When Your Own Tools Become the Weapon: A Critical Week for State Government Cybersecurity

Public Sector

Published on

March 20, 2026

Table of Contents

<table> <tbody> <tr> <td> Threat Assessment Level: ELEVATED Previous cycle (2026-03-18): CRITICAL → Current assessment: ELEVATED. The downgrade from CRITICAL reflects the availability of patches for the Cisco FMC zero-day (CVE-2026-20131) and CISA's issuance of Intune hardening guidance, which provide defenders actionable mitigation paths. However, the threat level remains ELEVATED — not GUARDED — because: (1) the Iran-linked Handala wiper campaign demonstrated a paradigm-shifting attack technique with no available signature-based defense; (2) Interlock ransomware exploited CVE-2026-20131 as a zero-day for 36 days before a patch existed and continues to actively target public-sector organizations; (3) SharePoint RCE CVE-2026-20963 is now confirmed exploited in the wild; and (4) CISA's institutional capacity to support state governments continues to erode. All threat actors and campaigns from the prior cycle — Handala/UNC5203, MuddyWater, APT28/Fancy Bear, Interlock, LeakNet, Termite/Velvet Tempest, and the ClickFix social engineering ecosystem — remain active and relevant. </td> </tr> </tbody> </table> <h2>Introduction                           </h2> State CIOs and CISOs face a threat environment this week that is qualitatively different from anything in recent memory — not because of a single catastrophic event, but because three simultaneous, high-severity attack campaigns are converging on technology that virtually every state agency deploys: Cisco firewall management, Microsoft Intune endpoint management, and SharePoint collaboration. The most alarming development is not a new piece of malware. It is the demonstrated weaponization of Microsoft Intune — a legitimate endpoint management platform — to wipe 200,000 devices at a major U.S. corporation without deploying a single malicious file. No hash to block. No C2 domain to sinkhole. No signature to detect. The weapon was the management console itself. For state IT leaders managing tens of thousands of endpoints across dozens of agencies, this is not a theoretical risk. It is a proven attack path, executed by a nation-state actor, against a U.S. target, in March 2026. This post synthesizes the intelligence from the past 72 hours into actionable guidance for state government IT leadership. Every finding maps to technology you likely operate and threats you can mitigate — starting today. <h2>What Changed                           </h2> <ul> <li>March 19 — CISA added CVE-2026-20131 (Cisco Secure Firewall Management Center, CVSS 10.0) to the Known Exploited Vulnerabilities (KEV) catalog, confirming that the Interlock ransomware group has been exploiting it as a zero-day since January 26, 2026 — a 36-day window before Cisco's March 4 patch.</li> <li>March 19 — CISA and Microsoft jointly issued an Intune hardening advisory following the Iran-linked Handala (also tracked as UNC5203/Void Manticore, MOIS-directed) wiper attack on Stryker Corporation, which destroyed approximately 200,000 devices using only legitimate Intune management commands.</li> <li>March 19 — CISA added CVE-2026-20963 (Microsoft SharePoint RCE, CVSS 8.8) to KEV, confirming active exploitation in the wild. The vulnerability was patched in January 2026 but many organizations remain unpatched.</li> <li>March 19 — Multiple outlets reported that Iran pre-positioned cyber strike infrastructure months before Operation Epic Fury (the U.S./Israel military operation launched February 28), indicating the current Iranian cyber campaign is pre-planned and sustained — not reactive.</li> <li>March 18–19 — ConnectWise ScreenConnect CVE-2026-3564 disclosed — a cryptographic signature verification flaw allowing session hijacking. This is the second critical ScreenConnect vulnerability in under a year, compounding MSP supply chain risk.</li> <li>March 19 — CISA published eight ICS advisories affecting Schneider Electric Modicon controllers, Automated Logic WebCTRL building management systems, and other OT/ICS products commonly deployed in state government facilities.</li> <li>March 17–19 — ClickFix social engineering techniques continued to evolve and proliferate across multiple unrelated threat groups, with new reporting confirming adoption by at least four actor clusters and an updated variant targeting Windows Terminal rather than the Run dialog.