Supply Chain Attacks Hit CI/CD Security Tools While Iran Masks Espionage as Ransomware: What State Government CISOs Must Act On Today

Public Sector

Published on

May 11, 2026

Table of Contents

Threat Assessment Level: ELEVATED (trending toward HIGH) Changed from prior cycle: Level remains ELEVATED but with increased urgency. The prior cycle (2026-05-10) identified LYNX ransomware targeting Indiana county government, APT41 campaigns against state .NET applications, and CVE-2026-0300 (PAN-OS CVSS 9.8) added to CISA KEV. This cycle adds a confirmed CI/CD supply chain backdoor, in-the-wild Linux privilege escalation, and Iranian state actors deploying fake ransomware for espionage — collectively increasing pressure on state IT environments across multiple attack surfaces simultaneously. <h2> Introduction </h2> State government IT leaders face a convergence of threats this week that demands immediate action. A threat actor has backdoored a widely-used Jenkins security plugin for the second time in six weeks, harvesting every secret accessible to CI/CD runners. A deterministic Linux privilege escalation exploit is now confirmed active in the wild. And Iran's MuddyWater group is deploying ransomware branding as cover for espionage operations — meaning your next "ransomware incident" may actually be a nation-state intelligence operation. These developments arrive while a critical intelligence collection gap (OSINT feed failure, Day 3) limits our ability to detect additional emerging threats. The window for defensive action is narrowing. <h2> What Changed This Week </h2> <table> <thead> <tr> <th> Date </th> <th> Event </th> <th> Impact to State Government </th> </tr> </thead> <tbody> <tr> <td> 2026-05-06 </td> <td> CVE-2026-0300 (PAN-OS, CVSS 9.8) added to CISA KEV </td> <td> Unauthenticated RCE on perimeter firewalls — emergency patch required </td> </tr> <tr> <td> 2026-05-08 </td> <td> PRIMITIVE BEAR/Gamaredon delivers new Htrackyx downloader </td> <td> Russia-nexus actor broadening beyond Ukraine targeting </td> </tr> <tr> <td> 2026-05-08 </td> <td> cPanel/WHM critical vulnerabilities disclosed (CVE-2026-29202/29201/29203) </td> <td> MSP-hosted state web properties at risk of Perl code injection </td> </tr> <tr> <td> 2026-05-09 </td> <td> APT41 updates campaign targeting U.S. state government .NET web apps </td> <td> IIS web shell deployment against state agency portals </td> </tr> <tr> <td> 2026-05-09 </td> <td> TeamPCP backdoors Checkmarx Jenkins AST Plugin (v2026.5.09) </td> <td> CI/CD credential theft — all Jenkins runner secrets compromised if installed </td> </tr> <tr> <td> 2026-05-10 </td> <td> LYNX ransomware claims Jackson County, Indiana </td> <td> Active ransomware targeting of Midwest government entities </td> </tr> <tr> <td> 2026-05-10 </td> <td> Qilin ransomware group publishes updated TTPs; government sector in active target list </td> <td> MODERATE — state/local government entities at ongoing risk </td> </tr> <tr> <td> 2026-05-11 </td> <td> "Dirty Frag" Linux LPE confirmed exploited in-the-wild </td> <td> Deterministic root escalation on RHEL/Ubuntu — patches available </td> </tr> <tr> <td> 2026-05-11 </td> <td> Rapid7 links Chaos ransomware to MuddyWater (Iran/MOIS) </td> <td> Nation-state using ransomware as false flag for espionage </td> </tr> </tbody> </table> <h2> Key Threat Analysis </h2> <h3> 1. TeamPCP Jenkins Supply Chain Backdoor — Your Security Tools Are the Target </h3> Actor: TeamPCP (criminal/hacktivist collective) What happened: TeamPCP compromised the Checkmarx Jenkins AST Plugin repository and released a backdoored version (2026.5.09) containing credential-harvesting malware called "Shai Hulud." This is their second compromise of Checkmarx infrastructure in approximately six weeks — the first was a GitHub Actions attack in March 2026. Why this matters for state government: Any state development