China-Nexus Espionage Groups Refresh Government-Targeting Tooling as OAuth Bypass Campaigns Surge

Public Sector

Published on

May 18, 2026

Table of Contents

Threat Assessment Level: ELEVATED (trending toward HIGH) Two Chinese intelligence-linked APT groups refreshed government-targeting malware this week. Active phishing campaigns can bypass MFA on Microsoft 365 tenants. A newly disclosed technique turns Microsoft Teams and Edge into attack tools. State government CISOs must act now. <h2> Executive Summary </h2> State government networks face a convergence of threats this week that demands immediate attention from senior IT leadership. China-nexus espionage actors CIRCUITPANDA and EMISSARY PANDA (APT27) both refreshed government-targeting indicators on May 18, signaling active operational interest. Simultaneously, Tycoon2FA and an AI-augmented variant are running device code phishing campaigns that bypass multi-factor authentication on Microsoft 365 — the identity backbone for most state agencies. A newly published defense evasion technique allows attackers to execute arbitrary code through signed Microsoft Electron applications (Teams, Edge, VS Code), defeating AppLocker and many EDR solutions. These developments arrive alongside eight new Siemens ICS advisories affecting SIMATIC and Ruggedcom systems deployed in state water treatment and transportation infrastructure, and an ongoing supply chain poisoning campaign targeting GitHub Actions CI/CD pipelines. <h2> What Changed This Week </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Significance </th> </tr> </thead> <tbody> <tr> <td> May 11–15 </td> <td> TeamPCP/Shai-Hulud compromised 170+ npm packages; OpenAI employee breach confirmed </td> <td> State developer environments and CI/CD pipelines at risk </td> </tr> <tr> <td> May 14 </td> <td> 8 Siemens ICS advisories published (SIMATIC CN 4100, Ruggedcom ROX, ROS#, gWAP, Teamcenter) </td> <td> Direct exposure for state water/transportation OT systems </td> </tr> <tr> <td> May 15 </td> <td> CISA adds new entry to Known Exploited Vulnerabilities catalog </td> <td> Federal patching mandate; state agencies should follow suit </td> </tr> <tr> <td> May 16 </td> <td> Kimsuky/APT43 updates credential harvesting via weaponized VS Code extensions using GitHub C2 </td> <td> State IT personnel targeted via rapport-building emails </td> </tr> <tr> <td> May 16 </td> <td> GitHub Actions cache poisoning campaign updated — cascading supply chain compromise </td> <td> Any state agency using GitHub Actions is potentially exposed </td> </tr> <tr> <td> May 17 </td> <td> CVE-2025-53690 (Sitecore CMS) confirmed exploited; "WeepSteel" backdoor deployed against government portals </td> <td> Direct threat to state citizen-facing web applications </td> </tr> <tr> <td> May 17 </td> <td> NightshadeC2 botnet confirmed — "UAC Prompt Bombing" defeats EDR, delivered via ClickFix social engineering </td> <td> New evasion technique targeting endpoint defenses </td> </tr> <tr> <td> May 18 </td> <td> CIRCUITPANDA IOCs refreshed — government and technology sector targeting (confidence 90) </td> <td> Active China-nexus espionage preparation against government </td> </tr> <tr> <td> May 18 </td> <td> EMISSARY PANDA/Hyperbro RAT IOCs refreshed — government-only targeting </td> <td> Second China-nexus group signaling operational readiness </td> </tr> <tr> <td> May 18 </td> <td> Tycoon2FA + AI-augmented device code phishing campaigns confirmed active against M365 tenants </td> <td> MFA bypass capability targeting state identity infrastructure </td> </tr> <tr> <td> May 18 </td> <td> Electron proxy execution technique publicly disclosed (Teams, Edge, VS Code) </td> <td> Signed Microsoft binaries become living-off-the-land attack tools </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Timeframe </th> <th> Actor / Campaign </th> <th> Target </th> <th> Status </th> </tr> </thead> <tbody> <tr> <td> Ongoing </td> <td> Volt Typhoon (China) </td> <td> Critical infrastructure pre-positioning </td> <td> No new indicators — stealth operations suspected </td> </tr> <tr> <td> Ongoing </td> <td> CHATTY SPIDER / PUNK SPIDER (Akira) / ROYAL SPIDER (BlackSuit) </td> <td> State/local government ransomware </td> <td> Active groups, no confirmed state targeting this cycle </td> </tr> <tr> <td> May 11–18 </td> <td> TeamPCP / Shai-Hulud </td> <td> npm packages, CI/CD pipelines </td> <td> Active — 170+ packages compromised </td> </tr> <tr> <td> May 16–18 </td> <td> Kimsuky / APT43 (DPRK) </td> <td> Government personnel credentials </td> <td> Active — VS Code extension weaponization </td> </tr> <tr> <td> May 17–18 </td> <td> Unknown (CVE-2025-53690) </td> <td> Sitecore CMS government portals </td> <td> Actively exploited — WeepSteel backdoor </td> </tr> <tr> <td> May 18 </td> <td> CIRCUITPANDA (China) </td> <td> Government / technology sectors </td> <td> IOCs refreshed — operational preparation </td> </tr> <tr> <td> May 18 </td> <td> EMISSARY PANDA / APT27 (China) </td> <td> Government networks </td> <td> Hyperbro RAT IOCs refreshed </td> </tr> <tr> <td> May 18 </td> <td> Tycoon2FA + AI variant </td> <td> Microsoft 365 tenants </td> <td> Active campaigns — MFA bypass </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. China-Nexus Multi-Actor Espionage Pressure </h3> Three distinct Chinese intelligence-linked groups now show active indicators against government networks: <ul> <li> CIRCUITPANDA — Refreshed installation-phase malware targeting government and technology sectors. High-confidence attribution (90). Known for persistent access and data exfiltration from government systems. </li> <li> EMISSARY PANDA (APT27) — Hyperbro RAT indicators re-validated and republished with government-only targeting. Hyperbro provides full remote access with process injection capabilities for defense evasion. </li> <li> APT41 — Ongoing .NET web application exploitation campaigns against state government (tracked since earlier this cycle). </li> </ul> Additionally, the BRICKSTORM campaign targets edge network appliances, and SLICKDEMON operates through supply chain vectors. This is not a single campaign — it represents a strategic, multi-pronged intelligence collection priority by Chinese services against U.S. state government networks. Why this matters for state agencies: State governments hold millions of citizen records (tax, health, driver's license), operate critical infrastructure, and often have less mature security programs than federal agencies — making them attractive targets for espionage actors seeking data that can be correlated with federal intelligence holdings. <h3> 2. OAuth Device Code Phishing — MFA Is No Longer Sufficient </h3> The Tycoon2FA phishing-as-a-service platform and a newer AI-augmented variant are actively exploiting OAuth device code authorization flows to steal Microsoft 365 access tokens. This technique completely bypasses MFA because the victim authenticates legitimately on Microsoft's real login page — they're simply authorizing a device code the attacker controls. The AI-augmented variant (first observed April 2026) uses large language models to generate highly convincing, context-aware phishing lures that increase success rates against trained users. Attack flow: <ul> <li> Attacker generates a device code via Microsoft's OAuth endpoint </li> </ul> <ul> <li> Victim receives a convincing email/message asking them to "verify" or "authorize" a device </li> </ul> <ul> <li> Victim enters the code at microsoft.com/devicelogin and authenticates normally (including MFA) </li> </ul> <ul> <li> Attacker receives a valid OAuth token granting full mailbox and cloud access </li> </ul> <ul> <li> Attacker uses the token for email collection, lateral movement, and persistence </li> </ul> Relevant ATT&CK techniques: T1566.002 , T1528 , T1550.001 , T1114.002 , T1078.004 <h3> 3. Electron Proxy Execution — Your Own Applications Become Weapons </h3> Newly published research demonstrates that any Electron-based application can be abused for arbitrary code execution via command-line arguments: --gpu-launcher, --utility-cmd-prefix, --browser-subprocess-path, and --renderer-cmd-prefix. This