 </td> <td> NSA/FBI announce Operation Masquerade — disruption of GRU SOHO router DNS hijack network </td> <td> Confirms Russian military intelligence was intercepting M365 credentials via compromised home routers; any state teleworker with an unpatched consumer router was in the blast radius </td> </tr> <tr> <td> Apr 6–8 </td> <td> Microsoft confirms EvilTokens device-code phishing campaign is “widespread” </td> <td> Bypasses MFA entirely; targets M365 organizational accounts — the primary productivity platform for most state agencies </td> </tr> <tr> <td> Apr 10 </td> <td> JUMPSEC reveals MuddyWater (Iranian MOIS) deployed ChainShell — blockchain-based C2 via Russian criminal infrastructure </td> <td> First confirmed nation-state use of blockchain C2; signals Iran-Russia cyber convergence that complicates attribution </td> </tr> <tr> <td> Apr 13 </td> <td> CISA adds 7 vulnerabilities to Known Exploited Vulnerabilities catalog, including CVE-2026-21643 (FortiClientEMS, CVSS 9.1) </td> <td> Patch deadline: April 16. Unauthenticated SQL injection leading to remote code execution. If your agency uses FortiClientEMS, this is a compliance and security emergency </td> </tr> <tr> <td> Apr 13 </td> <td> Emsisoft publishes 2025 ransomware statistics: 8,835 claimed victims (+46% YoY), 141 active groups </td> <td> Qilin (#1, 1,029 victims), Akira (#2, 640 victims), DragonForce, Medusa, and BianLian all actively targeting government </td> </tr> <tr> <td> Apr 14 </td> <td> Malwarebytes discovers fake Claude AI installer delivering PlugX espionage RAT via DLL sideloading </td> <td> Exploits organizational demand for AI tools; C2 to Alibaba Cloud infrastructure — historically associated with Chinese state-sponsored espionage </td> </tr> </tbody> </table> <h2>Threat Analysis                               </h2> <h3>1. The 48-Hour Clock: FortiClientEMS CVE-2026-21643</h3> CVE-2026-21643 is an unauthenticated SQL injection vulnerability in Fortinet’s FortiClientEMS — the centralized management console for FortiClient endpoint agents. It carries a CVSS score of 9.1 and allows remote code execution over HTTP without any credentials. CISA added this to the Known Exploited Vulnerabilities (KEV) catalog on April 13 with a remediation deadline of April 16, 2026. This is not a theoretical risk — it is being actively exploited in the wild, and CISA has tagged government as a target sector. For state agencies using FortiClientEMS for endpoint management, this vulnerability gives an attacker unauthenticated access to the system that manages every endpoint in your environment. Exploitation is trivial — SQL injection over HTTP — and the consequences are catastrophic: full remote code execution on the management server, with potential lateral movement to every managed endpoint. ATT&CK Technique: T1190 (Exploit Public-Facing Application) Also added to the KEV catalog in the same batch: - CVE-2026-34621 — Adobe Acrobat/Reader Prototype Pollution → arbitrary code execution (CVSS 8.6, deadline April 27) - CVE-2023-21529 — Microsoft Exchange Server Deserialization - CVE-2023-36424 — Microsoft Windows Out-of-Bounds Read privilege escalation - CVE-2025-60710 — Microsoft Windows Link Following privilege escalation - CVE-2012-1854 — Microsoft VBA DLL Hijacking - CVE-2020-9715 — Adobe Acrobat Use-After-Free <h3>2. EvilTokens: The MFA Bypass That’s Already Inside Your Tenant</h3> Microsoft’s Defender Security Research team confirmed on April 6 that a “widespread phishing campaign leveraging the device code authentication flow” is actively compromising M365 organizational accounts. Independent analysis from Sekoia and reporting from BleepingComputer corroborate that the EvilTokens phishing-as-a-service kit is being sold in underground forums and is in active use. Why this is different from normal phishing: Device-code phishing doesn’t steal passwords. It abuses Microsoft’s legitimate device-code authentication flow — the same flow used when you sign into a smart TV or IoT device. The victim enters a code on a legitimate Microsoft login page, and the attacker captures the resulting OAuth token. MFA is completed by the victim on the real Microsoft site. The attacker never needs the password or the second factor. This means your conditional access policies, your MFA deployment, and your anti-phishing training are all structurally bypassed. The