| Date | Development | Why It Matters for State Government |
|---|---|---|
| Sep 9 | CISA adds CVE-2026-20079 (Cisco FMC, CVSS 10.0), CVE-2026-19490 (Citrix, CVSS 9.3), CVE-2025-25249 (Fortinet, CVSS 8.1) to KEV | Three perimeter vendors, one KEV update, Sep 12 deadline |
| Sep 9 | Chrome V8 zero-day CVE-2026-87491 added to KEV | Drive-by code execution; every unpatched Chrome browser is a target |
| Sep 9–10 | Microsoft discloses Storm-3121/3032 passkey vishing campaign | ShinyHunters/Helix-linked actors hijacking M365 identities via personal-phone vishing |
| Sep 10 | Barracuda discloses blob URL phishing technique | No persistent URL — invisible to gateways, proxies, sandboxes |
| Sep 10 | CVE-2026-58138 (Orkes Conductor, CVSS 9.8) under mass exploitation | 1,290 attacks/24h; public exploit; critical for any agency/MSP running Conductor |
| Continuing | PivotC2 RAT actively deploying on U.S. FortiGate devices | 178 U.S. devices confirmed infected via CVE-2025-25249 |
| Date | Event | Actor / CVE | Impact |
|---|---|---|---|
| Jul 2026 | Earliest CVE-2025-25249 (FortiOS) exploitation begins | Russian-speaking financial actor | PivotC2 deployment begins; 3,000+ IPs targeted |
| May 2026 | Storm-3121/3032 passkey vishing campaign begins | Storm-3121 (ShinyHunters), Storm-3032 (Helix) | M365 identity theft, cloud exfiltration at scale |
| Aug 2026 | CVE-2026-20079 (Cisco FMC) exploitation confirmed | Fire Ant (China-nexus) | Root access on Cisco FMC; routers used as collection platforms |
| Sep 3 | CVE-2026-19490 (Citrix NetScaler) exploitation begins | Unattributed | 56 attempts observed; accelerating daily |
| Sep 8 | PoisonedRefresh rootkit disclosed on F5 BIG-IP | Unattributed | ~795 exposed endpoints; fileless, firmware-persistent |
| Sep 8 | NSA/CISA/FBI advisory on Chinese AI IP theft | DeepSeek, Alibaba, Moonshot AI | Strategic espionage concern |
| Sep 9 | Microsoft Patch Tuesday: 964 CVEs, 2 zero-days | Unattributed | CVE-2026-81963/85880 — SYSTEM-level privilege escalation |
| Sep 9 | CISA KEV: Cisco FMC, Citrix NetScaler, Fortinet, Chrome V8 | Multiple actors | Four critical CVEs, Sep 12 federal patch deadline |
| Sep 9–10 | Microsoft discloses Storm-3121/3032 vishing campaign | Storm-3121, Storm-3032 | 7 IOC domains; active M365 identity hijacking |
| Sep 10 | Blob URL phishing technique disclosed | Unattributed | Novel evasion defeats URL-based scanning |
| Sep 10 | CVE-2026-58138 (Orkes Conductor) mass exploitation | Unattributed | 1,290 attacks/day; CVSS 9.8 unauthenticated RCE |
Three perimeter vendors — Cisco, Citrix, Fortinet — landed on CISA KEV the same day.
| CVE | Product | CVSS |
|---|---|---|
| CVE-2026-20079 | Cisco FMC | 10.0 |
| CVE-2026-19490 | Citrix NetScaler | 9.3 |
| CVE-2025-25249 | Fortinet FortiOS | 8.1 |
CVE-2025-25249 is weaponized as PivotC2 RAT; 178 U.S. devices infected. Fire Ant (China-nexus) is exploiting Cisco IOS XR as collection platforms.
Storm-3121 (ShinyHunters) and Storm-3032 (Helix) run an M365 identity pipeline active since May: vishing to a personal phone → fake passkey portal → AiTM capture → new MFA registered → Graph API recon → controlled exfiltration, outside EDR/MDM visibility.
Barracuda disclosed blob URL phishing: pages render entirely in browser memory, invisible to gateways/proxies/sandboxes. DocuSign-themed lures are ubiquitous in state procurement.
CVE-2026-87491 is a Chrome V8 out-of-bounds write enabling drive-by code execution. Fixed in 153.0.8010.36+.
CVE-2026-58138 (CVSS 9.8) allows unauthenticated RCE on Orkes Conductor. 1,290 attacks blocked in 24h (+132%); public PoC available.
