What Happened in Suisun City?

At 5:45 am on August 7, something went very wrong inside Suisun City’s IT network. Malicious software had infected the systems, and within hours, the city declared a state of emergency. The move wasn’t just symbolic — it unlocked access to state and federal resources that smaller municipalities often can’t reach on their own.

The fallout has been wide. The attack disrupted 911 call routing, police and fire dispatch, records management, and general city services. Officials made the call to shut down the entire IT network, a drastic step meant to contain the damage and preserve evidence for a federal investigation.

That decision has real consequences. Online services are offline, City Hall is closed, and in-person meetings across planning, housing, and water departments have been suspended indefinitely.

Is 911 Still Working in Suisun City?

Yes — but not through the usual channels. In an update posted on August 10, the city assured residents that police and fire crews are still responding to emergency calls. Those calls are now being routed through the Solano County dispatch center instead of the city’s own system.

Officials also stressed there is no “imminent” threat to the public from the incident itself. For a city of roughly 30,000 people in Northern California, that’s a small comfort, but a necessary one.

Is This a Ransomware Attack?

Nobody has officially confirmed it yet, but the signs point that way. Suisun City Council Member Princess Washington posted on LinkedIn late on August 10 that an emergency meeting would take place the following day to address the ongoing effects of the incident. The council planned to discuss “threats to public services and facilities, cybersecurity matters and anticipated litigation.”

More tellingly, SFGATE reported that the meeting would include consideration of the city’s response to demands from the “person or persons” behind the malware. When a city starts talking about responding to demands, ransomware is usually the reason.

A Wave of Attacks on Local Governments

Suisun City isn’t an isolated case. It’s part of a troubling pattern that has accelerated over the past few weeks.

• Coweta, Oklahoma (August 5): The city confirmed a “system-wide ransomware attack” and is working with cybersecurity experts to recover systems and assess whether any data was accessed.
• Washburn County, Wisconsin (August 6): Officials issued a press release confirming they’re responding to a cyber incident and shut down technology services as part of the response. No word yet on whether it’s ransomware-related.
• St. Paul, Minnesota (August 2025): The Interlock ransomware group published employee data online after the city refused to pay.
• Clay County, Indiana and Jackson County, Missouri (2024): Both reported ransomware attacks that disrupted critical government services.

These aren’t one-off events. They’re a trend.

Why Are Local Governments Such a Popular Target?

The answer is painfully simple: they’re vulnerable, and attackers know it.

Seemant Sehgal, Founder & CEO of BreachLock, put it bluntly. Municipal IT and security teams, he said, “operate under resource constraints that most enterprise security organizations would find genuinely difficult to imagine.” When three incidents hit in the same news cycle, he added, “it’s clear that attackers have figured that out.”

His assessment is worth sitting with: “Suisun City, Coweta, Washburn County – these are not outliers, they are a pattern.”

Local governments are expected to deliver essential services on tight budgets. Cybersecurity often takes a back seat to roads, schools, and public safety. That calculus is now coming back to bite.

The Cost of a Cyber Incident Goes Beyond Money

For a city like Suisun, the immediate costs are obvious — IT recovery, forensic investigations, potentially a ransom payment. But the hidden costs are just as damaging. Every day City Hall stays closed, permits don’t get processed. Housing meetings get postponed. Water department inquiries go unanswered.

Residents feel the disruption even if their personal data never leaks. And if data does leak, the consequences can linger for years. Just ask St. Paul, where employee information is still floating around on the dark web.

What Can Other Cities Learn From This?

If there’s a silver lining in incidents like these, it’s that they force conversations about preparedness. Cities that haven’t been hit should be paying close attention.

Key takeaways from the recent wave of local government ransomware attacks:

• Have a backup plan for 911 dispatch. Suisun was lucky to have Solano County as a fallback. Not every city does.
• Shut down fast. Taking the entire network offline is painful, but it preserves evidence and limits spread. Hesitation is costly.
• Communicate early and often. Suisun’s updates, while not detailed, at least kept residents informed about what to expect.
• Assume you’re a target. Small cities are not too small to be attacked. They’re often the perfect size — enough data to be valuable, not enough budget to defend it.

The reality is that cyber incidents in government agencies are no longer a matter of if, but when. The cities that recover best will be the ones that planned for that inevitability before the malware hit.

The Discovery: A Decade-Old Hole in Secure Boot

Eleven Microsoft-signed UEFI shim bootloaders are carrying vulnerabilities that let attackers completely bypass Secure Boot. That’s the takeaway from a new ESET report, and the flaws have been sitting there for more than ten years.

These aren’t exotic, hard-to-reach bugs. No memory corruption. No reverse engineering. Just old code that still trusts even older code.

ESET flagged the shims to CERT/CC back in February 2026. All of them are version 0.9 or below, signed under Microsoft’s Microsoft Corporation UEFI CA 2011 third-party certificate. That’s the catch — any system that trusts that certificate will accept these bootloaders, no matter the OS installed.

Why Shims Exist (And Why They’re Dangerous)

A shim is a tiny first-stage bootloader. Microsoft signs it once, and that signature lets Linux distributions boot under Secure Boot without submitting every single update for signing. Convenient, sure. But it also means an attacker can grab a vulnerable shim, carry it to any machine with the Microsoft third-party cert, and boot from it.

The real problem isn’t the shim itself. It’s the second-stage bootloaders these old shims still trust — mostly GRUB 2. The trusted binaries were signed between 2013 and 2025, and older GRUB 2 builds are riddled with well-known flaws.

