Critical Infrastructure Under Siege: Splunk RCE, FortiBleed Fallout, and China's Supply Chain Offensive Converge on State Government

Public Sector

Published on

June 22, 2026

Table of Contents

Threat Assessment Level: ELEVATED Elevated from the prior week's baseline. While no confirmed compromises of state systems have been identified, the convergence of actively exploited vulnerabilities in core state IT infrastructure (Splunk SIEM, Fortinet firewalls), CISA-validated credential exposure targeting government, and expanding China-nexus supply chain operations creates a compounding risk environment that demands immediate defensive action. <h2> Introduction </h2> State government IT leaders face a threat environment this week where the tools designed to protect their networks — SIEM platforms, perimeter firewalls, and network access control systems — are themselves under active attack. A pre-authentication remote code execution vulnerability in Splunk Enterprise (CVE-2026-20253) now has public exploit code circulating freely. Tens of thousands of Fortinet administrator credentials remain exposed following the FortiBleed campaign, with CISA formally confirming government organizations among the victims. And a China-nexus actor is delivering espionage malware through compromised software installers that state IT shops may use in their imaging workflows. These are not theoretical risks. They are confirmed, active, and targeting your sector specifically. <h2> What Changed This Week </h2> <table> <thead> <tr> <th> Date </th> <th> Development </th> <th> Impact </th> </tr> </thead> <tbody> <tr> <td> 12 June </td> <td> VOID MANTICORE/Handala (IRGC-affiliated) confirms breach of California water utility </td> <td> Demonstrates active Iran-nexus targeting of U.S. water infrastructure under state jurisdiction </td> </tr> <tr> <td> 17–18 June </td> <td> 73,932 FortiGate admin credentials published following FortiBleed exploitation (CVE-2026-25815) by UNC5435 (Russia-nexus) </td> <td> Government entities explicitly tagged in criminal sales catalogs; CISA issues formal hardening directive </td> </tr> <tr> <td> 18 June </td> <td> CISA re-confirms CVE-2026-20253 (Splunk Enterprise pre-auth RCE) on Known Exploited Vulnerabilities catalog </td> <td> Public PoC available; state SIEM infrastructure directly at risk </td> </tr> <tr> <td> 18 June </td> <td> CISA publishes 6 ICS advisories covering Mitsubishi MELSEC, Schneider Electric, and Rockwell Automation products </td> <td> Directly affects SCADA/ICS systems in state-regulated water and energy utilities </td> </tr> <tr> <td> 19 June </td> <td> Active exploitation of Ivanti EPMM vulnerabilities (CVE-2026-1281, CVE-2026-1340) confirmed across 6 countries </td> <td> Government, financial services, and transportation sectors targeted </td> </tr> <tr> <td> 21 June </td> <td> ZionSiphon malware (attributed to 0xICS, pro-Iran/IRGC-affiliated) analyzed — purpose-built PLC manipulation via Modbus, DNP3, S7 </td> <td> Direct threat to water treatment SCADA systems under state oversight </td> </tr> <tr> <td> 21 June </td> <td> China-nexus SLICKDEMON malware identified in DAEMON Tools supply chain compromise </td> <td> Government among targeted sectors across 7 countries </td> </tr> <tr> <td> 21 June </td> <td> Lazarus Group (DPRK) HOPLIGHT backdoor IOC refreshed — targeting U.S. government </td> <td> Espionage-focused persistent access tool with active indicators </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Timeframe </th> <th> Actor / Campaign </th> <th> Target </th> <th> Status </th> </tr> </thead> <tbody> <tr> <td> Active since May 2026 </td> <td> UNC5435 (Russia-nexus) </td> <td> FortiGate perimeter devices globally </td> <td> Credentials published; exploitation ongoing </td> </tr> <tr> <td> 12 June 2026 </td> <td> VOID MANTICORE / Handala (Iran/IRGC) </td> <td> U.S. water utilities </td> <td> Confirmed breach </td> </tr> <tr> <td> 17–18 June 2026 </td> <td> FortiBleed credential dump </td> <td> Government, enterprise </td> <td> 73,932 credentials exposed </td> </tr> <tr> <td> 18 June 2026 </td> <td> Unknown actors </td> <td> Splunk Enterprise deployments </td> <td> Active exploitation (KEV) </td> </tr> <tr> <td> 19 June 2026 </td> <td> Unknown actors </td> <td> Ivanti EPMM (gov, finance, transport) </td> <td> Active exploitation across 6 countries </td> </tr> <tr> <td> 21 June 