Skip to main content
TLP:GREEN  ·  States / Public Sector
AI Weaponized, Atlassian Exploited:

State Government Networks Under Siege

ELEVATED, trending toward HIGH. Confirmed in-the-wild exploitation of Atlassian CVE-2026-21589 across eight Data Center products, convergence of three independent reports confirming AI is now operationally weaponized in cyberattacks, and persistent unpatched risk from the ShinyHunters PeopleSoft campaign despite leadership arrests. The window between disclosure and exploitation was less than 48 hours for the Atlassian flaw.

I am a
My sector

DevelopmentSignificance
Atlassian CVE-2026-21589...All eight Atlassian Data Center...
ShinyHunters leader Rey...Arrests don't eliminate risk - the...
AI confirmed as an active...Represents a phase transition from...
FortiMail CVE-2026-104286...High-value target for intercepting...
Wazza phishing-as-a-service...Most state Conditional Access...
Six new CISA ICS...Directly relevant to state...
LockBit 5.0 remains...Makes the Atlassian and FortiMail...

DateEventImpact
Sep 15ShinyHunters member "Umbreon"...Partial disruption of ShinyHunters...
Sep 24Arizona court employee clicks...1.3M records stolen including 30...
Oct 1CISA adds FortiMail CVE-2026-104286...Unauthenticated arbitrary file...
Oct 5Atlassian discloses CVE-2026-21589...Arbitrary file read affecting...
Oct 6WatchTowr publishes exploitation...Credential theft → Jira admin...
Oct 6CISA publishes 6 ICS advisories...Building automation and utility...
Oct 7VulnCheck confirms active...In-the-wild exploitation confirmed
Oct 7ShinyHunters leader "Rey" detained...Leadership disrupted but exploit...
Oct 7CrowdStrike reports Chinese actor...AI-assisted offensive operations...
Oct 7Arizona court breach publicly...State judiciary data exposure...
Oct 8Cisco Talos documents 84 malware...Four malware families (FRUITSHELL...
Oct 8Black Lotus Labs discloses PoeLLM...LiteLLM, Ollama, Gotenberg, Gitea...
Oct 8Congressional analysis urges PQC...White House PQC timeline: key...

The most urgent technical threat this cycle - an arbitrary file access vulnerability in the shared atlassian-plugins-webresource library affecting all eight self-hosted Data Center products simultaneously, no authentication required. WatchTowr's demonstrated chain: read crowd.properties for database credentials, authenticate as Jira admin using...

T1190T1552.001T1078.004T1083

ShinyHunters mass-exploited CVE-2026-35273 (CVSS 9.8) across government, healthcare, and education, with a documented WAF bypass circumventing standard Mandiant-recommended mitigations. Leadership arrests (Amman, Jordan and Netherlands) are positive but don't resolve risk: the exploit is fully public, the WAF bypass is documented, and the FBI's...

T1190T1059T1041T1070

ARTEX + Claude: a Chinese actor used agentic AI pentesting powered by Claude for production attacks against South Korean banks - not a proof-of-concept. AI-Analysis Evasion: 84 malware samples (FRUITSHELL, PLOTSAFE, HOLLOWCLAD, MANTLEMAZE) embed instructions to defeat AI-based malware analysis...

T1190T1102T1496

Wazza uses Microsoft's Device Code authentication flow instead of password theft - the victim enters a code on a legitimate Microsoft login page, and the attacker receives a valid OAuth token that bypasses MFA entirely. Multi-stage delivery: wildcard domains to config API to anti-bot validation to session token minting. Government, banking, and...

T1566.002T1528T1539

Six CISA ICS advisories affect Hitachi Energy (REB500, Asset Suite, SOI, RTU500 - the latter EOL with no patches) and Johnson Controls EasyIO. Separately, congressional analysis urges states to begin post-quantum cryptography readiness given the White House's 2030/2031 PQC timeline and active harvest-now-decrypt-later threats against...

T1190

ProbabilityPredicted EventBasis
HIGH (>70%)Additional exploitation of...Active exploitation confirmed by...
MODERATE-HIGH (50-70%)...Copycat exploitation of PeopleSoft...Exploit code and WAF bypass fully...
MODERATE (40-60%)Wazza or similar Device Code...Government is a named target...
MODERATE (40-60%)LockBit 5.0 or Qilin weaponize a...Historical pattern: 48–72 hour...
LOW-MODERATE (25-40%)...PoeLLM botnet expands targeting to...Campaign has been active since...

1. Atlassian CVE-2026-21589 Exploitation (CRITICAL):

Monitor: Web...

2. Device Code OAuth Phishing (HIGH):

Monitor: Azure...

3. PeopleSoft Exploitation Indicators (HIGH):

Monitor:...

4. AI Infrastructure Exposure (MODERATE-HIGH):

Monitor: Network...

5. Living-off-the-Land (Volt Typhoon / Salt Typhoon Posture):

Monitor:...

