| Date | Event | Significance |
|---|---|---|
| Aug 17, 2026 | CISA adds CVE-2025-62593 (Ray AI RCE) to KEV with 3-day mandate | AI/ML developer platforms now in active exploitation |
| Aug 18, 2026 | CISA adds CVE-2026-33824 (Windows IKE RCE, CVSS 9.8) and CVE-2026-55040 (SharePoint auth bypass, CVSS 9.1) to KEV | SharePoint flaw confirmed in active ransomware attacks |
| Aug 18, 2026 | VAULT PANDA/UNC6588 (China/MSS) confirmed using AI-assisted web shells against U.S. government and healthcare; China-nexus actors exploiting VMware vCenter (CVE-2026-59310) across 361 victims; PRC-nexus actors actively exploiting GlobalProtect VPN | Nation-state activity across multiple vectors intensifying |
| Aug 19, 2026 | CISA publishes AA26-231A — active threat to Siemens S7 PLCs | First 2026 advisory confirming ongoing ICS targeting; applies to ALL PLC operators |
| Aug 19, 2026 | CISA adds CVE-2026-64849 (MLflow SSRF, CVSS 9.3) to KEV | Second AI/ML platform KEV in 72 hours — scanning campaigns intensifying |
| Aug 19, 2026 | CVE-2026-66794 (Red Hat Kubernetes SSRF, CVSS 9.3) disclosed — no patch available | Unauthenticated access to internal cluster services; state OpenShift deployments exposed |
| Aug 20, 2026 | eSentire reports ErrTraffic MaaS delivering Cruciferra EDR-killer with blockchain C2 | Advanced nation-state TTPs now available as commodity service for $380/month |
| Aug 20, 2026 | Everest ransomware claims 3 U.S. government victims in single day | Government sector tied for most-targeted alongside technology |
| Timeframe | Actor/Campaign | Target | Key Detail |
|---|---|---|---|
| Aug 1–12, 2026 | MuddyWater (Iran/MOIS) | U.S. water/wastewater (7+ states) | ICS/PLC intrusions against critical infrastructure |
| Aug 17, 2026 | Unattributed | AI/ML platforms (Ray) | Active exploitation triggers CISA KEV |
| Aug 18, 2026 | GRACEFUL SPIDER / Cl0p | ~50 organizations (PTC Windchill) | Mass extortion campaign |
| Aug 18, 2026 | Unattributed (ransomware operators) | SharePoint environments | CVE-2026-55040 used in ransomware delivery |
| Aug 18, 2026 | VAULT PANDA / UNC6588 (China/MSS) | U.S. government, healthcare | AI-assisted web shells |
| Aug 18, 2026 | China-nexus APT (unattributed) | 361 victims (VMware vCenter) | Babuk ransomware as espionage smokescreen |
| Aug 19, 2026 | Unattributed (active campaign) | Siemens S7 PLCs — all sectors | CISA AA26-231A joint advisory |
| Aug 19–20, 2026 | PRC-nexus actors | GlobalProtect VPN users | Active exploitation campaign |
| Aug 20, 2026 | ErrTraffic MaaS operators | Broad (WordPress → enterprise) | ClickFix → Cruciferra EDR-killer with blockchain C2 |
| Aug 20, 2026 | Everest, Qilin, DeadLock | U.S. government, technology | Multiple dark web victim claims |
CISA Advisory AA26-231A confirms an ongoing campaign targeting Siemens S7 Series PLCs — but explicitly warns that the threat extends to all PLC manufacturers and operators. For state agencies, this directly impacts water and wastewater treatment facilities, building automation systems (HVAC, physical security), and transportation signal systems.
This advisory follows MuddyWater's confirmed ICS intrusions against water systems in 7+ U.S. states (August 1–12). The convergence of Iranian state-sponsored and unattributed PLC targeting represents the most significant OT threat to state infrastructure in 2026.
Two CISA KEV additions in 72 hours targeting AI/ML developer tooling: CVE-2025-62593 — Ray AI Framework RCE (KEV Aug 17); and CVE-2026-64849 — MLflow SSRF (CVSS 9.3, KEV Aug 19). The unauthenticated /api/2.0/mlflow/webhooks/{id}/test endpoint allows attackers to reach internal cloud metadata services and exfiltrate credentials.