2026 </td> <td> 0xICS (Iran/IRGC-affiliated) </td> <td> Water treatment PLC systems </td> <td> Malware analyzed; capability confirmed </td> </tr> <tr> <td> 21 June 2026 </td> <td> China-nexus (unattributed) </td> <td> Government via DAEMON Tools </td> <td> Supply chain compromise active </td> </tr> <tr> <td> 21 June 2026 </td> <td> Lazarus Group (DPRK) </td> <td> U.S. government </td> <td> IOC active; HOPLIGHT backdoor </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. CVE-2026-20253 — Your SIEM Is the Target </h3> Splunk Enterprise versions 10.2 (below 10.2.4) and 10.0 (below 10.0.7) contain a pre-authentication remote code execution vulnerability in an unauthenticated PostgreSQL sidecar service. An attacker can create or truncate arbitrary files and chain this to full code execution — without any credentials . Why this matters for state government: Splunk is the SIEM. If an attacker compromises your SIEM, they can suppress alerts, manipulate logs, and operate undetected across your entire environment. This is not just another vulnerability — it is an attack on your ability to see attacks. A full proof-of-concept exploit is publicly available. CISA has re-confirmed active exploitation in the wild. Reference: <a href="https://advisory.splunk.com/advisories/SVD-2026-0603"> SVD-2026-0603 </a> | <a href="https://labs.watchtowr.com/why-use-app-level-auth-when-every-database-has-auth-splunk-enterprise-cve-2026-20253-pre-auth-rce/"> PoC Analysis by watchTowr </a> <h3> 2. FortiBleed — The Credential Crisis Continues </h3> The publication of 73,932 FortiGate administrator credentials following exploitation of CVE-2026-25815 by UNC5435 (Russia-nexus) remains the most operationally urgent threat to state networks. CISA's 18 June guidance formally confirms that government organizations are among those affected. The compounding risk: Stolen FortiGate admin credentials don't just give attackers firewall access. They enable: <ul> <li> Disabling security policies to allow lateral movement </li> <li> Pivoting to internal systems (Cisco ISE, Splunk, Active Directory) </li> <li> Establishing persistent VPN access that survives password resets if MFA isn't enforced </li> <li> Selling access to ransomware operators (Akira/PUNK SPIDER and Qilin/REVENANT SPIDER are both known to purchase initial access) </li> </ul> Probability assessment: Analysts assess a 75–85% probability of ransomware deployment against state infrastructure within 7–14 days for organizations that have not rotated FortiGate credentials. <h3> 3. China-Nexus Supply Chain Offensive — SLICKDEMON via DAEMON Tools </h3> A China-nexus actor has compromised the software supply chain of DAEMON Tools, a disk imaging utility, to deliver SLICKDEMON espionage malware. Government is explicitly among the targeted sectors across seven countries. Why state IT should care: DAEMON Tools is commonly used in IT deployment workflows for disk imaging, ISO mounting, and system provisioning. If your agencies use this software — even on a handful of admin workstations — the trojanized installer provides a direct path into your environment. This is the fourth simultaneous China-nexus operation targeting government identified in current collection (alongside Cisco zero-day exploitation, FishMonger/I-SOON espionage, and TeamPCP supply chain worm activity). This operational tempo is the highest observed against U.S. government targets this year. Notable absence: Volt Typhoon and Salt Typhoon — historically the primary China-nexus threats to U.S. government infrastructure — have produced zero indicators in recent collection. This may indicate retooling or migration to new infrastructure that evades current detection. Their absence should not be interpreted as reduced risk. <h3> 4. ICS/SCADA — State-Regulated Utilities Under Pressure </h3> Six ICS advisories published on 18 June affect products commonly deployed in state-regulated water and energy utilities: <table> <thead> <tr> <th> Vendor </th> <th> Product </th> <th> Risk </th> </tr> </thead> <tbody> <tr> <td> Mitsubishi </td> <td> MELSEC iQ-F Series (FX5) </td> <td> Remote denial of service </td> </tr> <tr> <td> Schneider Electric </td> <td> PowerChute Serial Shutdown </td> <td> Unauthorized access </td> </tr> <tr> <td> Schneider Electric </td> <td> EasyLogic T150 / Saitel DP </td> <td> Sensitive file access </td> </tr> <tr> <td> Rockwell