China’s Pre-Summit Cyber Offensive Accelerates as RMM Supply Chain Attacks Surge: What State Government CISOs Must Do Now

Public Sector

Published on

April 30, 2026

Table of Contents

Threat Assessment Level: HIGH Maintained from prior cycle. The convergence of China-nexus prepositioning activity ahead of the 14–15 May Trump-Xi summit, expanding RMM supply chain weaponization, and two critical vulnerabilities with public exploit code sustains the HIGH threat posture for state government networks. <h2> Introduction </h2> State government IT leaders face a threat environment that is intensifying on multiple fronts simultaneously. A newly disclosed Chinese espionage group — Shadow-Earth-053 — has compromised government and defense networks across eight countries using the same prepositioning playbook as Volt Typhoon. Three legitimate remote management tools are now being weaponized against the MSP-dependent IT model that most state agencies rely on. And two critical vulnerabilities — one in the Linux kernel, one in SCADA/HMI software — have public exploit code available today. This is not a theoretical risk window. The 14–15 May Trump-Xi summit creates a geopolitical trigger point that historically correlates with intensified Chinese cyber operations. State agencies have approximately two weeks to harden their posture before the highest-probability attack window opens. <h2> What Changed </h2> The past 72 hours brought six developments that materially alter the state government threat landscape: <ol> <li> Shadow-Earth-053 disclosed — A new China-nexus group has infiltrated 12+ government and defense networks across Poland, Pakistan, Thailand, Malaysia, India, Myanmar, Sri Lanka, and Taiwan since December 2024. TrendAI researchers explicitly compare it to Volt Typhoon and Salt Typhoon, warning of destructive prepositioning capability. </li> <li> RMM tool abuse tripled — ImmyBot and Action1 join ConnectWise ScreenConnect as phishing-delivered remote access tools. State agencies that whitelist RMM vendor domains for MSP operations are directly exposed. </li> <li> CVE-2026-31431 “Copy Fail” — A Linux kernel privilege escalation vulnerability (CVSS 7.8) affecting all distributions since 2017 now has a 732-byte public exploit. Any unprivileged user can obtain root. </li> <li> CVE-2025-69985 FUXA SCADA RCE — A CVSS 9.8 authentication bypass in the FUXA web-based SCADA/HMI platform enables unauthenticated remote code execution. Full exploit published on Exploit-DB. </li> <li> GopherWhisper full toolset revealed — ESET published complete technical details on this China-aligned APT that uses Microsoft 365 Outlook, Slack, and Discord APIs for command-and-control against government targets. Directly relevant to any state M365 tenant. </li> <li> Qilin ransomware BYOVD EDR killer validated — Cisco Talos and Europol confirmed a Qilin ransomware module capable of disabling 300+ security products before encryption begins, including major EDR platforms relied upon by state agencies. This capability materially degrades defender advantage and coincides with active Medusa ransomware deployment through compromised MSP infrastructure. </li> </ol> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Relevance to State Gov </th> </tr> </thead> <tbody> <tr> <td> 23 Apr 2026 </td> <td> CISA confirms Volt Typhoon and Flax Typhoon remain pre-positioned in U.S. critical infrastructure </td> <td> Direct threat to state-managed utilities and 911 systems </td> </tr> <tr> <td> 24 Apr 2026 </td> <td> CVE-2025-69985 FUXA SCADA RCE published (CVSS 9.8) </td> <td> State water/wastewater SCADA at risk </td> </tr> <tr> <td> 27–28 Apr 2026 </td> <td> CVE-2026-32202 Windows NTLM zero-click exploitation confirmed (APT28/Fancy Bear) </td> <td> State Windows domain environments targeted </td> </tr> <tr> <td> 28 Apr 2026 </td> <td> CVE-2024-1708 ConnectWise ScreenConnect added to CISA KEV; Storm-1175 deploying Medusa ransomware via MSPs </td> <td> State MSP supply chain directly threatened </td> </tr> <tr> <td> 28 Apr 2026 </td> <td> Qilin ransomware BYOVD EDR killer validated by Cisco Talos and Europol — disables 300+ security products </td> <td> State endpoint protection at risk </td> </tr> <tr> <td> 29 Apr 2026 </td> <td> CISA publishes OT Zero Trust guidance </td> <td> Defensive framework for state utilities </td> </tr> <tr> <td> 30 Apr 2026 </td> <td> Shadow-Earth-053 China-nexus group disclosed — 12+ government networks compromised </td> <td> Pattern matches Volt Typhoon prepositioning </td> </tr> <tr> <td> 30 Apr 2026 </td> <td> ImmyBot and Action1 RMM phishing campaigns documented </td> <td> State MSP tool whitelist exploitable </td> </tr> <tr> <td> 30 Apr 2026 </td> <td> CVE-2026-31431 “Copy Fail” Linux kernel privesc — public PoC </td> <td> All state Linux infrastructure affected </td> </tr> <tr> <td> 30 Apr 2026 </td> <td> GopherWhisper full toolset published — M365 API abuse for C2 </td> <td> State M365 tenant is a viable C2 channel </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. China-Nexus Prepositioning: Five Groups, One Strategy </h3> The U.S. state government sector now faces five tracked China-aligned threat groups with government-targeting prepositioning behavior: <table> <thead> <tr> <th> Group </th> <th> Tooling </th> <th> Primary Targets </th> <th> Status </th> </tr> </thead> <tbody> <tr> <td> Volt Typhoon </td> <td> Living-off-the-land </td> <td> U.S. critical infrastructure </td> <td> Active, pre-positioned (CISA confirmed) </td> </tr> <tr> <td> Flax Typhoon (Integrity Technology Group) </td> <td> Compromised IoT device networks </td> <td> U.S. infrastructure </td> <td> Active, pre-positioned (CISA confirmed) </td> </tr> <tr> <td> Salt Typhoon </td> <td> Telecom-focused implants </td> <td> U.S. telecommunications </td> <td> Active </td> </tr> <tr> <td> Shadow-Earth-053 </td> <td> ShadowPad, NoodleRat, Godzilla web shells </td> <td> Government, defense (8 countries) </td> <td> Newly disclosed </td> </tr> <tr> <td> GopherWhisper </td> <td> LaxGopher, RatGopher, SSLORDoor, BoxOfFriends </td> <td> Mongolian government (M365 API C2) </td> <td> Full toolset now public </td> </tr> </tbody> </table> Shadow-Earth-053 exploits ProxyLogon (CVE-2021-26855/26857/26858/27065) and a newer vulnerability called React2Shell (CVE-2025-55182, CVSS 10.0) for initial access. The group deploys ShadowPad — a backdoor shared across the Chinese APT ecosystem since 2019 — and NoodleRat on Linux targets. They use Godzilla web shells for persistence and abuse AnyDesk for lateral delivery. The strategic concern: TrendAI researchers explicitly state that Shadow-Earth-053’s behavior mirrors Volt Typhoon’s prepositioning doctrine — compromising networks and maintaining persistent access for potential future destructive operations. The timing ahead of the 14–15 May Trump-Xi summit is not coincidental; Chinese cyber operations historically intensify around major diplomatic events. GopherWhisper’s M365 abuse is particularly relevant to state government. The group uses Microsoft Graph API to send C2 commands through Outlook mailboxes, Slack channels, and Discord servers. ESET recovered over 9,000 C2 messages from a single campaign against a Mongolian government institution. Any state agency running M365 should assume this C2 technique could be used against their tenant. <h3> 2. Critical Vulnerabilities Demanding Immediate Action </h3> CVE-2026-31431 — “Copy Fail” Linux Kernel Privilege Escalation (CVSS 7.8) A logic bug in the Linux kernel’s authencesn AEAD template allows any unprivileged local user to modify in-memory copies of setuid-root binaries and obtain a root shell. The vulnerability has existed in all Linux distributions since 2017. The proof-of-concept is a 732-byte Python script — trivial to execute, requiring no specialized tooling. High-risk state assets: Multi-tenant servers, container infrastructure (Kubernetes, Docker), CI/CD runners, shared hosting environments, and any Linux system where non-root users have shell access. CVE-2025-69985 — FUXA SCADA/HMI Authentication Bypass + RCE (CVSS 9.8) FUXA is a web-based SCADA/HMI platform used for industrial process visualization. Versions ≤ 1.2.8 contain an authentication bypass that allows unauthenticated attackers to execute arbitrary Node.js code on the server by spoofing the HTTP Referer header to the /api/runscript endpoint. High-risk state assets: Water treatment facilities, wastewater systems, small utility operations, and any OT environment using FUXA for process monitoring. The full exploit is published on Exploit-DB. <h3> 3. Ransomware Landscape: Qilin’s EDR Killer Changes the Game </h3> While no new state/local government ransomware incident was reported in this cycle, the Qilin ransomware group’s BYOVD-based EDR killer — validated by both Cisco Talos and Europol — represents a qualitative escalation. This module can disable over 300 security products before encryption begins, including major EDR platforms that state agencies rely on. Active ransomware groups with confirmed government targeting updated in the past 72 hours include Qilin , Everest , and WorldLeaks (a newer group). The Medusa ransomware continues to be deployed through compromised MSP infrastructure via Storm-1175. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional China-nexus scanning/exploitation of state Exchange servers and network appliances </td> <td> >70% </td> <td> 7–14 days </td> <td> Pre-summit pattern; Shadow-Earth-053 actively exploiting ProxyLogon; Volt Typhoon confirmed active </td> </tr> <tr> <td> Opportunistic exploitation of FUXA SCADA instances (CVE-2025-69985) </td> <td> 40–60% </td> <td> 7 days </td> <td> Public PoC on Exploit-DB; Shodan-discoverable targets; CVSS 9.8 </td> </tr> <tr> <td> Additional RMM platforms weaponized via phishing (Atera, NinjaRMM, Syncro) </td> <td> 40–60% </td> <td> 14 days </td> <td> Clear trend line — three tools in rapid succession; technique is trivially adaptable </td> </tr> <tr> <td> CVE-2026-31431 “Copy Fail” weaponized for container escape in cloud environments </td> <td> 25–40% </td> <td> 14 days </td> <td> Simple PoC; high-value multi-tenant targets; container escape is a premium capability </td> </tr> <tr> <td> Ransomware incident at a U.S. state or local government agency </td> <td> 50–70% </td> <td> 14 days </td> <td> Qilin/Everest/Medusa actively targeting gov; EDR killer capability reduces defender advantage </td> </tr> <tr> <td> China-nexus destructive operation triggered by summit diplomatic failure </td> <td> 10–20% </td> <td> 15–30 days </td> <td> Prepositioning confirmed; destructive capability assessed; low probability absent major escalation </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK Technique </th> <th> Detection Approach </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> Unauthorized RMM agent installations </td> <td> T1219 (Remote Access Software) </td> <td> Alert on MSI/EXE installations matching RMM agent patterns (ImmyBot, Action1, ConnectWise) outside approved change windows. Monitor for new services with RMM vendor names. </td> </tr> <tr> <td> CRITICAL </td> <td> ProxyLogon exploitation indicators </td> <td> T1190 (Exploit Public-Facing Application) </td> <td> Monitor Exchange Server IIS logs for /owa/auth/ anomalies, unexpected .aspx files in inetpub, and Godzilla web shell signatures. </td> </tr> <tr> <td> HIGH </td> <td> M365 OAuth application consent anomalies </td> <td> T1550.001 (Application Access Token) </td> <td> Alert on new OAuth app consents with Mail.Read, Mail.Send, or Files.ReadWrite.All permissions. Monitor Microsoft Graph API call volumes per application. </td> </tr> <tr> <td> HIGH </td> <td> Linux privilege escalation attempts </td> <td> T1068 (Exploitation for Privilege Escalation) </td> <td> Monitor for unexpected setuid binary modifications, authencesn kernel module loading, and privilege transitions from unprivileged to root. </td> </tr> <tr> <td> HIGH </td> <td> VBS script execution from user downloads </td> <td> T1059.005 (Visual Basic) </td> <td> Alert on cscript.exe or wscript.exe executing .vbs files from Downloads, Temp, or browser cache directories. </td> </tr> <tr> <td> MEDIUM </td> <td> DLL sideloading via Microsoft binaries </td> <td> T1574.002 (DLL Side-Loading) </td> <td> Monitor for OFFCLN.EXE loading unexpected DLLs (OCLEAN.DLL, DWINTL.DLL). Flag any Microsoft-signed binary loading DLLs from non-standard paths. </td> </tr> <tr> <td> MEDIUM </td> <td> Outbound connections to cloud collaboration APIs from servers </td> <td> T1071.003 (Mail Protocols), T1567.002 (Exfiltration to Cloud Storage) </td> <td> Servers should not be making API calls to Slack, Discord, or Microsoft Graph unless explicitly authorized. Alert on unexpected outbound to api.slack.com, discord.com/api, graph.microsoft.com from server segments. </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: A China-nexus actor has deployed a web shell on an Exchange server via ProxyLogon. </li> </ol> <ul> <li> Hunt: Search for .aspx files created after the last patching cycle in Exchange virtual directories. Check for Godzilla web shell signatures (Base64-encoded command execution patterns). Review Exchange HTTP logs for anomalous POST requests to non-standard paths. </li> </ul> <ol> <li> Hypothesis: GopherWhisper-style M365 API abuse is occurring in the state tenant. </li> </ol> <ul> <li> Hunt: Query Azure