team running Jenkins with the Checkmarx AST plugin may have pulled the malicious update automatically. The backdoor sweeps environment variables, SSH keys, Azure credentials, GitHub PATs, Kubernetes tokens, and deployment keys — then exfiltrates everything to attacker-controlled infrastructure including .trycloudflare.com tunnels and checkmarx[.]zone. The deeper problem: The attacker is specifically targeting security scanning tools — the tools meant to protect your pipeline. Repeated re-entry suggests either incomplete remediation by Checkmarx or retained persistent access. State development teams that trust automated plugin updates without integrity verification are running unsigned code in production. ATT&CK Techniques: T1195.002 (Supply Chain Compromise), T1552.001 (Credentials in Files), T1041 (Exfiltration Over C2 Channel) <h3> 2. Dirty Frag Linux Privilege Escalation — Now Exploited in the Wild </h3> CVEs: CVE-2026-43284 (xfrm-ESP), CVE-2026-43500 (RxRPC) What happened: The "Dirty Frag" exploit chains two Linux kernel flaws for deterministic local privilege escalation to root. Unlike many kernel exploits, this requires no race condition — it succeeds reliably. Microsoft Defender telemetry confirms limited in-the-wild exploitation, with post-exploitation activity including modification of GLPI LDAP authentication files and PHP session manipulation. Why this matters for state government: State agencies running RHEL or Ubuntu Linux servers — particularly those hosting GLPI (common in government IT asset management) or other PHP-based internal applications — face a reliable path from any local user account to full root compromise. Internet-facing Linux systems without patches are at highest risk. ATT&CK Techniques: T1068 (Exploitation for Privilege Escalation), T1003 (OS Credential Dumping) <h3> 3. MuddyWater Deploys Chaos Ransomware as Espionage Cover </h3> Actor: MuddyWater (Seedworm) — Iranian MOIS-linked What happened: Rapid7 links a Chaos ransomware campaign to MuddyWater with moderate confidence. The attack chain uses Microsoft Teams social engineering (external accounts initiating screen-sharing), credential harvesting via screen sharing, AnyDesk/DWAgent for persistence, and MFA manipulation. Critically, no actual encryption occurred — Chaos ransomware was deployed as a false flag while data was exfiltrated and posted on a leak site. Why this matters for state government: This fundamentally challenges how incident response teams classify events. A "ransomware incident" where encryption fails or doesn't occur is typically closed as a failed criminal attack. MuddyWater's TTP evolution means such incidents may actually be successful espionage operations. State agencies holding policy intelligence, law enforcement data, or federal inter-agency trust relationships are high-value espionage targets. Code-signing indicator: The "Donald Gay" certificate used in this campaign has been previously linked to MOIS operations. ATT&CK Techniques: T1566.003 (Phishing via Service), T1219 (Remote Access Software), T1056.001 (Input Capture), T1486 (Data Encrypted for Impact — false flag) <h3> 4. cPanel/WHM Critical Vulnerabilities — MSP-Hosted State Properties at Risk </h3> CVEs: CVE-2026-29202 (Perl code injection — CRITICAL), CVE-2026-29201 (arbitrary file read — HIGH), CVE-2026-29203 (symlink chmod DoS — MEDIUM) What happened: Three severe cPanel/WHM vulnerabilities were disclosed on 2026-05-08. The most critical (CVE-2026-29202) allows unauthenticated Perl code injection via the create_user API — effectively granting remote code execution on any unpatched cPanel server. Why this matters for state government: Many state agency web properties are hosted by managed service providers (MSPs) running cPanel/WHM. These systems are often outside direct state IT control, creating a coordination challenge for emergency patching. Patched