When Two Nation States Strike at Once: Why State Government CISOs Must Act This Week

Public Sector

Published on

March 23, 2026

Table of Contents

<table> <tbody> <tr> <td> Threat Assessment Level: HIGH (Elevated from ELEVATED in the prior cycle of March 21, 2026. The escalation is driven by the convergence of Iranian cyber retaliation risk following the expiration of a U.S. ultimatum, confirmed Russian intelligence operations against government officials' messaging apps, and an expanding supply chain attack surface - all occurring during a period of reduced federal cybersecurity support to state and local governments.) </td> </tr> </tbody> </table> <h2>Introduction                                </h2> State government IT leaders face a threat environment this week that is qualitatively different from anything in recent memory. For the first time in years, two major nation-state adversaries - Iran and Russia - are simultaneously conducting active cyber operations against U.S. government targets, while the federal agencies that state governments depend on for support are themselves under strain. This is not a theoretical warning. The FBI and CISA have confirmed that thousands of government officials' Signal and WhatsApp accounts have already been compromised by Russian intelligence. Iran's MOIS-affiliated Handala group has already wiped approximately 80,000 endpoints at a U.S. corporation. And a supply-chain attack affecting the widely used Trivy vulnerability scanner has metastasized from GitHub to Docker Hub to npm - potentially poisoning CI/CD pipelines across the public sector. State CIOs and CISOs cannot wait for federal guidance that may arrive late or not at all. This blog distills the intelligence your teams need to act - today. <h2>What Changed                                </h2> Since our last assessment on March 21, six developments have shifted the threat landscape: <ol> <li>Iran ultimatum expired (March 22). President Trump's 48-hour ultimatum threatening strikes on Iranian power plants expired without resolution. The U.S.-Israel military campaign against Iran, ongoing since February 28, has already provoked destructive cyber retaliation. The FBI seized Handala's leak infrastructure on March 21, but the underlying MOIS capability is intact. Iran has explicitly threatened retaliatory attacks on U.S. energy and water infrastructure.</li> <li>DarkSword iOS exploit chain disclosed (March 22). Google's Threat Intelligence Group revealed a full-chain JavaScript-based iOS exploit kit - dubbed DarkSword - that chains six vulnerabilities (including three zero-days) to achieve kernel-level access on iPhones running iOS 26.0 through 26.3. Critically, one of the actors using DarkSword is PARS Defense, an Iranian commercial surveillance vendor. Apple released an emergency patch (iOS 26.3.1).</li> <li>Trivy supply chain compromise expanded. What began as a GitHub Actions compromise has now spread to Docker Hub (compromised images 0.69.4-0.69.6) and npm (47 packages infected by a self-propagating malware called CanisterWorm that uses blockchain-based command-and-control). Any state agency DevOps team running Trivy in CI/CD pipelines may be affected.</li> <li>CISA issued eight ICS advisories affecting Schneider Electric and Automated Logic systems - the exact building management and power monitoring platforms deployed in state government facilities across the country.</li> <li>Russian intelligence confirmed compromising Signal and WhatsApp at scale (March 20). An FBI/CISA joint advisory confirmed that Russian Intelligence Services have compromised thousands of accounts belonging to current and former U.S. government officials, military personnel, and political figures. The techniques exploit the "linked devices" feature to silently mirror communications, bypassing end-to-end encryption entirely.</li> <li>Ransomware pressure intensifies: Cisco FMC zero-day and Foster City emergency (March 20-22). The Interlock ransomware group has been exploiting CVE-2026-20131 (Cisco FMC, CVSS 10.0) as a zero-day since January 26. CISA issued an emergency patch directive on March 20. Separately, Foster City, California declared a state of emergency on March 22 after a ransomware attack paralyzed municipal systems - with no group yet claiming responsibility, raising the possibility of a wiper operation disguised as ransomware.