</li> <li>March 17 — Reporting confirmed that CISA election security programs have been "hollowed out" and that the 2015 Cybersecurity Information Sharing Act framework faces expiration in September 2026 without congressional action, signaling a structural reduction in federal cyber support to state and local governments.</li> </ul> <h2>Threat Timeline                          </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Severity </th> <th> State Gov Relevance </th> </tr> </thead> <tbody> <tr> <td> 2026-01-26 </td> <td> Interlock begins exploiting Cisco FMC CVE-2026-20131 as zero-day </td> <td> CRITICAL </td> <td> Cisco FMC widely deployed in state WANs </td> </tr> <tr> <td> 2026-01 (est.) </td> <td> Iran pre-positions cyber strike infrastructure ahead of Epic Fury </td> <td> HIGH </td> <td> State OT/BMS systems are potential targets </td> </tr> <tr> <td> 2026-01-14 </td> <td> Microsoft patches SharePoint CVE-2026-20963 </td> <td> MEDIUM </td> <td> Patch window opens; unpatched orgs accumulate risk </td> </tr> <tr> <td> 2026-02-28 </td> <td> Operation Epic Fury launched (U.S./Israel military operation) </td> <td> HIGH </td> <td> Triggers Iranian cyber retaliation campaign </td> </tr> <tr> <td> 2026-03-04 </td> <td> Cisco patches CVE-2026-20131 in FMC </td> <td> HIGH </td> <td> Patch available but exploitation ongoing </td> </tr> <tr> <td> 2026-03-11–13 </td> <td> Handala/UNC5203 executes Stryker wiper attack via Intune (200K devices) </td> <td> CRITICAL </td> <td> Proves Intune weaponization is viable </td> </tr> <tr> <td> 2026-03-17 </td> <td> Reporting confirms CISA election security programs “hollowed out”; cyber intelligence-sharing framework faces Sept 2026 expiration </td> <td> HIGH </td> <td> Reduces federal support to states </td> </tr> <tr> <td> 2026-03-18 </td> <td> ConnectWise ScreenConnect CVE-2026-3564 disclosed; patch released (v26.1) </td> <td> HIGH </td> <td> MSP/vendor remote access tool </td> </tr> <tr> <td> 2026-03-19 </td> <td> CISA adds CVE-2026-20131 to KEV; issues Intune hardening advisory; adds CVE-2026-20963 to KEV; publishes 8 ICS advisories </td> <td> CRITICAL </td> <td> Triple KEV day + ICS advisories for state-deployed products </td> </tr> </tbody> </table> <h2>Key Threat Analysis                           </h2> <h3>1. Interlock Ransomware and the Cisco FMC Zero-Day</h3> Interlock is a ransomware operation linked to the VICE SPIDER ecosystem (which includes Vice Society, Rhysida, and aliases DEV-0832/Vanilla Tempest). Threat intelligence data shows Interlock has claimed 99 victims since December 2023, with 67% based in the United States and 9% in the public sector — including the city of Saint Paul, Minnesota. The group exploited CVE-2026-20131 — an unauthenticated remote code execution vulnerability in Cisco Secure Firewall Management Center's web interface, caused by insecure deserialization of Java byte streams — for 36 days before a patch was available. The vulnerability carries a CVSS score of 10.0 (maximum severity) and grants attackers root-level access to the FMC appliance. What makes this particularly concerning for state government: Interlock's toolset includes Cobalt Strike, Mimikatz, PsExec, AnyDesk, ScreenConnect, MeshAgent, RustDesk, and SharpHound — a full-spectrum post-exploitation kit. Once inside via FMC, they have the tools to map your Active Directory, escalate privileges, move laterally, and deploy ransomware across the enterprise. ATT&CK Techniques: T1190 (Exploit Public-Facing Application), T1068 (Exploitation for Privilege Escalation), T1486 (Data Encrypted for Impact), T1021.001 (Remote Services: RDP) <h3>2. Handala/Void Manticore: Intune as a Wiper Delivery Platform</h3> The Iran-linked Handala group (also tracked as UNC5203, Void Manticore, directed by Iran's MOIS per DOJ/FBI attribution) executed what may be the most consequential attack technique of 2026: using Microsoft Intune — a legitimate, trusted endpoint management platform — to wipe 200,000 devices at Stryker Corporation. No malware was deployed. The attackers compromised Intune administrator credentials and used the platform's native device management capabilities to push destructive commands. This is a paradigm shift. Every previous major wiper attack — NotPetya, WhisperGate, BiBi-Linux — deployed malicious binaries that could theoretically be detected by EDR, antivirus, or