| Date | Event | Severity | Status |
|---|---|---|---|
| Nov 10 | Barracuda ESG pre-auth root chain (CVE-2026-116606 + CVE-2026-111560) disclosed; active exploitation confirmed at multiple organizations | CVSS 9.3 + 8.6 | Active exploitation |
| Nov 10 | SAP discloses PROXYGATE (CVE-2026-89103) and ICM2SHELL (CVE-2026-76964, CVE-2026-89126) — three CVSS 10.0 unauthenticated RCE flaws; working exploit provided to SAP | CVSS 10.0 × 3 | Working exploit exists; no in-the-wild exploitation yet |
| Nov 10 | Microsoft Patch Tuesday: Windows AD RCE (CVE-2026-119948) affects Server 2016–2025 | CVSS 7.5 | No exploitation yet |
| Nov 10 | CISA adds 6 vulnerabilities to KEV catalog, including Cisco BroadWorks XXE (CVE-2026-20320) linked to autonomous AI exploitation campaign, and SonicWall SAML bypass (CVE-2026-19868) | Various | Active exploitation (KEV = confirmed) |
| Nov 9 | 30+ zero-day vulnerabilities in N-able N-central published with exploit code; vendor takes hosted service offline | No CVEs assigned | Public exploit code; no patch available |
| Nov 9 | France formally attributes October 11–12 ICS refrigeration sabotage across 700 supermarket sites to Iran's IRGC (Shahid Kaveh and Shahid Shoostari units) via CyberAveng3rs and Soldiers of Solomon fronts | N/A | First formal Western attribution of ICS sabotage to Iran on allied soil |
| Nov 9 | BYOD ransomware gang claims full domain controller takeover at Vanderbilt University; exfiltration of 1M+ SSNs | N/A | Confirmed claim |
| Nov 11 | ClickFix social engineering evolves from infostealer delivery to full Active Directory compromise with 11-host lateral spread documented | N/A | Multiple incidents observed |
| Oct 28 | APT42 (IRGC-IO) compromises FEC e-filing system; ongoing nation-state interest in election infrastructure confirmed | N/A | Confirmed compromise |
| Nov 9–10 | Chinese APT campaigns updated: UNC6727 (SUNBRICKED malware) and UNC7072 (CLOUDHAZE, S3 exfiltration) targeting government and healthcare; UNC5221 continues Ivanti exploitation | N/A | Active campaigns |
| Nov 9–10 | Russian Turla deploys previously undocumented "Cereal" malware against government Exchange servers for silent email exfiltration; APT28 and APT29 indicators updated | N/A | Active campaign |
| Date | Actor / Campaign | Event | Impact to State Government |
|---|---|---|---|
| Oct 11–12 | IRGC / CyberAveng3rs | ICS sabotage of 700 supermarket refrigeration systems in France | Demonstrates Iranian capability and willingness to attack civilian ICS; state water/HVAC/BMS systems use similar PLCs |
| Oct 28 | APT42 (IRGC-IO) | Compromise of FEC e-filing system | Election infrastructure integrity concern for state election systems |
| Oct 30 | UTA0576 / UNC5221 | Ivanti Connect Secure CVE-2026-111357 added to CISA KEV | State VPN infrastructure exposure |
| Nov 5 | CISA/ASD/NSA | Joint PQC vendor readiness guidance published | Procurement and cryptographic migration planning trigger |
| Nov 9 | BYOD Ransomware | Vanderbilt University domain controller takeover, 1M+ SSNs exfiltrated | Education sector adjacent to state systems; demonstrates DC-targeting TTP |
| Nov 9 | France / ANSSI | Formal attribution of ICS sabotage to Iran's IRGC | Raises baseline for ICS threat to all Western nations |
| Nov 9 | Sean Bales / N-able | 30+ N-central zero-days published; vendor takes service offline | Direct MSP supply chain risk to SLTT |
| Nov 10 | Barracuda | ESG pre-auth root chain actively exploited | Direct risk to state email infrastructure |
| Nov 10 | SAP / Onapsis | PROXYGATE + ICM2SHELL: 3× CVSS 10.0 disclosed | Direct risk to state financial management systems |
| Nov 10 | Microsoft | Patch Tuesday: AD RCE CVE-2026-119948 | Direct risk to every state domain controller |
| Nov 11 | Huntress | ClickFix campaign documented with full AD compromise chain | Social engineering threat to state employees |
CVE-2026-116606 (CVSS 9.3, pre-authentication authorization bypass) chains with CVE-2026-111560 (CVSS 8.6, command injection) to give attackers root-level access to Barracuda ESG appliances without any credentials; target-industry:government.
The simultaneous public disclosure of 30+ zero-day vulnerabilities with working exploit code for N-able N-central is unprecedented in scale for an MSP platform; CVE-2026-120017 (also: AstarionRAT, EtherRAT, NetSupport, BoobaProject, DraftKings, LiveRamp, Warp Panda, Volt Typhoon, Salt Typhoon, N0n).