only effective countermeasure is to block the device-code authentication flow in Azure AD/Entra ID conditional access policies for all accounts except explicitly approved service principals. ATT&CK Techniques: T1528 (Steal Application Access Token), T1078.004 (Valid Accounts: Cloud Accounts), T1114.002 (Remote Email Collection) <h3>3. Operation Masquerade: GRU Was Hijacking Home Routers to Steal Government Credentials</h3> On April 7–8, the DOJ, FBI, and NSA jointly announced a court-authorized operation to neutralize a GRU (Russian military intelligence, APT28) network of compromised SOHO routers. The operation — dubbed “Operation Masquerade” — revealed that GRU operators had compromised consumer-grade routers (Ubiquiti, ASUS, and similar brands) used by government employees working from home, then manipulated DNS settings to redirect Microsoft 365 authentication traffic through attacker-controlled infrastructure. The FBI sent commands to compromised routers to collect forensic data and reset DNS configurations. While the disruption is positive, the disclosure confirms a worst-case scenario: a foreign military intelligence service was actively intercepting government M365 credentials by compromising the home network equipment of remote workers. State agencies with telework programs should assume that any employee using an unpatched consumer router may have been in the blast radius. DNS settings on all SOHO routers in remote/telework environments should be verified immediately. ATT&CK Techniques: T1584.008 (Compromise Infrastructure: Network Devices), T1557.002 (Adversary-in-the-Middle: DNS), T1078 (Valid Accounts) <h3>4. MuddyWater’s ChainShell: Iran Rents Russian Criminal Infrastructure, Hides C2 on the Blockchain</h3> JUMPSEC published research on April 10 revealing that MuddyWater — an Iranian group linked to the Ministry of Intelligence and Security (MOIS) — has adopted a Russian malware-as-a-service platform to deploy a Node.js-based agent called ChainShell. The agent uses Ethereum smart contracts to store and retrieve its command-and-control address, making takedowns extremely difficult. Five independent sources confirmed this within four days. The campaign currently targets Israel, but MuddyWater has historically targeted U.S. government entities, and the operational model is scalable. Why this matters strategically: This is the first confirmed case of a nation-state actor renting criminal infrastructure and using blockchain for C2 resilience. It represents a convergence of the nation-state and cybercriminal ecosystems that fundamentally complicates attribution and defense. If this model proliferates — and there is every reason to expect it will — defenders will face blended threats that don’t fit clean “nation-state” or “criminal” categories. ATT&CK Techniques: T1102.002 (Web Service: Bidirectional Communication), T1583.006 (Acquire Infrastructure: Web Services), T1059.007 (JavaScript) <h3>5. Fake Claude AI Installer Delivers PlugX Espionage Malware</h3> Malwarebytes discovered a fake website impersonating Anthropic’s Claude AI service that distributes the PlugX remote access trojan — a malware family historically associated with Chinese state-sponsored espionage. The attack uses a ZIP archive containing an MSI installer that deploys a classic DLL sideloading chain: a signed G DATA updater binary (NOVUpdate.exe) loads a malicious DLL (avk.dll), which decrypts an encrypted payload. C2 communication is established to 8.217.190.58 (Alibaba Cloud) over HTTPS within 22 seconds of execution. As state agencies evaluate and adopt AI tools, employees searching for AI software become targets. This attack doesn’t exploit a software vulnerability — it exploits organizational demand for AI tools combined with the absence of an approved software policy. ATT&CK Techniques: T1574.002 (DLL Side-Loading), T1036.005 (Masquerading), T1547.001 (Registry Run Keys / Startup Folder) <h3>6. Ransomware Landscape: 46% Growth, Government Remains a Top Target</h3> Emsisoft’s 2025 annual report documents 8,835 claimed ransomware victims — a 46% increase year-over-year — across 141 active ransomware groups. The top groups actively targeting government: <table> <thead> <tr> <th> Group </th> <th> 2025 Claimed Victims </th> <th> Government Targeting </th> </tr> </thead> <tbody> <tr> <td> Qilin </td> <td> 1,029 </td> <td> Active — confirmed state/local government victims </td> </tr> <tr> <td> Akira </td> <td> 640 </td> <td> Active — government and education sectors </td> </tr> <tr> <td> DragonForce </td> <td> Active </td> <td> Confirmed government targeting </td> </tr> <tr> <td> Medusa </td> <td> Active </td> <td> Confirmed government targeting </td> </tr> <tr> <td> BianLian </td> <td> Active </td> <td> Data exfiltration focus; government sector </td> </tr> <tr> <td> Hellcat </td> <td> Active </td> <td> Emerging; government sector observed </td> </tr> </tbody> </table> No new state or local government ransomware incident was reported in the past 24 hours, but given the statistical trajectory (+46% YoY with government as a priority target), this is a matter of when, not if. <h3>7. CyberAv3ngers: Iranian IRGC-CEC Actively Manipulating U.S. Water and Energy PLCs</h3> CISA Advisory AA26-097A (April 7) confirmed that CyberAv3ngers — attributed to Iran’s Islamic Revolutionary Guard Corps Cyber-Electronic Command (IRGC-CEC) — are actively manipulating Rockwell Automation programmable logic controllers (PLCs) at U.S. water treatment and energy facilities. The group uses Dropbear SSH for persistence on compromised OT devices. State agencies with oversight of water utilities, energy infrastructure, or transportation SCADA systems should treat this as a confirmed, active threat to the systems they regulate or operate. <h2>Predictive Analysis: What Comes Next</h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Accelerated exploitation of CVE-2026-21643 (FortiClientEMS) before April 16 deadline </td> <td> HIGH (>70%) </td> <td> 48 hours </td> <td> Threat actors historically accelerate exploitation after CISA KEV addition; SQLi exploitation is trivial </td> </tr> <tr> <td> EvilTokens-based business email compromise attempts against state finance and procurement staff </td> <td> MODERATE (40–60%) </td> <td> 7 days </td> <td> PhaaS model lowers barrier for less-sophisticated actors; state finance offices are high-value BEC targets </td> </tr> <tr> <td> Additional AI-themed social engineering campaigns using ChatGPT, Copilot, or Gemini branding </td> <td> MODERATE (40–60%) </td> <td> 14 days </td> <td> The Claude/PlugX template is easily replicated; AI tool adoption is accelerating across government </td> </tr> <tr> <td> MuddyWater ChainShell campaign expanding beyond Israel to U.S. targets </td> <td> LOW-MODERATE (20–40%) </td> <td> 30 days </td> <td> Blockchain C2 infrastructure is resilient and the Russian MaaS model is scalable; MuddyWater has historical U.S. targeting </td> </tr> <tr> <td> Volt Typhoon / Salt Typhoon pre-positioning activity surfacing in state government networks </td> <td> LOW-MODERATE (20–40%) </td> <td> 30 days </td> <td> BeyondTrust CVE-2026-1731 China-nexus campaign is active; absence of Volt/Salt Typhoon reporting is notable given geopolitical tensions </td> </tr> <tr> <td> Ransomware incident affecting a U.S. state or local government entity </td> <td> HIGH (>70%) </td> <td> 30 days </td> <td> 46% YoY growth, 141 active groups, government is a confirmed priority target sector </td> </tr> </tbody> </table> <h2>SOC Operational Guidance                </h2> <h3>Detection Priorities</h3> <ol> <li> Device-Code Phishing (EvilTokens) - Hunt Hypothesis: Adversaries are using device-code phishing to obtain OAuth tokens for M365 accounts, bypassing MFA. Look for anomalous device-code authentication events followed by mail forwarding rule creation or unusual mailbox access patterns. - What to Monitor: - Azure AD sign-in logs: filter for authenticationProtocol = deviceCode — any device-code authentication from a user account (not a service principal) should be investigated - Token refresh events from geolocations inconsistent with the user’s normal pattern (T1528) - New inbox rules or mail forwarding rules created within 24 hours of a device-code authentication event (T1114.002) - OAuth application consent grants from unfamiliar applications (T1550.001) - Detection Logic: Alert on DeviceCodeAuthentication events in Azure AD where the requesting application is not in your approved service principal list. Correlate with New-InboxRule or Set-Mailbox PowerShell commands within a 4-hour window.