network monitoring. The Intune wiper attack bypasses all of these controls because the "weapon" is a legitimate management command from a trusted platform. For state government, the implications are stark: if an attacker compromises a single Intune Global Administrator account — potentially via an adversary-in-the-middle (AiTM) phishing attack that steals a session token — they could push a device wipe to every state-managed endpoint simultaneously. Laptops, desktops, and mobile devices across every agency. ATT&CK Techniques: T1072 (Software Deployment Tools), T1485 (Data Destruction), T1078 (Valid Accounts), T1078.004 (Cloud Accounts), T1538 (Cloud Service Dashboard) <h3>3. Iran's Sustained Cyber Retaliation Posture</h3> The Handala/Stryker attack does not exist in isolation. Intelligence reporting from the week of March 17–19 confirms that Iranian cyber operators pre-positioned strike infrastructure months before Operation Epic Fury was launched on February 28. Iran is combining missile strikes, disinformation campaigns, and cyberattacks in a coordinated retaliatory campaign and has publicly named major U.S. technology firms as targets. This is not a short-duration spike. The pre-positioning timeline indicates a sustained campaign that will likely continue for months. MuddyWater (MOIS-affiliated, also tracked as TEMP.Zagros) remains active with its Dindoor backdoor operations. APT28/Fancy Bear (Russian GRU) continues leveraging ClickFix social engineering. The broader threat actor landscape remains fully active. Iran has previously demonstrated willingness to target U.S. critical infrastructure — including water treatment systems in 2023–2024. State government OT and building management systems represent opportunistic targets for actors seeking high-visibility disruption. <h3>4. SharePoint RCE in the Wild (CVE-2026-20963)</h3> CVE-2026-20963 is a deserialization-of-untrusted-data vulnerability in Microsoft SharePoint (CVSS 8.8) that allows an authorized attacker to execute arbitrary code. The "authorized attacker" requirement is key: this is not an unauthenticated exploit. An attacker needs a valid SharePoint account — which is exactly what AiTM phishing campaigns deliver. The attack chain is clear: tax-season phishing email → AiTM credential theft → compromised M365 account → SharePoint RCE. Microsoft patched this in January 2026, but CISA's March 19 KEV addition confirms organizations remain unpatched and exploitation is active. <h3>5. The ClickFix Social Engineering Ecosystem</h3> ClickFix — a social engineering technique that tricks users into executing malicious commands — continues to evolve and proliferate. It has now been adopted by at least four unrelated threat groups, including operators linked to Interlock. Recent reporting indicates ClickFix has evolved to target Windows Terminal instead of the Run dialog, and a MacSync infostealer variant is being distributed via fake AI tools. The proliferation of ClickFix across multiple actor groups — from ransomware operators to nation-state actors including APT28 — suggests it has become a shared commodity technique, much like phishing kits were a decade ago. <h3>6. CISA Institutional Erosion</h3> A structural factor compounding all of the above: CISA's capacity to support state and local governments is degrading. Reporting from March 17 confirmed that election security programs have been "hollowed out," and the 2015 Cybersecurity Information Sharing Act framework faces expiration in September 2026 without congressional action. The irony is acute: CISA issued three KEV additions and an Intune hardening advisory in a single day (March 19) while simultaneously losing the staff and budget to help states implement the guidance. <h2>Predictive Analysis                          </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional Iranian wiper or disruptive attacks against U.S. organizations </td> <td> HIGH (75–85%) </td> <td> 7–30 days </td> <td> Pre-positioned infrastructure, public targeting statements, Stryker precedent, sustained Epic Fury escalation </td> </tr> <tr> <td> Interlock ransomware targets additional state/local government entities via Cisco FMC or other vectors </td> <td> MODERATE-HIGH (55–65%) </td> <td> 30–60 days </td> <td> 9% public-sector victim rate, 67% U.S. focus, CVSS 10.0 zero-day in toolkit, ClickFix as alternative access vector </td> </tr> <tr> <td> AiTM