State Networks Breached,
One Million Records Exposed, Endpoint Protections Bypassed

Nevada’s investigation into its statewide ransomware incident revealed how a single trojanized system administration tool created a long-running foothold that enabled lateral access, data theft, and eventual encryption across virtual machines. In Philadelphia, the University of Pennsylvania confirmed that threat actors accessed internal systems through a compromised PennKey Single Sign On account and claimed to have taken records linked to more than one million donors. Meanwhile, new research documented the abuse of legitimately signed kernel drivers that were used to disable Microsoft Defender and evade endpoint detection and response controls.

This edition of the ColorTokens Threat Intelligence Brief outlines how attackers gained initial access, and calls attention to the most critical vulnerabilities disclosed during this period, including several high scoring Common Vulnerabilities and Exposures items that require immediate patching to reduce attack surface and prevent privilege escalation.

How ColorTokens Threat Intelligence Helps You Stay Breach Ready:

• Connects real incidents to attacker behavior, helping teams understand how threats progress from initial access to widespread disruption.
• Identifies lateral movement patterns across servers, virtual machines, and administrative tools so defenders can contain activity earlier.
• Surfaces indicators of compromise and tactics used in campaigns such as trojanized installers, privilege escalation, and signed driver abuse.
• Highlights operational technology and Internet of Things intrusion trends that affect essential services, including water utilities.
• Translates technical findings into practical actions so organizations can strengthen isolation controls, validate segmentation, and reduce recovery time.

Our cybersecurity specialists can help you interpret these threat developments and apply the right containment strategies so your organization stays breach ready before the next incident unfolds.