When Your VPN Becomes the Front Door: Critical Exploits Targeting State Government Systems

Public Sector

Published on

June 15, 2026

Table of Contents

Threat Assessment Level: ELEVATED (Maintained from prior cycle — raised from GUARDED due to confirmed mass exploitation of state government enterprise systems and active weaponization of perimeter VPN infrastructure by ransomware operators.) <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demands immediate executive attention. Two critical vulnerabilities — one in Oracle PeopleSoft, the backbone of state HR and financial operations, and one in Palo Alto Networks GlobalProtect VPN — are under confirmed active exploitation by sophisticated threat actors. Simultaneously, the ransomware supply chain targeting government is visibly accelerating, with access brokers refreshing their inventories of stolen state credentials and multiple ransomware groups updating their government-targeting profiles within the same 48-hour window. This is not a theoretical risk assessment. Attackers are inside government networks today . The question for state CIOs and CISOs is whether your organization has already been compromised — and whether your patching and detection posture can close the window before data exfiltration or ransomware deployment occurs. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters </th> </tr> </thead> <tbody> <tr> <td> ShinyHunters claims Council of Europe breach — 297 GB exfiltrated from HR, payroll, and medical systems using CVE-2026-35273 (Oracle PeopleSoft RCE) </td> <td> Same actor, same exploit chain targeting ~100 organizations. Any state running PeopleSoft 8.61/8.62 is in the blast radius. </td> </tr> <tr> <td> CVE-2026-0257 (PAN-OS GlobalProtect) exploitation escalates — Rapid7 and Palo Alto confirm multi-victim exploitation with public PoC now available </td> <td> Attackers forge VPN cookies using publicly available HTTPS certificates. A common misconfiguration turns your VPN gateway into an open door. </td> </tr> <tr> <td> CISA adds CVE-2026-35273 to KEV catalog — CVSS 9.8, unauthenticated RCE </td> <td> Federal BOD 22-01 mandates remediation within 3 weeks. State agencies should follow the same timeline — or faster. </td> </tr> <tr> <td> HOOK SPIDER access broker updated with explicit U.S. government targeting </td> <td> This Russian-nexus actor sells stolen credentials to SCATTERED SPIDER, VICE SPIDER, and other ransomware operators. State .gov credentials in their inventory = ransomware within days. </td> </tr> <tr> <td> KRYBIT and AuditTeam ransomware groups refresh government targeting </td> <td> Two additional ransomware operations now actively listing government-public-services as a target sector. </td> </tr> <tr> <td> REVENANT SPIDER (Qilin affiliate) confirms exploitation of CVE-2026-50751 (Check Point VPN bypass) </td> <td> Direct ransomware deployment via VPN appliance confirmed June 14 — the VPN-to-ransomware pipeline is now operational across multiple exploit chains. </td> </tr> <tr> <td> Nation-state actors active across multiple fronts — China-nexus UNC5475 exploiting Cisco IOS-XE zero-days, Iran-nexus Handala/VOID MANTICORE breaching California water utilities, DPRK FAMOUS CHOLLIMA activating new C2 infrastructure </td> <td> Espionage and destructive operations are running in parallel with the criminal ransomware threat, compounding detection and response demands on state security teams. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Actor </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> May 18, 2026 </td> <td> First wave of CVE-2026-0257 exploitation from Vultr infrastructure </td> <td> Unknown (single actor, spoofed MACs) </td> <td> VPN session forgery against enterprise targets </td> </tr> <tr> <td> May 21, 2026 </td> <td> Second exploitation wave from Dromatics Systems infrastructure </td> <td> Same actor </td> <td> Expanded victim set; full internal network access confirmed </td> </tr> <tr> <td> May 29, 2026 </td> <td> Public proof-of-concept for CVE-2026-0257 published on GitHub </td> <td> N/A </td> <td> Exploitation barrier eliminated for all skill levels </td> </tr> <tr> <td> June 12, 2026 </td> <td> ShinyHunters (UNC6040) begins mass exploitation of CVE-2026-35273 </td> <td> ShinyHunters / Bling