AD sign-in logs for OAuth applications with Mail.ReadWrite or Mail.Send permissions that were consented in the last 90 days. Check for high-volume Microsoft Graph API calls from unfamiliar application IDs. Look for mailbox rules forwarding to external addresses. </li> </ul> <ol> <li> Hypothesis: CVE-2026-31431 has been exploited on a multi-tenant Linux host. </li> </ol> <ul> <li> Hunt: Review auditd logs for unexpected execve calls transitioning from low-privilege UIDs to UID 0. Check for recently modified setuid binaries. Monitor for authencesn references in kernel logs. </li> </ul> <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits Systems) </h3> <ul> <li> Primary threat: Ransomware (Qilin, Medusa) targeting financial processing systems; DPRK-nexus actors (LABYRINTH CHOLLIMA) conducting financially motivated operations </li> <li> Priority action: Ensure offline backups of benefits payment databases and tax processing systems are current and tested. Deploy behavioral detection for BYOVD attacks (Qilin’s EDR killer targets financial sector security tools). Monitor for XcTRAT indicators on systems processing financial data. </li> <li> ATT&CK focus: T1486 (Data Encrypted for Impact), T1490 (Inhibit System Recovery), T1219 (Remote Access Software) </li> </ul> <h3> Energy (State-Managed Utilities, Grid Coordination) </h3> <ul> <li> Primary threat: CVE-2025-69985 FUXA SCADA RCE; Volt Typhoon prepositioning in energy infrastructure; Shadow-Earth-053 targeting critical infrastructure </li> <li> Priority action: Immediately inventory all FUXA deployments. Isolate any instance running version ≤ 1.2.8 from network access. Verify OT network segmentation prevents IT-to-OT lateral movement. Implement CISA’s new OT Zero Trust guidance (published 29 April 2026) as a framework for architecture review. </li> <li> ATT&CK focus: T1190 (Exploit Public-Facing Application), T1210 (Exploitation of Remote Services), T0855 (Unauthorized Command Message — ICS) </li> </ul> <h3> Healthcare (Medicaid Systems, State Health Agencies) </h3> <ul> <li> Primary threat: Ransomware disrupting benefits processing and patient data systems; RMM tool abuse via healthcare MSPs; Linux privilege escalation on clinical data servers </li> <li> Priority action: Verify all MSP-managed healthcare systems use only authorized RMM tools. Patch Linux servers hosting Medicaid/benefits databases against CVE-2026-31431 as highest priority (PHI exposure risk from privilege escalation). Review healthcare MSP contracts for RMM tool specifications. </li> <li> ATT&CK focus: T1219 (Remote Access Software), T1068 (Exploitation for Privilege Escalation), T1567 (Exfiltration Over Web Service) </li> </ul> <h3> Government (Executive Branch Agencies, Law Enforcement, Elections) </h3> <ul> <li> Primary threat: China-nexus espionage (Shadow-Earth-053, Volt Typhoon, GopherWhisper) targeting government networks for intelligence collection and prepositioning; APT28 NTLM credential theft; OAuth/phishing credential compromise </li> <li> Priority action: Verify all Exchange Servers are patched against the full ProxyLogon chain (CVE-2021-26855/26857/26858/27065) — Shadow-Earth-053 is actively exploiting these in 2026. Audit M365 OAuth application consents across all agency tenants. Implement FIDO2/phishing-resistant MFA for all privileged accounts. Brief election infrastructure teams on the heightened China-nexus threat window through mid-May. </li> <li> ATT&CK focus: T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1550.001 (Application Access Token), T1003 (OS Credential Dumping) </li> </ul> <h3> Aviation / Logistics (State DOT, Airport Authorities, Port Systems) </h3> <ul> <li> Primary threat: Shadow-Earth-053 explicitly targets transportation sector; Volt Typhoon pre-positioned in transportation infrastructure per CISA; supply chain compromise via logistics MSPs </li> <li> Priority action: Review network segmentation between IT and operational technology in transportation management systems. Audit all remote access tools used by transportation MSPs and maintenance contractors. Monitor for ShadowPad and NoodleRat indicators on systems managing traffic control, port operations, or aviation coordination. </li> <li> ATT&CK focus: T1219 (Remote Access Software), T1071.001 (Web Protocols — ShadowPad C2), T1036 (Masquerading) </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Initiate emergency patching of all Linux servers against CVE-2026-31431 — prioritize