Active Exploitation of SolarWinds Serv-U, New China-Nexus Actor Targeting Government, and ICS Vulnerabilities Demand Immediate State Agency Action

Public Sector

Published on

June 8, 2026

Table of Contents

Threat Assessment Level: ELEVATED State government IT leaders face a convergence of actively exploited vulnerabilities, new social engineering campaigns targeting U.S. government organizations, and a wave of industrial control system advisories affecting utility partners. This week's intelligence confirms that threat actors are actively probing the tools state agencies rely on daily — SolarWinds Serv-U for file transfer, Chrome browsers across the enterprise, and SCADA systems in partner utilities. A brand-new China-nexus threat actor designated just this week is already confirmed to target government entities. The window for defensive action is narrow. <h2> What Changed </h2> The past week brought several developments that shift the operational picture for state IT leadership: <ul> <li> CVE-2026-28318 (SolarWinds Serv-U) was added to the CISA Known Exploited Vulnerabilities (KEV) catalog on June 5, confirming active in-the-wild exploitation. This pre-authentication denial-of-service vulnerability affects a file transfer tool widely deployed across state agencies. </li> <li> UNC6861 , a newly tracked European-origin threat cluster, is actively deploying NETSUPPORT remote access trojans against U.S. government organizations using "ClickFix" social engineering — fake CAPTCHA verification prompts that trick users into executing malicious commands. </li> <li> Five ICS advisories were published in a single day (June 4), including three affecting Hitachi Energy products deployed in state-adjacent electrical grid infrastructure. </li> <li> UNC5475 , a brand-new China-nexus actor designation, appeared in threat intelligence feeds on June 8 with confirmed government targeting. No aliases or detailed TTPs are available yet — this is an emerging threat requiring close monitoring. </li> <li> APT42 (Charming Kitten / Mint Sandstorm) , an Iranian IRGC-IO-linked actor, received updated intelligence confirming ongoing credential harvesting operations against government, energy, and healthcare sectors. </li> <li> Miasma worm (TeamPCP) compromised 73 Microsoft GitHub repositories between June 5–6 via malicious AI coding tool configurations, posing a supply chain risk to state DevOps teams using AI coding assistants. </li> <li> CVE-2026-10881 (Chrome, CVSS 9.6) — a critical sandbox escape vulnerability — is addressed in Chrome version 149.0.7827.53+. State agencies should verify enterprise-wide deployment of this update. </li> </ul> Change from prior cycle: The threat assessment remains at ELEVATED (unchanged from June 7). While no single event warrants escalation to HIGH, the combination of confirmed exploitation (Serv-U KEV), active government targeting (UNC6861), and expanding China-nexus actor designations (UNC5475) maintains elevated pressure on state defenses. <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Relevance to State Government </th> </tr> </thead> <tbody> <tr> <td> June 2 </td> <td> CISA/Partners publish ATG hardening guidance for fuel tank monitoring systems </td> <td> State fleet fueling depots, underground storage tank compliance </td> </tr> <tr> <td> June 3 </td> <td> CVE-2026-45247 (Magento/Mirasvit, CVSS 9.8) added to CISA KEV </td> <td> State e-commerce portals using Magento </td> </tr> <tr> <td> June 4 </td> <td> Five ICS advisories published (Hitachi Energy RTU500, MACH HiDraw, ITT600, NAVTOR, B&R PPT30) </td> <td> State utility partners — power grid substations, SCADA systems </td> </tr> <tr> <td> June 5 </td> <td> CVE-2026-28318 (SolarWinds Serv-U, CVSS 7.5) added to CISA KEV </td> <td> Direct impact — Serv-U deployed for state file transfer operations </td> </tr> <tr> <td> June 5–6 </td> <td> Miasma worm (TeamPCP) compromises 73 Microsoft GitHub repositories via malicious AI coding tool configs </td> <td> State DevOps teams using AI coding assistants </td> </tr> <tr> <td> June 