</li> <li> PlugX DLL Sideloading via Fake AI Installers - Hunt Hypothesis: Users downloading AI tools from unofficial sources may execute trojanized installers that deploy PlugX via DLL sideloading. Look for signed binaries loading unexpected DLLs from user-writable directories. - What to Monitor: - wscript.exe spawning NOVUpdate.exe or any process loading avk.dll (T1574.002) - Any executable running from %APPDATA%\WindowsUpdate\ — this is not a legitimate Windows Update path (T1547.001) - Outbound HTTPS connections to 8.217.190[.]58 (Alibaba Cloud) (T1071.001) - MSI installer execution from user Downloads folders followed by DLL loads from non-standard paths (T1036.005) - VBScript execution followed by self-deletion (~del.vbs.bat pattern) (T1070.004) - Blocking Action: Block C2 IP 8.217.190[.]58 at the firewall and proxy. Add NOVUpdate.exe + avk.dll combination to endpoint detection rules.</li> <li> SOHO Router DNS Manipulation (APT28/GRU) - Hunt Hypothesis: Compromised home routers are redirecting DNS queries for Microsoft authentication endpoints to attacker-controlled infrastructure. Look for M365 authentication anomalies from remote workers. - What to Monitor: - Azure AD sign-in logs showing authentication from IP addresses that don’t match the user’s known ISP or VPN exit point (T1557.002) - Certificate warnings or TLS errors on Microsoft authentication endpoints reported by users (T1557) - DNS resolution for login.microsoftonline.com and login.windows.net returning unexpected IP addresses (T1584.008) - Investigation Guidance: For any suspicious remote authentication, ask the user to run nslookup login.microsoftonline.com from their home network and compare results against known Microsoft IP ranges. Discrepancies indicate DNS manipulation.</li> <li> FortiClientEMS Exploitation - Hunt Hypothesis: Unauthenticated attackers are exploiting SQL injection in FortiClientEMS to achieve remote code execution on the management server. - What to Monitor: - FortiClientEMS server logs for unusual SQL error messages or unexpected database queries (T1190) - New processes spawned by the FortiClientEMS service account (T1059) - Outbound connections from the FortiClientEMS server to unfamiliar IP addresses - Any lateral movement originating from the FortiClientEMS server to managed endpoints - Immediate Action: If patching cannot be completed before April 16, restrict network access to the FortiClientEMS management interface to authorized administrator IP addresses only.</li> <li> AWS Federation Persistence - Hunt Hypothesis: Adversaries with compromised AWS IAM credentials are using sts:GetFederationToken to create federated sessions that survive credential deactivation. - What to Monitor: - CloudTrail events for sts:GetFederationToken API calls — these should be rare in most environments (T1078.004) - Federated session activity continuing after the parent IAM user’s access keys have been deactivated - Unusual AssumeRole or GetSessionToken calls from unfamiliar source IPs - IR Playbook Update: Standard containment (deactivating API keys) is insufficient. Attach an explicit deny-all IAM policy to compromised users to invalidate all active sessions, including federated ones.</li> </ol> <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services (State Revenue, Treasury, Procurement)</h3> State revenue agencies, treasury offices, and procurement divisions handle high-value financial transactions that make them prime targets for business email compromise following EvilTokens credential theft. <ul> <li>Priority Threat: EvilTokens device-code phishing → M365 account takeover → BEC targeting payment workflows</li> <li>Action: Implement conditional access policies requiring compliant/managed devices for all financial system access. Enable “risky sign-in” alerts in Azure AD Identity Protection. Review and harden approval workflows for wire transfers and vendor payment changes — require out-of-band confirmation for any payment modification initiated via email.</li> <li>Detection Focus: Monitor for new inbox rules, mail forwarding, and delegate access changes on finance staff mailboxes (T1114.002, T1098.002).