Converging Threats to State Government Networks: Ransomware Operators and Nation-State Actors Target the Same Infrastructure

Public Sector

Published on

June 11, 2026

Table of Contents

Threat Assessment Level: ELEVATED <h2> Introduction </h2> State government IT leaders face an uncomfortable reality this week: the criminal ransomware groups hunting your networks and the nation-state espionage teams pre-positioning inside your infrastructure are exploiting the same vulnerabilities in the same devices . Your SonicWall VPN, your Arista data center switches, your Cisco ASA firewalls — these are now contested terrain where both PUNK SPIDER (Akira ransomware) and Chinese espionage actors (UNC5475) are actively operating. Meanwhile, a 13-day degradation in open-source intelligence collection has reduced our ability to corroborate threats — meaning the picture may be worse than what we can currently confirm. With summer ransomware season approaching and CISA adding new actively-exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, the window for defensive action is narrowing. This brief provides the specific intelligence state CIOs and CISOs need to prioritize resources today. <h2> What Changed </h2> <table> <thead> <tr> <th> Development </th> <th> Why It Matters for State Government </th> </tr> </thead> <tbody> <tr> <td> PUNK SPIDER (Akira) confirmed targeting US state/local government </td> <td> CrowdStrike updated this actor's profile on June 11 — "Government" and "Local Government" are explicit targets across 48 countries including the US. Primary entry: SonicWall VPN exploitation. </td> </tr> <tr> <td> CVE-2026-7473 (Arista EOS) added to CISA KEV </td> <td> Active exploitation confirmed June 9. Allows attackers to inject traffic into internal network segments via tunnel spoofing — directly relevant to state data center switching infrastructure. </td> </tr> <tr> <td> China-nexus networking/virtualization campaign updated </td> <td> Campaign targeting government networks via Cisco and virtualization platforms refreshed June 9. Aligns with UNC5475 zero-day exploitation patterns tracked since late May. </td> </tr> <tr> <td> Three ICS advisories issued (Schneider Electric, Siemens) </td> <td> Schneider Modicon managed switches have a RADIUS authentication vulnerability — relevant to any state agency with OT/building management systems. </td> </tr> <tr> <td> PUNK SPIDER now using AI-generated scripts </td> <td> Akira operators confirmed using AI to automate Veeam credential extraction and accelerate lateral movement — expect faster time-to-encryption in future incidents. </td> </tr> <tr> <td> FAMOUS CHOLLIMA (DPRK) activated new C2 infrastructure </td> <td> Refreshed DPRK espionage operations targeting government entities confirmed June 10 — represents an additional nation-state threat vector alongside China-nexus and Iranian actors. </td> </tr> <tr> <td> GoblinRAT Linux backdoor disclosed — 6-year government dwell time </td> <td> Analysis published June 8 reveals a nation-state-caliber Linux implant masquerading as Zabbix monitoring that operated undetected in government IT environments from 2020 to 2026 — underscoring critical gaps in Linux threat detection. </td> </tr> </tbody> </table> <h2> Threat Timeline </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Relevance </th> </tr> </thead> <tbody> <tr> <td> 2026-05-29 </td> <td> CISA KEV: CVE-2026-42271 (LiteLLM RCE, CVSS 9.8) </td> <td> Any state AI pilot program using LiteLLM is vulnerable to authenticated RCE </td> </tr> <tr> <td> 2026-06-05 </td> <td> CVE-2026-7473 (Arista EOS tunnel bypass) published </td> <td> CVSS 5.8 but exploitable for lateral movement in data centers </td> </tr> <tr> <td> 2026-06-08 </td> <td> GoblinRAT analysis published — Linux backdoor in government IT (2020–2026) </td> <td> Nation-state caliber implant masquerading as Zabbix monitoring; undetected for 6 years </td> </tr> <tr> <td> 2026-06-09 </td> <td> CISA adds CVE-2026-7473 to KEV — active exploitation confirmed </td> <td> Immediate patching required for Arista EOS with VXLAN/GRE configurations </td> </tr> <tr> <td> 2026-06-09 </td> <td> China-nexus campaign targeting networking/virtualization updated </td> <td> UNC5475 activity against government network infrastructure continues </td> </tr> <tr> <td> 2026-06-09 </td> <td> Three ICS advisories: Schneider EcoStruxure, Modicon, Siemens KACO </td> <td> OT/building management systems in state facilities affected </td> </tr> <tr> <td> 2026-06-09 </td> <td> APT42 (Charming Kitten/IRGC-IO) profile refreshed — government targeting