7 </td> <td> UNC6861 ClickFix campaign last IOC observed; active against U.S. government </td> <td> Direct targeting of government employees via social engineering </td> </tr> <tr> <td> June 8 </td> <td> UNC5475 (China-nexus) designated — government targeting confirmed </td> <td> New actor; state agencies likely within collection scope </td> </tr> <tr> <td> June 8 </td> <td> APT42 (Iran/IRGC-IO) intelligence updated — government credential harvesting active </td> <td> State cloud accounts (M365/Azure) at risk </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. SolarWinds Serv-U Under Active Exploitation (CVE-2026-28318) </h3> CISA's addition of CVE-2026-28318 to the KEV catalog confirms that attackers are actively exploiting this pre-authentication denial-of-service vulnerability in SolarWinds Serv-U. The vulnerability is triggered by crafted POST requests using Content-Encoding: deflate and affects all versions prior to 15.5.4 Hotfix 1. While classified as denial-of-service, state IT leaders should understand the operational implications: DoS against file transfer infrastructure can serve as a smokescreen for data exfiltration or as a disruption tactic during broader intrusion operations. SolarWinds Serv-U is a known target of nation-state actors — it was previously exploited by Chinese threat groups for initial access into government networks. Affected versions: Serv-U prior to 15.5.4 Hotfix 1 Exploitation: Confirmed in-the-wild (CISA KEV) CVSS: 7.5 (HIGH) <h3> 2. UNC6861 ClickFix Campaign — Social Engineering Targeting Government </h3> UNC6861 represents a sophisticated social engineering operation specifically targeting U.S. government employees. The attack chain is designed to bypass traditional email security controls: <ol> <li> Lure: Victims encounter fake "Verify you are human" CAPTCHA prompts (ClickFix technique) </li> <li> Execution: The lure tricks users into running commands that invoke legitimate Windows utilities — finger.exe, curl, and tar — to download a portable Python interpreter </li> <li> Payload: Base64-encoded in-memory scripts fetch NETSUPPORT RAT from command-and-control infrastructure </li> <li> Persistence: Windows Scheduled Tasks maintain access </li> </ol> This technique is particularly dangerous because it uses Living-off-the-Land binaries (LOLBins) that are already present on Windows systems and typically whitelisted by endpoint protection. Traditional antivirus focused on malicious attachments or macros will not detect this chain. Targeted sectors: U.S. government, financial services, education, manufacturing, technology <h3> 3. ICS/OT Vulnerability Wave — Utility Partner Risk </h3> Five ICS advisories in 24 hours signal an elevated vulnerability disclosure period for operational technology. Three advisories affect Hitachi Energy products commonly deployed in state-adjacent electrical grid infrastructure: <ul> <li> Hitachi Energy RTU500 — Remote Terminal Units in power grid substations; vulnerabilities could disrupt SCADA communications </li> <li> Hitachi Energy MACH HiDraw — Buffer overflow in substation automation engineering workstations </li> <li> Hitachi Energy ITT600 Explorer — Telecontrol engineering tool vulnerabilities </li> </ul> Additionally, CISA's Automatic Tank Gauge (ATG) hardening guidance highlights that fuel monitoring systems at government fleet depots are frequently internet-exposed with default credentials — a trivial entry point for attackers. <h3> 4. Expanding China-Nexus Threat to State Government </h3> The designation of UNC5475 as a new China-nexus actor targeting government — appearing alongside updates to APT41, APT5, and UNC5221 — signals expanding Chinese operational capacity against U.S. government targets. Combined with the continued (though currently quiet) presence of Volt Typhoon and Salt Typhoon in critical infrastructure, state agencies should assume they fall within the collection requirements of multiple independent Chinese cyber units. Volt Typhoon intelligence was last updated approximately three and a half weeks