Libra </td> <td> ~100 organizations compromised including government ERP systems </td> </tr> <tr> <td> June 12, 2026 </td> <td> CISA adds CVE-2026-35273 to Known Exploited Vulnerabilities catalog </td> <td> N/A </td> <td> Federal remediation clock starts </td> </tr> <tr> <td> June 12, 2026 </td> <td> Handala / VOID MANTICORE claims California water utility breaches </td> <td> IRGC-affiliated Iranian actor </td> <td> 5 GB customer data exfiltrated from municipal water systems </td> </tr> <tr> <td> June 14, 2026 </td> <td> Qilin ransomware affiliate confirms exploitation of CVE-2026-50751 (Check Point VPN bypass) </td> <td> REVENANT SPIDER </td> <td> Direct ransomware deployment via VPN appliance </td> </tr> <tr> <td> June 14, 2026 </td> <td> KRYBIT and AuditTeam ransomware groups update targeting profiles </td> <td> Multiple </td> <td> Government-public-services explicitly added </td> </tr> <tr> <td> June 15, 2026 </td> <td> ShinyHunters posts Council of Europe breach — 297 GB, 429,000 files </td> <td> ShinyHunters / UNC6040 </td> <td> Payroll, medical records, bank details for 10,000+ employees </td> </tr> <tr> <td> June 15, 2026 </td> <td> HOOK SPIDER access broker profile refreshed with U.S. gov targeting </td> <td> HOOK SPIDER (Russia-nexus) </td> <td> Credential pipeline feeding multiple RaaS operations </td> </tr> <tr> <td> June 15, 2026 </td> <td> PAN-OS CVE-2026-0257 exploitation confirmed widening by Rapid7 MDR </td> <td> Unknown </td> <td> Multiple customers compromised via forged VPN cookies </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. Oracle PeopleSoft CVE-2026-35273 — The Government ERP Crisis </h3> CVE-2026-35273 is an unauthenticated remote code execution vulnerability in Oracle PeopleSoft PeopleTools 8.61 and 8.62, specifically in the Updates Environment Management (PSEMHUB) component. CVSS score: 9.8 Critical . No credentials required. Full system takeover. Actor: ShinyHunters (also tracked as UNC6040, Bling Libra) — a prolific data theft and extortion group that has now compromised approximately 100 organizations using this single vulnerability. Their June 15 claim against the Council of Europe demonstrates the scale: 297 GB of HR data, payroll records spanning 15 years, 14,000 CVs, bank account information, and medical records. Why state government is uniquely exposed: Oracle PeopleSoft remains the dominant ERP platform for state government HR and Finance operations. The vulnerability requires no authentication — if the PSEMHUB endpoint is network-accessible, it is exploitable. ShinyHunters has demonstrated both capability (mass exploitation) and intent (government targets) with this specific exploit chain. Critical assessment: States that have not patched are likely already compromised. ShinyHunters' demonstrated pivot from pure data theft to extortion — evidenced by the Council of Europe breach disclosure — indicates they will monetize every compromised instance. <h3> 2. PAN-OS GlobalProtect CVE-2026-0257 — Your VPN Certificate Is the Key </h3> CVE-2026-0257 is an authentication bypass in Palo Alto Networks GlobalProtect portals and gateways. The attack exploits a common configuration where the same certificate is used for both HTTPS service and cookie encryption. Attackers extract the public key from the HTTPS certificate and forge authentication cookies that grant full VPN sessions — bypassing MFA entirely. Exploitation status: Confirmed active exploitation across multiple organizations by Rapid7 MDR and Palo Alto Unit42. A public proof-of-concept has been available since May 29. CISA has added this to the KEV catalog. Indicators of compromise: Both exploitation waves used a consistent spoofed MAC address (aa:bb:cc:dd:ee:ff) and generic hostnames (GP-CLIENT, DESKTOP-GP01), suggesting automated tooling by a single sophisticated actor. Architectural lesson: This vulnerability exposes a systemic weakness — certificate reuse across authentication and transport functions. Any perimeter appliance sharing certificates between TLS termination and token encryption is vulnerable to analogous attacks. <h3> 3. The Ransomware Supply Chain Is Targeting You by Name </h3> The ransomware threat to state government is not a single actor — it is an ecosystem with specialized roles: <ul> <li> HOOK