</li> </ul> <h3>Energy (State Utility Oversight, Public Power Authorities)</h3> CISA Advisory AA26-097A confirms CyberAv3ngers (IRGC-CEC) are actively manipulating PLCs at U.S. water and energy facilities. State agencies regulating or operating energy infrastructure face direct risk. <ul> <li>Priority Threat: CyberAv3ngers PLC manipulation via Dropbear SSH; ICS advisories for Siemens Industrial Edge and Contemporary Controls BASC 20T</li> <li>Action: Audit all internet-facing OT/ICS management interfaces. Verify that Rockwell Automation PLCs are segmented from IT networks with monitored jump servers. Ensure Dropbear SSH is not running on any OT devices — if found, treat as a confirmed compromise indicator. Apply Siemens and Contemporary Controls ICS patches per CISA advisories.</li> <li>Detection Focus: Monitor for SSH connections to PLC management interfaces from non-authorized IP addresses. Alert on any firmware changes to PLCs outside scheduled maintenance windows.</li> </ul> <h3>Healthcare (Medicaid, State Health Agencies, Public Health Labs)</h3> Healthcare IT vendors are a confirmed supply chain risk vector, and ransomware groups (Qilin, Akira) actively target healthcare. State Medicaid systems and public health infrastructure contain protected health information (PHI) that carries both regulatory and operational risk. <ul> <li>Priority Threat: Ransomware (Qilin, Akira) targeting healthcare; supply chain compromise via healthcare IT vendors; credential theft via EvilTokens</li> <li>Action: Verify that Medicaid claims processing systems and EHR platforms have offline backup and recovery procedures tested within the last 90 days. Audit third-party healthcare IT vendor access — ensure vendor VPN accounts use MFA and are scoped to minimum necessary access. Review BAA (Business Associate Agreement) breach notification requirements.</li> <li>Detection Focus: Monitor for unusual data exfiltration patterns from Medicaid databases (T1041). Alert on bulk record access outside normal business hours.</li> </ul> <h3>Government (Executive Agencies, Legislature, Courts, Elections)</h3> State government agencies are the primary target for every threat in this report — from nation-state espionage (APT28, MuddyWater, PlugX) to ransomware (Qilin, Akira, DragonForce) to credential theft (EvilTokens). <ul> <li>Priority Threat: EvilTokens M365 credential theft; FortiClientEMS CVE-2026-21643 exploitation; APT28 SOHO router DNS hijacking; ransomware</li> <li>Action: Enforce conditional access policies blocking device-code authentication in Azure AD. Patch FortiClientEMS before April 16. Issue guidance to all remote workers to update home router firmware and verify DNS settings. Ensure all agencies — including small boards and commissions with limited IT resources — are covered by centralized endpoint detection.</li> <li>Detection Focus: Prioritize Azure AD sign-in anomalies, FortiClientEMS server integrity monitoring, and ransomware precursor activity (T1486 precursors: mass file enumeration, shadow copy deletion, credential dumping).</li> </ul> <h3>Aviation / Logistics (State DOT, Port Authorities, Airport Operations)</h3> State departments of transportation, port authorities, and airport operations manage SCADA and operational technology systems that intersect with the same ICS threat landscape as energy and water. <ul> <li>Priority Threat: CyberAv3ngers ICS targeting (transferable TTPs to transportation SCADA); ransomware disrupting logistics operations; supply chain compromise</li> <li>Action: Audit all SCADA and traffic management systems for internet-facing management interfaces. Segment OT networks from IT networks with monitored boundary controls. Ensure transportation management systems have manual fallback procedures for ransomware scenarios. Review vendor remote access to traffic control and port management systems.</li> <li>Detection Focus: Monitor for unauthorized access to SCADA HMI (Human-Machine Interface) systems. Alert on any configuration changes to traffic management or port operations systems outside change windows.