ago (May 15); Salt Typhoon intelligence was last updated approximately twelve days ago (May 27). Operational pauses of this duration historically precede major campaign disclosures. This absence is signal, not safety. <h3> 5. APT42 (Iran/IRGC-IO) — Credential Harvesting Against Government Cloud </h3> APT42, also tracked as Charming Kitten and Mint Sandstorm, is an Iranian actor affiliated with the IRGC Intelligence Organization (IRGC-IO), with updated intelligence confirming active operations against government, energy, healthcare, and education sectors. Their primary TTPs center on: <ul> <li> OAuth consent phishing to steal cloud application tokens </li> <li> Sophisticated spearphishing with credential harvesting landing pages </li> <li> Targeting cloud accounts (M365, Google Workspace) for email collection and persistent access </li> </ul> State agencies with Azure AD/Entra ID environments should treat this as a direct threat to their identity infrastructure. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional KEV additions for FortiClient EMS (CVE-2026-35616) or Cisco UCM (CVE-2026-20230) within 7 days </td> <td> 70% (HIGH) </td> <td> Both vulnerabilities are critical severity, affect government-deployed products, and match KEV addition patterns </td> </tr> <tr> <td> UNC6861 ClickFix campaign expands with government compliance or IT notification-themed lures </td> <td> 50% (MODERATE) </td> <td> Active campaign with confirmed government targeting; social engineering themes typically evolve to match target context </td> </tr> <tr> <td> Volt Typhoon or Salt Typhoon operational pause ends with new campaign disclosure </td> <td> 30% (LOW-MODERATE) </td> <td> Extended operational silence historically precedes major public reporting; Volt Typhoon currently at 3+ weeks, Salt Typhoon at ~2 weeks </td> </tr> <tr> <td> Summer ransomware campaign targeting state/local government begins </td> <td> 40% (MODERATE) </td> <td> Historical seasonal pattern (budget cycles, reduced staffing); currently quiet but pre-positioning may be underway </td> </tr> <tr> <td> UNC5475 linked to existing Chinese APT infrastructure within 30 days </td> <td> 60% (MODERATE-HIGH) </td> <td> New designations frequently merge with or relate to established groups as analysis matures </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <ol> <li> UNC6861 ClickFix LOLBin Chain (HIGH PRIORITY) </li> </ol> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> Detection Approach </th> </tr> </thead> <tbody> <tr> <td> T1204.001 (User Execution — Malicious Link) </td> <td> Monitor for browser processes spawning command-line interpreters </td> </tr> <tr> <td> T1218 (System Binary Proxy Execution) </td> <td> Alert on finger.exe execution from any user context — this binary has near-zero legitimate use in enterprise environments </td> </tr> <tr> <td> T1105 (Ingress Tool Transfer) </td> <td> Detect curl.exe or tar.exe invoked by non-administrator accounts, especially when parent process is a browser </td> </tr> <tr> <td> T1059.006 (Python Execution) </td> <td> Alert on portable Python interpreters (python.exe or pythonw.exe) executing from user-writable directories (AppData, Temp, Downloads) </td> </tr> <tr> <td> T1053.005 (Scheduled Task) </td> <td> Monitor scheduled task creation that references Python interpreters or scripts in non-standard paths </td> </tr> <tr> <td> T1219 (Remote Access Software — NETSUPPORT) </td> <td> Block or alert on NETSUPPORT Manager network signatures; monitor for client32.exe or associated DLLs </td> </tr> </tbody> </table> Hunting Hypothesis: "If UNC6861 is active in our environment, we will see finger.exe → curl.exe → tar.exe execution chains within 60 seconds of each other, originating from a browser parent process, followed by scheduled task creation within 5 minutes." Sigma Rule Logic: detection: selection_lolbin: Image|endswith: - '\finger.exe' - '\curl.exe' - '\tar.exe' ParentImage|endswith: - '\chrome.exe' - '\msedge.exe' - '\firefox.exe' condition: selection_lolbin <ol start="2"> <li> SolarWinds