active </td> <td> Credential harvesting via phishing remains primary TTP </td> </tr> <tr> <td> 2026-06-10 </td> <td> FAMOUS CHOLLIMA (DPRK) activated new C2 infrastructure </td> <td> Refreshed espionage operations targeting government entities </td> </tr> <tr> <td> 2026-06-11 </td> <td> PUNK SPIDER (Akira) profile updated — US gov explicitly targeted </td> <td> AI-augmented ransomware operations via SonicWall VPN exploitation </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. PUNK SPIDER / Akira Ransomware — Direct Threat to State Agencies </h3> Actor: PUNK SPIDER (aliases: REDBIKE, Darter, Storm-1567) Malware: Akira ransomware Initial Access: CVE-2024-40766 (SonicWall SSL VPN) This is the most immediate threat to state government networks. PUNK SPIDER explicitly lists "Government" and "Local Government" as target sectors. Their operational playbook: <ol> <li> Exploit unpatched SonicWall SSL VPN (CVE-2024-40766) </li> <li> Extract credentials from Veeam Backup & Replication databases — now automated with AI-generated scripts </li> <li> Move laterally via RDP using harvested credentials </li> <li> Encrypt VMware ESXi and Hyper-V hypervisors </li> <li> Destroy backup infrastructure to prevent recovery </li> </ol> The AI-scripting development is significant: it compresses the dwell time between initial access and encryption, giving defenders less time to detect and respond. ATT&CK Techniques: T1190, T1486, T1490, T1078, T1021.001, T1003.001 <h3> 2. China-Nexus Espionage (UNC5475) — Pre-Positioning in Network Infrastructure </h3> Actor: UNC5475 (China-nexus) Campaign: Targeting networking and virtualization technology across government, energy, aerospace, and technology sectors in 12+ countries This campaign, updated June 9, represents the continuation of China's strategic pre-positioning inside Western government networks — the same doctrine behind Volt Typhoon and Salt Typhoon. UNC5475 exploits zero-day vulnerabilities in Cisco ASA/FTD appliances and is now expanding to virtualization platforms. The strategic concern: these actors are not stealing data today. They are establishing persistent access for potential future disruption during a geopolitical crisis. State government networks that coordinate utility operations, emergency services, and election infrastructure are high-value pre-positioning targets. ATT&CK Techniques: T1190, T1059.004, T1562.001, T1005, T1041 <h3> 3. CVE-2026-7473 — Arista EOS Tunnel Bypass (KEV) </h3> CVSS: 5.8 (Medium) — but actively exploited in the wild Affected: Arista EOS switches with VXLAN, decap-group, or GRE tunnel interfaces Impact: Attackers can inject traffic into internal network segments by spoofing tunnel packets, effectively bypassing network segmentation For state data centers running Arista switching infrastructure, this vulnerability allows an attacker who can reach the switch's tunnel interface to bridge directly into internal VLANs — negating microsegmentation controls. ATT&CK Techniques: T1599.001, T1048, T1572 <h3> 4. APT42 / Charming Kitten (Iran/IRGC-IO) — Credential Harvesting </h3> Actor: APT42 (aliases: Charming Kitten, Mint Sandstorm, TA453, CALANQUE, UNC788, GreenCharlie) Affiliation: Iranian IRGC Intelligence Organization (IRGC-IO) Targets: Government, education, energy, healthcare across 17+ countries APT42's profile was refreshed June 9 with continued government targeting. Their primary technique remains sophisticated spearphishing — fake conference invitations, journalist impersonation, and credential harvesting pages. State government employees with policy roles, international engagement, or energy sector oversight are likely targets. ATT&CK Techniques: T1566.002, T1598.003, T1539, T1528 <h3> 5. ICS/OT Vulnerabilities — Schneider Electric & Siemens </h3> Three advisories issued June 9 affect operational technology commonly deployed in state government facilities: <ul> <li> Schneider Electric Modicon Managed Switches (ICSA-26-160-01): RADIUS authentication vulnerability — could allow authentication bypass on OT network switches </li> <li> Schneider Electric EcoStruxure Panel Server (ICSA-26-160-03): Building/energy management panel vulnerability </li> <li> Siemens KACO Blueplanet Inverters (ICSA-26-160-02): Credential derivation from device serial interface </li> </ul> State agencies managing building automation, energy coordination, or water treatment oversight should assess exposure. <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Timeframe </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> Additional CISA KEV additions for network