State agencies experimenting with AI/ML for citizen services, fraud detection, or internal analytics are directly exposed. These platforms are often deployed by data science teams outside traditional IT governance — creating shadow infrastructure invisible to vulnerability management programs.
The ErrTraffic malware-as-a-service platform (operated by actor "LenAI," $380/month) now delivers the Cruciferra loader with EDR-killing capability via BYOVD (Bring Your Own Vulnerable Driver).
Infection chain: compromised WordPress sites → fake CAPTCHA (ClickFix) → victim pastes PowerShell → DLL side-loading via Microsoft-signed ServiceModelReg.exe → process hollowing → Remus infostealer + EDR termination. Blockchain-backed C2 using Polygon smart contracts as dead-drop resolvers makes this immune to traditional domain takedowns.
The vulnerable driver DCRCVDrv.sys is dropped to C:\Windows\Temp\ and used to terminate endpoint protection. The side-loaded malicious DLL is named mscoree.dll.
This is a paradigm shift: techniques previously exclusive to nation-state actors (BYOVD EDR-killing, blockchain C2) are now available to any criminal willing to pay $380/month.
CVE-2026-66794 (CVSS 9.3) in Red Hat Multicluster Engine for Kubernetes allows an unauthenticated attacker to proxy requests to arbitrary services across all managed clusters via the cluster-proxy-addon component. No patch is available.
For state agencies running Red Hat OpenShift for containerized workloads — increasingly common for modernized citizen services — this vulnerability grants an attacker the equivalent of unrestricted lateral movement across every managed cluster from a single exposed route.
Everest ransomware dominated dark web activity on August 20, claiming 3 victims including U.S. government targets. Combined with continued activity from Qilin and DeadLock, the government sector tied with technology as the most-targeted vertical in a single day.
Active ransomware groups confirmed targeting U.S. government in the current cycle: Everest (U.S. government claims, Aug 20); Qilin (active, Aug 20); GRACEFUL SPIDER / Cl0p (mass extortion via PTC Windchill, ~50 orgs, Aug 18); and unattributed operators using CVE-2026-55040 (SharePoint) for ransomware delivery.
Seven distinct nation-state actors show recent activity updates this cycle, spanning China, Iran, and Russia:
| Actor | Origin | Target |
|---|---|---|
| VAULT PANDA / UNC6588 | China (MSS) | U.S. government, healthcare |
| China-nexus APT (unattributed) | China | 361 victims — VMware vCenter, Babuk as cover |
| PRC-nexus (unattributed) | China | GlobalProtect VPN users |
| UNC6527 / FLUXWEAVE | China | Updated Aug 19 — under assessment |
| APT25 | China | Updated Aug 19 — under assessment |
| UNC5007 / Flax Typhoon | China | Updated Aug 19 — under assessment |
| MuddyWater | Iran (MOIS) | U.S. water/wastewater (7+ states) |
| UNC4057 / Callisto | Russia | Updated Aug 19 — under assessment |
| Scenario | Probability | Basis |
|---|---|---|
| Additional CISA KEV additions for AI/ML tooling as scanning campaigns intensify | HIGH (>70%) | Two KEVs in 72 hours indicates active campaign; more platforms likely affected |
| Everest ransomware claims a state or local government victim within 7 days | MODERATE (40–60%) | Current tempo of 3 gov claims/day; state/local distinction unclear in dark web posts |
| PRC-nexus actors exploit CVE-2026-66794 (K8s SSRF) against government Kubernetes deployments before patch availability | MODERATE (40–60%) | China-nexus actors have demonstrated rapid exploitation of unpatched infrastructure vulns (vCenter pattern) |
| ClickFix/Cruciferra EDR-killer technique appears in ransomware campaign targeting government within 90 days | HIGH (>70%) | $380/month MaaS pricing ensures rapid adoption by ransomware affiliates |
| Additional ICS/PLC targeting advisories following AA26-231A | MODERATE (40–60%) | Historical pattern: CISA advisories cluster when active campaigns are detected across multiple victims |
| Priority | What to Detect | ATT&CK ID | Detection Logic |
|---|---|---|---|
| CRITICAL | BYOVD driver loading (DCRCVDrv.sys in C:\Windows\Temp\) | T1562.001 | Monitor for unsigned/vulnerable driver loads from temp directories; cross-reference Microsoft Vulnerable Driver Blocklist |