phishing campaigns leveraging tax-season lures compromise state employee M365 accounts </td> <td> HIGH (70–80%) </td> <td> Now through April 15 </td> <td> Seasonal pattern, successor PhaaS platforms (Starkiller) filling Tycoon2FA gap, MFA bypass techniques maturing </td> </tr> <tr> <td> Compromised M365 account chains into SharePoint RCE (CVE-2026-20963) or Intune abuse </td> <td> MODERATE (40–50%) </td> <td> 30–60 days </td> <td> Attack chain is proven; depends on patch status and Intune hardening </td> </tr> <tr> <td> Chinese APT activity (Salt Typhoon, Volt Typhoon) resurfaces against government networks </td> <td> MODERATE (45–55%) </td> <td> 30–90 days </td> <td> Absence of reporting during Iran crisis is notable; historical pattern of sustained pre-positioning in U.S. infrastructure </td> </tr> <tr> <td> Exploitation of ConnectWise ScreenConnect CVE-2026-3564 in MSP supply chain attacks </td> <td> MODERATE (40–50%) </td> <td> 14–30 days </td> <td> Second critical vuln in <1 year; MSPs are proven high-value targets </td> </tr> </tbody> </table> <h2>SOC Operational Guidance               </h2> <h3>Priority Detection Use Cases</h3> <h4>1. Cisco FMC Compromise Indicators</h4> Hunt Hypothesis: If Interlock exploited CVE-2026-20131 in our environment, we would see unexpected Java processes on FMC hosts, new administrative accounts created on FMC, or lateral movement (RDP, PsExec, WMI) originating from FMC management IP addresses. ATT&CK: T1190, T1068, T1021.001, T1136 (Create Account) Actions: Query FMC audit logs for new account creation since January 26, 2026. Review network flow data for outbound connections from FMC management interfaces to unexpected destinations. Check for Cobalt Strike beacon patterns (default ports 443, 8443, or malleable C2 profiles) originating from FMC subnets. If FMC management interface was internet-exposed at any point since January 26, treat as presumed compromised and initiate incident response. <h4>2. Intune Management Platform Abuse</h4> Hunt Hypothesis: If an attacker compromised an Intune administrator account, we would see bulk device management commands (wipe, retire, reset) issued outside of normal change windows, or Intune admin sign-ins from anomalous locations/devices. ATT&CK: T1072, T1485, T1078.004, T1538 Actions: Enable and monitor Intune audit logs in Microsoft Purview/Sentinel. Create alerts for: (a) any device wipe command affecting >10 devices in a 1-hour window; (b) Intune admin sign-ins from non-corporate IP ranges; (c) new Intune admin role assignments; (d) Conditional Access policy modifications. Baseline normal Intune admin activity patterns to detect anomalies. <h4>3. SharePoint Post-Exploitation Activity</h4> Hunt Hypothesis: If an attacker exploited CVE-2026-20963 after compromising an employee account, we would see unusual SharePoint API calls, file uploads of web shells or scripts, or process execution on SharePoint servers. ATT&CK: T1190, T1059, T1078 Actions: Review SharePoint Unified Audit Logs for unusual file operations (aspx/asmx uploads, large data exports). Monitor SharePoint server processes for unexpected child processes (cmd.exe, powershell.exe, certutil.exe spawned by w3wp.exe). Verify January 2026 cumulative update is applied. <h4>4. AiTM Phishing / Session Token Theft</h4> Hunt Hypothesis: If state employees are targeted by AiTM phishing during tax season, we would see M365 sign-ins with stolen session tokens — characterized by sign-ins that bypass MFA, originate from proxy infrastructure, and are followed by mailbox rule creation or data exfiltration. ATT&CK: T1566.002, T1539, T1078.004 Actions: Monitor Azure AD sign-in logs for: (a) sign-ins marked "MFA satisfied by session token" from new IP addresses; (b) impossible travel detections; (c) inbox rule creation (forwarding, deletion) immediately after sign-in. Deploy Microsoft's token theft detection playbook. Alert on any new mail forwarding rules to external addresses. <h4>5. ClickFix / Windows Terminal Abuse</h4> Hunt Hypothesis: If ClickFix social engineering succeeds against a state employee, we would see Windows Terminal (wt.exe) or PowerShell launched with encoded commands, followed by download and execution of second-stage payloads. ATT&CK: T1204.002 (User Execution: Malicious File), T1059.001 (PowerShell) Actions: Monitor endpoint telemetry for wt.exe or powershell.exe launched with Base64-encoded command-line