ThreatATT&CK
1. Atlassian CVE-2026-21589...T1552.001...
2. Device Code OAuth Phishing...T1528 T1566.002...
3. PeopleSoft Exploitation...T1059 T1041...
4. AI Infrastructure Exposure...T1102 T1190...
5. Living-off-the-Land (Volt...T1078 T1072...
IOC Blocking Table:
5.78.73[.]122boegl-krysl[.]eucheck[.]boegl-krysl[.]eu*workers[.]dev (pattern)

Block the above at perimeter...

Hunting Hypotheses:
HUNT 01
1. Atlassian CVE-2026-21589 Exploitation (CRITICAL)
"An attacker has exploited CVE-2026-21589 to read Crowd credentials and is now authenticating to Jira as an administrator from an unusual source IP" — search for new admin sessions in Jira audit logs that correlate with file access anomalies in Crowd
HUNT 02
2. Device Code OAuth Phishing (HIGH)
"A user was socially engineered into entering a Device Code on a legitimate Microsoft page, granting an attacker a persistent OAuth token" — correlate Device Code sign-ins with phishing email delivery within the preceding 30 minutes
HUNT 03
3. PeopleSoft Exploitation Indicators (HIGH)
"A copycat actor has exploited CVE-2026-35273 using the published WAF bypass to deploy a webshell on our PeopleSoft instance" — search for URL-encoded double-dot sequences in WAF logs that may have bypassed existing rules
HUNT 04
4. AI Infrastructure Exposure (MODERATE-HIGH)
"An internally deployed LiteLLM or Ollama instance has been compromised by PoeLLM and is now mining cryptocurrency" — search for XMRig or Kryptex process names, unusual CPU utilization spikes on AI/ML servers, and outbound connections to mining pools
HUNT 05
5. Living-off-the-Land (Volt Typhoon / Salt Typhoon Posture)
"A pre-positioned Chinese APT actor is using valid credentials and native tools to move laterally through our network without triggering signature-based detection" — baseline normal administrative tool usage and alert on deviations

Financial Services
Treasury, Revenue, Benefits
Primary threat
ARTEX+Claude demonstrates production-ready AI-powered banking attacks; Wazza explicitly names...
Actions
  • Ensure fraud detection accounts for AI-generated social engineering; implement Device Code restrictions for treasury M365 access
Energy
Hitachi Energy, Johnson Controls
Primary threat
October 6 CISA advisories directly affect utility SCADA; RTU500 EOL status requires replacement...
Actions
  • Patch Hitachi Energy ICS systems; verify AI/automation tools (LiteLLM, Ollama, Gitea) aren't internet-exposed in OT environments
Healthcare
Medicaid PeopleSoft
Primary threat
ShinyHunters confirmed healthcare as a target sector; patient health information carries indefinite...
Actions
  • Audit Medicaid/health agency PeopleSoft for exploitation indicators; ensure Veeam backups are patched and air-gapped
Government
PeopleSoft, Atlassian, M365
Primary threat
PeopleSoft is highest-risk; M365 tenants need Device Code restrictions; self-hosted Atlassian...
Actions
  • Verify PeopleSoft patching and WAF URL-encoding bypass coverage; block Device Code flow in Conditional Access
Aviation / Logistics
DOT, Transit Authorities
Primary threat
Johnson Controls EasyIO affects transit/DOT building automation; ShinyHunters extorted Jeppesen...
Actions
  • Verify Johnson Controls exposure in transit facilities; apply the same PeopleSoft/Atlassian scrutiny used elsewhere
No sector cards match the selected filters.

Patch all Atlassian Data Center products for CVE-2026-21589...
Incident Responder
Verify FortiMail is patched for CVE-2026-104286...
Incident Responder
Block Device Code authentication flow in Azure AD/Entra ID...
SOC AnalystIAM Analyst
Deploy IOC blocklists: domains boegl-krysl[.]eu...
SOC Analyst
No immediate actions for the selected roles.
Audit all PeopleSoft instances for CVE-2026-35273 indicators...
Incident Responder
Implement detection for LiteLLM/Ollama exposure on...
SOC Analyst
Review Infoblox NIOS for CVE-2026-107510 privilege escalation.
Incident Responder
Deploy detection for AI-analysis evasion strings in malware...
SOC Analyst
No 7-day actions for the selected roles.
Initiate a post-quantum cryptography readiness assessment for...
CISO / Exec
Commission a PeopleSoft security architecture review - treat...
CISO / Exec
Develop an AI security governance framework requiring threat...
CISO / Exec
Update IR playbooks for Atlassian credential-chain attacks and...
Incident Responder
No 30-day actions for the selected roles.
The Bottom Line

The threat landscape facing state government IT this week combines critical vulnerabilities under active exploitation (Atlassian, PeopleSoft, FortiMail), a new MFA-bypassing phishing class (Device Code flow), and confirmed operational AI weaponization. The arrests of ShinyHunters leadership are welcome but don't reduce technical risk - the exploits are public, the attack surface is mapped, and copycat actors will fill the vacuum. Three decisions this week: confirm your Atlassian and PeopleSoft...

1
Confirm Atlassian and PeopleSoft patching status today.
2
Block Device Code authentication in your M365 tenant.
3
Find your AI services before attackers do.
No items found.