infrastructure vulnerabilities </td> <td> HIGH (70%) </td> <td> 7 days </td> <td> Current exploitation tempo against edge devices; multiple vendors affected </td> </tr> <tr> <td> PUNK SPIDER/Akira ransomware incident against a US state or local government entity </td> <td> MODERATE (50%) </td> <td> 30 days </td> <td> Explicit targeting confirmed; SonicWall exposure widespread in government; summer ransomware season </td> </tr> <tr> <td> China-nexus actors expand exploitation from Cisco to Fortinet/Palo Alto in government networks </td> <td> MODERATE (40%) </td> <td> 30 days </td> <td> Consistent with Volt Typhoon multi-vendor pre-positioning doctrine </td> </tr> <tr> <td> GoblinRAT-class Linux implant discovered in additional government environments </td> <td> LOW-MODERATE (30%) </td> <td> 60 days </td> <td> 6-year dwell time suggests broad deployment; limited detection capability in most state Linux environments </td> </tr> <tr> <td> APT42 credential harvesting campaign targeting state government policy staff </td> <td> MODERATE (45%) </td> <td> 30 days </td> <td> Active targeting of government sector confirmed; state-level policy roles align with IRGC-IO intelligence requirements </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK ID </th> <th> Detection Approach </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> SonicWall SSL VPN authentication anomalies </td> <td> T1190 </td> <td> Alert on successful VPN auth from unusual geolocations; monitor for CVE-2024-40766 exploitation signatures </td> </tr> <tr> <td> CRITICAL </td> <td> Arista EOS tunnel interface traffic from unauthorized sources </td> <td> T1599.001 </td> <td> ACL logging on VXLAN/GRE decap-groups; alert on tunnel packets from non-peer IPs </td> </tr> <tr> <td> HIGH </td> <td> Veeam Backup database access from non-Veeam processes </td> <td> T1003.001 </td> <td> Sigma rule: process accessing VeeamBackup.mdf that is NOT VeeamBackupSvc.exe </td> </tr> <tr> <td> HIGH </td> <td> RDP lateral movement following VPN authentication </td> <td> T1021.001 </td> <td> Correlate VPN login → RDP session initiation within 30 minutes to new internal hosts </td> </tr> <tr> <td> HIGH </td> <td> Credential harvesting phishing with conference/journalist lures </td> <td> T1566.002 </td> <td> Email gateway rules for domains mimicking conference registration or media organizations </td> </tr> <tr> <td> MODERATE </td> <td> Linux process masquerading as monitoring services (Zabbix, Nagios) </td> <td> T1036.004 </td> <td> Hunt: processes named zabbix_agentd or similar running from non-standard paths (/tmp, /var/tmp, user home) </td> </tr> <tr> <td> MODERATE </td> <td> ESXi/Hyper-V encryption preparation </td> <td> T1486 </td> <td> Monitor for mass .vmdk file access or esxcli commands disabling VMs in rapid succession </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ol> <li> Hypothesis: PUNK SPIDER has already compromised a SonicWall VPN appliance in our environment. </li> <ul> <li> Hunt: Review SonicWall VPN logs for successful authentications using credentials not in HR/IAM systems. Check for VPN sessions with anomalous duration or data transfer volumes. Look for CVE-2024-40766 exploitation artifacts in appliance logs. </li> </ul> <li> Hypothesis: A China-nexus actor has persistent access to a Cisco ASA/FTD device. </li> <ul> <li> Hunt: Compare running configurations against known-good baselines. Search for unauthorized user accounts, modified ACLs, or unusual outbound connections from management interfaces. Check for T1562.001 (security tool modification) indicators. </li> </ul> <li> Hypothesis: GoblinRAT or similar implant exists on Linux infrastructure masquerading as a monitoring agent. </li> <ul> <li> Hunt: Enumerate all processes on Linux servers claiming to be Zabbix, Nagios, NRPE, or Prometheus. Verify binary hashes against vendor-published checksums. Check for encrypted outbound HTTPS connections to non-standard ports from monitoring service accounts. </li> </ul> <li> Hypothesis: APT42 has harvested credentials from a state employee via phishing. </li> <ul> <li> Hunt: Review Azure AD/M365 sign-in logs for impossible travel, new device registrations, or OAuth token grants to unfamiliar applications. Check for mail forwarding rules created in the last 30 days (T1114.003). </li> </ul> </ol> <h3> Indicators of Compromise </h3> IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds. For the latest indicators associated with PUNK SPIDER/Akira, UNC5475, APT42, FAMOUS CHOLLIMA, and GoblinRAT, please query Anomali ThreatStream Next-Gen