arguments. Alert on mshta.exe, certutil.exe, or bitsadmin.exe downloading executables. Review proxy logs for connections to known ClickFix staging domains. <h4>6. OT/BMS Anomaly Monitoring</h4> Hunt Hypothesis: If Iranian or other actors target state building management or water/wastewater systems, we would see unauthorized access to WebCTRL or Modicon PLC management interfaces, firmware modifications, or setpoint changes outside maintenance windows. ATT&CK: T1583 (Acquire Infrastructure), T1485 (Data Destruction — OT context) Actions: Verify Automated Logic WebCTRL and Schneider Electric Modicon management interfaces are not internet-accessible. Monitor OT network segments for unauthorized connections. Review access logs for WebCTRL admin portals. <h3>IOC Blocking Guidance                               </h3> The following IOCs have been verified through intelligence collection. Apply to perimeter controls, SIEM correlation rules, and threat hunting queries as appropriate. <h4>Network Indicators</h4> <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 176.113.115[.]97 </td> <td> Malicious infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 176.113.115[.]209 </td> <td> Malicious infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 85.209.11[.]49 </td> <td> Malicious infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 31.41.244[.]100 </td> <td> Malicious infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 188.119.66[.]189 </td> <td> Malicious infrastructure </td> </tr> </tbody> </table> Note on IP `1.1.3[.]0`: This China Telecom (Fujian) IP is tagged in threat intelligence platforms to 20+ actor groups including Interlock, Scattered Spider, LockBit, Play, and Qilin. It is useful for correlation and hunting but should not be used as a standalone blocking indicator due to high shared-infrastructure risk. <h4>File Hashes (select high-confidence indicators)</h4> <table> <thead> <tr> <th> Type </th> <th> Value </th> </tr> </thead> <tbody> <tr> <td> SHA-256 </td> <td> 7def662b245e995377ac5f83a969085846de3b654308d8deeb48555ffc78c988 </td> </tr> <tr> <td> SHA-256 </td> <td> b7c96d19845837cdc25da4fd545ede0743668b70db6d1d22f0e657c27a8cd713 </td> </tr> <tr> <td> SHA-256 </td> <td> c4b2e134279ec2f484a4f1505914c68d20c20596ec544b2b2b48151df2a93327 </td> </tr> <tr> <td> SHA-256 </td> <td> f7b89d35d9a54d9a9a419ff83d6c7598eddfca9737f959c67cc19eb5ba489bab </td> </tr> <tr> <td> SHA-256 </td> <td> f84b3439ac34616573d5e579b1d26211098168825719aeef3137a4d03392625a </td> </tr> <tr> <td> SHA-256 </td> <td> a0a049feafb6843d05e741055d693d4acced2a3942cf5f122cb1d3b281ee8490 </td> </tr> <tr> <td> SHA-256 </td> <td> 90a89ad6e8c4271c52bc8e83eb687837dc781d3a01c04e2ca62974a9aecc9f80 </td> </tr> <tr> <td> SHA-256 </td> <td> d2ed3a442faf5e1a83101bf6951212a04d3d0e1896c5f208726fb9dd2bf601f7 </td> </tr> <tr> <td> SHA-256 </td> <td> 458ced67f6762226b7ad22044f382d89e4979a57647139553927fa60cc529451 </td> </tr> <tr> <td> SHA-256 </td> <td> 8e53d239691d7e66dc4686d751912af7adeb2aff0e5c6218a14780ba0818fed0 </td> </tr> <tr> <td> MD5 </td> <td> d6e7547ad7dfd1fbc62e8282aebcc391 </td> </tr> <tr> <td> MD5 </td> <td> f588802958c35fe18eb87bc36651a3d1 </td> </tr> <tr> <td> MD5 </td> <td> 2bb209ccfc5103eccab523c875050cfa </td> </tr> <tr> <td> MD5 </td> <td> a7e7d00d531cb7ca27d0f3bee448573f </td> </tr> <tr> <td> MD5 </td> <td> 964c13b68dc6b6b918b66a9a10469d2a </td> </tr> </tbody> </table> Additional IOCs are available through Anomali ThreatStream and partner feeds.  <h2>Sector-Specific Defensive Priorities</h2> <h3>Financial Services (State Treasury, Revenue, Tax Systems)</h3> Tax-season phishing campaigns are directly targeting financial transaction workflows. State tax filing portals, revenue management systems, and treasury payment platforms face elevated risk from AiTM phishing that steals employee session tokens, potentially enabling unauthorized access to financial systems. <ul> <li>Priority: Deploy phishing-resistant MFA (FIDO2) on all accounts with access to financial systems — treasury, tax processing, benefits disbursement</li> <li>Priority: Implement anomaly detection on tax filing portals for credential stuffing and automated submission patterns</li> <li>Priority: Review SharePoint sites containing financial data; verify CVE-2026-20963 patch status on any SharePoint instance hosting tax or revenue documents</li> <li>Monitor for: Fake state tax portal domains (typosquats), fraudulent