SPIDER (Russia-nexus access broker): Updated June 15 with explicit targeting of U.S. government and local government across 68 countries. Uses RedLine and Vidar infostealers to harvest credentials, then resells access to ransomware operators including SCATTERED SPIDER, VICE SPIDER, ALPHA SPIDER, and WANDERING SPIDER. </li> <li> REVENANT SPIDER (Qilin ransomware affiliate): Confirmed exploiting CVE-2026-50751 (Check Point VPN authentication bypass) for direct ransomware deployment as of June 14. </li> <li> KRYBIT : Ransomware group targeting government, energy, healthcare, financial services, and education across 28 countries. Updated June 14. </li> <li> AuditTeam : Narrowly focused ransomware group targeting government-public-services, manufacturing, and technology. Updated June 14. </li> <li> BITWISE SPIDER (LockBit): Updated June 15 with continued government targeting. </li> </ul> The timeline is compressing. The window between credential theft by access brokers and ransomware deployment by affiliates has historically been 7–14 days. With automated tooling and pre-positioned access, this window may now be as short as 48–72 hours. <h3> 4. Nation-State Activity — Persistent and Evolving </h3> <ul> <li> China-nexus (UNC5475): Active campaign exploiting Cisco IOS-XE zero-days against government networks, updated June 14. FishMonger/I-SOON espionage operations remain active. </li> <li> Iran-nexus (Handala/VOID MANTICORE): IRGC-affiliated actor claimed breach of California municipal water utility systems on June 12, exfiltrating customer data from Bakersfield, Visalia, and Chico. </li> <li> Russia-nexus: Actor abusing Slack as C2 channel for AI-assisted cloud credential theft remains active. </li> <li> DPRK (FAMOUS CHOLLIMA): New C2 infrastructure activated with updated INVISIBLEFERRET malware. </li> </ul> Notable absence: No Volt Typhoon or Salt Typhoon activity detected this cycle. Given these China-nexus actors' persistent targeting of U.S. government networks, this absence likely reflects a collection gap rather than an operational pause. State agencies should not interpret silence as safety. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Ransomware deployment against a U.S. state agency via PeopleSoft or VPN exploit </td> <td> HIGH (75–85%) </td> <td> Next 30 days </td> <td> ShinyHunters mass exploitation + HOOK SPIDER credential sales + multiple RaaS groups refreshing gov targeting simultaneously </td> </tr> <tr> <td> Additional state PeopleSoft instances discovered already compromised </td> <td> HIGH (70–80%) </td> <td> Next 14 days </td> <td> ~100 orgs already hit; unauthenticated RCE with no detection in many environments </td> </tr> <tr> <td> CVE-2026-0257 exploitation by ransomware affiliates (not just initial access actors) </td> <td> MODERATE-HIGH (60–70%) </td> <td> Next 21 days </td> <td> Public PoC available; Qilin already exploiting similar VPN bypass (Check Point); VPN access = direct path to ransomware deployment </td> </tr> <tr> <td> Iranian hacktivist operation against additional U.S. water/wastewater utilities </td> <td> MODERATE (50–60%) </td> <td> Next 30 days </td> <td> Handala/VOID MANTICORE demonstrated capability and intent; water sector OT security remains weak </td> </tr> <tr> <td> Credential-based intrusion at a state agency via infostealer logs sold by HOOK SPIDER </td> <td> MODERATE (45–55%) </td> <td> Next 14 days </td> <td> HOOK SPIDER explicitly targeting U.S. gov; RedLine/Vidar campaigns ongoing; state agencies often lack stealer log monitoring </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Hunt Hypotheses </h3> Hypothesis 1: CVE-2026-0257 exploitation against GlobalProtect <ul> <li> What to look for: VPN authentication events with MAC address aa:bb:cc:dd:ee:ff or 00:11:22:33:44:55; hostnames GP-CLIENT, DESKTOP-GP01, or WINDOWS-LAPTOP-001; empty domain field for source user; connections from IPs listed in the IOC table below </li> <li> ATT&CK: T1133 (External Remote Services), T1556.006 (Modify Authentication Process: MFA), T1078 (Valid Accounts) </li> <li> Log sources: GlobalProtect authentication logs, PAN-OS system logs, firewall connection logs </li> <li> Lookback period: May 17, 2026 to present (first exploitation wave began May 18) </li> </ul> Hypothesis 