directly. <h2> Sector-Specific Defensive Priorities </h2> <h3> Financial Services (State Treasury, Revenue, Tax Systems) </h3> <ul> <li> Primary threat: PUNK SPIDER/Akira ransomware targeting financial data for double extortion </li> <li> Action: Validate offline backup integrity for tax/revenue databases; ensure Veeam backup credentials are stored in a separate credential vault not accessible from the production domain </li> <li> Monitor: Unusual bulk access to taxpayer PII databases; after-hours database export operations </li> </ul> <h3> Energy (Utility Coordination, Grid Oversight, SCADA) </h3> <ul> <li> Primary threat: China-nexus pre-positioning (UNC5475/Volt Typhoon); Schneider Electric ICS vulnerabilities </li> <li> Action: Patch Schneider Modicon managed switches (ICSA-26-160-01) to prevent RADIUS authentication bypass; audit network segmentation between IT and OT zones </li> <li> Monitor: Anomalous traffic crossing IT/OT boundaries; unauthorized access to EcoStruxure Panel Servers; Siemens KACO inverter serial interface access </li> </ul> <h3> Healthcare (Medicaid, Public Health, HHS Systems) </h3> <ul> <li> Primary threat: Ransomware (Akira/Qilin) targeting healthcare data; APT42 targeting health policy staff </li> <li> Action: Ensure Medicaid/HHS systems have tested, air-gapped backup recovery procedures; brief health policy staff on APT42 phishing TTPs (fake conference invitations) </li> <li> Monitor: Mass file encryption indicators on clinical/claims databases; phishing emails referencing health policy conferences or WHO/CDC events </li> </ul> <h3> Government (Central IT, Shared Services, Elections) </h3> <ul> <li> Primary threat: Full convergence — ransomware (PUNK SPIDER), espionage (UNC5475, APT42, FAMOUS CHOLLIMA), and pre-positioning (Volt Typhoon) </li> <li> Action: Immediate SonicWall VPN patch validation; Arista EOS tunnel configuration audit; proactive Linux threat hunt for GoblinRAT indicators </li> <li> Monitor: All SOC detection priorities above apply; additionally monitor for DPRK-linked C2 callbacks and unusual DNS resolution patterns </li> </ul> <h3> Aviation/Logistics (State DOT, Airport Authorities, Port Systems) </h3> <ul> <li> Primary threat: China-nexus espionage targeting transportation infrastructure; ICS vulnerabilities in traffic management and port systems </li> <li> Action: Audit Cisco ASA/FTD configurations at transportation network boundaries; review Schneider building management systems at state-owned facilities </li> <li> Monitor: Unusual configuration changes on network edge devices; outbound data exfiltration from transportation planning systems </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> IT Ops / Network </td> <td> Validate all SonicWall SSL VPN appliances are patched for CVE-2024-40766. This is PUNK SPIDER's confirmed initial access vector for Akira ransomware against government targets. Any unpatched appliance is an open door. </td> </tr> <tr> <td> 2 </td> <td> IT Ops / Network </td> <td> Audit Arista EOS switches for VXLAN/GRE decap-group configurations. If present, apply vendor patch per Security Advisory SA-0137 or implement ACLs restricting tunnel source IPs to known peers only. CVE-2026-7473 is actively exploited. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Enable enhanced logging on VPN concentrators and correlate with RDP lateral movement. PUNK SPIDER's kill chain moves from VPN → credential theft → RDP → encryption. Detection at the VPN-to-RDP pivot is the highest-value alert. </td> </tr> <tr> <td> 4 </td> <td> CISO </td> <td> Authorize emergency procurement of backup OSINT intelligence feed. 13 days of collection degradation has created blind spots across all threat categories. Corroboration capability must be restored before summer ransomware season peaks. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> SOC / Detection Engineering </td> <td> Deploy Sigma detection rule for Veeam Backup database access (VeeamBackup.mdf) from non-Veeam processes. This is PUNK SPIDER's credential extraction technique for gaining ESXi/Hyper-V access. </td> </tr> <tr> <td> 6 </td> <td> IT Ops / OT </td> <td> Audit Schneider Electric Modicon managed switches for RADIUS authentication configuration. Apply patches per ICSA-26-160-01 to prevent authentication bypass in OT network segments. </td> </tr> <tr> <td> 7 </td> <td> IAM / Security </td> <td> Brief high-profile staff on APT42 phishing TTPs. Policy directors, international liaisons, and energy/health leadership should be warned about fake conference invitations and journalist impersonation attempts. Reinforce