Serv-U Exploitation (CVE-2026-28318) </li> </ol> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> Detection Approach </th> </tr> </thead> <tbody> <tr> <td> T1499.004 (Application DoS) </td> <td> Monitor Serv-U service availability; alert on unexpected restarts or resource exhaustion </td> </tr> <tr> <td> T1190 (Exploit Public-Facing Application) </td> <td> Inspect HTTP POST requests to Serv-U with `Content-Encoding: deflate` headers — high volume or malformed requests indicate exploitation attempts </td> </tr> </tbody> </table> Hunting Hypothesis: "If CVE-2026-28318 is being exploited against our Serv-U instances, we will see anomalous POST request patterns with deflate encoding, potentially followed by service degradation or unexpected outbound connections from the Serv-U host." <ol start="3"> <li> APT42 Credential Harvesting </li> </ol> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> Detection Approach </th> </tr> </thead> <tbody> <tr> <td> T1528 (Steal Application Access Token) </td> <td> Monitor Azure AD/Entra ID for suspicious OAuth application consent grants, especially from unfamiliar app IDs </td> </tr> <tr> <td> T1078.004 (Cloud Accounts) </td> <td> Alert on impossible travel, new device enrollments, or MFA bypass events in cloud identity logs </td> </tr> <tr> <td> T1114.002 (Email Collection — Remote) </td> <td> Monitor for new mail forwarding rules or delegate access grants in Exchange Online </td> </tr> <tr> <td> T1539 (Steal Web Session Cookie) </td> <td> Detect AiTM proxy indicators — certificate mismatches on authentication pages, unusual redirect chains </td> </tr> </tbody> </table> <ol start="4"> <li> ICS/OT Monitoring </li> </ol> <table> <thead> <tr> <th> ATT&CK Technique </th> <th> Detection Approach </th> </tr> </thead> <tbody> <tr> <td> T1133 (External Remote Services) </td> <td> Scan for internet-exposed ATG systems, RTU management interfaces, and SCADA HMI panels </td> </tr> <tr> <td> T1078.001 (Default Credentials) </td> <td> Audit all OT-adjacent systems for factory-default credentials </td> </tr> <tr> <td> T0855 (Unauthorized Command Message) </td> <td> If OT network monitoring exists, alert on unexpected Modbus/DNP3 commands to RTU500 units </td> </tr> </tbody> </table> <h3> Investigation Triggers </h3> Escalate to incident response if any of the following are observed: <ul> <li> finger.exe execution on any endpoint (near-zero false positive rate in enterprise) </li> <li> Portable Python interpreter in user-writable directory with scheduled task persistence </li> <li> Serv-U service crash or restart correlated with high-volume POST requests </li> <li> New OAuth application consent in Azure AD not matching approved application list </li> <li> Outbound connections from OT network segments to internet destinations </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits Systems) </h3> <ul> <li> Primary threat: APT42 credential harvesting targeting financial sector cloud accounts; UNC6861 social engineering </li> <li> Priority action: Audit all OAuth application consents in Azure AD tenant serving treasury/revenue systems. Implement conditional access policies requiring compliant devices for financial application access. </li> <li> Detection focus: Monitor for anomalous access patterns to financial databases, especially after-hours token usage or access from new geographic locations (T1078.004) </li> </ul> <h3> Energy (State Utility Partnerships, Grid Interconnects) </h3> <ul> <li> Primary threat: Hitachi Energy RTU500/MACH HiDraw/ITT600 vulnerabilities; Volt Typhoon pre-positioning (currently quiet but historically targets energy) </li> <li> Priority action: Request written attestation from utility partners on Hitachi Energy firmware patch status. Verify network segmentation between IT and OT environments at state-utility interconnection points. </li> <li> Detection focus: Monitor for reconnaissance against SCADA management interfaces (T1133); alert on any new remote access connections to OT segments </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: APT42 