</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>IMMEDIATE (Within 48 Hours)</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> IT Operations </td> <td> Patch FortiClientEMS to the latest version addressing CVE-2026-21643 (CVSS 9.1) before the CISA deadline of April 16, 2026. This is an unauthenticated SQL injection leading to remote code execution. If patching is not possible within 48 hours, restrict network access to the FortiClientEMS management interface to authorized administrator IPs only. </td> </tr> <tr> <td> CRITICAL </td> <td> Identity / Cloud Ops </td> <td> Block device-code authentication flow in Azure AD / Entra ID conditional access policies for all user accounts. Exempt only explicitly approved service principals. EvilTokens PhaaS is actively compromising M365 accounts at scale and bypasses MFA entirely. This is a configuration change — no patching required — and can be deployed same-day. </td> </tr> <tr> <td> CRITICAL </td> <td> IT Operations </td> <td> Issue emergency guidance to all remote/telework employees: update home router firmware, change default admin credentials, and verify DNS settings (should point to agency-approved DNS servers, not unknown addresses). This addresses the confirmed GRU SOHO router DNS hijack operation (Operation Masquerade). </td> </tr> <tr> <td> HIGH </td> <td> SOC </td> <td> Block C2 IP 8.217.190[.]58 at all firewalls, proxies, and EDR platforms. Block execution of Bid-Packet-INV-Document.js via application control policies. These are confirmed indicators from the fake Claude AI / PlugX espionage campaign. </td> </tr> </tbody> </table> <h3>7-DAY</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> HIGH </td> <td> IT Operations </td> <td> Patch Adobe Acrobat/Reader for CVE-2026-34621 (Prototype Pollution, CVSS 8.6) and CVE-2020-9715 (Use-After-Free). CISA KEV deadline: April 27. </td> </tr> <tr> <td> HIGH </td> <td> IT Operations </td> <td> Audit all NGINX deployments for WebDAV module (ngx_http_dav_module) with COPY/MOVE methods combined with alias directives. If present, upgrade to NGINX 1.28.3+ or 1.29.7+ to address CVE-2026-27654 (buffer overflow). </td> </tr> <tr> <td> HIGH </td> <td> IT Operations </td> <td> Patch Microsoft Exchange Server for CVE-2023-21529 (deserialization) and Microsoft Windows for CVE-2023-36424 and CVE-2025-60710. All added to CISA KEV on April 13. </td> </tr> <tr> <td> HIGH </td> <td> SOC </td> <td> Create detection rules for PlugX DLL sideloading: alert on any process loading avk.dll from %APPDATA%\WindowsUpdate\, and on wscript.exe spawning NOVUpdate.exe. Deploy across all endpoint detection platforms. </td> </tr> <tr> <td> HIGH </td> <td> SOC + Cloud Ops </td> <td> Audit AWS IAM policies for sts:GetFederationToken permissions. Update incident response playbooks: when containing a compromised AWS IAM user, attach an explicit deny-all policy rather than only deactivating API keys. Federated sessions survive key deactivation. </td> </tr> <tr> <td> HIGH </td> <td> SOC </td> <td> Build EvilTokens detection playbook: monitor Azure AD sign-in logs for deviceCode authentication protocol events from user accounts; correlate with inbox rule changes and mail forwarding within a 4-hour window; alert on OAuth consent grants from unfamiliar applications. </td> </tr> </tbody> </table> <h3>30-DAY</h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> HIGH </td> <td> CISO / Policy </td> <td> Publish an internal policy prohibiting download of AI tools from unofficial sources. Establish an approved AI tool list with verified download URLs distributed to all agencies. Brief all staff on the fake Claude AI / PlugX campaign as a concrete example. </td> </tr> <tr> <td> HIGH </td> <td> CISO / IT Operations </td> <td> Conduct a zero-trust architecture assessment focused on the “trust surface” — legitimate cloud services, signed binaries, and standard authentication flows being abused by attackers. Three of this week’s five major events exploited trusted infrastructure. Reputation-based defenses are structurally inadequate. </td> </tr> <tr> <td> MODERATE </td> <td> CISO / OT Security </td> <td> Commission an OT/ICS security assessment for all state-operated or state-regulated water treatment, energy, and transportation SCADA systems. Verify network segmentation, audit remote access, and confirm that Rockwell Automation PLCs are not internet-accessible. Reference CISA Advisory AA26-097A. </td> </tr> <tr> <td> MODERATE </td> <td> HR / Recruiting </td> <td> Brief recruiting and hiring teams on North Korean (DPRK) fake interview tactics. DPRK operatives use fake coding challenges and interview repositories to deliver malware (INVISIBLEFERRET). All coding challenge repositories should be verified before execution on state devices. </td> </tr> <tr> <td> MODERATE </td> <td> CISO / Governance </td> <td> Review cybersecurity legislative tracking processes. Active state legislative sessions are underway, but intelligence