</li> </ol> <h2>Conflict and Threat Timeline                </h2> <table> <tbody> <tr> <td> Date </td> <td> Event </td> <td> Impact to State Government </td> </tr> <tr> <td> Feb 28 </td> <td> U.S.-Israel military campaign against Iran begins </td> <td> Initiates retaliatory cyber risk cycle against all U.S. government entities </td> </tr> <tr> <td> Mar 6 </td> <td> Last observed MuddyWater/Dindoor espionage activity </td> <td> MOIS espionage actor goes silent - 16+ days of anomalous quiet </td> </tr> <tr> <td> Mar 11 </td> <td> Handala (Void Manticore) wipes ~80,000 Stryker endpoints via Microsoft Intune </td> <td> Demonstrates MOIS capability to weaponize endpoint management platforms </td> </tr> <tr> <td> Mar 19 </td> <td> CISA warns on endpoint management security </td> <td> Direct response to Intune abuse; relevant to any state agency using SCCM/Intune </td> </tr> <tr> <td> Mar 19-20 </td> <td> CISA publishes 8 ICS advisories (Schneider, Automated Logic) </td> <td> Affects building management and power monitoring in state facilities </td> </tr> <tr> <td> Mar 20 </td> <td> CISA emergency directive: patch CVE-2026-20131 (Cisco FMC, CVSS 10.0) within 3 days </td> <td> Interlock ransomware exploited this as a zero-day since Jan 26 </td> </tr> <tr> <td> Mar 20 </td> <td> FBI/CISA joint advisory: Russian intelligence compromising Signal/WhatsApp </td> <td> Thousands of government officials' accounts already breached </td> </tr> <tr> <td> Mar 20 </td> <td> Foster City, CA declares state of emergency after ransomware attack </td> <td> Municipal government paralyzed; no group has claimed responsibility </td> </tr> <tr> <td> Mar 21 </td> <td> FBI seizes Handala leak site infrastructure </td> <td> Disrupts but does not eliminate MOIS destructive capability </td> </tr> <tr> <td> Mar 22 </td> <td> Trump's 48-hour Iran ultimatum expires </td> <td> Cyber retaliation risk reaches maximum </td> </tr> <tr> <td> Mar 22 </td> <td> Google GTIG discloses DarkSword iOS exploit chain; Apple patches iOS 26.3.1 </td> <td> Iranian-linked actors (PARS Defense) have full iPhone compromise capability </td> </tr> <tr> <td> Mar 22 </td> <td> Trivy compromise expands to Docker Hub and npm (CanisterWorm) </td> <td> Supply chain blast radius widens significantly </td> </tr> </tbody> </table> <h2>Key Threat Analysis                           </h2> Iranian Destructive Operations: Handala, MuddyWater, and DarkSword Three distinct Iranian threat actors - Handala and MuddyWater linked to Iran's Ministry of Intelligence and Security (MOIS), and PARS Defense an Iranian commercial surveillance vendor - present simultaneous risks to state government: Handala (also tracked as UNC5203 / Void Manticore) conducted the most consequential destructive cyber operation against a U.S. target in years when it weaponized Microsoft Intune's legitimate remote wipe capability to destroy approximately 80,000 endpoints at Stryker Corporation on March 11. No traditional malware was deployed - the attack abused valid administrative credentials and a trusted management platform. The FBI seized Handala's infrastructure on March 21, but the group's operators and TTPs remain active. MuddyWater (TEMP.Zagros) is a separate MOIS-affiliated espionage group that was last observed deploying the Dindoor backdoor against U.S. networks on March 6. Their 16-day silence during an active military conflict is anomalous and concerning. When espionage actors go quiet during escalation, it often signals preparation for coordinated operations rather than cessation of activity. PARS Defense is an Iranian commercial surveillance vendor newly identified as a user of the DarkSword iOS exploit chain. DarkSword delivers three post-exploitation payloads - GHOSTBLADE (data mining), GHOSTKNIFE (modular backdoor), and GHOSTSABER (persistent backdoor with binary module support). While current targeting has been observed in Saudi Arabia, Turkey, Malaysia, and Ukraine, the availability of full iPhone compromise capability to Iranian-linked actors during active U.S.