Automation </td> <td> FactoryTalk Historian </td> <td> Authentication token theft + DoS </td> </tr> <tr> <td> AzeoTech </td> <td> DAQFactory </td> <td> Arbitrary code execution via .ctl file </td> </tr> </tbody> </table> Combined with the ZionSiphon malware (purpose-built PLC manipulation targeting water treatment via Modbus, DNP3, and S7 protocols) and the confirmed VOID MANTICORE breach of a California water utility, state-regulated water systems face a multi-vector threat from both nation-state actors and their hacktivist proxies. <h3> 5. Lazarus Group (DPRK) — HOPLIGHT Backdoor Targeting U.S. Government </h3> Active indicators for the Lazarus Group's HOPLIGHT backdoor have been refreshed, with U.S. government confirmed as a target sector. HOPLIGHT provides persistent remote access with capabilities to disable security tools (ATT&CK T1562.001) — a technique specifically designed to blind defenders. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Ransomware deployment against state agency via FortiBleed credentials </td> <td> 75–85% </td> <td> 7–14 days </td> <td> Credentials published; ransomware groups (Akira, Qilin) actively purchasing government access </td> </tr> <tr> <td> Splunk exploitation escalation as PoC circulates </td> <td> 70–80% </td> <td> 7 days </td> <td> Public PoC + KEV listing + high-value target (SIEM = defender blindness) </td> </tr> <tr> <td> Additional China-nexus supply chain compromises disclosed </td> <td> 60–70% </td> <td> 30 days </td> <td> Four simultaneous operations suggest coordinated campaign; additional vendors likely compromised </td> </tr> <tr> <td> ICS/SCADA exploitation attempt against state water utility </td> <td> 50–60% </td> <td> 30 days </td> <td> Confirmed breach (CA water), purpose-built malware (ZionSiphon), 6 new ICS advisories </td> </tr> <tr> <td> Volt Typhoon / Salt Typhoon re-emergence with new tooling </td> <td> 40–50% </td> <td> 60 days </td> <td> Absence from collection despite high China-nexus tempo suggests retooling, not retirement </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Hunt </th> <th> ATT&CK Technique </th> <th> Detection Approach </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> Splunk PostgreSQL sidecar exploitation </td> <td> T1190 (Exploit Public-Facing App) </td> <td> Monitor for unexpected file creation in Splunk PostgreSQL data directories; alert on non-Splunk processes spawning from splunkd context </td> </tr> <tr> <td> CRITICAL </td> <td> Unauthorized FortiGate admin sessions </td> <td> T1078 (Valid Accounts), T1133 (External Remote Services) </td> <td> Audit all FortiGate admin logins against known-good list; alert on logins from new source IPs or outside business hours </td> </tr> <tr> <td> HIGH </td> <td> HOPLIGHT behavioral indicators </td> <td> T1562.001 (Disable Security Tools) </td> <td> Alert on Windows executables that terminate or modify AV/EDR services; correlate with network C2 beaconing </td> </tr> <tr> <td> HIGH </td> <td> SLICKDEMON supply chain delivery </td> <td> T1195.002 (Supply Chain Compromise) </td> <td> Audit DAEMON Tools installations; verify installer hashes against vendor-published checksums; monitor for unexpected PowerShell execution (T1059.001) post-install </td> </tr> <tr> <td> HIGH </td> <td> FortiGate credential abuse for lateral movement </td> <td> T1556 (Modify Authentication Process) </td> <td> Monitor for new VPN profiles, unauthorized admin account creation, or firewall policy modifications </td> </tr> <tr> <td> MEDIUM </td> <td> ICS protocol anomalies (Modbus/DNP3/S7) </td> <td> T0831 (Manipulation of Control) </td> <td> Baseline normal PLC communication patterns; alert on commands from non-standard source IPs or outside maintenance windows </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> "Has our Splunk been compromised?" — Search for file creation events in PostgreSQL sidecar directories that don't correlate with legitimate Splunk operations. Check for webshells or reverse shells spawned from Splunk process trees. </li> <li> "Are stolen FortiGate credentials being used against us?" — Pull all FortiGate admin authentication logs for the past 30 days. Identify any sessions from IP addresses not in your authorized management network list. Check for admin accounts created after 17 June. </li> <li> "Is DAEMON Tools in our environment?" — Run software inventory query across all