refund processing, and business email compromise targeting treasury wire transfers</li> </ul> <h3>Energy (State-Managed Power, Utilities Oversight)</h3> CISA's March 19 ICS advisories for Schneider Electric EcoStruxure PME/EPO (power monitoring) and Schneider Electric Modicon controllers directly affect energy infrastructure. Iran's demonstrated willingness to target U.S. critical infrastructure — combined with pre-positioned cyber capabilities — elevates the risk to state-regulated or state-operated power systems. <ul> <li>Priority: Apply patches per CISA advisories ICSA-26-078-01, ICSA-26-078-02, and ICSA-26-078-04 for Schneider Electric products</li> <li>Priority: Verify network segmentation between IT and OT environments; ensure Modicon PLC management interfaces are not reachable from corporate networks</li> <li>Priority: Establish or verify out-of-band communication plans for OT environments in case of IT network compromise</li> <li>Monitor for: Unauthorized access to SCADA/HMI systems, firmware modification attempts on PLCs, anomalous setpoint changes</li> </ul> <h3>Healthcare (State Health Agencies, Medicaid Systems)</h3> Interlock ransomware has claimed 10 healthcare victims (10% of its total), making healthcare its third most-targeted sector. State health agencies managing Medicaid enrollment, public health data, and hospital licensing systems are within the target profile. The combination of sensitive PII (health records, SSNs) and operational urgency (patient safety) makes healthcare a high-value ransomware target. <ul> <li>Priority: Verify Cisco FMC patch status for any FMC instances managing healthcare network firewalls</li> <li>Priority: Ensure healthcare data repositories on SharePoint are patched against CVE-2026-20963</li> <li>Priority: Review and test backup/recovery procedures for Medicaid and public health systems — ransomware recovery time directly impacts resident services</li> <li>Monitor for: Cobalt Strike beacons, SharpHound/BloodHound Active Directory enumeration, and lateral movement tools (PsExec, WMI) in healthcare network segments</li> </ul> <h3>Government (Executive Branch Agencies, Courts, Elections)</h3> State government agencies are the primary audience for this entire report, but several sub-sectors warrant specific callouts: <ul> <li>Elections: CISA election security programs have been “hollowed out” per March 17 reporting. States must assume reduced federal support for election infrastructure security through the 2026 cycle. Engage the EI-ISAC and MS-ISAC directly for compensating support.</li> <li>Courts: Court case management systems often run on legacy infrastructure with extended patching cycles. Verify SharePoint and Cisco FMC patch status in judicial branch networks.</li> <li>DMV/Benefits: High-volume citizen-facing portals are prime targets for credential harvesting and data theft. Tax-season phishing techniques will be repurposed for DMV and benefits fraud.</li> <li>Priority: Conduct an emergency inventory of all Intune Global Administrator accounts across all agencies; enforce FIDO2 MFA and Privileged Identity Management (PIM) with just-in-time access</li> <li>Priority: Assess the state's dependency on CISA services and develop contingency plans for reduced federal cyber support</li> <li>Priority: Ensure the September 2026 Cybersecurity Information Sharing Act expiration is on the state CISO's legislative tracking radar</li> </ul> <h3>Aviation / Logistics (State DOT, Airports, Port Authorities)</h3> State departments of transportation, airport authorities, and port facilities operate OT systems (traffic management, baggage handling, cargo tracking) that share vulnerability profiles with the ICS products covered in this week's CISA advisories. Supply chain disruption is a stated objective of Iranian retaliatory operations. <ul> <li>Priority: Review Automated Logic WebCTRL deployments in airport terminals and transportation facilities; apply patches per CISA ICSA-26-078-08</li> <li>Priority: Audit ConnectWise ScreenConnect instances used by transportation system vendors; upgrade to version 26.1</li> <li>Priority: Verify network segmentation between transportation OT systems (traffic signals, tunnel ventilation, bridge controls) and corporate IT networks</li> <li>Monitor for: Unauthorized remote access sessions to transportation control systems, anomalous ScreenConnect connections from vendor