affects: <ul> <li> Microsoft Teams (Teams.exe) </li> <li> Microsoft Edge (msedge.exe, msedgewebview2.exe) </li> <li> Visual Studio Code </li> <li> Any Chromium/Electron application </li> </ul> Because these are signed Microsoft binaries, they are trusted by AppLocker, WDAC, and most EDR allowlists. An attacker with initial access can execute arbitrary payloads through these applications without triggering standard detection rules. This works across Windows, macOS, and Linux. For state government: Teams and Edge are deployed on virtually every managed endpoint. This technique transforms your standard productivity tools into living-off-the-land binaries (LOLBins) that bypass your application control policies. <h3> 4. ICS/OT Vulnerability Exposure </h3> Eight Siemens advisories published May 14 affect product families commonly deployed in state government OT environments: <ul> <li> SIMATIC CN 4100 — Multiple vulnerabilities (industrial communication) </li> <li> Ruggedcom ROX — Three separate advisories covering input validation flaws, feature key vulnerabilities, and third-party component issues </li> <li> ROS# — Path traversal vulnerability </li> <li> gWAP — Remote code execution via third-party library </li> <li> Teamcenter — Multiple vulnerabilities in engineering data management </li> </ul> State water treatment facilities and transportation management systems commonly use SIMATIC and Ruggedcom equipment. These advisories represent exploitable attack surface in environments where patching is operationally complex and often delayed. <h3> 5. Supply Chain Compromise — GitHub Actions Cache Poisoning </h3> An active campaign is poisoning GitHub Actions caches to inject malicious code into CI/CD workflows. The cascading nature means a single compromised action can propagate to thousands of downstream repositories. This adds to the already-active TeamPCP/Shai-Hulud npm poisoning campaign (170+ packages compromised) and the earlier Jenkins plugin backdoor. Relevant ATT&CK techniques: T1195.002 , T1059.001 , T1552.001 , T1048 State agencies using GitHub for application development — including citizen-facing portals, internal tools, and infrastructure-as-code — are exposed if they consume community actions without pinning to verified commit SHAs. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional China-nexus IOC refreshes indicating active campaign operations </td> <td> HIGH (70%) </td> <td> 7 days </td> <td> Pattern of coordinated feed updates across multiple actor groups suggests campaign preparation </td> </tr> <tr> <td> Device code phishing attempts against state M365 tenants </td> <td> MODERATE (50%) </td> <td> 7 days </td> <td> Campaigns are active and broadly targeting government; AI augmentation increases scale </td> </tr> <tr> <td> Exploitation of Electron proxy execution in targeted intrusion </td> <td> MODERATE (45%) </td> <td> 14 days </td> <td> Technique is now public, trivially exploitable, and affects universal state applications </td> </tr> <tr> <td> CVE-2025-53690 (Sitecore) exploitation against additional state portals </td> <td> MODERATE (40%) </td> <td> 14 days </td> <td> Confirmed in-the-wild exploitation with WeepSteel backdoor; many state agencies run Sitecore </td> </tr> <tr> <td> Ransomware deployment against state government systems </td> <td> LOW-MODERATE (20%) </td> <td> 7 days </td> <td> No precursor indicators detected, but CHATTY SPIDER, PUNK SPIDER (Akira), and ROYAL SPIDER (BlackSuit) remain active against government </td> </tr> <tr> <td> Volt Typhoon/Salt Typhoon detection in state OT environments </td> <td> LOW (15%) </td> <td> 30 days </td> <td> No indicators but extreme stealth operations may be ongoing undetected </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <ol> <li> Electron Proxy Execution (HIGH — deploy immediately) </li> </ol> Hunt for command-line arguments on Electron binaries that indicate proxy execution: Process Name IN (Teams.exe, msedge.exe, msedgewebview2.exe, chrome.exe, Code.exe) AND CommandLine CONTAINS ANY ( "--gpu-launcher", "--utility-cmd-prefix", "--browser-subprocess-path", "--renderer-cmd-prefix" ) ATT&CK: T1218 (System Binary Proxy Execution) — this is effectively a new LOLBin category. Hunting hypothesis: If an attacker has achieved initial access via phishing or supply chain compromise, they may pivot to Electron proxy execution to evade EDR. Look for Teams.exe or msedge.exe spawning unexpected child processes (cmd.exe, powershell.exe, calc.exe, or any non-standard child). <ol start="2"> <li> OAuth Device Code Flow Abuse (HIGH) </li> </ol> Monitor Azure AD sign-in logs for device code authentication: SignInLogs | where AuthenticationProtocol == "deviceCode" | where UserPrincipalName !in (approved_service_accounts) | where ResultType == 0 ATT&CK: T1528 (Steal Application Access Token), T1550.001 (Use Alternate Authentication Material) Hunting hypothesis: Legitimate device code usage in state environments is limited to kiosk devices, digital signage, and specific IoT scenarios. Any device code authentication from a standard user account — especially from an unusual IP or geography — warrants immediate investigation. Additional signals: <ul> <li> Multiple device code authentications from the same IP in a short window </li> <li> Device code auth followed immediately by mail access ( T1114.002 ) </li> <li> OAuth app consent grants for unfamiliar applications (check for unexpected apps.googleusercontent[.]com client ID patterns in consent logs) </li> </ul> <ol start="3"> <li> China-Nexus IOC Blocking (HIGH) </li> </ol> Note: File hash indicators for CIRCUITPANDA and EMISSARY PANDA/Hyperbro RAT are available through Anomali ThreatStream and partner feeds. Retrieve the latest verified IOC set directly from ThreatStream prior to deployment to ensure indicator integrity and avoid false positives. Do not deploy unverified hashes to production EDR blocklists. ATT&CK: T1059 (Command and Scripting Interpreter), T1105 (Ingress Tool Transfer), T1055 (Process Injection) <ol start="4"> <li> Sitecore CMS / CVE-2025-53690 (HIGH) </li> </ol> If your agency operates Sitecore CMS instances: <ul> <li> Hunt for WeepSteel backdoor indicators (file system artifacts, unusual .NET assemblies in Sitecore directories) </li> <li> Monitor for anomalous outbound connections from web servers </li> <li> Review IIS logs for exploitation patterns against Sitecore endpoints </li> </ul> ATT&CK: T1190 (Exploit Public-Facing Application) <ol start="5"> <li> Supply Chain — GitHub Actions (MODERATE) </li> </ol> Audit: Review all .github/workflows/*.yml files for: - actions/cache usage without hash verification - Actions pinned to version tags (e.g., @v3) instead of commit SHAs - Unexpected cache restore keys or paths ATT&CK: T1195.002 (Supply Chain Compromise: Compromise Software Supply Chain) <ol start="6"> <li> Living-off-the-Land Hunting for Volt Typhoon (ONGOING) </li> </ol> Even without new indicators, proactive hunting for Volt Typhoon TTPs remains critical: <ul> <li> Unusual netsh, wmic, ntdsutil usage on network edge devices </li> <li> Anomalous SMB/WinRM lateral movement from F5 or Ivanti appliances </li> <li> Unexpected scheduled tasks on domain controllers </li> </ul> ATT&CK: T1059.001 (PowerShell), T1053.005 (Scheduled Task), T1003.003 (NTDS) <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (Revenue, Treasury, Tax Agencies) </h3> <ul> <li> Primary threat: EMISSARY PANDA (APT27) has historically targeted financial data; Hyperbro RAT provides full data exfiltration capability </li> <li> OAuth risk: Tax portals using M365 authentication are prime targets for device code phishing — taxpayer data is high-value for both espionage and fraud </li> <li> Action: Implement conditional access policies restricting device code flow; audit all OAuth app registrations in agency Azure AD tenants; ensure SAP financial systems are segmented from compromised identity paths </li> </ul> <h3> Energy (Utilities, Power, Water Treatment) </h3> <ul> <li> Primary threat: Siemens SIMATIC CN 4100 and Ruggedcom ROX vulnerabilities directly affect water treatment SCADA systems </li> <li> Volt Typhoon concern: Pre-positioning