2: PeopleSoft PSEMHUB exploitation <ul> <li> What to look for: Unexpected HTTP requests to PeopleSoft Updates Environment Management endpoints from external IPs; new admin accounts created in PeopleSoft; unusual data export volumes from HR/Finance modules </li> <li> ATT&CK: T1190 (Exploit Public-Facing Application), T1059.003 (Windows Command Shell), T1530 (Data from Cloud Storage Object) </li> <li> Log sources: PeopleSoft application logs, web server access logs, database audit logs, DLP alerts </li> <li> Lookback period: June 10, 2026 to present </li> </ul> Hypothesis 3: Infostealer-sourced credential abuse <ul> <li> What to look for: Logins from unusual geographic locations or new devices for state employee accounts; MFA fatigue attacks (repeated push notifications); VPN connections from residential ISPs not matching employee home locations </li> <li> ATT&CK: T1078 (Valid Accounts), T1589.001 (Gather Victim Identity: Credentials), T1555 (Credentials from Password Stores) </li> <li> Log sources: Azure AD sign-in logs, Conditional Access policy violations, VPN authentication logs </li> </ul> <h3> Detection Rules to Deploy </h3> <table> <thead> <tr> <th> Priority </th> <th> Rule Description </th> <th> ATT&CK </th> <th> Data Source </th> </tr> </thead> <tbody> <tr> <td> IMMEDIATE </td> <td> Alert on GlobalProtect auth with known-bad MACs or hostnames </td> <td> T1133, T1556.006 </td> <td> PAN-OS auth logs </td> </tr> <tr> <td> IMMEDIATE </td> <td> Block/alert on connections to CVE-2026-0257 exploitation IPs </td> <td> T1071 </td> <td> Firewall logs </td> </tr> <tr> <td> 7-DAY </td> <td> Anomalous PeopleSoft PSEMHUB endpoint access from external IPs </td> <td> T1190 </td> <td> WAF / web server logs </td> </tr> <tr> <td> 7-DAY </td> <td> New admin account creation in PeopleSoft outside change windows </td> <td> T1136 </td> <td> Application audit logs </td> </tr> <tr> <td> 7-DAY </td> <td> Bulk data export from HR/Finance modules exceeding baseline </td> <td> T1567 </td> <td> DLP / database audit </td> </tr> <tr> <td> 30-DAY </td> <td> Certificate reuse detection across perimeter appliances </td> <td> T1556.006 </td> <td> Certificate inventory </td> </tr> </tbody> </table> <h2> IOC Blocking Table </h2> The following indicators are associated with confirmed CVE-2026-0257 (PAN-OS GlobalProtect) exploitation campaigns. Block at perimeter and hunt in historical logs back to May 17, 2026. <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> IPv4 </td> <td> 23.128.228[.]6 </td> <td> CVE-2026-0257 exploitation infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 104.207.144[.]154 </td> <td> CVE-2026-0257 exploitation infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 146.19.216[.]119 </td> <td> CVE-2026-0257 exploitation infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 146.19.216[.]120 </td> <td> CVE-2026-0257 exploitation infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 146.19.216[.]125 </td> <td> CVE-2026-0257 exploitation infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 179.43.172[.]213 </td> <td> CVE-2026-0257 exploitation infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 185.195.232[.]139 </td> <td> CVE-2026-0257 exploitation infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 198.12.106[.]60 </td> <td> CVE-2026-0257 exploitation infrastructure </td> </tr> <tr> <td> IPv4 </td> <td> 202.144.192[.]47 </td> <td> CVE-2026-0257 exploitation infrastructure </td> </tr> </tbody> </table> Additional IOCs (file hashes associated with APT campaigns and malware delivery) are available via Anomali ThreatStream Next-Gen and partner feeds. <h2> Sector-Specific Defensive Priorities </h2> <h3> Government (State & Local Agencies) </h3> <ul> <li> Priority 1: Patch or isolate Oracle PeopleSoft 8.61/8.62 PSEMHUB endpoints immediately. If patching requires a maintenance window, restrict PSEMHUB network access to internal-only as an interim control. </li> <li> Priority 2: Audit GlobalProtect configuration for certificate sharing between HTTPS and cookie encryption. Apply dedicated cookie encryption certificate. </li> <li> Priority 3: Conduct credential exposure check against infostealer log marketplaces (Hudson Rock, Flare, SpyCloud) for all state .gov email domains. Any matches indicate