versions (≥11.136.0.9) are available. ATT&CK Techniques: T1190 (Exploit Public-Facing Application), T1059.006 (Perl Execution) <h3> 5. Persistent Threats From Prior Cycles — Still Active </h3> <table> <thead> <tr> <th> Actor </th> <th> Origin </th> <th> Current Status </th> <th> State Gov Relevance </th> </tr> </thead> <tbody> <tr> <td> APT41 </td> <td> China-nexus </td> <td> Active campaign targeting U.S. state .NET web apps (updated 2026-05-09) </td> <td> DIRECT — IIS web shells on state portals </td> </tr> <tr> <td> Volt Typhoon </td> <td> China-nexus </td> <td> No new indicators in 5+ days — suspicious silence </td> <td> HIGH — known for long-dwell pre-positioning on perimeter devices; PAN-OS CVE-2026-0300 is ideal entry point </td> </tr> <tr> <td> LYNX (TRAVELING SPIDER) </td> <td> Criminal </td> <td> Claimed Jackson County, IN on 2026-05-10 </td> <td> DIRECT — Midwest state/local government targeting </td> </tr> <tr> <td> PRIMITIVE BEAR/Gamaredon </td> <td> Russia-nexus </td> <td> New Htrackyx downloader (2026-05-08); broadening targeting </td> <td> MODERATE — historically Ukraine-focused but expanding </td> </tr> <tr> <td> Qilin </td> <td> Criminal </td> <td> Active profile with updated TTPs published this cycle </td> <td> MODERATE — government sector in target list </td> </tr> </tbody> </table> <h2> Predictive Analysis </h2> <table> <thead> <tr> <th> Scenario </th> <th> Probability </th> <th> Basis </th> </tr> </thead> <tbody> <tr> <td> TeamPCP attempts additional supply chain compromises against Checkmarx or adjacent security tooling vendors within 2 weeks </td> <td> 70% (HIGH) </td> <td> Accelerating operational tempo — two compromises in 6 weeks; likely retained access </td> </tr> <tr> <td> Dirty Frag exploitation expands to target unpatched state Linux servers within 7 days </td> <td> 50% (MODERATE) </td> <td> PoC is public, exploit is deterministic, patches not yet universal </td> </tr> <tr> <td> MuddyWater Teams social engineering targets U.S. government entities within 30 days </td> <td> 35% (LOW-MODERATE) </td> <td> TTP proven effective; group's operational tempo increased in early 2026 </td> </tr> <tr> <td> Volt Typhoon has already exploited CVE-2026-0300 on state PAN-OS firewalls and is in quiet persistence </td> <td> 40% (MODERATE) </td> <td> Matches known MO — exploit perimeter devices, persist silently for months; suspicious absence of indicators </td> </tr> <tr> <td> LYNX publishes Jackson County data on leak site, triggering copycat targeting of adjacent state/county entities </td> <td> 55% (MODERATE) </td> <td> Standard ransomware operator playbook post-compromise </td> </tr> </tbody> </table> <h2> SOC Operational Guidance </h2> <h3> Detection Priorities </h3> <table> <thead> <tr> <th> Priority </th> <th> What to Monitor </th> <th> ATT&CK ID </th> <th> Detection Logic </th> </tr> </thead> <tbody> <tr> <td> CRITICAL </td> <td> Jenkins plugin versions — specifically Checkmarx AST Plugin v2026.5.09 </td> <td> T1195.002 </td> <td> Asset inventory query: identify all Jenkins instances; check installed plugin manifests for checkmarx-ast version string </td> </tr> <tr> <td> CRITICAL </td> <td> Outbound connections from Jenkins runners to .trycloudflare[.]com or checkmarx[.]zone </td> <td> T1041 </td> <td> DNS/proxy logs: alert on any Jenkins runner resolving trycloudflare[.]com subdomains or checkmarx[.]zone </td> </tr> <tr> <td> HIGH </td> <td> Microsoft Teams external screen-sharing sessions followed by AnyDesk/DWAgent installation </td> <td> T1566.003 , T1219 </td> <td> Correlate Teams audit logs (external user + screen share) with endpoint telemetry (AnyDesk/DWAgent binary execution within 30 minutes) </td> </tr> <tr> <td> HIGH </td> <td> Linux kernel exploitation artifacts — .swp files in GLPI/LDAP config directories </td> <td> T1068 </td> <td> File integrity monitoring: alert on .swp file creation