| Development | Date | Significance |
|---|---|---|
| CISA adds CVE-2026-63077 (TeamCity RCE) to KEV | Aug 5 | Unauthenticated remote code execution, CVSS 9.8. FCEB compliance deadline: August 8 — three days from today. Active exploitation confirmed. |
| keyv/cacheable npm supply chain worm discovered | Aug 4 | Tens of millions of weekly downloads compromised. Self-propagating credential harvester targeting AWS, Azure, GCP keys and CI/CD tokens. Forges sigstore provenance attestations to evade integrity checks. |
| ChainDrop npm worm escalates to 440 packages | Aug 4 | Second concurrent npm supply chain campaign reaches 500M weekly downloads across 440 compromised packages, compounding risk to Node.js development environments. |
| CVE-2026-18577 (N-able N-central) added to KEV | Aug 3 | Authentication bypass in the RMM platform used by MSPs managing state endpoints. This is a bypass of the previous patch (CVE-2026-18556) — the first fix was incomplete. |
| CVE-2026-70426 (Jenkins RCE) disclosed | Aug 5 | Deserialization bypass enabling arbitrary code execution on Jenkins controllers. CVSS 9.0. No exploitation observed yet — but the window is closing rapidly. |
| Salt Typhoon / Volt Typhoon persistent access disclosed | Jul 25 | Chinese MSS-affiliated actors confirmed maintaining living-off-the-land presence in state and National Guard networks. Access remains unresolved. |
| WARLOCK SPIDER ransomware actively targeting local government | Ongoing | RaaS group (GOLD SALEM / Storm-2603) explicitly targets local and state government. Leverages recently disclosed RCEs for initial access; uses Cloudflare Workers and Supabase for C2. |
| City of Pittsburg loses $913K to BEC | Aug 5 (disclosed) | Classic vendor-spoofing ACH fraud against municipal government. FBI investigating. Pattern directly applicable to state agencies. |
| Zbtlink routers ship with ENDLESSDOORS backdoor | Aug 5 | 20+ Chinese-manufactured router models contain factory-installed root backdoor beaconing to Chinese C2 every 35 seconds. |
| Verizon DBIR 2026 released | Aug 5 | Exploitation now #1 initial access (31%), ransomware in 48% of breaches, third-party involvement at 48% (up from 30%), median critical vuln remediation: 43 days. |
| Date | Event | Impact to State Government |
|---|---|---|
| Jul 25 | Salt Typhoon / Volt Typhoon persistent access in state and National Guard networks disclosed | Unresolved — Chinese MSS-affiliated actors maintain living-off-the-land presence |
| Aug 1 | CVE-2026-18556 exploitation confirmed against MSP environments (9+ orgs) | MSP-managed state endpoints at risk via trusted relationship |
| Aug 3 | CVE-2026-18577 (N-central patch bypass) added to CISA KEV | Previous remediation insufficient — re-patching required |
| Aug 4 | keyv/cacheable npm worm begins self-propagation | State Node.js development environments exposed to credential theft |
| Aug 4 | ChainDrop npm worm escalates to 440 packages / 500M weekly downloads | Second concurrent npm supply chain campaign compounds risk |
| Aug 5 | CVE-2026-63077 (TeamCity) added to CISA KEV — deadline Aug 8 | Any unpatched TeamCity instance is non-compliant Friday |
| Aug 5 | CVE-2026-70426 (Jenkins CVSS 9.0) publicly disclosed | Weaponization expected within days based on DBIR exploitation trends |
| Aug 5 | City of Pittsburg BEC disclosed ($913K loss) | Validates ongoing BEC threat to government finance operations |
| Aug 5 | Zbtlink ENDLESSDOORS factory backdoor disclosed | Supply chain hardware risk for any agency using affected routers |
A deserialization vulnerability in TeamCity's agent polling protocol allows unauthenticated attackers to execute arbitrary commands on TeamCity servers. No credentials required. No user interaction needed. CISA has confirmed active exploitation and set an August 8 compliance deadline. Any state agency running TeamCity versions prior to 2026.1.3 or 2025.11.7 is at immediate risk of complete CI/CD pipeline compromise — including access to stored credentials, deployment keys, and the ability to inject malicious code into production builds.
A bypass of Jenkins' JEP-200 class filters allows code execution on Jenkins controllers via the Remoting protocol. While exploitation currently requires a compromised agent or Agent/Connect permission, the DBIR's finding that weaponization now occurs within hours of disclosure makes this a ticking clock. Jenkins versions ≤2.575 and LTS ≤2.568.1 are affected.
On August 4, attackers compromised the maintainer account for the keyv and cacheable npm package families and published trojanized versions that download a Bun runtime and execute a 728KB credential-harvesting payload; steal AWS/GCP/Azure keys, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub Actions OIDC tokens, and npm tokens; self-propagate by republishing trojanized versions of other packages using stolen npm tokens; forge sigstore provenance attestations — defeating cryptographic supply chain integrity verification; and plant persistence in .claude and .vscode directories.