pre-ransomware positioning. </li> <li> Priority 4: Verify backup integrity and test restoration procedures for critical systems (PeopleSoft, Active Directory, financial applications). Ransomware deployment probability is elevated. </li> </ul> <h3> Financial Services (State Treasury, Tax, Revenue) </h3> <ul> <li> Priority 1: Monitor for SAMBA SPIDER / Mispadu banking trojan delivery targeting financial processing systems. Fresh samples identified June 15. </li> <li> Priority 2: Implement enhanced transaction monitoring for state payment systems during the elevated threat period. </li> <li> Priority 3: Review API security for tax filing and revenue collection portals — PeopleSoft Finance modules are confirmed targets. </li> <li> Priority 4: Ensure wire transfer and ACH payment authorization requires out-of-band verification during elevated threat periods. </li> </ul> <h3> Energy (State-Regulated Utilities, Grid Operations) </h3> <ul> <li> Priority 1: Coordinate with utility partners on ICS advisory applicability for Schneider Electric EcoStruxure Panel Server, Modicon Network Managed Switches, and KACO Blueplanet Inverters. </li> <li> Priority 2: Review network segmentation between IT and OT environments. Iranian-nexus actors (Handala/VOID MANTICORE) have demonstrated capability against water utility SCADA systems. </li> <li> Priority 3: Audit remote access to OT environments — VPN vulnerabilities (CVE-2026-0257, CVE-2026-50751) could provide lateral movement paths to operational technology. </li> <li> Priority 4: Verify that safety instrumented systems (SIS) are air-gapped from enterprise networks. </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Priority 1: PeopleSoft HR systems containing employee health records and benefits data are confirmed targets. Apply CVE-2026-35273 patch with urgency — ShinyHunters specifically exfiltrated medical records from the Council of Europe. </li> <li> Priority 2: KRYBIT ransomware explicitly targets healthcare. Verify endpoint detection coverage across clinical and administrative systems. </li> <li> Priority 3: Review data loss prevention controls on systems containing Protected Health Information (PHI). Exfiltration-before-encryption is the dominant ransomware model. </li> <li> Priority 4: Ensure HIPAA breach notification procedures are current and tested — probability of a reportable incident is elevated. </li> </ul> <h3> Aviation & Logistics (State DOT, Port Authorities, Transit) </h3> <ul> <li> Priority 1: Transportation management systems often rely on network infrastructure (Cisco, Palo Alto) vulnerable to the exploits discussed. Audit VPN and router configurations. </li> <li> Priority 2: Supply chain compromise risk is elevated — HOOK SPIDER targets technology vendors that may serve as managed service providers to transit agencies. </li> <li> Priority 3: Review physical security system network connectivity. IP cameras (Brickcom vulnerabilities noted in ICS advisories) connected to state networks represent lateral movement opportunities. </li> <li> Priority 4: Ensure continuity of operations plans account for ransomware scenarios affecting traffic management and transit scheduling systems. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Next 24–48 Hours) </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Block all 9 CVE-2026-0257 exploitation IPs at perimeter firewall and hunt in GlobalProtect logs back to May 17 </td> <td> SOC </td> <td> Confirmed exploitation infrastructure; historical compromise possible </td> </tr> <tr> <td> Verify PAN-OS GlobalProtect certificate configuration — if cookie encryption certificate is shared with HTTPS service, generate dedicated certificate or disable auth override cookies </td> <td> Network Operations </td> <td> This misconfiguration is the root cause enabling CVE-2026-0257 exploitation </td> </tr> <tr> <td> Confirm Oracle PeopleSoft CVE-2026-35273 patch status; if unpatched, restrict PSEMHUB endpoint to internal-only access </td> <td> Application Operations </td> <td> CVSS 9.8, CISA KEV, confirmed mass exploitation by ShinyHunters </td> </tr> <tr> <td> Activate incident response retainer and brief IR team on PeopleSoft and GlobalProtect exploitation indicators </td> <td> CISO / IR Lead </td> <td> Probability of discovering