endpoints. If found, capture installer hash and compare against known-good. Monitor those hosts for SLICKDEMON indicators: unexpected PowerShell execution, new scheduled tasks, or C2 beaconing over HTTPS (T1071.001). </li> <li> "Are our security tools being disabled?" — Query EDR telemetry for service stop/disable events targeting antivirus, EDR agents, or Windows Defender. Correlate with process ancestry to identify if a HOPLIGHT-style payload is responsible. </li> </ol> <h3> IOC Blocking Guidance </h3> Validated IOCs for all campaigns discussed in this report — including HOPLIGHT, SLICKDEMON, ZionSiphon, and FortiBleed-associated infrastructure — are available through Anomali ThreatStream and partner intelligence feeds. Contact your Anomali representative or access ThreatStream directly to retrieve current, verified indicators for blocking and detection rule deployment. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Benefits Systems) </h3> <ul> <li> Primary threat: FortiBleed credential theft enabling access to financial transaction systems </li> <li> Action: Isolate financial system network segments from general-purpose FortiGate management planes; implement break-glass-only admin access for treasury systems </li> <li> Watch for: Ivanti EPMM exploitation (CVE-2026-1281, CVE-2026-1340) — financial services confirmed as target sector </li> </ul> <h3> Energy (State-Regulated Utilities, Grid Operations) </h3> <ul> <li> Primary threat: ICS advisory batch (Schneider PowerChute, Rockwell FactoryTalk) + ZionSiphon PLC manipulation capability </li> <li> Action: Patch Schneider Electric PowerChute Serial Shutdown and Rockwell FactoryTalk Historian within 7 days; verify network segmentation between IT and OT environments </li> <li> Watch for: Anomalous Modbus/DNP3/S7 traffic from non-standard source addresses </li> </ul> <h3> Healthcare (State Health Agencies, Medicaid Systems) </h3> <ul> <li> Primary threat: Ransomware via FortiBleed credentials (Akira and Qilin both target healthcare) </li> <li> Action: Verify FortiGate credential rotation for health agency perimeters; ensure offline backups of Medicaid eligibility and claims databases are current </li> <li> Watch for: Lateral movement from compromised VPN sessions into health data repositories </li> </ul> <h3> Government (Executive Branch Agencies, Shared Services) </h3> <ul> <li> Primary threat: Splunk SIEM compromise (CVE-2026-20253) creating defender blindness + China-nexus espionage via supply chain </li> <li> Action: Emergency Splunk patching; audit DAEMON Tools presence; review Cisco ISE posture given CVE-2026-20181 (CVSS 9.1) </li> <li> Watch for: Lazarus HOPLIGHT indicators; security tool disabling events; unauthorized Splunk configuration changes </li> </ul> <h3> Aviation / Logistics (State DOT, Port Authorities, Transit) </h3> <ul> <li> Primary threat: Ivanti EPMM exploitation (transportation confirmed as target sector) + supply chain compromise </li> <li> Action: Verify Ivanti EPMM patch status; audit mobile device management infrastructure for unauthorized access </li> <li> Watch for: China-nexus actors have historically targeted transportation for strategic intelligence collection; SLICKDEMON campaign includes this sector </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Next 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🔴 </td> <td> IT Operations </td> <td> Patch Splunk Enterprise to 10.2.4+ or 10.0.7+ across all state SIEM deployments. If patching requires a maintenance window, disable the PostgreSQL sidecar service as an interim mitigation per SVD-2026-0603. Pre-auth RCE with public exploit — your SIEM is a target. </td> </tr> <tr> <td> 🔴 </td> <td> IT Operations </td> <td> Rotate ALL FortiGate administrative credentials on every internet-facing device. Enable MFA on all management plane access. Audit for unauthorized admin accounts created after 17 June. Verify against CISA FortiBleed hardening checklist. </td> </tr> <tr> <td> 🔴 </td> <td> CISO / Executive </td> <td> Approve emergency patching windows for Splunk and FortiGate. These cannot wait for standard change management cycles. </td> </tr> </tbody> </table> <h3> 7-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟠 </td> <td> OT/ICS Security </td> <td> Review Mitsubishi MELSEC iQ-F, Schneider PowerChute, and Rockwell FactoryTalk Historian deployments in state-regulated utilities. Apply