| Scenario | Probability | Basis |
|---|---|---|
| FortiGate compromise (CVE-2025-25249) → PivotC2 → lateral movement into agency networks | HIGH (>75%) | 178 devices already infected; state agencies are known Fortinet customers |
| M365 hijack via Storm-3121/3032 → exfiltration → extortion demand | HIGH (70–80%) | Active since May; targets personal devices outside MDM; ShinyHunters link |
| Drive-by compromise via CVE-2026-87491 (Chrome V8) | MODERATE-HIGH (50–65%) | Actively exploited zero-day; fleet update lag creates exposure |
| Blob URL phishing vs. state procurement/finance via DocuSign lures | MODERATE (40–55%) | DocuSign ubiquitous in gov procurement; defeats current defenses |
| Ransomware following identity compromise (ShinyHunters/Falcon) | MODERATE (40–50%) | Identity-to-extortion pipeline is a logical next step |
| China-nexus exploitation of Cisco IOS XR backbone routers | MODERATE (35–50%) | Fire Ant confirmed; Volt Typhoon pattern consistent |
| OT/ICS targeting of water SCADA via CyberAv3ngers | LOW-MODERATE (20–35%) | Remains active; absence ≠ reassurance |
Storm-3121/3032 Passkey Vishing — Identity Compromise Detection:
| ATT&CK | Detection Logic | Data Source |
|---|---|---|
| T1566.004 | Help desk impersonation correlated with MFA registration <1hr | User reports, Entra ID |
| T1098.005 | New MFA method from non-corporate IP/geolocation | Entra ID audit logs |
| T1528 | Device-code OAuth flows from unexpected user agents | Entra ID sign-in logs |
| T1087.004 | Rapid Graph API calls to /users, /groups, /directoryRoles | Graph API audit logs |
| T1530 | Bulk SharePoint/OneDrive access (>100 files/hr) | Defender for Cloud Apps |
FortiGate PivotC2 Compromise Detection:
| ATT&CK | Detection Logic | Data Source |
|---|---|---|
| T1190 | Anomalous HTTP to mgmt interfaces from external IPs | FortiGate/web filter logs |
| T1059.007 | Node.js process execution on appliances | FortiGate CLI audit |
| T1573 | Outbound TLS from mgmt to non-Fortinet IPs | Network flow, egress logs |
| T1005 | Config export/credential access outside backup windows | FortiGate config audit |
Blob URL Phishing Detection:
| ATT&CK | Detection Logic | Data Source |
|---|---|---|
| T1566.002 | Calendar-invite emails with OAuth/Teams redirects | Email gateway |
| T1204.001 | blob: URL generation in Chrome auth contexts | Chrome telemetry |
| T1102 | Service-worker registrations tied to cdn.bloom[.]io | Proxy logs |
IOC Blocking Table:
passkeyhelpdesk[.]comsecure-passkey[.]comsetupmypasskey[.]comadd-passkey[.]comintegratedsso[.]comoktasession[.]comkeysyncos[.]comcdn.bloom[.]io
Block the above at perimeter firewalls, proxies, and DNS. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
Hunting Hypotheses:
HUNT 01 · T1098.005
Storm-3121/3032 identity compromise
Expect: a new MFA registration from a non-corporate IP within 1 hour, Graph API enumeration within 2 hours, and sustained SharePoint/OneDrive access below 1,000 files/hour to evade volumetric alerts.
HUNT 02 · T1190
FortiGate PivotC2 deployment
Expect: a Node.js process on the appliance, outbound TLS to non-Fortinet infrastructure, SOCKS5 proxy activity, and configuration/credential access outside backup windows.
HUNT 03 · T1204.001
Blob URL phishing targeting
Expect: DocuSign-themed emails with calendar attachments, redirect chains through Microsoft domains terminating externally, and blob URL generation followed by credential submission — invisible to proxy logs.
Financial Services
Treasury, Tax Systems
Primary threat
Storm-3121/3032 identity hijack → PII extortion
Actions
- Require managed devices; pilot FIDO2
Energy
Utilities
Primary threat
Perimeter compromise as IT→OT bridge
Actions
- Patch/rotate creds on IT/OT firewalls
Healthcare
Medicaid
Primary threat
Ransomware via identity compromise
Actions
- Block vishing domains
Government
Agencies
Primary threats
Nation-state espionage (APT28, Salt/Volt Typhoon)
Actions
- Push Chrome fleet-wide
Aviation / Logistics
DOT
Primary threat
Perimeter compromise threatens DOT/port infrastructure
Actions
- Inventory perimeter devices; enforce MFA
No sector cards match the selected filters.
Patch Fortinet (CVE-2025-25249); rotate admin creds.
Incident Responder
Update Chrome fleet to 153.0.8010.36+ (CVE-2026-87491).
Incident Responder
Block 7 vishing domains + cdn.bloom[.]io at gateway/proxy/DNS.
SOC Analyst
Authorize an emergency patch window ahead of Sep 12.
CISO / Exec
No immediate actions for the selected roles.
Patch Cisco FMC & Citrix NetScaler before Sep 12.
Incident Responder
Deploy blob URL detection; alert on multi-hop OAuth redirects.
SOC Analyst
Audit Orkes Conductor; complete Patch Tuesday rollout.
Incident Responder
No 7-day actions for the selected roles.
Pilot FIDO2 for CIO/CISO/treasury roles.
CISO / Exec
Escalate OSINT procurement; forward Chrome telemetry.
CISO / ExecSOC Analyst
Verify OT/ICS patch status; tabletop the FortiGate kill chain.
ICS / OTIncident Responder
No 30-day actions for the selected roles.
The Bottom Line
The threat landscape facing state government networks is compounding risk across multiple layers at once: perimeter under pressure from three vendor vulnerabilities in the wild, identity under vishing that bypasses MFA, and a novel phishing technique blinding URL-based defenses. A compromised FortiGate yields lateral-movement credentials; a hijacked M365 identity yields extortion data. The kill chains converge, and the Sep 12 KEV deadline is 48 hours away.
1
Have you patched the perimeter?
2
Have you blocked the vishing domains?
3
Is the Sep 12 window authorized?