-Iran hostilities creates a direct surveillance risk for state governors, attorneys general, legislative leaders, and senior IT officials who carry iPhones. Key CVEs: CVE-2025-31277, CVE-2025-43529, CVE-2025-43520 (DarkSword chain - patched in iOS 26.3.1) Russian Intelligence: Messaging App Compromise at Scale The FBI/CISA joint advisory (PSA260320) issued March 20 confirms that Russian Intelligence Services have compromised thousands of Signal and WhatsApp accounts belonging to current and former U.S. government officials, military personnel, political figures, and journalists. Dutch intelligence services independently corroborated the campaign. The techniques are deceptively simple: <ul> <li>Fake "Signal Security Support Bot" messages requesting verification codes</li> <li>Malicious QR codes that exploit the "linked devices" feature to silently pair an attacker's device to the victim's account</li> <li>Group invitation links that actually authorize new device pairing</li> </ul> Once a device is linked, the attacker receives a real-time copy of every message sent and received - without triggering any notification to the victim. This bypasses end-to-end encryption entirely because the attacker's device is treated as a legitimate endpoint. State government relevance is direct. Senior officials routinely use Signal and WhatsApp for informal policy discussions, legislative coordination, and crisis communications. Any state employee who has received an unusual message requesting a code, asking them to scan a QR code, or inviting them to a new group should be treated as potentially compromised. Ransomware: Interlock, Foster City, and the Cisco FMC Gateway The Interlock ransomware group has been exploiting CVE-2026-20131 - a CVSS 10.0 unauthenticated remote code execution vulnerability in Cisco Firepower Management Center - as a zero-day since January 26, 2026. That is 53 days of exploitation before a patch existed. CISA issued an emergency directive on March 20 requiring federal agencies to patch within three days. State agencies running Cisco FMC that have not yet patched are operating with an unacceptable level of risk. Meanwhile, Foster City, California declared a state of emergency on March 20 after a ransomware attack paralyzed municipal systems. Notably, no ransomware group has claimed responsibility - unusual given that most groups claim victims within 48-72 hours. This absence raises the possibility that the attack may be a wiper operation disguised as ransomware, which would be consistent with Iranian TTPs observed in the Handala/Stryker incident. Additional ransomware groups actively targeting government in March 2026 include Qilin (updated March 22), Akira, Play, and Medusa. Key CVEs: <ul> <li>CVE-2026-20131 (Cisco FMC, CVSS 10.0 - actively exploited by Interlock)</li> <li>CVE-2026-20127 (Cisco SD-WAN Manager, CVSS 10.0 - actively exploited)</li> </ul> Supply Chain: Trivy, ConnectWise, and the Expanding Blast Radius The compromise of the Trivy open-source vulnerability scanner - maintained by Aqua Security - has expanded from its initial GitHub Actions footprint into Docker Hub and npm: <ul> <li>Docker Hub: Compromised images tagged 0.69.4, 0.69.5, and 0.69.6 were pushed without corresponding GitHub releases. The latest tag currently points to the compromised 0.69.6 image.</li> <li>GitHub Actions: 75 tags were force-pushed, exposing CI/CD secrets across all downstream consumers.</li> <li>npm: A self-propagating malware called CanisterWorm has infected 47 npm packages using a novel Internet Computer Protocol (ICP) blockchain-based command-and-control mechanism that resists traditional domain seizure or IP blocking.</li> </ul> Separately, ConnectWise ScreenConnect - the remote support tool used by many managed service providers (MSPs) serving state agencies - disclosed CVE-2026-3564 (CVSS 9.0), its second critical vulnerability in under a year. Given that MSPs are a primary IT delivery mechanism for many state agencies, this represents a direct supply chain risk. Key CVEs: <ul> <li>CVE-2026-3564 (ConnectWise ScreenConnect, CVSS 9.0)</li> <li>CVE-2026-20963 (Microsoft SharePoint, CVSS 8.8 - actively exploited deserialization RCE, added to CISA KEV)</li> </ul> Critical Infrastructure: ICS/OT Advisories Hitting State Facilities CISA published eight ICS advisories on March 19-20 affecting systems commonly deployed in state government buildings and infrastructure: <table> <tbody> <tr> <td> System </td> <td> Vendor </td> <td> Risk </td> <td> State Government Exposure </td> </tr> <tr> <td> WebCTRL Premium Server </td> <td> Automated Logic </td> <td> Communication interception/modification </td> <td> HIGH - manages HVAC and building management in state facilities </td> </tr> <tr> <td> EcoStruxure PME/EPO </td> <td> Schneider Electric </td> <td> Power monitoring compromise </td> <td> HIGH - monitors power in state