collection on new cybersecurity legislation has produced no results for three consecutive weeks — likely a monitoring gap, not an absence of legislative activity. Manually check the NCSL Cybersecurity Legislation Tracker and ensure automated monitoring is functioning. </td> </tr> </tbody> </table> <h3>Executive / IR Preparedness</h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Timeframe </th> </tr> </thead> <tbody> <tr> <td> Approve emergency patching window for FortiClientEMS before April 16 CISA deadline </td> <td> CIO / CISO </td> <td> Immediate </td> </tr> <tr> <td> Approve Azure AD conditional access policy change to block device-code authentication </td> <td> CISO / Identity Team </td> <td> Immediate </td> </tr> <tr> <td> Tabletop exercise: Ransomware scenario targeting a mid-size state agency with limited IT staff </td> <td> CISO / IR Team </td> <td> 30 days </td> </tr> <tr> <td> Review cyber insurance policy for coverage of nation-state attacks and supply chain compromise </td> <td> CISO / Legal / Risk </td> <td> 30 days </td> </tr> <tr> <td> Brief the Governor’s office / legislative leadership on the GRU router operation and its implications for state telework security </td> <td> CISO / CIO </td> <td> 7 days </td> </tr> </tbody> </table> <h2>The Bigger Picture: Three Structural Shifts</h2> <ol> <li> Trust is the new attack surface. Three of this week’s five major events exploit trusted infrastructure: Microsoft’s own device-code authentication flow (EvilTokens), signed G DATA software binaries (PlugX), and legitimate home networking equipment (GRU router hijacking). Attackers are not breaking through your defenses — they are walking through your front door using your own keys. This demands a fundamental shift from reputation-based security (“is this IP/domain/binary known-bad?”) to behavior-based security (“is this action consistent with what this user/system normally does?”).</li> <li> Nation-state and criminal ecosystems are converging. MuddyWater — an Iranian MOIS intelligence service — is now renting infrastructure from Russian cybercriminals and using blockchain to hide its operations. This is not an isolated case; it is the future of the threat landscape. The clean categories of “nation-state threat” and “criminal threat” that inform our risk frameworks and budget justifications are dissolving. Defense strategies must account for adversaries that combine state-level sophistication with criminal-level infrastructure resilience.</li> <li> AI adoption creates a new social engineering vector. The fake Claude AI installer delivering PlugX is a harbinger. As state agencies race to adopt AI tools — often without formal procurement processes or approved software lists — every employee searching for “download Claude” or “install Copilot” becomes a potential entry point for espionage malware. This is not a technology problem; it is a policy and governance problem that requires an immediate organizational response.</li> </ol> <h2>Bottom Line                                  </h2> The threat environment facing state government IT is defined by speed and convergence. A critical Fortinet vulnerability has a 48-hour patching deadline. A phishing kit that bypasses MFA is confirmed active at scale against the exact platform your agencies use every day. A foreign military intelligence service was caught hijacking the home routers of government workers. And the lines between nation-state espionage, criminal ransomware, and supply chain social engineering are blurring beyond recognition. The actions outlined in this report are specific, prioritized, and time-bound. The FortiClientEMS patch and the Azure AD conditional access change are the two highest-leverage actions available right now — both can be executed today, and both materially reduce your exposure to confirmed, active threats. The adversaries are not waiting. Neither should we.

FEATURED RESOURCES

April 14, 2026

Anomali Cyber Watch

When Silence Is the Loudest Warning: Iran's Cyber Operations Enter a Dangerous New Phase

April 14, 2026

Anomali Cyber Watch

Public Sector

When Trust Becomes the Attack Surface: What State Government CISOs Need to Know This Week

April 13, 2026

Anomali Cyber Watch

Iran’s Cyber War Enters Its Most Dangerous Phase: Active ICS Exploitation, Geographic Expansion, and Two Critical Zero-Days

Explore All