existing compromise during hunting is significant </td> </tr> <tr> <td> Validate offline backup integrity for PeopleSoft, Active Directory, and financial systems </td> <td> IT Operations </td> <td> Ransomware deployment probability elevated; recovery capability is the last line of defense </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Deploy SOC detection rules for GlobalProtect spoofed MAC/hostname patterns and PeopleSoft anomalous access </td> <td> SOC Engineering </td> <td> Convert threat intelligence into automated detection </td> </tr> <tr> <td> Conduct credential exposure audit against infostealer log marketplaces for all state .gov domains </td> <td> Identity & Access Management </td> <td> HOOK SPIDER actively harvesting and reselling government credentials </td> </tr> <tr> <td> Coordinate with utility partners on Schneider Electric / Modicon / KACO ICS advisory patch status </td> <td> OT Security / CISO </td> <td> Iranian-nexus actors demonstrated capability against water infrastructure </td> </tr> <tr> <td> Review and harden Cisco IOS-XE configurations against China-nexus UNC5475 zero-day campaign </td> <td> Network Operations </td> <td> Active campaign targeting government network infrastructure </td> </tr> <tr> <td> Brief agency heads on elevated ransomware threat and verify cyber insurance coverage and notification procedures </td> <td> CISO / Legal </td> <td> Executive preparedness for probable incident </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Action </th> <th> Owner </th> <th> Rationale </th> </tr> </thead> <tbody> <tr> <td> Implement enterprise-wide certificate separation policy — no shared certificates between TLS and authentication functions on any perimeter appliance </td> <td> Enterprise Architecture </td> <td> Architectural weakness enabled CVE-2026-0257; same pattern exists on other platforms </td> </tr> <tr> <td> Deploy infostealer log monitoring as continuous capability (not one-time audit) </td> <td> Identity & Access Management </td> <td> Access broker → ransomware pipeline is accelerating; continuous monitoring catches new exposures </td> </tr> <tr> <td> Conduct tabletop exercise simulating simultaneous PeopleSoft data breach and ransomware deployment </td> <td> CISO / IR / Executive Team </td> <td> Test organizational response to the most probable attack scenario </td> </tr> <tr> <td> Evaluate redundant threat intelligence collection sources to eliminate single-point-of-failure in monitoring </td> <td> CTI / CISO </td> <td> Intelligence collection gaps create blind spots that adversaries exploit </td> </tr> <tr> <td> Audit all state agency VPN configurations against a hardened baseline (certificate hygiene, MFA enforcement, session controls) </td> <td> Network Operations / Security Architecture </td> <td> VPN appliances are the #1 initial access vector for both espionage and ransomware actors in 2026 </td> </tr> </tbody> </table> <h2> Bottom Line </h2> The threat landscape facing state government IT has shifted from theoretical risk to confirmed active exploitation. ShinyHunters is inside PeopleSoft environments now . CVE-2026-0257 exploitation has a public proof-of-concept and confirmed victims. Access brokers are explicitly advertising U.S. government credentials to ransomware operators. The decisions made in the next 48 hours — whether to approve emergency patching windows, whether to fund credential exposure audits, whether to activate incident response capabilities — will determine whether your state is reading about the next government breach or responding to one. Patch. Hunt. Verify your backups. Brief your governor's office. The clock is running. Anomali CTI Desk | 2026-06-15 For IOC feeds, detection content, and actor tracking dashboards, contact your Anomali representative or access indicators directly via Anomali ThreatStream Next-Gen.

FEATURED RESOURCES

June 15, 2026

Anomali Cyber Watch

Iran's Cyber War Machine Isn't Stopping for Peace Talks: What CISOs Need to Know Now

June 15, 2026

Anomali Cyber Watch

Public Sector

When Your VPN Becomes the Front Door: Critical Exploits Targeting State Government Systems

June 12, 2026

Anomali Cyber Watch

Iran's Cyber Offensive Enters a Dangerous New Phase: What CISOs Must Know on Day 104

Explore All