in OT environments for potential disruption remains the highest-consequence scenario </li> <li> Action: Prioritize Siemens patching (Ruggedcom ROX to v2.17.1+, ROS# to v2.2.2+); conduct network segmentation validation between IT and OT; deploy passive OT monitoring if not already in place; hunt for anomalous traffic crossing IT/OT boundaries </li> </ul> <h3> Healthcare (Health & Human Services, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware groups (CHATTY SPIDER, PUNK SPIDER/Akira) disproportionately target healthcare for maximum extortion pressure </li> <li> Data theft: China-nexus actors value health records for intelligence correlation (linking identities across datasets) </li> <li> Action: Validate offline backup integrity for Medicaid/EHR systems; ensure network segmentation isolates clinical systems; test ransomware incident response playbook; monitor for Akira/BlackSuit precursor activity (RDP brute force, VPN credential stuffing) </li> </ul> <h3> Government (Executive Agencies, Public Safety, Elections) </h3> <ul> <li> Primary threat: CIRCUITPANDA and EMISSARY PANDA are explicitly targeting government — IOCs refreshed today </li> <li> Credential theft: Tycoon2FA device code phishing targets the M365 identity layer that underpins all agency operations </li> <li> Sitecore exposure: Citizen-facing portals running Sitecore CMS are vulnerable to CVE-2025-53690 / WeepSteel </li> <li> Action: Retrieve and deploy China-nexus IOCs from Anomali ThreatStream immediately; restrict device code OAuth flow; patch or WAF-protect Sitecore instances; conduct privileged account audit focusing on accounts with access to citizen PII databases </li> </ul> <h3> Aviation / Logistics (Transportation, DOT) </h3> <ul> <li> Primary threat: Siemens Ruggedcom equipment in traffic management systems; supply chain compromise affecting fleet management software </li> <li> ICS exposure: Traffic signal controllers and intelligent transportation systems using Ruggedcom are affected by this week's advisories </li> <li> Action: Inventory all Ruggedcom deployments in transportation infrastructure; apply patches during maintenance windows; validate that traffic management networks are air-gapped or properly segmented from enterprise IT; audit third-party vendor access to transportation control systems </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> SOC </td> <td> Deploy Sysmon/EDR detection rule for Electron proxy execution arguments (--gpu-launcher, --utility-cmd-prefix, --browser-subprocess-path, --renderer-cmd-prefix) spawning child processes from Teams.exe, msedge.exe, msedgewebview2.exe </td> </tr> <tr> <td> 2 </td> <td> SOC </td> <td> Retrieve verified CIRCUITPANDA and EMISSARY PANDA file hash indicators from Anomali ThreatStream and add to EDR blocklist </td> </tr> <tr> <td> 3 </td> <td> Identity/IT Ops </td> <td> Review Azure AD sign-in logs for device code authentication flow usage — flag any unexpected grants in the last 30 days </td> </tr> <tr> <td> 4 </td> <td> Identity/IT Ops </td> <td> Create conditional access policy blocking device code flow for all users except explicitly approved service accounts (kiosk/signage devices only) </td> </tr> <tr> <td> 5 </td> <td> CISO </td> <td> Approve emergency conditional access policy change (item 4) — this blocks the primary Tycoon2FA attack path </td> </tr> <tr> <td> 6 </td> <td> Web App Team </td> <td> Confirm Sitecore CMS patch status for CVE-2025-53690; if unpatched, deploy WAF rule to block exploitation attempts immediately </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 7 </td> <td> OT Security </td> <td> Apply Siemens patches: SIMATIC CN 4100, Ruggedcom ROX (v2.17.1+), ROS# (v2.2.2+) — prioritize water treatment and transportation SCADA </td> </tr> <tr> <td> 8 </td> <td> DevOps </td> <td> Audit all GitHub Actions workflows — pin actions to commit SHAs, enable workflow hash verification, review cache restore keys </td> </tr> <tr> <td> 9 </td> <td> Security Awareness </td> <td> Deploy targeted training on device code phishing scenarios — include screenshots of