in /etc/glpi/, /var/www/glpi/, or LDAP auth config paths </td> </tr> <tr> <td> HIGH </td> <td> Unusual PAN-OS admin account activity or scheduled tasks on firewall management interfaces </td> <td> T1078 </td> <td> SIEM correlation: PAN-OS management plane logins outside business hours, new scheduled tasks, or lateral movement from firewall IPs to internal hosts </td> </tr> <tr> <td> MEDIUM </td> <td> cPanel create_user API calls from unexpected sources </td> <td> T1190 </td> <td> WAF/web server logs: monitor for create_user API endpoint access from non-administrative IPs </td> </tr> </tbody> </table> <h3> Hunting Hypotheses </h3> <ul> <li> "Has TeamPCP already harvested our secrets?" — Search Jenkins build logs and environment variable dumps for evidence of the Shai Hulud credential sweeper. Look for unexpected outbound connections from CI/CD infrastructure in the past 72 hours. Check if any Azure/AWS credentials, GitHub PATs, or SSH keys accessible to Jenkins have been used from anomalous locations. </li> </ul> <ul> <li> "Is Volt Typhoon already inside our PAN-OS perimeter?" — Hunt for living-off-the-land indicators on PAN-OS appliances: unusual admin accounts created after 2026-05-06, modified cron jobs, unexpected outbound connections from management interfaces, or evidence of credential harvesting from the firewall configuration. </li> </ul> <ul> <li> "Did a 'failed ransomware' event actually succeed as espionage?" — Review any recent incidents classified as "ransomware — no encryption" or "ransomware — contained before execution." Re-examine for data exfiltration indicators, especially via legitimate remote access tools (AnyDesk, DWAgent, Quick Assist). </li> </ul> <ul> <li> "Are our .NET state portals hosting APT41 web shells?" — Scan all internet-facing IIS/.NET applications for unauthorized ASPX files, especially in writable directories. Compare file timestamps against known deployment schedules. </li> </ul> <h3> Blocking Guidance </h3> Block or alert on the following verified indicators at perimeter and endpoint: <table> <thead> <tr> <th> Type </th> <th> Value </th> <th> Context </th> </tr> </thead> <tbody> <tr> <td> Domain </td> <td> checkmarx[.]zone </td> <td> TeamPCP C2 infrastructure </td> </tr> <tr> <td> Domain </td> <td> [subdomain].trycloudflare[.]com (from Jenkins runners) </td> <td> TeamPCP C2 tunneling </td> </tr> </tbody> </table> Additional IOCs for the campaigns discussed in this report — including hashes, additional infrastructure indicators, and actor-attributed domains — are available through Anomali ThreatStream Next-Gen and partner feeds. Consult ThreatStream Next-Gen for the latest verified indicators before deploying block rules. <h2> Sector-Specific Defensive Priorities </h2> <h3> Government (State & Local Agencies) </h3> <ul> <li> Immediate: Verify no Jenkins instance runs Checkmarx AST Plugin v2026.5.09. If found, invoke full incident response — assume all secrets compromised. </li> <li> Immediate: Patch all Linux servers for CVE-2026-43284/CVE-2026-43500 (Dirty Frag). Prioritize systems running GLPI or PHP-based citizen services. </li> <li> 7-Day: Update IR playbooks to include "ransomware-as-espionage" branch — when ransomware deploys but does not encrypt, escalate to nation-state response track. </li> <li> 30-Day: Commission Volt Typhoon-focused threat hunt on all PAN-OS appliances, especially those patched after 2026-05-06 (attacker may have exploited before patch). </li> </ul> <h3> Financial Services (State Treasury, Revenue, Pension Systems) </h3> <ul> <li> Immediate: Audit CI/CD pipelines processing financial data for supply chain integrity — verify plugin checksums, restrict auto-update policies. </li> <li> 7-Day: Implement conditional access policies blocking external Teams screen-sharing for finance staff (MuddyWater TTP mitigation). </li> <li> 30-Day: Review SAP NetWeaver access