data centers </td> </tr> <tr> <td> EcoStruxure Automation Expert </td> <td> Schneider Electric </td> <td> Industrial automation vulnerability </td> <td> MODERATE </td> </tr> <tr> <td> Modicon M241/M251/M262 </td> <td> Schneider Electric </td> <td> Denial of service </td> <td> MODERATE - PLCs in water/wastewater systems </td> </tr> <tr> <td> Modicon M241/M251/M258/LMC058 </td> <td> Schneider Electric </td> <td> XSS/open redirect - account compromise </td> <td> MODERATE - PLCs in water/wastewater systems </td> </tr> </tbody> </table> These advisories take on heightened significance given Iran's explicit threats against U.S. energy and water infrastructure and the documented MOIS pre-positioning against OT/SCADA systems. <h2>Predictive Analysis: What Comes Next</h2> <table> <tbody> <tr> <td> Scenario </td> <td> Probability </td> <td> Timeframe </td> <td> Basis </td> </tr> <tr> <td> Iranian cyber retaliatory operations against U.S. critical infrastructure (water, energy, government endpoints) </td> <td> >70% </td> <td> 7-14 days </td> <td> Military escalation, ultimatum expiration, demonstrated MOIS capability (Stryker), explicit Iranian threats </td> </tr> <tr> <td> Additional Trivy/CanisterWorm supply chain fallout as npm propagation continues </td> <td> >70% </td> <td> 7-14 days </td> <td> Self-propagating mechanism confirmed; 47 packages already infected; blockchain C2 resists takedown </td> </tr> <tr> <td> Foster City ransomware attribution emerges - potentially revealing Iranian wiper-as-ransomware </td> <td> 40-60% </td> <td> 7-14 days </td> <td> Unusual absence of claim; timing aligns with Iran escalation; wiper-as-ransomware is documented Iranian TTP </td> </tr> <tr> <td> DarkSword iOS targeting expands to U.S./NATO government officials </td> <td> 40-60% </td> <td> 14-30 days </td> <td> Iranian-linked actors already using the kit; U.S. officials are high-value intelligence targets during military operations </td> </tr> <tr> <td> Chinese APT (Volt Typhoon / Salt Typhoon) exploitation of U.S. distraction with Iran to advance infrastructure pre-positioning </td> <td> 20-40% </td> <td> 30-60 days </td> <td> Historical pattern of opportunistic Chinese operations during U.S. crises; current absence of reporting may indicate improved OPSEC </td> </tr> <tr> <td> MuddyWater resurfaces with coordinated MOIS operation alongside Handala </td> <td> 40-60% </td> <td> 7-21 days </td> <td> 16+ day silence during escalation is anomalous; MOIS coordinates across affiliated groups </td> </tr> </tbody> </table> <h2>SOC Operational Guidance</h2> Priority Detection and Blocking Block immediately at DNS and firewall layers: <table> <tbody> <tr> <td> IOC Type </td> <td> Value </td> <td> Context </td> </tr> <tr> <td> Domain </td> <td> snapshare[.]chat </td> <td> DarkSword iOS exploit delivery </td> </tr> <tr> <td> Domain </td> <td> static.cdncounter[.]net </td> <td> DarkSword C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> sahibndn[.]io </td> <td> DarkSword C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> e5.malaymoil[.]com </td> <td> DarkSword C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> sqwas.shapelie[.]com </td> <td> DarkSword C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> scan.aquasecurtiy[.]org </td> <td> Trivy supply chain typosquatted C2 </td> </tr> <tr> <td> IPv4 </td> <td> 62.72.21[.]10 </td> <td> DarkSword C2 </td> </tr> <tr> <td> IPv4 </td> <td> 72.60.98[.]48 </td> <td> DarkSword C2 </td> </tr> </tbody> </table> Hunting Hypotheses Hunt 1 - Signal/WhatsApp Device Linking Abuse (ATT&CK: T1566.003, T1539) <ul> <li>Search email and messaging logs for messages containing "Signal Security Support," "verify your account," or QR code image attachments from unknown senders.</li> <li>Audit Signal linked devices on executive and senior leadership phones. Any device linked after February 1, 2026 that the user does not recognize should be treated as a compromise indicator.</li> <li>Monitor for anomalous authentication patterns to messaging web clients from state network IP ranges.</li> </ul> Hunt 2 - Endpoint Management Weaponization (ATT&CK: T1078, T1485) <ul> <li>If your agency uses Microsoft Intune, SCCM, or any endpoint management platform: audit all remote wipe commands issued in the past 30 days. Any mass wipe command not correlated to a documented IT ticket is a critical finding.</li> <li>Review administrative account access to endpoint management consoles for anomalous login times, locations, or MFA bypass.