Affected packages include keyv@6.0.0, cacheable@2.5.1, flat-cache@6.1.24, file-entry-cache@11.1.6, cache-manager@7.2.10, and multiple @cacheable/* scoped packages. The dependency chain reaches into widely-used tools like ESLint, meaning state development teams may be affected even without directly importing these packages.
A second concurrent campaign — ChainDrop — has independently compromised 440 npm packages reaching approximately 500 million weekly downloads. The simultaneous occurrence of two self-propagating npm supply chain campaigns represents an unprecedented concentration of risk to Node.js development environments.
N-able N-central is the remote monitoring and management platform used by many MSPs to administer state government endpoints. CVE-2026-18577 is a bypass of the patch for CVE-2026-18556 — meaning organizations that diligently applied the first fix remain vulnerable. This "patch-of-a-patch" pattern is becoming more common and demands that agencies verify remediation rather than assuming a single patch cycle resolves the issue.
The MSP attack vector is particularly dangerous for state government because it exploits trusted relationships (MITRE ATT&CK T1199). A compromised MSP tool provides authenticated access to every managed endpoint without triggering the security controls designed to detect external intrusion.
Salt Typhoon and Volt Typhoon (both Chinese MSS-affiliated) maintain unresolved persistent access in state and National Guard networks first disclosed July 25, 2026. These actors specialize in living-off-the-land techniques — using legitimate tools and valid credentials to avoid detection. The absence of new indicators this cycle does not indicate they have departed. It indicates they are operating within normal administrative noise.
BANISHED KITTEN (IRGC-affiliated) continues targeting water and wastewater PLCs across 7+ U.S. states. No new activity was observed this cycle, but the threat remains active.
The Zbtlink ENDLESSDOORS factory backdoor represents a different dimension of Chinese-origin supply chain risk. Twenty router models ship with a root-level implant masquerading as a Linux kernel thread (kworker) that beacons to Chinese C2 infrastructure every 35 seconds on ports 7000/7001. Any state agency or county partner using these devices has an undetectable persistent backdoor in their network.
WARLOCK SPIDER (aliases: GOLD SALEM, Storm-2603) is a ransomware group that emerged in April 2025 and explicitly targets local government alongside 20+ other industries. Unusually, they also target Russian entities and refuse Russian members. They leverage recently disclosed RCE vulnerabilities for initial access and use Cloudflare Workers and Supabase for command and control — infrastructure that blends with legitimate cloud traffic.
The City of Pittsburg BEC incident ($913,839 in fraudulent ACH payments) demonstrates that the most financially damaging attacks against government require no malware and no zero-days. Email compromise, vendor impersonation, and a single fraudulent payment instruction were sufficient. The 5-day detection gap is typical for this attack pattern.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| CVE-2026-70426 (Jenkins) exploited in the wild | >80% | 7 days | CVSS 9.0 + public advisory + DBIR-documented hours-to-weaponization trend |
| Additional npm packages discovered compromised beyond keyv/cacheable | 50–70% | 7 days | Worm is self-propagating via stolen npm tokens; propagation is automated |
| WARLOCK SPIDER or similar RaaS group discloses a U.S. state/local government victim | 40–60% | 7 days | 48% ransomware rate in DBIR + explicit local-gov targeting by WARLOCK SPIDER |
| CVE-2026-63077 (TeamCity) used to compromise a government CI/CD pipeline | 60–75% | 14 days | Active exploitation confirmed + government listed as targeted industry |
| Volt Typhoon / Salt Typhoon activity detected in additional state networks | 30–50% | 30 days | Known persistent access + living-off-the-land methodology delays detection |
Monitor: Inbound connections to TeamCity agent polling ports from unexpected sources Detect: T1190 — unexpected process spawning from TeamCity server processes; T1059.001 — PowerShell or cmd.exe execution by TeamCity service accounts Hunt hypothesis: "If TeamCity is compromised, the attacker will access stored credentials and deployment keys" — search for T1552.001 (credential file access) by TeamCity service accounts outside normal build windows Block: Internet-facing TeamCity instances without VPN — these should not exist
Monitor: T1059.007 — JavaScript execution via preinstall hooks in CI/CD runners; unexpected Bun runtime downloads Detect: T1552.001 — bulk access to cloud credential files (.aws/credentials, .azure/, ~/.config/gcloud/); T1528 — npm OIDC token exchange requests from unexpected sources Hunt hypothesis: "If a CI runner is compromised, stolen tokens will be used to publish packages" — monitor npm registry API calls (registry.npmjs.org/-/whoami, /-/npm/v1/oidc/token/exchange/package/) from build infrastructure Block: Outbound connections from CI runners to unexpected GitHub repositories (T1567.001 exfiltration via code repository commits) Investigate: Any .claude or .vscode directory modifications on build servers
Block immediately: Egress to 47.107.224[.]89, 47.100.190[.]96, 45.32.81[.]152, 43.248.136[.]125 on ports 7000/7001 Block: DNS resolution for rbdg4nzqadui[.]wikaba[.]com, zbtctl[.]epplink[.]net, online-string[.]com Detect: T1071.001 — periodic beaconing every 35 seconds to the above infrastructure; T1036.004 — processes named kworker that are not legitimate kernel threads (check /proc/[pid]/exe symlink) Hunt hypothesis: "If Zbtlink routers exist in our environment, they are actively beaconing" — scan asset inventory for models: CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, Z8102AX-2DSIM
Hunt: T1078 (Valid Accounts) — authentication from service accounts at unusual times or from unusual source IPs; T1072 (Software Deployment Tools) — legitimate admin tools (PsExec, WMI, PowerShell Remoting) used in unusual patterns Detect: Network device configuration changes outside change windows; new scheduled tasks or services created by accounts that don't normally perform administration Key principle: These actors deliberately operate within normal administrative noise. Detection requires behavioral baselines, not signature matching.