multi-tenant hosts, container infrastructure, and CI/CD runners </td> <td> IT Operations </td> </tr> <tr> <td> Verify Exchange Server patch status for ProxyLogon chain (CVE-2021-26855/26857/26858/27065) across all agencies </td> <td> IT Operations </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Inventory all FUXA SCADA/HMI deployments across state agencies and utility partners; isolate any instance running version ≤ 1.2.8 and upgrade </td> <td> OT Security / Utility Coordination </td> </tr> <tr> <td> Compile definitive inventory of authorized RMM platforms and their expected C2 domains; create SOC detection rules for any RMM agent not on the approved list </td> <td> IT Operations / SOC </td> </tr> <tr> <td> Add FABLETIGER/ShadowAgent and LABYRINTH CHOLLIMA/XcTRAT hashes to EDR watchlist (SHA-256, SHA-1, MD5 indicators listed above) </td> <td> SOC / Endpoint Ops </td> </tr> <tr> <td> Review M365 tenant OAuth application consent policies — require admin consent for all third-party apps; audit existing consented apps for Mail.Read, Mail.Send, Files.ReadWrite permissions </td> <td> Identity & Access Management </td> </tr> <tr> <td> Brief all agency CISOs on the China-nexus pre-summit threat window (through 15 May) with specific indicators and hunting guidance </td> <td> CISO Office </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Action </th> <th> Responsible Team </th> </tr> </thead> <tbody> <tr> <td> Establish standing intelligence watch for China-nexus prepositioning through mid-May summit period; increase monitoring cadence for Exchange, VPN, and network appliance exploitation </td> <td> CISO Office / SOC </td> </tr> <tr> <td> Commission strategic assessment of AI agent identity risks for state IAM — evaluate whether current policies distinguish human vs. machine identities in Azure AD/Entra ID </td> <td> CISO Office / IAM </td> </tr> <tr> <td> Implement CISA OT Zero Trust guidance as framework for state utility OT architecture review </td> <td> OT Security / CISO Office </td> </tr> <tr> <td> Review and update incident response playbooks for ransomware scenarios involving EDR bypass (Qilin BYOVD technique) — ensure out-of-band detection and response capabilities exist </td> <td> IR Team / CISO Office </td> </tr> <tr> <td> Evaluate container security posture — ensure pod security policies prevent privilege escalation and that kernel patching processes cover container host OS </td> <td> Cloud / DevOps </td> </tr> </tbody> </table> <h3> Executive / IR Preparedness </h3> <ul> <li> Brief the Governor’s office on the elevated China-nexus threat posture and the May summit timeline. Frame as: “Foreign intelligence services are pre-positioning in government networks ahead of a diplomatic event. We are taking specific hardening actions.” </li> <li> Test ransomware response procedures — specifically the scenario where EDR is disabled by a BYOVD attack. Ensure backup restoration procedures work without endpoint security tooling. </li> <li> Review cyber insurance coverage for state agencies — confirm that MSP supply chain compromise and nation-state attacks are covered scenarios. </li> <li> Establish communication channel with CISA Region [X] for real-time threat sharing during the May summit window. </li> </ul> <h2> Bottom Line </h2> The next two weeks represent a defined threat window for state government networks. The convergence of Chinese prepositioning operations, expanding supply chain attack surfaces, and critical vulnerabilities with public exploits creates a situation where inaction carries measurable risk. The intelligence is clear. The indicators are specific. The timeline is compressed. State IT leaders who act on the immediate recommendations in this bulletin — blocking unauthorized RMM domains, patching Linux kernels, verifying Exchange Server status, and briefing their teams on the China-nexus threat — will materially reduce their exposure during the highest-risk period. Those who wait will be responding to incidents instead of preventing them.

FEATURED RESOURCES

April 30, 2026

Anomali Cyber Watch

The Cyber Front Intensifies: Iranian Operations Expand Into New Domains as Diplomacy Collapses

April 30, 2026

Anomali Cyber Watch

Public Sector

China’s Pre-Summit Cyber Offensive Accelerates as RMM Supply Chain Attacks Surge: What State Government CISOs Must Do Now

April 29, 2026

Anomali Cyber Watch

Iran’s Cyber War Isn’t Waiting for a Ceasefire — and Neither Should You

Explore All