</li> <li>Alert on any new Global Administrator or Intune Administrator role assignments in Azure AD.</li> </ul> Hunt 3 - Trivy/Supply Chain Compromise (ATT&CK: T1195.002, T1552.001) <ul> <li>Search container registries for any pull of aquasec/trivy:0.69.4, aquasec/trivy:0.69.5, or aquasec/trivy:0.69.6. If found, treat all CI/CD secrets in those pipelines as compromised.</li> <li>Search DNS logs for resolution of scan.aquasecurtiy[.]org (note the typo - "securtiy" not "security").</li> <li>Audit npm dependency trees for unexpected new packages added after March 18.</li> </ul> Hunt 4 - MuddyWater/Dindoor Backdoor (ATT&CK: T1071.001, T1105) <ul> <li>Proactively search for Dindoor backdoor indicators across state network telemetry. Cross-reference known MuddyWater infrastructure with Handala/Void Manticore IOCs - both are MOIS-affiliated and may share infrastructure.</li> <li>Monitor for anomalous PowerShell execution patterns consistent with MuddyWater's documented use of living-off-the-land techniques.</li> </ul> Hunt 5 - Cisco FMC/SD-WAN Exploitation (ATT&CK: T1190) <ul> <li>If Cisco FMC or SD-WAN Manager is deployed, review logs for unauthenticated access attempts or anomalous API calls predating the March 20 patch. Interlock exploited CVE-2026-20131 as a zero-day since January 26 - compromise may predate patching.</li> <li>Search for indicators of Interlock ransomware staging: unusual scheduled tasks, lateral movement via RDP, or data staging in temporary directories.</li> </ul> MFA Bypass Awareness (ATT&CK: T1557, T1539) Multiple independent sources this cycle confirm that adversary-in-the-middle (AiTM) session token theft is now routinely bypassing push-notification and SMS-based MFA. The Tycoon2FA phishing-as-a-service platform was recently disrupted, but the technique is commoditized across multiple platforms. SOC teams should: <ul> <li>Monitor for impossible-travel alerts on M365 accounts even when MFA was successfully completed.</li> <li>Alert on new inbox rules or mail forwarding rules created shortly after authentication events.</li> <li>Treat any session token replay from a new IP/device as a high-priority investigation.</li> </ul> <h2>Sector-Specific Defensive Priorities</h2> State and Local Government (Primary Audience) <ul> <li>Patch CVE-2026-20131 (Cisco FMC) and CVE-2026-20127 (Cisco SD-WAN) immediately. The CISA deadline has passed. Non-compliance is not a risk acceptance decision - it is an exposure.</li> <li>Issue a statewide advisory on Signal/WhatsApp phishing to all elected officials, agency heads, and senior staff. Provide step-by-step instructions for auditing linked devices.</li> <li>Mandate iOS 26.3.1 update for all state-issued and BYOD iPhones used by senior officials. Enable Lockdown Mode for the Governor's office, Attorney General, and legislative leadership.</li> <li>Audit endpoint management platforms (Intune, SCCM) for unauthorized administrative actions. The Handala/Stryker attack demonstrated that these platforms can be weaponized without deploying any malware.</li> <li>Assess CISA service degradation impact. Identify which federal services your state relies on - vulnerability scanning, Albert network sensors, incident response surge capacity, election security support - and develop compensating controls before the 2026 midterm cycle intensifies.</li> </ul> Financial Services <ul> <li>Prioritize SharePoint patching (CVE-2026-20963, CVSS 8.8). Financial institutions with SharePoint-based document management for regulatory filings and client data are directly exposed to this actively exploited deserialization RCE.</li> <li>Audit MSP/ScreenConnect access. Financial services firms using ConnectWise ScreenConnect for vendor remote support should upgrade to version 26.1+ immediately (CVE-2026-3564, CVSS 9.0) and audit session logs for unauthorized access.</li> <li>Monitor for AiTM phishing targeting treasury and wire transfer functions. MFA bypass techniques are being used to compromise financial accounts and initiate fraudulent transactions.</li> </ul> Energy <ul> <li>Treat Iran OT threats as imminent. Energy utilities - particularly those with Schneider Electric EcoStruxure PME/EPO or Modicon PLCs - should verify ICS advisory patches (ICSA-26-078-01 through -04) and review OT network segmentation.