Monitor: T1114.002 — mail forwarding rules created on finance staff mailboxes; T1534 — internal emails requesting payment changes Detect: New inbox rules forwarding to external addresses; login from unusual geographies on finance team accounts Investigate: Any ACH payment modification request that arrives solely via email without phone verification
| Threat | ATT&CK |
|---|---|
| TeamCity Exploitation (CVE-2026-63077) | T1190 T1059.001 T1552.001 |
| npm Supply Chain Worm (keyv/cacheable) | T1059.007 T1552.001 T1528 T1567.001 |
| Zbtlink ENDLESSDOORS Backdoor | T1071.001 T1036.004 |
| Volt Typhoon / Salt Typhoon Living-off-the-Land | T1078 T1072 |
| BEC / ACH Fraud | T1114.002 T1534 |
Block the above at perimeter firewalls, proxies, and DNS. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
- Enforce dual-authorization for all ACH payments exceeding $50,000 with mandatory out-of-band voice verification to a pre-registered vendor phone number
- Audit mail forwarding rules on all finance staff mailboxes weekly — attackers establish persistence via T1114.002 before executing fraud
- Implement payment velocity alerts: flag any single ACH transaction exceeding historical norms for the vendor relationship
- Validate network segmentation between IT and OT environments — Volt Typhoon's methodology involves lateral movement from IT into operational technology
- Audit remote access to SCADA systems: ensure no direct internet exposure, enforce MFA on all jump hosts
- Review CISA ICS advisories for Schneider IGSS, MikroTik RouterOS, and libiec61850 — apply patches to any deployed systems even without confirmed exploitation
- Prioritize Jenkins and TeamCity patching in any development environments supporting health information exchanges or Medicaid eligibility systems
- Audit npm dependencies in patient portal web applications — the keyv/cacheable dependency chain reaches into common frameworks
- Ensure offline backups of Medicaid enrollment databases are tested and recoverable within 72 hours
- Confirm TeamCity patch status across all agencies by August 7 (FCEB deadline August 8)
- Verify N-able N-central hotfix (2026.3 HF1) is applied — coordinate with MSP partners who manage state endpoints
- Implement conditional access policies blocking legacy authentication protocols
- Brief all agency help desks on CHATTY SPIDER callback phishing TTPs — this group uses voicemail-themed emails directing recipients to call attacker-controlled numbers
- Conduct network device inventory specifically targeting Chinese-manufactured equipment — Zbtlink routers and similar devices may exist in traffic management or port operations networks
- Audit VPN concentrators and edge devices for unauthorized configuration changes — Volt Typhoon's preferred persistence mechanism
- Validate that GPS/ADS-B systems and freight management platforms are segmented from general IT networks
keyv@6.0.0, cacheable@2.5.1, flat-cache@6.1.24, file-entry-cache@11.1.6, cache-manager@7.2.10, all @cacheable/* packages published August 4. Pin to known-good versions. Rotate all npm tokens, AWS keys, Azure secrets, GCP credentials, and GitHub tokens on any affected CI runner.npm audit with --audit-level=critical as a blocking gate in CI pipelines. Add lockfile integrity verification to build processes.preinstall hook execution spawning network connections, and bulk credential file access by Node.js processes.Three concurrent CI/CD attack vectors, two simultaneous npm supply chain campaigns, an unpatched MSP authentication bypass, confirmed nation-state persistence in state networks, and a validated $913K government BEC loss — all within a single reporting cycle. The convergence is not coincidental. Adversaries have identified development and deployment infrastructure as the highest-leverage target in the government attack surface: compromise the pipeline, and every downstream application is potentially poisoned. The DBIR's confirmation that exploitation has overtaken credential theft as the #1 initial access vector marks a structural shift in the threat landscape. Patching SLAs designed for a credential-theft-dominant environment are no longer adequate. The documented hours-to-weaponization trend means the window between public disclosure and active exploitation is now measured in hours, not weeks. State agencies face a specific compounding risk: the CI/CD systems requiring urgent patching this week are the same systems that deploy patches to everything else. Prioritize accordingly.