accounts</li> </ul> <h2>Prioritized Defense Recommendations</h2> <h3>Immediate (24–48 Hours)</h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> <th> Justification </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Patch all Cisco FMC instances for CVE-2026-20131. If the FMC management interface was internet-exposed at any point since January 26, 2026, initiate compromise assessment — hunt for unexpected admin accounts, anomalous Java processes, and lateral movement from FMC hosts. </td> <td> Network Security / IR </td> <td> CVSS 10.0, CISA KEV, 36-day zero-day exploitation by Interlock ransomware </td> </tr> <tr> <td> 2 </td> <td> Harden Microsoft Intune immediately. Enforce phishing-resistant MFA (FIDO2) on all Intune admin accounts. Restrict device wipe permissions to break-glass accounts only. Enable Intune audit logging. Implement Conditional Access policies requiring compliant devices and trusted locations for admin access. </td> <td> Identity & Cloud Security </td> <td> Proven wiper attack path; 200K devices destroyed at Stryker </td> </tr> <tr> <td> 3 </td> <td> Patch SharePoint for CVE-2026-20963. Verify the January 2026 cumulative update is applied to all SharePoint instances — on-premises and hybrid. If unpatched, treat as emergency. </td> <td> Applications / SharePoint Admin </td> <td> CISA KEV, active exploitation confirmed, chains with AiTM credential theft </td> </tr> <tr> <td> 4 </td> <td> Issue a tax-season phishing alert to all state employees. Specifically warn about fake refund notices, payroll forms, and IRS impersonation. Instruct employees to deny and report any MFA prompts they did not initiate. </td> <td> Security Awareness / SOC </td> <td> Peak phishing season; AiTM attacks bypass traditional MFA </td> </tr> </tbody> </table> <h3>7-Day Actions</h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> <th> Justification </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> Upgrade ConnectWise ScreenConnect to version 26.1 across all instances. Audit which vendors and MSPs have ScreenConnect access to state systems; revoke unnecessary access. </td> <td> Vendor Management / Endpoint </td> <td> CVE-2026-3564; second critical vuln in <1 year </td> </tr> <tr> <td> 6 </td> <td> Patch Automated Logic WebCTRL in state buildings per CISA ICSA-26-078-08. Verify management interfaces are not internet-accessible. </td> <td> Facilities / OT Security </td> <td> Active ICS advisory; building management systems in state facilities </td> </tr> <tr> <td> 7 </td> <td> Patch Schneider Electric Modicon controllers at water/wastewater and power monitoring facilities per CISA ICSA-26-078-01 and -02. </td> <td> OT Security / Utilities </td> <td> Active ICS advisories; Iran targeting critical infrastructure </td> </tr> <tr> <td> 8 </td> <td> Conduct Intune admin account inventory across all agencies. Remove stale accounts, enforce least privilege, enable Privileged Identity Management (PIM) for just-in-time admin access. </td> <td> Identity & Cloud Security </td> <td> Reduces blast radius of credential compromise </td> </tr> <tr> <td> 9 </td> <td> Deploy token theft detection in Azure AD/Entra ID. Implement Microsoft's recommended playbook for detecting session token replay attacks. </td> <td> SOC / Identity </td> <td> AiTM phishing bypasses MFA; token theft is the primary post-phishing technique </td> </tr> </tbody> </table> <h3>30-Day Actions</h3> <table> <thead> <tr> <th> # </th> <th> Action </th> <th> Owner </th> <th> Justification </th> </tr> </thead> <tbody> <tr> <td> 10 </td> <td> Conduct a tabletop exercise: “Intune Wiper Scenario.” Simulate an attacker compromising an Intune admin account and pushing a mass device wipe across all agencies. Test detection capabilities, response procedures, communication plans, and recovery timelines. </td> <td> IR / CISO Office </td> <td> Proven attack technique; tests organizational resilience to a novel threat </td> </tr> <tr> <td> 11 </td> <td> Evaluate phishing-resistant MFA rollout for all state employees — not just administrators. FIDO2 security keys or Windows Hello for Business. AiTM attacks render SMS and TOTP MFA ineffective for any account. </td> <td> Identity / CIO Office </td> <td> Strategic investment; single highest-leverage control against credential theft </td> </tr> <tr> <td> 12 </td> <td> Assess CISA dependency and develop contingency plans. With CISA budget cuts reducing federal