ESET proved the point using Oracle Linux’s shim. It trusts a GRUB 2 binary vulnerable to a 2015 bug that lets unsigned code load through crafted multiboot modules. The attack is almost trivial: build an unsigned kernel image, drop it next to the old shim and GRUB 2, and load it with a single command at boot.

Bypassing the Defenses Built to Catch This

The shims also sidestep the very mechanisms designed to stop them.

• MOK denylist: Enforcement only arrived in shim version 0.9. Older shims ignore it entirely, so an attacker can load binaries that an organization thought were revoked.
• Secure Boot Advanced Targeting (SBAT): This version-based revocation system came in shim 15.3. Earlier shims never even check the SBAT policy.

That’s a double whammy. Even if you’ve revoked a malicious bootloader, these old shims won’t respect your decision.

The deeper issue is visibility. Shim submissions have only been cataloged transparently since 2017. Nobody knows how many older, still-trusted shims are out there. That’s a scary thought for anyone managing a fleet of Linux servers.

What’s Been Fixed (And What Hasn’t)

Two CVEs cover the reported shims: CVE-2026-8863 and CVE-2026-10797. Microsoft revoked the vulnerable binaries in the dbx update shipped with its June 9 Patch Tuesday.

Windows machines should update automatically. Linux users can pull the revocation through the Linux Vendor Firmware Service.

But here’s the kicker: ESET isn’t releasing indicators of compromise. The vulnerable shims are part of legitimate software packages on thousands of systems that have never been compromised. Releasing IoCs would cause massive misidentification.

Instead, defenders should follow the advice in ESET’s Protection and detection section. That’s the practical path forward.

What This Means for Your Systems

If you’re running Linux on UEFI hardware, this is worth taking seriously. The attack doesn’t need physical access — an attacker just needs to boot from a USB drive or compromise the boot chain.

Check your shim version. If it’s 0.9 or below, you’re exposed. Update through your distribution’s normal channels, and make sure the dbx update is applied.

For security teams, this is a reminder that Secure Boot isn’t a silver bullet. It’s a chain, and every link matters. Old shims are a weak link that’s been hiding in plain sight for a decade.

Related reading: Microsoft fixes 200 CVEs in June Patch Tuesday and how to check your Linux bootloader version.

Go-Based macOS Malware: A New Threat Emerges

Security researchers at Huntress have uncovered a new strain of infostealing malware designed specifically for macOS. This Go-based macOS malware operates through ClickFix social engineering attacks, a technique that tricks users into executing malicious commands disguised as CAPTCHA prompts.

First identified in June 2026, this malware represents a significant escalation in the sophistication of macOS-targeted threats. Unlike typical malware that requires exploiting system vulnerabilities, this attack relies on human error—a far more unpredictable and effective vector.

How ClickFix Attacks Deliver the Malware

The attack begins with a popup window that appears to be a legitimate CAPTCHA challenge. Users are instructed to copy a long command string and paste it into the Terminal application. This command downloads and executes the initial stage of the attack.

According to Huntress, the command pulls a Bash profiler/loader that collects system details before fetching a Mac-native Mach-O payload matched to the victim’s processor architecture. Mach-O is the executable format used by macOS, and in this case, the Go-based stealer was built to scrape browser password stores, Apple Keychain data, and cached credentials from the infected system.

The Role of Go in the Malware

Go, also known as Golang, has become a popular language for malware development due to its cross-platform capabilities and ease of compiling for different architectures. This particular Go-based macOS malware is a prime example, as it can be tailored to run efficiently on both Intel and Apple Silicon Macs.

Crypto Wallet Drain Function

One of the most concerning features of this malware is its DRAIN function. This capability checks whether a cryptocurrency wallet holds funds and then redirects all or part of that balance to attacker-controlled wallets. This makes the malware particularly dangerous for individuals and organizations that hold digital assets.

“The malware also included a DRAIN function that could check whether a cryptocurrency wallet held funds, then redirected all or part of that balance to attacker-controlled wallets,” the Huntress blog post stated.

Attribution to Aeza Group

The loader, payload hosting, and command and control (C2) infrastructure all link back to the Aeza Group, a sanctioned Russian bulletproof hoster associated with cybercrime. This attribution highlights the ongoing threat from state-aligned or state-tolerant cybercriminal networks.

Bulletproof hosters like Aeza Group provide infrastructure that is resistant to law enforcement takedowns, making them a preferred choice for cybercriminals seeking long-term operational stability.

Mitigation and Response Strategies

Huntress advises organizations to mitigate ClickFix threats through user education and by installing malicious script mitigation browser add-ons like NoScript. Additionally, network devices like Pi-Hole DNS can reduce the chances of popups appearing by blocking known-bad domains from resolving through DNS blocking.

“If a user inadvertently follows through with a ClickFix exploit, it is imperative that the user inform their IT team immediately and that the machine be brought into an isolation mode,” the researchers concluded.

“The malware may or may not achieve persistence, but it is easily remediated by deleting any copies of the binary left behind on the machine. Once deleted, the malware will not spontaneously reconstitute itself.”

Practical Steps for Users

• Always verify the legitimacy of CAPTCHA prompts, especially those that ask you to run commands in Terminal.
• Use browser extensions like NoScript to block unauthorized scripts.
• Implement DNS-level filtering to block known malicious domains.
• Regularly back up important data and maintain offline copies.
• If you suspect a ClickFix attack, disconnect from the network and contact your IT department immediately.

For more on protecting your systems, consider reading about macOS security best practices and ClickFix attack prevention.