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| Barracuda ESG exploitation expands to additional government targets; CISA KEV addition | 70% | 7 days | Active exploitation confirmed; historical 27% government victimology in prior ESG campaigns |
| N-central exploits weaponized by ransomware affiliates for MSP-to-client pivots | 75% | 7–14 days | Public exploit code + proven MSP→SLTT attack path (Kaseya precedent) |
| SAP PROXYGATE/ICM2SHELL exploitation in the wild | 50% | 14 days | Working exploit exists; internet-facing SAP instances are enumerable |
| ClickFix techniques adopted by ransomware affiliates targeting SLTT | 45% | 30 days | Documented AD compromise capability lowers the barrier for ransomware deployment |
| Chinese APT exploitation of Barracuda ESG (mirroring 2023 UNC4841 campaign) | 40% | 30 days | Same product, same vulnerability class, same target profile |
| Windows AD RCE CVE-2026-119948 exploitation in the wild | 30% | 30 days | High attack complexity mitigates; but high-value target (DCs) motivates research |
Detection Logic: Alert on browser processes (chrome.exe, msedge.exe, firefox.exe) spawning cmd.exe, powershell.exe, or wscript.exe (ATT&CK T1204.002, T1059.001). This should never happen in normal operations. Secondary Detection: Alert on the AD recon sequence nltest /dclist → net group "Domain Admins" → whoami /all executed from a workstation within a short time window (T1018, T1069.002). Lateral Movement Indicator: WinRM connections (TCP 5985/5986) originating from workstations to domain controllers (T1021.006). Workstations should not be managing DCs via WinRM. C2 Detection: Outbound SSH on non-standard ports from workstations (T1572). State employees should not have SSH clients initiating outbound tunnels. Block immediately: - Domains: westlaw-signon[.]com, moziw[.]com, ghost[.]io (specifically vvestalw.ghost[.]io) - IPs: 23.227.199[.]41 (SSH tunnel C2), 167.148.201[.]104 (DuskDesk RAT C2, port 3861) ATT&CK: T1204.002 T1059.001 T1018 T1069.002 T1021.006 T1572
Detection Logic: Monitor for unexpected outbound connections from ESG appliance management interfaces (T1190, T1068). Review ESG logs for anomalous admin API calls or configuration changes. Check for unauthorized processes running as root on ESG appliances. Network Detection: Alert on ESG admin UI access from external IP addresses. This interface should never be internet-exposed. ATT&CK: T1190 T1068
Detection Logic: Monitor SAP Gateway ports (33NN/48NN) for connections from external IP ranges (T1190). Alert on WebSocket upgrade requests to SAP ICM/Web Dispatcher from untrusted sources. Monitor for unexpected process execution as <sid>adm user (T1059). Interim Mitigation: If patching is not immediately possible, disable WebSocket support (icm/HTTP/support_websocket_upgrade=FALSE) and set gw/acl_mode_proxy=1. ATT&CK: T1190 T1059
Detection Logic: Monitor for unexpected remote management tool connections, particularly N-central agent communications (T1199). Alert on new local admin account creation on endpoints managed by MSPs (T1136.001). Review MSP remote access logs for anomalous session times or source IPs. ATT&CK: T1199 T1136.001
Block the above at perimeter firewalls, proxies, and DNS. westlaw-signon[.]com ClickFix typosquat targeting legal professionals; moziw[.]com ClickFix payload delivery; 23.227.199[.]41 ClickFix SSH tunnel C2; 167.148.201[.]104 DuskDesk RAT C2 (port 3861). Hashes: ccefbdec2718d864d9d33c743aabfcef88a8d7904d1c598bfcf15cf5f3591c88 (SHA-256, HAZYTIGER APT malware); a3081df333ca7f18bd90d10a45125ab5011dcf9d2806feae2935f09cab07da4c (SHA-256, HAZYTIGER APT malware); e3992f8c945b0761242377cba32d91b0a390c7cecd79478439843d93e6d2b76b (SHA-256, HAZYTIGER APT malware); d1c4717d22de54e9bed7d060e9d84343 (MD5, LUXURYSPIDER CobaltStrike/Frost); 6982b95d329d90351b7ddeca615ab1bed405b9d2 (SHA-1, LUXURYSPIDER CobaltStrike/Frost). Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
- Apply SAP Security Notes 3798345, 3810197 (PROXYGATE) and 3778530, 3778556 (ICM2SHELL) immediately.
- Review ICS/OT network segmentation for state-managed water treatment, transportation, and building management systems.
- Ensure Medicaid and public health data systems have offline backup verification completed within 7 days.
- Verify Barracuda ESG patch status across all agencies.
- Audit VPN and remote access infrastructure for transportation management systems.
westlaw-signon[.]com, moziw[.]com; alert on C2 IPs 23.227.199[.]41 and 167.148.201[.]104. Create detection for browsers spawning cmd.exe or powershell.exe. Ingest HAZYTIGER and LUXURYSPIDER hashes into EDR blocklists (see IOC table above). Brief agency heads on the Barracuda and N-central situations. These may require emergency change windows outside normal schedules. Identify whether any MSP serving state agencies uses N-able N-central. If yes, demand written confirmation that instances are offline or patched. Restrict MSP remote access until confirmation received. Verify Barracuda ESG patch status for CVE-2026-116606 and CVE-2026-111560 across all agencies.nltest /dclist -> net group "Domain Admins" -> whoami /all sequence from workstations; alert on WinRM from workstations to DCs; alert on outbound SSH from non-server endpoints. Distribute ClickFix awareness alert to all state employees: a single-slide visual showing the fake CAPTCHA -> clipboard paste -> PowerShell flow with clear "NEVER paste commands from websites" messaging.cmd.exe, powershell.exe, or wscript.exe.The convergence of active email gateway exploitation, a mass MSP zero-day disclosure, maximum-severity ERP vulnerabilities, and an AD remote code execution flaw - all within a 48-hour window - is not a coincidence.