support and the Cybersecurity Information Sharing Act facing September 2026 expiration, evaluate whether the state needs to increase internal threat hunting capacity, engage MS-ISAC/EI-ISAC more deeply, or procure commercial threat intelligence services. </td> <td> CISO Office / Policy </td> <td> Structural reduction in federal cyber support to states </td> </tr> <tr> <td> 13 </td> <td> Establish behavioral analytics for legitimate tool abuse. Create detection rules for anomalous use of management platforms (Intune bulk commands, unusual ScreenConnect sessions, off-hours SharePoint API activity, unexpected SCCM deployments). Traditional signature-based detection will not catch these attacks. </td> <td> SOC / Detection Engineering </td> <td> The Intune wiper used no malware; ClickFix uses the victim's own terminal; Interlock uses legitimate RMM tools for persistence </td> </tr> </tbody> </table> <h3>Executive / IR Preparedness</h3> <ul> <li>CISO: Brief the Governor's office or state CIO on the Intune wiper precedent and its implications for state endpoint management. This is a board-level risk that may require emergency budget authorization for FIDO2 key procurement and Intune hardening.</li> <li>General Counsel: Monitor class action litigation against Stryker — outcomes will establish precedent for organizational liability when legitimate management platforms are weaponized.</li> <li>IR Team: Update incident response playbooks to include “management platform compromise” as a scenario. Current playbooks likely assume malware-based attacks; the Intune wiper requires a fundamentally different response (credential revocation, Conditional Access lockdown, platform isolation — not malware containment).</li> <li>Communications: Prepare holding statements for a scenario in which state employee devices are mass-wiped. Citizen-facing services would be disrupted; proactive communication planning reduces reputational damage.</li> </ul> <h2>The Bottom Line                          </h2> First, identity is now the primary perimeter. Three of this week's five major threats — Intune weaponization, SharePoint RCE, and tax-season AiTM phishing — require compromised credentials as a prerequisite. The attacker who steals a session token from a single state employee can chain that access into remote code execution on SharePoint, or — if they reach an admin account — a mass device wipe via Intune. Phishing-resistant MFA (FIDO2) for privileged accounts is no longer a roadmap item. It is the single control that would have mitigated all three attack paths. Second, your management tools are now in the threat model. The Stryker attack proved that an endpoint management platform can be turned into a weapon of mass destruction without a single line of malicious code. Every state CISO should be asking: If our Intune admin credentials were compromised tonight, what would happen? If the answer is “an attacker could wipe every device we manage,” then hardening those controls is not a 30-day project — it is a this-week project. Third, federal support is diminishing at the worst possible time. CISA issued three KEV additions and a major hardening advisory in a single day while simultaneously losing the capacity to help states implement the guidance. States that have relied on federal assistance for threat hunting, vulnerability management, and incident response need to build internal capacity or find alternative partners — now, not after the next incident. The threat actors are not waiting. Interlock exploited a zero-day for 36 days before anyone noticed. Handala pre-positioned infrastructure months before striking. The window between vulnerability disclosure and exploitation is collapsing. The window between exploitation and catastrophic impact is measured in hours. <table> <tbody> <tr> <td> Patch the Cisco FMC. Harden Intune. Patch SharePoint. Deploy FIDO2. Do it this week. </td> </tr> </tbody> </table>

FEATURED RESOURCES

March 20, 2026

Anomali Cyber Watch

Iran's Cyber War Machine Is Damaged — But Still Firing. Here's What CISOs Need to Know Now.

March 20, 2026

Public Sector

Anomali Cyber Watch

When Your Own Tools Become the Weapon: A Critical Week for State Government Cybersecurity

March 19, 2026

Agentic SOC Platform

Threat Intelligence Platform

Anomali Named SC Awards Finalist x2: What the Recognition Reflects About Where Security Operations Is Headed

Explore All