Public Administration Ransomware Leak-Site Listings Rise 65% as Credential Abuse Grows
Summary
ReliaQuest reports a 65% rise in public administration organizations listed on ransomware data-leak sites and growing credential abuse. It recommends stronger authentication, perimeter hardening, persistence hunting, and automated containment.
Key points
- Public administration organizations listed on data-leak sites rose 65% to 117 this quarter, according to the article.
- Phishing’s share of reported access paths fell from 48% to 40%, while password spraying, credential stuffing, password guessing, and account access removal gained ground.
- Recommended defenses include phishing-resistant MFA, authentication rate limits and alerts, and monitoring for suspicious login patterns.
- The article reports 109 newly exploited vulnerabilities, up 76%; 59 were weaponized within five days of disclosure, and same-day exploitation rose to 32.
- For CVE-2026-76504, described as an unpatched, actively exploited Cisco Catalyst SD-WAN Manager authentication bypass, the article advises restricting internet exposure and management access.
- The article describes reported persistence activity involving Laundry Bear, Lazarus Group, Nimbus Manticore, and Kimsuky, and recommends hunting for unexpected SSH tunnels, malicious mailbox rules, and misuse of admin tools.
- Mean time to contain rose from 34 to 39 minutes; the article reports an average of five minutes for organizations using Automated Response Playbooks.
Article Details
- Defense Focus
- Defend public administration systems against credential abuse, exploitation of internet-facing vulnerabilities, and persistent access to government mailboxes and records.
- Detection Methods
- Alert on high-volume authentication failures, impossible travel, and logins from new infrastructure.
- Monitor for unauthorized Account Access Removal and administrator API activity.
- Hunt for unexpected SSH tunnels, malicious mailbox rules, and use of legitimate administrative tools.
- Correlate identity, endpoint, and email signals to identify persistence and intrusion activity.
- Alert on password spraying and exposed credentials; monitor for impersonating domains and leaked government data.
- Data Sources
- Identity and authentication telemetry
- Endpoint telemetry
- Network telemetry
- Cloud telemetry
- Email telemetry
- Administrator API activity
- Platforms
- GreyMatter
- Defensive Actions
- Enforce phishing-resistant MFA on VPNs and administrative portals, and rate-limit authentication attempts.
- Patch known-exploited perimeter vulnerabilities quickly; until CVE-2026-76504 is patched, restrict Cisco Catalyst SD-WAN Manager exposure and allow management access only from trusted IPs or via VPN.
- Disable PsExec where it is not needed and block Rclone with application allowlisting.
- Use approved automated response playbooks to contain validated command-and-control, confirmed credential abuse, or ransomware tooling.
MITRE ATT&CK
T1014 · RootkitThe article reports that Lazarus Group used rootkit evasion alongside its Windows zero-day activity.T1068 · Exploitation for Privilege EscalationThe article reports that Lazarus Group used a Windows zero-day to obtain SYSTEM access.T1110.001 · Password GuessingThe article reports password guessing gaining ground against the sector.T1110.003 · Password SprayingThe article identifies password spraying as a growing login-abuse technique against public administration organizations.T1110.004 · Credential StuffingThe article reports credential stuffing gaining ground as attackers use scalable login abuse.T1531 · Account Access RemovalThe article reports Account Access Removal gaining ground and recommends detecting unauthorized use that can lock out legitimate administrators.T1534 · Internal SpearphishingThe article reports an increase in Internal Spearphishing, describing abuse of trusted internal communications.T1566 · PhishingPhishing remains a leading access path, and the article reports that Kimsuky used AI to sharpen phishing.T1572 · Protocol TunnelingThe article reports that Nimbus Manticore deployed a reverse SSH tunneler for long-term access.
CVE
Threat Actors
KimsukyThe article reports that Kimsuky used AI to sharpen phishing and speed payload changes.Laundry BearThe article reports that Laundry Bear exploited an Outlook Web Access flaw to retain mailbox access after a single email was viewed.Lazarus GroupThe article reports that Lazarus Group used a Windows zero-day to gain SYSTEM access and used rootkit evasion.Nimbus ManticoreThe article reports that Nimbus Manticore deployed a reverse SSH tunneler for long-term access.
Vendors
Ciscoapplication allowlisting to cut off exfiltration. CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, is being exploited in the wild with no patch yet available, and compromise couldIvantiand same-day exploitation doubling to 32, driven by rapid weaponization of internet-facing flaws in Ivanti Connect Secure and Microsoft SharePoint. Patch known-exploited perimeter flaws quickly, disable PsExecMicrosoftdoubling to 32, driven by rapid weaponization of internet-facing flaws in Ivanti Connect Secure and Microsoft SharePoint. Patch known-exploited perimeter flaws quickly, disable PsExec where it isn’t needed, and
Products
AI Model Brokeragents across identity, endpoint, network, cloud, and email, and routes each task through the AI Model Broker, which selects the best model for the job by cost, speed, and accuracy—without the customer managingCisco Catalyst SD-WAN Managerallowlisting to cut off exfiltration. CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, is being exploited in the wild with no patch yet available, and compromise could exposeGreyMatterGreyMatter is built for that operating model. The platform decomposes investigations into single-task agents across identity, endpoint, network, cloud, and email, and routes each task through the AI Model Broker, whichIvanti Connect Securesame-day exploitation doubling to 32, driven by rapid weaponization of internet-facing flaws in Ivanti Connect Secure and Microsoft SharePoint. Patch known-exploited perimeter flaws quickly, disable PsExec where itMicrosoft SharePointto 32, driven by rapid weaponization of internet-facing flaws in Ivanti Connect Secure and Microsoft SharePoint. Patch known-exploited perimeter flaws quickly, disable PsExec where it isn’t needed, and blockMicrosoft Windowsan Outlook Web Access flaw to retain mailbox access after a single viewed email; “Lazarus Group” used a Windows zero-day for SYSTEM access with rootkit evasion; “Nimbus Manticore” deployed a reverse SSH tunneler forOutlook on the webPublic administration drew heavy nation-state attention this quarter. “Laundry Bear” exploited an Outlook Web Access flaw to retain mailbox access after a single viewed email; “Lazarus Group” used a Windows zero-dayUniversal Translatormanaging models or usage costs. It normalizes telemetry across an agency’s existing tools with its Universal Translator, running detection at source, at storage, or in transit so threats are caught before data has to
Tools
PsExecin Ivanti Connect Secure and Microsoft SharePoint. Patch known-exploited perimeter flaws quickly, disable PsExec where it isn’t needed, and block “Rclone” with application allowlisting to cut off exfiltration.RClonePatch known-exploited perimeter flaws quickly, disable PsExec where it isn’t needed, and block “Rclone” with application allowlisting to cut off exfiltration. CVE-2026-76504, a CVSS 9.8 authentication bypass