</li> <li>Pre-position OT isolation procedures. If a destructive attack is detected, the ability to rapidly isolate SCADA/OT networks from IT networks is the difference between a cybersecurity incident and a safety incident.</li> <li>Monitor for pre-positioning indicators on network edge devices (routers, firewalls, VPN concentrators) consistent with both Iranian and Chinese (Volt Typhoon) TTPs.</li> </ul> Healthcare <ul> <li>Ransomware preparedness is paramount. Healthcare remains a top ransomware target for Qilin, Akira, and Medusa. Ensure offline backups of electronic health records and clinical systems are current and tested.</li> <li>Audit Intune/SCCM configurations. Healthcare organizations that use Microsoft Intune for mobile device management should implement the same hardening controls recommended after the Stryker incident - restrict remote wipe permissions, require multi-person approval for mass actions, and monitor for anomalous administrative commands.</li> <li>Patch ConnectWise ScreenConnect if used by biomedical engineering or IT support vendors for remote maintenance of clinical systems.</li> </ul> Aviation and Logistics <ul> <li>Supply chain integrity is the priority. Aviation and logistics organizations with CI/CD pipelines should audit for Trivy usage and pin to version 0.69.3 or earlier. Any pipeline that executed versions 0.69.4-0.69.6 should have all secrets rotated.</li> <li>Monitor for GOOTLOADER SEO poisoning targeting procurement and logistics search terms. GOOTLOADER campaigns have re-emerged targeting government and are known to deliver Cobalt Strike and ransomware payloads via poisoned search results for shipping documents, customs forms, and logistics contracts.</li> <li>Review OT security for airport and port facility management systems, particularly Automated Logic WebCTRL (ICSA-26-078-08) used in building management.</li> </ul> <h2>Prioritized Defense Recommendations</h2> Immediate (Within 24 Hours) <table> <tbody> <tr> <td> Priority </td> <td> Responsible Team </td> <td> Action </td> </tr> <tr> <td> IMMEDIATE </td> <td> SOC </td> <td> Block DarkSword domains (snapshare[.]chat, static.cdncounter[.]net, sahibndn[.]io, e5.malaymoil[.]com, sqwas.shapelie[.]com), C2 IPs (62.72.21[.]10, 72.60.98[.]48), and Trivy C2 (scan.aquasecurtiy[.]org) at DNS and firewall layers. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Operations </td> <td> Confirm Cisco FMC is patched against CVE-2026-20131 (CVSS 10.0). CISA deadline was March 23. If unpatched, escalate to CISO as a critical finding. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Operations </td> <td> Confirm Cisco SD-WAN Manager patched against CVE-2026-20127 (CVSS 10.0) and related actively exploited SD-WAN flaws. </td> </tr> <tr> <td> IMMEDIATE </td> <td> IT Operations </td> <td> Confirm SharePoint Server patched against CVE-2026-20963 (CVSS 8.8, actively exploited deserialization RCE). </td> </tr> <tr> <td> IMMEDIATE </td> <td> CISO / Executive Office </td> <td> Issue advisory to all senior leadership and elected officials: update personal and state-issued iPhones to iOS 26.3.1 immediately. Enable Lockdown Mode for highest-risk individuals (Governor, AG, legislative leadership). </td> </tr> <tr> <td> IMMEDIATE </td> <td> CISO / Communications </td> <td> Issue statewide advisory: Signal and WhatsApp support will never request verification codes via in-app messages. Do not scan QR codes or click links from unknown contacts. All employees should review Signal linked devices and remove any unrecognized entries. </td> </tr> </tbody> </table> 7-Day Actions <table> <tbody> <tr> <td> Priority </td> <td> Responsible Team </td> <td> Action </td> </tr> <tr> <td> 7-DAY </td> <td> DevOps </td> <td> Audit all CI/CD pipelines for Trivy usage. Pin to version 0.69.3 or earlier. If versions 0.69.4-0.69.6 were executed, treat all pipeline secrets as compromised and rotate immediately. Audit npm dependencies for CanisterWorm indicators. </td> </tr> <tr> <td> 7-DAY </td> <td> IT Operations </td> <td> Upgrade ConnectWise ScreenConnect to version 26.1+ to remediate CVE-2026-3564 (CVSS 9.0). Audit ScreenConnect server logs for unauthorized access. </td> </tr> <tr> <td> 7-DAY </td> <td> IT Operations (Facilities/OT) </td> <td> Verify Automated Logic WebCTRL Premium Server patched per ICSA-26-078-08. Audit Schneider Electric EcoStruxure PME/EPO installations per ICSA-26-078-04. These systems manage HVAC and power monitoring in state buildings. </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Conduct