controls given ongoing APT41 interest in state financial systems. </li> </ul> <h3> Energy (State Energy Regulatory Systems, SCADA Oversight) </h3> <ul> <li> Immediate: Verify ICS advisory patches for ABB B&R, Hitachi PCM600, and Johnson Controls CEM AC2000 systems under state oversight. </li> <li> 7-Day: Segment OT/SCADA management networks from enterprise IT — Volt Typhoon's known objective is pre-positioning for infrastructure disruption. </li> <li> 30-Day: Conduct tabletop exercise simulating Volt Typhoon-style compromise of perimeter firewall leading to OT network access. </li> </ul> <h3> Healthcare (State Health/Human Services, Medicaid Systems) </h3> <ul> <li> Immediate: Patch Linux servers hosting health databases for Dirty Frag (CVE-2026-43284/43500) — HIPAA-protected data at risk from privilege escalation. </li> <li> 7-Day: Review Microsoft Teams external access policies for health agency staff — MuddyWater's social engineering via Teams is directly applicable. </li> <li> 30-Day: Assess SaaS platform concentration risk (Canvas LMS breach demonstrates single-vendor failure can affect thousands of organizations simultaneously). </li> </ul> <h3> Aviation & Logistics (State DOT, Port Authorities, Transit Systems) </h3> <ul> <li> Immediate: Verify PAN-OS patch status on all perimeter firewalls at transportation management centers — CVE-2026-0300 enables unauthenticated RCE. </li> <li> 7-Day: Audit .NET web applications for state transit/logistics portals against APT41 web shell indicators. </li> <li> 30-Day: Map all MSP-hosted web properties running cPanel and verify patch status for CVE-2026-29202. </li> </ul> <h2> Prioritized Defense Recommendations </h2> <h3> IMMEDIATE (Within 24 Hours) </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> DevOps / App Teams </td> <td> Audit ALL Jenkins instances for Checkmarx AST Plugin v2026.5.09. If present: isolate the Jenkins environment, rotate ALL secrets accessible to runners (Azure creds, GitHub PATs, SSH keys, K8s tokens), and invoke incident response. </td> </tr> <tr> <td> 2 </td> <td> IT Operations </td> <td> Apply Dirty Frag patches (CVE-2026-43284, CVE-2026-43500) to all RHEL/Ubuntu Linux servers. Prioritize internet-facing systems and those running GLPI or PHP applications. </td> </tr> <tr> <td> 3 </td> <td> SOC </td> <td> Deploy detection for Teams-based social engineering: Alert on external accounts initiating screen-sharing with state employees, especially when followed by AnyDesk or DWAgent installation within 30 minutes. </td> </tr> <tr> <td> 4 </td> <td> IT Operations </td> <td> Confirm PAN-OS CVE-2026-0300 patches are applied on all perimeter firewalls. If any remain unpatched since May 6, treat as potentially compromised. </td> </tr> </tbody> </table> <h3> 7-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 5 </td> <td> IT Operations / Vendor Mgmt </td> <td> Verify all MSP-hosted cPanel instances are patched to ≥11.136.0.9. Send formal patch verification requests to hosting vendors for CVE-2026-29202 (Perl code injection). </td> </tr> <tr> <td> 6 </td> <td> DevOps </td> <td> Pin ALL Jenkins plugins to verified SHA checksums rather than version tags. Implement plugin integrity verification as a CI/CD governance control. </td> </tr> <tr> <td> 7 </td> <td> SOC / IR Team </td> <td> Update IR playbooks to include "ransomware-as-false-flag" scenario. When ransomware is detected but no encryption occurs, escalate as potential nation-state espionage — involve different stakeholders and implement longer-term containment. </td> </tr> <tr> <td> 8 </td> <td> SOC </td> <td> Deploy web shell detection across all internet-facing .NET/IIS applications. Hunt for unauthorized ASPX files, especially those created after 2026-05-09 (APT41 campaign update). </td> </tr> </tbody> </table> <h3> 30-DAY </h3> <table> <thead> <tr> <th> Priority </th> <th> Responsible Team </th> <th> Action </th> </tr> </thead> <tbody> <tr> <td> 9 </td> <td> CISO / Red Team </td> <td> Commission proactive Volt Typhoon threat hunt on PAN-OS firewalls. Focus on unusual admin accounts, scheduled tasks, and lateral movement from firewall management interfaces. Their silence is not reassurance — it's their operational signature. </td> </tr> <tr> <td> 10 </td> <td> CISO / Governance </td> <td> Establish CI/CD supply chain security policy requiring cryptographic verification of all pipeline plugins and dependencies. The TeamPCP pattern (repeated compromise of the same vendor) will be replicated by other actors. </td> </tr> <tr> <td> 11 </td> <td> CISO / Procurement </td> <td> Resolve OSINT collection gap — procure alternative intelligence feeds (direct RSS, additional API providers) to eliminate single-point-of-failure in threat detection capability. Three days of degraded collection is an unacceptable blind spot. </td> </tr> <tr> <td> 12 </td> <td> IR Team / Executive </td> <td> Conduct tabletop exercise simulating a combined scenario: nation-state actor deploys ransomware as cover while exfiltrating citizen PII. Test whether current IR processes correctly identify and escalate the espionage component. </td> </tr> </tbody> </table> <h2> Executive Decisions Required </h2> <table> <thead> <tr> <th> # </th> <th> Decision </th> <th> Owner </th> <th> Deadline </th> </tr> </thead> <tbody> <tr> <td> 1 </td> <td> Confirm whether any state Jenkins instance uses Checkmarx AST plugin — if yes, authorize incident response </td> <td> CIO </td> <td> Today </td> </tr> <tr> <td> 2 </td> <td> Authorize emergency patching window for Linux fleet (Dirty Frag) </td> <td> CISO </td> <td> Today </td> </tr> <tr> <td> 3 </td> <td> Direct MSP vendor coordination for cPanel patch verification </td> <td> CIO </td> <td> Within 7 days </td> </tr> <tr> <td> 4 </td> <td> Approve alternative OSINT feed procurement to restore collection capability </td> <td> CISO </td> <td> Within 7 days </td> </tr> <tr> <td> 5 </td> <td> Fund proactive Volt Typhoon threat hunt (internal or contracted) </td> <td> CISO </td> <td> Within 30 days </td> </tr> </tbody> </table> <h2> Bottom Line </h2> The threat environment facing state government IT is defined by three converging trends: supply chain attacks are targeting the security tools themselves, nation-state actors are deliberately blurring the line between espionage and criminal ransomware, and sophisticated adversaries like Volt Typhoon may already be inside perimeter devices waiting for the right moment. Each of these trends demands a different defensive response — but they share a common requirement: action today, not next quarter. The TeamPCP backdoor means secrets may already be exfiltrated. The Dirty Frag exploit means Linux servers without patches are one local account compromise away from full root access. And MuddyWater's false-flag playbook means your IR team needs to question every "failed ransomware" event. State agencies cannot afford to treat these as theoretical risks. Check your Jenkins plugins. Patch your Linux servers. Update your IR playbooks. Hunt your firewalls. The adversaries are not waiting. Anomali CTI Desk | 2026-05-11 | TLP:GREEN This intelligence product is intended for state government senior IT leadership. Distribute within your organization per TLP:GREEN handling requirements.

FEATURED RESOURCES

May 12, 2026

Anomali Cyber Watch

Public Sector

State Government Cyber Threat Brief: LockBit Infrastructure Actively Scanning Government Networks as AI Attack Surface Explodes

May 11, 2026

Anomali Cyber Watch

Public Sector

Supply Chain Attacks Hit CI/CD Security Tools While Iran Masks Espionage as Ransomware: What State Government CISOs Must Act On Today

May 7, 2026

Anomali Cyber Watch

Iranian Cyber Forces in “Coiled Spring” Posture: What CISOs Must Do Before the Window Closes

Explore All