legitimate microsoft.com/devicelogin page being abused </td> </tr> <tr> <td> 10 </td> <td> SOC </td> <td> Conduct proactive threat hunt for Volt Typhoon LOTL indicators on network edge devices (F5, Ivanti) — focus on unusual scheduled tasks, netsh commands, and SMB lateral movement </td> </tr> <tr> <td> 11 </td> <td> IR Team </td> <td> Validate ransomware incident response playbook — confirm offline backup integrity, communication plans, and legal/insurance notification procedures </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 12 </td> <td> CISO </td> <td> Evaluate and contract backup OSINT intelligence provider — current collection gap creates unacceptable corroboration risk </td> </tr> <tr> <td> 13 </td> <td> CISO </td> <td> Commission assessment of AppLocker/WDAC policies given Electron LOLBin disclosure — current allowlisting model may be fundamentally insufficient </td> </tr> <tr> <td> 14 </td> <td> Architecture </td> <td> Review OAuth application consent framework — implement admin consent workflow for all new app registrations; audit existing grants </td> </tr> <tr> <td> 15 </td> <td> OT Security </td> <td> Conduct network segmentation validation between IT and OT environments — verify that compromised IT credentials cannot reach SCADA systems </td> </tr> <tr> <td> 16 </td> <td> CISO </td> <td> Brief agency heads on China-nexus multi-actor espionage posture — three distinct groups targeting government simultaneously represents strategic-level threat requiring executive awareness </td> </tr> </tbody> </table> <h2> Executive / IR Preparedness </h2> Decision points requiring CISO action this week: <ul> <li> Approve device code flow restriction — This single conditional access policy change blocks the most active credential theft campaign targeting your environment. Low operational impact (few legitimate use cases), high security value. </li> </ul> <ul> <li> Authorize OSINT provider procurement — Gaps in open-source intelligence corroboration mean every threat assessment carries higher uncertainty. This is an intelligence architecture vulnerability, not just a tool outage. </li> </ul> <ul> <li> Confirm OT patch scheduling — Siemens vulnerabilities in water and transportation systems require coordination with operations teams. Initiate scheduling now for maintenance window patching. </li> </ul> Board-level talking point: "Chinese intelligence services are actively targeting state government networks through at least three separate operational groups simultaneously. Our MFA can be bypassed by currently active phishing campaigns. We are implementing emergency controls this week." <h2> Bottom Line </h2> The convergence of China-nexus espionage refreshes, MFA-bypassing credential theft campaigns, and a new defense evasion technique affecting every Microsoft endpoint creates a threat environment that demands immediate action — not next sprint, not next quarter. The six immediate actions listed above can be implemented within 24 hours and collectively address the three highest-probability attack scenarios facing state government networks this week. The conditional access policy blocking device code flow is the single highest-leverage defensive action available: one configuration change that neutralizes an entire class of active campaigns. State agencies hold data that nation-states want and operate infrastructure that adversaries seek to pre-position against. The threat actors are not waiting. Neither should we. Anomali CTI Desk | 2026-05-18 Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream and partner feeds. Distribution: TLP:GREEN — Suitable for sharing with peer state agencies and sector partners.

FEATURED RESOURCES

June 1, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Critical Window as Kinetic Conflict Reaches Day 94

June 1, 2026

Anomali Cyber Watch

Public Sector

Software Supply Chain Attacks Hit Developer Tools as Russian APT28 Expands Domestic Infrastructure

May 29, 2026

Anomali Cyber Watch

Iran's Cyber Paradox: Degraded APTs, Empowered Proxies, and the Rise of Bootkit Wipers

Explore All