proactive threat hunt for MuddyWater/Dindoor backdoor indicators. Cross-reference with Handala/Void Manticore infrastructure. Sixteen days of silence from an MOIS-affiliated actor during military escalation warrants active investigation. </td> </tr> <tr> <td> 7-DAY </td> <td> SOC </td> <td> Implement detection for Azure Monitor alert callback phishing - monitor for emails from Azure Monitor containing phone numbers or callback requests impersonating Microsoft Security Team. </td> </tr> </tbody> </table> 30-Day Actions <table> <tbody> <tr> <td> Priority </td> <td> Responsible Team </td> <td> Action </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Commission assessment of state election infrastructure security posture given CISA workforce reductions. Identify which CISA services are degraded and develop compensating controls before the 2026 midterm cycle. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO / IR Team </td> <td> Develop an Iran cyber retaliation response playbook covering: (1) wiper incident response for endpoint management abuse (Intune/SCCM), (2) OT/SCADA isolation procedures for water and power systems, (3) crisis communication plan for a destructive attack scenario. Conduct a tabletop exercise within 30 days. </td> </tr> <tr> <td> 30-DAY </td> <td> IT Operations / IAM </td> <td> Evaluate FIDO2/passkey deployment for state employee Microsoft 365 accounts. Push-notification and SMS-based MFA is being routinely bypassed by adversary-in-the-middle attacks. Phishing-resistant authentication is no longer optional - it is an operational necessity. </td> </tr> <tr> <td> 30-DAY </td> <td> CISO </td> <td> Review and update MSP/vendor access controls. The ConnectWise ScreenConnect vulnerability (second critical CVE in under a year) and the Trivy supply chain compromise demonstrate that vendor trust must be continuously verified, not assumed. </td> </tr> </tbody> </table> <h2>The Structural Challenge: States Are Increasingly on Their Own</h2> One factor that makes this threat convergence particularly dangerous is the degradation of federal cybersecurity support. CISA workforce reductions, the lapse of key information-sharing authorities, and the hollowing out of election security programs mean that state governments cannot rely on the same level of federal incident response surge capacity, vulnerability scanning, or threat intelligence sharing that existed even six months ago. This is not a political observation - it is an operational reality that must inform resource allocation decisions. State CISOs should be having direct conversations with their governors and legislative leadership about: <ul> <li>Funding for compensating controls to replace degraded federal services</li> <li>Interstate information-sharing agreements to fill intelligence gaps</li> <li>Incident response retainer contracts with private-sector firms to ensure surge capacity exists when - not if - a significant incident occurs</li> <li>Election security readiness independent of federal support, given the approaching 2026 midterm cycle</li> </ul> <h2>Bottom Line                               </h2> The intelligence picture is unambiguous. Iranian MOIS-affiliated actors have demonstrated the capability and intent to conduct destructive operations against U.S. targets. Russian intelligence is actively harvesting government officials' private communications. Supply chain attacks are expanding faster than most organizations can audit their dependencies. And the federal safety net that state governments have historically relied upon is thinner than it has been in a decade. The actions outlined in this report are not aspirational - they are the minimum defensive posture for the current threat environment. The Cisco FMC patch deadline has passed. The iOS emergency update is available now. The Signal linked-device audit takes five minutes per phone. Every day of delay is a day your adversaries are already using.

FEATURED RESOURCES

March 23, 2026

Anomali Cyber Watch

Iran's Cyber War Enters a New Phase: State-directed Destruction, Synchronized Strikes, and the 24-Hour Reconstitution Problem

March 23, 2026

Public Sector

Anomali Cyber Watch

When Two Nation States Strike at Once: Why State Government CISOs Must Act This Week

March 20, 2026

Anomali Cyber Watch

Iran's Cyber War Machine Is Damaged — But Still Firing. Here's What CISOs Need to Know Now.

Explore All