| CRITICAL | PowerShell execution from browser context (ClickFix pattern) | T1059.001, T1204.002 | Alert on powershell.exe spawned by browser process (chrome.exe, msedge.exe, firefox.exe) or via Win+R/Win+X within 5 seconds of clipboard paste |
| HIGH | DLL side-loading of mscoree.dll via ServiceModelReg.exe | T1574.002 | Baseline legitimate mscoree.dll load paths; alert on loads from non-standard directories |
| HIGH | Outbound connections to blockchain RPC endpoints from non-developer systems | T1102 | Monitor for HTTPS connections to polygon-rpc[.]com, infura[.]io, alchemy[.]com from standard workstations |
| HIGH | SSRF exploitation patterns against Kubernetes proxy routes | T1190 | WAF/proxy logs showing requests to /cluster-proxy-addon routes with redirect chains to internal IPs (169.254.169.254, 10.x.x.x) |
| MEDIUM | Process hollowing into ServiceModelReg.exe | T1055.012 | Monitor for ServiceModelReg.exe with network connections or child processes inconsistent with its legitimate function |
| Indicator | Type | Context |
|---|---|---|
DCRCVDrv.sys (in C:\Windows\Temp\) | Vulnerable driver | BYOVD EDR-killer — Cruciferra campaign |
mscoree.dll (non-standard path) | Malicious DLL | Side-loaded by ServiceModelReg.exe |
ServiceModelReg.exe | Process hollowing target | Legitimate binary abused for injection |
Add DCRCVDrv.sys to the Windows Defender Application Control vulnerable driver blocklist immediately. Hash-based IOCs (SHA-256 and SHA-1) for these campaigns could not be verified against confirmed intelligence sources this cycle and have been withheld — query Anomali ThreatStream Next-Gen directly for validated file hash indicators. Additional network and infrastructure IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
cluster-proxy routes accessible from non-admin networks or the internet.- Enforce hardware FIDO2 tokens for all treasury and tax system administrative access — ClickFix bypasses SMS/TOTP MFA
- Monitor for anomalous EFT/ACH transaction patterns that could indicate compromised credentials from infostealer campaigns
- Implement network segmentation between IT and OT networks with unidirectional gateways where feasible
- Verify firmware integrity on all Siemens S7 PLCs; apply CISA-recommended mitigations including disabling unnecessary remote access protocols
- Review Johnson Controls Metasys and Siemens Desigo CC deployments for default credentials and exposed management interfaces
- Audit all public-facing web applications for web shell indicators (unexpected .aspx/.php files, anomalous outbound connections from web servers)
- Segment Medicaid/health data systems from general agency networks — these are high-value espionage targets
- Ensure healthcare-specific ransomware playbooks account for Everest and Qilin TTPs (valid account abuse for initial access)
- Validate SharePoint patching status across all agencies — CVE-2026-55040 is confirmed in active ransomware attacks
- Enforce conditional access policies blocking legacy authentication protocols in Microsoft 365/Entra ID
- Test backup restoration procedures for critical citizen services (DMV, courts, benefits) — assume ransomware will hit within 30 days
- Inventory all PLCs controlling traffic signals, tunnel ventilation, and bridge operations; verify network isolation
- Audit CI/CD pipelines (Jenkins, GitHub Actions) for dependency on compromised packages — malicious Rust crate "arrayref" executes a build-time payload
- Review GlobalProtect VPN configurations — PRC-nexus actors are actively exploiting Palo Alto GlobalProtect
DCRCVDrv.sys execution — confirmed EDR-killer in active campaigns.polygon-rpc[.]com, infura[.]io, alchemy[.]com) from non-developer workstations — commodity MaaS now uses blockchain C2.The convergence of active ICS targeting, unpatched critical infrastructure vulnerabilities, and the democratization of advanced evasion techniques through cheap MaaS platforms creates a threat environment where state agencies cannot afford delayed action. The Siemens S7 PLC advisory alone represents potential public safety implications for water treatment and transportation systems under state control. The threat actors are not waiting for your next patch cycle. Neither should you.