targeting healthcare for intelligence collection; SNOWLIGHT malware updated with healthcare targeting; ransomware seasonal risk </li> <li> Priority action: Verify endpoint protection coverage on all systems processing PHI. Ensure offline backup integrity for Medicaid claims processing systems. </li> <li> Detection focus: Monitor for lateral movement from compromised credentials (T1078.004 → T1021); alert on bulk data access to health records databases </li> </ul> <h3> Government (All Executive Branch Agencies) </h3> <ul> <li> Primary threat: UNC6861 ClickFix campaign directly targeting U.S. government; UNC5475 (new China-nexus actor); APT42 credential theft </li> <li> Priority action: Issue immediate security awareness alert on ClickFix/fake CAPTCHA lures. Deploy LOLBin detection rules for finger.exe/curl/tar chains. Review all scheduled tasks created in the past 30 days for anomalies. </li> <li> Detection focus: Full LOLBin execution chain monitoring (T1218, T1105, T1059.006); Azure AD consent grant monitoring (T1528) </li> </ul> <h3> Aviation/Logistics (State DOT, Airport Authorities, Fleet Operations) </h3> <ul> <li> Primary threat: ATG system exposure at fleet fueling depots; ICS vulnerabilities in transportation SCADA; supply chain risk from MSP access </li> <li> Priority action: Conduct immediate scan for internet-exposed Automatic Tank Gauge systems at all state fleet fueling locations. Change default credentials on all fuel monitoring equipment. Verify MSP access controls and session logging. </li> <li> Detection focus: Monitor for unauthorized access to fleet management systems; alert on new remote access sessions from MSP IP ranges outside maintenance windows (T1133, T1078.001) </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> IT Operations </td> <td> Patch SolarWinds Serv-U to version 15.5.4 Hotfix 1 to remediate CVE-2026-28318 (CISA KEV, actively exploited). Verify Content-Encoding filtering per SolarWinds Trust Center advisory. </td> </tr> <tr> <td> CRITICAL </td> <td> SOC </td> <td> Deploy ClickFix detection rules — alert on finger.exe, curl.exe, or tar.exe execution from browser parent processes. Block NETSUPPORT RAT network signatures at perimeter. </td> </tr> <tr> <td> HIGH </td> <td> CISO/CIO </td> <td> Authorize emergency patching window for Serv-U and confirm Chrome 149 (v149.0.7827.53+) deployment status across all managed endpoints (remediates CVE-2026-10881, CVSS 9.6 sandbox escape). </td> </tr> <tr> <td> HIGH </td> <td> Security Awareness </td> <td> Issue flash alert to all employees on ClickFix/fake CAPTCHA social engineering — "Never run commands from a website claiming to verify you are human." </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> HIGH </td> <td> IT Operations </td> <td> Verify Chrome auto-update deployment — audit any systems where Chrome version is below 149.0.7827.53. Investigate update failures exceeding 48 hours. </td> </tr> <tr> <td> HIGH </td> <td> OT/Infrastructure </td> <td> Engage utility partners on Hitachi Energy RTU500 firmware status (ICSA-26-155-04). Request written patch attestation from SCADA vendors. </td> </tr> <tr> <td> HIGH </td> <td> IT Operations </td> <td> Audit state fleet fueling infrastructure for internet-exposed ATG systems. Implement network segmentation per CISA ATG hardening guidance. Rotate all default credentials on tank monitoring systems. </td> </tr> <tr> <td> MODERATE </td> <td> SOC </td> <td> Review Azure AD audit logs for suspicious OAuth application consent grants in the past 90 days. Revoke any unrecognized application permissions. </td> </tr> <tr> <td> MODERATE </td> <td> IT Operations </td> <td> Assess exposure to CVE-2026-20230 (Cisco Unified Communications Manager SSRF-to-root) and CVE-2026-35616 (FortiClient EMS) — both likely candidates for near-term KEV addition. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> MODERATE </td> <td> SOC </td> <td> Develop APT42 detection content — implement monitoring for OAuth consent phishing, suspicious Azure AD app registrations, anomalous mail forwarding rules, and AiTM proxy indicators. </td> </tr> <tr> <td> MODERATE </td> <td> CISO </td> <td> Request threat briefing on UNC5475 from MS-ISAC or CISA regional coordinator. Assess whether state systems match this new China-nexus actor's targeting profile. </td> </tr> <tr> <td> MODERATE </td> <td> CISO/IR </td> <td> Conduct tabletop exercise simulating a ClickFix-to-RAT compromise scenario — test detection, containment, and credential reset procedures. </td> </tr> <tr> <td> STANDARD </td> <td> IT Operations </td> <td> Establish quarterly OT threat briefing cadence with critical infrastructure partners (water, power, transportation) to address the visibility gap in state-adjacent ICS/SCADA environments. </td> </tr> <tr> <td> STANDARD </td> <td> CISO </td> <td> Evaluate supplementary threat intelligence feeds (MS-ISAC alerts RSS, Recorded Future, Flashpoint) to address persistent OSINT collection gaps affecting ransomware and legislative monitoring. </td> </tr> </tbody> </table> <h3> Executive/IR Preparedness </h3> <ul> <li> Incident response readiness: Ensure IR playbooks include scenarios for file transfer infrastructure compromise (Serv-U), RAT deployment via social engineering (NETSUPPORT), and cloud identity compromise (OAuth token theft). Verify that legal counsel and communications teams are briefed on notification requirements for PII-holding systems. </li> <li> Decision authority: Pre-authorize emergency patching for any future CISA KEV additions affecting state infrastructure — the 24-hour response window leaves no room for approval delays. </li> <li> Partner coordination: Establish or verify communication channels with utility SCADA operators for coordinated vulnerability response. The five ICS advisories this week demonstrate that state government's risk extends beyond its own network boundary. </li> </ul> <h2> IOC Blocking Guidance </h2> The following section provides indicators associated with threats discussed in this report for deployment to perimeter controls, EDR block lists, and SIEM correlation rules. Note: Confirmed, sourced IOCs for the UNC6861, APT42, and UNC5475 campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and associated partner indicator packages. State agencies with MS-ISAC membership should review the current indicator packages for UNC6861 and APT42 campaigns directly through the MS-ISAC portal. No IOCs are published inline at this time to avoid disseminating unverified indicators. Contact your Anomali account team for curated, validated indicator packages tied to the specific threat actors and CVEs covered in this report. <h2> Bottom Line </h2> The threat environment facing state government IT remains at ELEVATED — not because of a single catastrophic event, but because of the simultaneous pressure across multiple attack surfaces: actively exploited file transfer vulnerabilities, social engineering campaigns purpose-built for government targets, expanding Chinese cyber operations against sub-national entities, and a wave of ICS vulnerabilities in utility partner infrastructure. The decisions made this week — whether to authorize emergency Serv-U patching, whether to deploy ClickFix detection rules, whether to engage utility partners on RTU500 firmware — will determine whether your agency is positioned ahead of exploitation or responding to an incident. The adversaries targeting state government are not waiting. Neither should we. <h2> Closing </h2> Published: June 8, 2026 | Anomali CTI Desk For questions or additional indicator packages, contact your Anomali account team or the MS-ISAC SOC.

FEATURED RESOURCES

June 8, 2026

Anomali Cyber Watch

Iran Declares Ceasefire Over: Cyber Retaliation Window Opens for Critical Infrastructure

June 8, 2026

Anomali Cyber Watch

Public Sector

Active Exploitation of SolarWinds Serv-U, New China-Nexus Actor Targeting Government, and ICS Vulnerabilities Demand Immediate State Agency Action

June 5, 2026

Anomali Cyber Watch

Iran's Cyber Offensive Enters a Dangerous New Phase: What CISOs Must Know on Day 98

Explore All