vendor patches per ICSA-26-169-02 through -07. Prioritize Rockwell FactoryTalk (authentication token theft risk). </td> </tr> <tr> <td> 🟠 </td> <td> IT Operations </td> <td> Audit enterprise software inventory for DAEMON Tools installations. If present, verify installer integrity against vendor checksums, quarantine suspicious installations, and monitor for SLICKDEMON indicators (unexpected PowerShell, C2 beaconing). </td> </tr> <tr> <td> 🟠 </td> <td> SOC </td> <td> Deploy detection rules for HOPLIGHT behavioral indicators — specifically T1562.001 (security tool disabling) from Windows executables. Retrieve current HOPLIGHT IOCs from Anomali ThreatStream for YARA rule and signature deployment. </td> </tr> <tr> <td> 🟠 </td> <td> SOC </td> <td> Conduct 30-day retrospective review of all FortiGate admin authentication logs. Identify and investigate any sessions from unauthorized source IPs. </td> </tr> </tbody> </table> <h3> 30-DAY Actions </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 🟡 </td> <td> CISO </td> <td> Commission assessment of Cisco ISE deployment security posture. CVE-2026-20181 (CVSS 9.1) requires admin credentials — but stolen FortiGate credentials or access broker purchases could enable chaining. </td> </tr> <tr> <td> 🟡 </td> <td> CISO </td> <td> Conduct cross-platform credential isolation audit. Four core infrastructure platforms (Fortinet, Cisco ISE, Cisco SD-WAN, Splunk) have critical vulnerabilities. Verify that compromise of one does not enable exploitation of another through shared credentials or trust relationships. </td> </tr> <tr> <td> 🟡 </td> <td> IR Team </td> <td> Update incident response playbooks to include "SIEM compromise" scenario. If Splunk is compromised, what is your fallback detection capability? Ensure out-of-band alerting exists. </td> </tr> <tr> <td> 🟡 </td> <td> CISO </td> <td> Evaluate state water utility cybersecurity posture given confirmed Iran-nexus targeting (VOID MANTICORE breach, ZionSiphon capability). Consider tabletop exercise simulating PLC manipulation at a water treatment facility. </td> </tr> </tbody> </table> <h2> The Compounding Risk </h2> What makes this week's threat landscape particularly dangerous is not any single vulnerability — it's the convergence . Consider this attack chain: <ol> <li> Attacker uses published FortiGate credentials (FortiBleed) to access the perimeter </li> <li> From the firewall, they pivot to Splunk (CVE-2026-20253) and compromise the SIEM </li> <li> With the SIEM compromised, they suppress all alerts </li> <li> They move laterally to Cisco ISE (CVE-2026-20181) to modify network access policies </li> <li> They deploy ransomware across the environment — with no alerts firing </li> </ol> Each of these steps uses a confirmed, actively exploited vulnerability in products that state governments are known to operate. The window to break this chain is closing. <h2> Bottom Line </h2> The threat actors targeting state government infrastructure are not waiting for your next change management window. Russia-nexus groups have already published your peers' firewall credentials. China-nexus actors are poisoning software supply chains. Iran-nexus groups have demonstrated the capability and intent to manipulate water treatment systems. And a pre-authentication exploit for your SIEM platform is freely available online. The actions outlined above — particularly Splunk patching and FortiGate credential rotation — are not optional security hygiene. They are emergency response measures for an active threat environment. Patch Splunk. Rotate FortiGate credentials. Verify your ICS segmentation. Do it today. Published 22 June 2026 by the Anomali CTI Desk. Intelligence sources include CISA KEV/Advisories, Anomali ThreatStream, and partner intelligence feeds. For IOC feeds and detection content packages supporting this report, contact your Anomali representative or access ThreatStream directly.

FEATURED RESOURCES

June 22, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Pre-Strike Phase: What CISOs Must Do This Week

June 22, 2026

Anomali Cyber Watch

Public Sector

Critical Infrastructure Under Siege: Splunk RCE, FortiBleed Fallout, and China's Supply Chain Offensive Converge on State Government

June 19, 2026

Anomali Cyber Watch

Iran's Cyber Forces Are Converging: FortiBleed, Cisco KEV, and the Access-to-Destruction Pipeline

Explore All