MFA and OAuth app consent policies. </td> </tr> <tr> <td> 8 </td> <td> IT Ops / Network </td> <td> Baseline all Cisco ASA/FTD configurations and implement automated drift detection. UNC5475's zero-day exploitation of these devices means configuration integrity monitoring is essential. </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Owner </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 9 </td> <td> SOC / Threat Hunt </td> <td> Conduct proactive threat hunt on Linux infrastructure for GoblinRAT indicators. Focus on: processes masquerading as monitoring agents (Zabbix, Nagios), unusual cron persistence, encrypted C2 over HTTPS to non-standard ports. GoblinRAT operated undetected for 6 years in government environments. </td> </tr> <tr> <td> 10 </td> <td> CISO / Architecture </td> <td> Commission assessment of AI gateway deployments (LiteLLM or equivalent) against CVE-2026-42271. Any authenticated user can achieve host-level code execution. Pilot AI programs must be evaluated before broader deployment. </td> </tr> <tr> <td> 11 </td> <td> CISO / IR </td> <td> Conduct tabletop exercise simulating Akira ransomware incident. Scenario: SonicWall VPN compromised → Veeam credentials extracted → ESXi encrypted within 4 hours. Test: backup recovery procedures, communication plans, and decision authority for system isolation. </td> </tr> <tr> <td> 12 </td> <td> IT Ops / Architecture </td> <td> Implement unified network edge vulnerability dashboard covering Cisco, Arista, Fortinet, Palo Alto, and SonicWall. Three separate threat clusters are targeting different perimeter vendors — consolidated visibility is required. </td> </tr> </tbody> </table> <h2> Intelligence Collection Note </h2> Our open-source intelligence collection capability has been degraded for 13 consecutive days. This means: <ul> <li> Threat corroboration is impaired — we cannot independently verify single-source findings </li> <li> Emerging threats may be missed if they appear only in OSINT channels </li> <li> Legislative and regulatory intelligence (cybersecurity bills, executive orders) is not being collected </li> </ul> We are actively working to restore this capability. In the interim, all assessments in this brief should be treated as potentially incomplete. The threats we can see are serious; the threats we cannot see due to collection gaps may be equally so. <h2> Advisory References </h2> The following advisory references are relevant for patch validation: <table> <thead> <tr> <th> Reference </th> <th> Description </th> </tr> </thead> <tbody> <tr> <td> <a href="https://www.arista.com/en/support/advisories-notices/security-advisory/22872-security-advisory-0137"> Arista Security Advisory SA-0137 </a> </td> <td> CVE-2026-7473 patch guidance </td> </tr> <tr> <td> ICSA-26-160-01 </td> <td> Schneider Electric Modicon Managed Switches </td> </tr> <tr> <td> ICSA-26-160-02 </td> <td> Siemens KACO Blueplanet Inverters </td> </tr> <tr> <td> ICSA-26-160-03 </td> <td> Schneider Electric EcoStruxure Panel Server </td> </tr> </tbody> </table> Additional IOCs available via Anomali ThreatStream Next-Gen. <h2> Bottom Line </h2> The convergence of ransomware operators and nation-state actors on the same network edge infrastructure is not coincidental — it reflects the reality that VPN appliances, switches, and firewalls are the highest-value targets in any network. For state government, where these devices protect citizen data, critical infrastructure coordination, and democratic processes, the stakes are existential. The good news: a single defensive investment in VPN hardening, network edge patching, and backup integrity addresses both the criminal and espionage threats simultaneously. The bad news: the window is closing. PUNK SPIDER is actively hunting state and local government targets right now , and summer historically brings peak ransomware activity. Patch your SonicWall. Audit your Arista switches. Test your backups. Brief your staff on phishing. Do it today. Anomali CTI Desk — June 11, 2026 For questions or additional context on any finding in this brief, contact your CTI team.

FEATURED RESOURCES

June 11, 2026

Anomali Cyber Watch

Iranian Cyber Operations in Strategic Pause — But Pre-Positioning Accelerates Behind the Diplomacy

June 11, 2026

Anomali Cyber Watch

Public Sector

Converging Threats to State Government Networks: Ransomware Operators and Nation-State Actors Target the Same Infrastructure

June 10, 2026

Anomali Cyber Watch

Iranian Cyber Operations Enter Sustained Pre-Positioning Phase: What CISOs Must Know Now

Explore All