| Development | Details |
|---|---|
| FortiOS CVE-2025-25249 added to CISA KEV (Sep 9). Heap-based buffer overflow enabling RCE; PivotC2 RAT observed post-exploitation. CVSS 8.1. | 178 FortiGate devices already confirmed infected |
| MikroTik RouterOS CVE-2026-67277 added to CISA KEV (Sep 10). Unauthenticated bandwidth-test flaw allows memory disclosure/kernel restart. CERT.PL confirms active exploitation. | Affects RouterOS 6.x/7.x branches |
| SloppyRAT disclosed by Zscaler (Sep 11). New RAT via ClickFix, purpose-built for ransomware lateral movement - Defender manipulation, reverse SOCKS proxy, Polygon C2 fallback. | Same delivery used by espionage actor UNC6924 |
| KATARU IoT botnet disclosed by Nozomi Networks (Sep 11). Brute-forces Telnet then escalates to root via 3 Linux kernel exploits. | Affects Linux servers, not just IoT devices |
| 3 CISA ICS advisories (Sep 10) covering AVEVA, Orthanc DICOM, and NextGen Mirth Connect. | State pipeline, hospital, Medicaid systems |
| Storm-3121/Storm-3032 M365 vishing confirmed active (Sep 9-10). Passkey-themed vishing targeting personal devices to pivot into M365 tenants. | Both clusters active against state M365 environments |
| Date | Event | Severity | State Gov Relevance |
|---|---|---|---|
| May 2026 (ongoing) | Storm-3121 / Storm-3032 begin passkey-themed vishing against M365 users | HIGH | State M365/Entra ID tenants are targets |
| Sep 9, 2026 | CISA adds CVE-2025-25249 (FortiOS) to KEV; 178 U.S. FortiGate devices confirmed infected with PivotC2 RAT | CRITICAL | Direct exposure if state FortiGates unpatched |
| Sep 10, 2026 | CISA adds CVE-2026-67277 (MikroTik) to KEV; CERT.PL confirms active exploitation | HIGH | MikroTik deployed in branch/remote offices |
| Sep 10, 2026 | CISA publishes ICS advisories for AVEVA, Orthanc DICOM, NextGen Mirth Connect | HIGH | State utilities, hospitals, health IT |
| Sep 11, 2026 | Zscaler publishes SloppyRAT analysis - ClickFix-delivered ransomware pre-positioning tool | HIGH | ClickFix bypasses email security; targets all sectors |
| Sep 11, 2026 | Nozomi Networks publishes KATARU botnet analysis - Linux kernel LPE weaponization | MODERATE | State Linux servers and OT-adjacent devices exposed |
CVE-2025-25249 (FortiOS) heap overflow enables RCE. PivotC2 RAT confirmed post-exploitation tooling; 178 devices already infected.
CVE-2026-67277 (MikroTik) allows unauthenticated memory disclosure/kernel restart. CERT.PL confirms active exploitation.
Perimeter exploitation is accelerating across vendors - a rolling patch emergency.
SloppyRAT's delivery chain abuses legitimate binaries: finger.exe (TCP 79) initiates download, renames curl.exe to a numeric .com file, IronPython executes CastleLoader/CastleRAT, then SloppyRAT loads reflectively in memory. It modifies Defender and deploys a reverse SOCKS proxy - ransomware pre-positioning.
Convergence risk: the same delivery was previously used by espionage actor UNC6924.
KATARU weaponizes 3 Linux kernel privesc CVEs: Dirty Frag (8.8), Fragnesia (7.8), Copy Fail (7.8, KEV) - affecting standard Linux kernels, not just IoT. State Linux servers in OT-adjacent environments (SCADA, building automation) share the exposure. ARM samples show broken shellcode, but ported variants are expected soon. Encrypted C2 and persistence across 12+ init systems make remediation hard.
| Actor | Status |
|---|---|
| Volt/Salt Typhoon (China) | Pre-positioned; silence likely a collection gap |
| CyberAv3ngers (Iran) | Water/pipeline targeting continues |
| APT15/Mirage (China) | Fresh gov/healthcare hashes |
| Storm-3121/3032 (Criminal) | Active M365 passkey vishing |
| APT28/29/41 | Updated activity Sep 10-11 |
| Scenario | Probability | Basis |
|---|---|---|
| Additional exploitation of FortiOS CVE-2025-25249 against state FortiGate devices | HIGH (>70%) | PivotC2 RAT already in the wild; 178 devices confirmed compromised |
| SloppyRAT attributed to a named ransomware group (e.g., Rhysida, SafePay) | MODERATE (40-60%) | Purpose-built tooling rarely stays unattributed |
| ClickFix delivery adopted by additional threat actors beyond UNC6924/SloppyRAT | MODERATE (40-60%) | Technique is proving effective; low barrier to adoption |
| KATARU derivative with correctly ported architecture-specific LPE exploits | MODERATE (40-60%) | Current ARM binary broken; fix is trivial |
| Ransomware incident against a U.S. state/local government entity | MODERATE (40-60%) | Rhysida/SafePay active; SloppyRAT adds a new vector |
| Volt Typhoon or Salt Typhoon activity surfaces in public reporting | LOW-MODERATE (25-40%) | Absence likely a collection gap |
Alert on finger.exe outbound (TCP 79) - zero legitimate use in state gov; curl.exe renamed to numeric .com; IronPython/Python from user-writable paths; spoofed explorer.exe parent; reflective DLL loading; unauthorized SOCKS proxy connections.
Monitor for unexpected admin accounts, modified firewall rules, new VPN tunnels; anomalous outbound connections; syslog gaps. Verify firmware integrity.
Monitor unexpected bandwidth-test (btest) traffic; unscheduled reboots; SSH from IOC IPs; new/modified user accounts.
Monitor Telnet brute-force (especially OT-adjacent); unexpected privesc events; new systemd/cron/udev entries outside change management.
Monitor M365 sign-ins from unusual locations/devices following vishing reports; unrequested passkey/MFA registrations; Conditional Access bypass attempts.
| Threat | ATT&CK |
|---|---|
| P1: ClickFix Delivery Chain | T1218 T1036 T1059.006 T1090.003 |
| P2: FortiGate Post-Exploitation | T1190 T1219 T1070 |
| P3: MikroTik Exploitation | T1078 |
| P4: Linux Kernel LPE | T1110.001 T1068 T1543.002 |
| P5: M365 Identity Hijacking | T1078.004 |
Block above at perimeter/DNS. SHA-256 hashes via Anomali ThreatStream Next-Gen.
- Block finger.exe execution; restrict Python/IronPython in user dirs
- Inventory AVEVA deployments; segment from enterprise IT
- Patch Orthanc DICOM and Mirth Connect; verify offline backups
- Emergency FortiOS patching is the top priority
- Inventory MikroTik devices; prioritize firmware updates
The threat landscape facing state government networks is defined by a single reality: the perimeter is under simultaneous attack from multiple directions. FortiGate firewalls, MikroTik routers, Linux servers, IoT devices, and M365 identities all face active exploitation at the same time. The good news: the most impactful actions are also the most straightforward - patch FortiOS and MikroTik today, block TCP port 79, deploy ClickFix detection, and audit Linux kernel versions on OT-adjacent systems. ClickFix deserves particular attention - it bypasses email security entirely by tricking users into executing commands themselves. No attachment to scan, no link to block. The defense is user awareness plus technical controls, and both are needed.