TLP:GREEN  ·  States / Public Sector
CI/CD Pipelines Under Siege:

Supply Chain Attacks Converge on Government Infrastructure

ELEVATED. In the past 72 hours, three distinct attack vectors have converged on CI/CD systems — a critical TeamCity zero-day now on CISA's Known Exploited Vulnerabilities catalog with a Friday deadline, a self-propagating npm worm that forges cryptographic provenance signatures, and a newly disclosed Jenkins deserialization flaw rated CVSS 9.0. Meanwhile, the Verizon 2026 Data Breach Investigations Report confirms what these events illustrate: vulnerability exploitation has overtaken credential theft as the #1 breach vector for the first time in 19 years.

I am a
My sector

DevelopmentDateSignificance
CISA adds CVE-2026-63077 (TeamCity RCE) to KEVAug 5Unauthenticated remote code execution, CVSS 9.8. FCEB compliance deadline: August 8 — three days from today. Active exploitation confirmed.
keyv/cacheable npm supply chain worm discoveredAug 4Tens of millions of weekly downloads compromised. Self-propagating credential harvester targeting AWS, Azure, GCP keys and CI/CD tokens. Forges sigstore provenance attestations to evade integrity checks.
ChainDrop npm worm escalates to 440 packagesAug 4Second concurrent npm supply chain campaign reaches 500M weekly downloads across 440 compromised packages, compounding risk to Node.js development environments.
CVE-2026-18577 (N-able N-central) added to KEVAug 3Authentication bypass in the RMM platform used by MSPs managing state endpoints. This is a bypass of the previous patch (CVE-2026-18556) — the first fix was incomplete.
CVE-2026-70426 (Jenkins RCE) disclosedAug 5Deserialization bypass enabling arbitrary code execution on Jenkins controllers. CVSS 9.0. No exploitation observed yet — but the window is closing rapidly.
Salt Typhoon / Volt Typhoon persistent access disclosedJul 25Chinese MSS-affiliated actors confirmed maintaining living-off-the-land presence in state and National Guard networks. Access remains unresolved.
WARLOCK SPIDER ransomware actively targeting local governmentOngoingRaaS group (GOLD SALEM / Storm-2603) explicitly targets local and state government. Leverages recently disclosed RCEs for initial access; uses Cloudflare Workers and Supabase for C2.
City of Pittsburg loses $913K to BECAug 5 (disclosed)Classic vendor-spoofing ACH fraud against municipal government. FBI investigating. Pattern directly applicable to state agencies.
Zbtlink routers ship with ENDLESSDOORS backdoorAug 520+ Chinese-manufactured router models contain factory-installed root backdoor beaconing to Chinese C2 every 35 seconds.
Verizon DBIR 2026 releasedAug 5Exploitation now #1 initial access (31%), ransomware in 48% of breaches, third-party involvement at 48% (up from 30%), median critical vuln remediation: 43 days.

DateEventImpact to State Government
Jul 25Salt Typhoon / Volt Typhoon persistent access in state and National Guard networks disclosedUnresolved — Chinese MSS-affiliated actors maintain living-off-the-land presence
Aug 1CVE-2026-18556 exploitation confirmed against MSP environments (9+ orgs)MSP-managed state endpoints at risk via trusted relationship
Aug 3CVE-2026-18577 (N-central patch bypass) added to CISA KEVPrevious remediation insufficient — re-patching required
Aug 4keyv/cacheable npm worm begins self-propagationState Node.js development environments exposed to credential theft
Aug 4ChainDrop npm worm escalates to 440 packages / 500M weekly downloadsSecond concurrent npm supply chain campaign compounds risk
Aug 5CVE-2026-63077 (TeamCity) added to CISA KEV — deadline Aug 8Any unpatched TeamCity instance is non-compliant Friday
Aug 5CVE-2026-70426 (Jenkins CVSS 9.0) publicly disclosedWeaponization expected within days based on DBIR exploitation trends
Aug 5City of Pittsburg BEC disclosed ($913K loss)Validates ongoing BEC threat to government finance operations
Aug 5Zbtlink ENDLESSDOORS factory backdoor disclosedSupply chain hardware risk for any agency using affected routers

A deserialization vulnerability in TeamCity's agent polling protocol allows unauthenticated attackers to execute arbitrary commands on TeamCity servers. No credentials required. No user interaction needed. CISA has confirmed active exploitation and set an August 8 compliance deadline. Any state agency running TeamCity versions prior to 2026.1.3 or 2025.11.7 is at immediate risk of complete CI/CD pipeline compromise — including access to stored credentials, deployment keys, and the ability to inject malicious code into production builds.

T1190

A bypass of Jenkins' JEP-200 class filters allows code execution on Jenkins controllers via the Remoting protocol. While exploitation currently requires a compromised agent or Agent/Connect permission, the DBIR's finding that weaponization now occurs within hours of disclosure makes this a ticking clock. Jenkins versions ≤2.575 and LTS ≤2.568.1 are affected.

T1059.001

On August 4, attackers compromised the maintainer account for the keyv and cacheable npm package families and published trojanized versions that download a Bun runtime and execute a 728KB credential-harvesting payload; steal AWS/GCP/Azure keys, HashiCorp Vault tokens, Kubernetes service account tokens, GitHub Actions OIDC tokens, and npm tokens; self-propagate by republishing trojanized versions of other packages using stolen npm tokens; forge sigstore provenance attestations — defeating cryptographic supply chain integrity verification; and plant persistence in .claude and .vscode directories.

Affected packages include keyv@6.0.0, cacheable@2.5.1, flat-cache@6.1.24, file-entry-cache@11.1.6, cache-manager@7.2.10, and multiple @cacheable/* scoped packages. The dependency chain reaches into widely-used tools like ESLint, meaning state development teams may be affected even without directly importing these packages.

A second concurrent campaign — ChainDrop — has independently compromised 440 npm packages reaching approximately 500 million weekly downloads. The simultaneous occurrence of two self-propagating npm supply chain campaigns represents an unprecedented concentration of risk to Node.js development environments.

T1059.007T1552.001T1528T1567.001

N-able N-central is the remote monitoring and management platform used by many MSPs to administer state government endpoints. CVE-2026-18577 is a bypass of the patch for CVE-2026-18556 — meaning organizations that diligently applied the first fix remain vulnerable. This "patch-of-a-patch" pattern is becoming more common and demands that agencies verify remediation rather than assuming a single patch cycle resolves the issue.

The MSP attack vector is particularly dangerous for state government because it exploits trusted relationships (MITRE ATT&CK T1199). A compromised MSP tool provides authenticated access to every managed endpoint without triggering the security controls designed to detect external intrusion.

T1199

Salt Typhoon and Volt Typhoon (both Chinese MSS-affiliated) maintain unresolved persistent access in state and National Guard networks first disclosed July 25, 2026. These actors specialize in living-off-the-land techniques — using legitimate tools and valid credentials to avoid detection. The absence of new indicators this cycle does not indicate they have departed. It indicates they are operating within normal administrative noise.

BANISHED KITTEN (IRGC-affiliated) continues targeting water and wastewater PLCs across 7+ U.S. states. No new activity was observed this cycle, but the threat remains active.

The Zbtlink ENDLESSDOORS factory backdoor represents a different dimension of Chinese-origin supply chain risk. Twenty router models ship with a root-level implant masquerading as a Linux kernel thread (kworker) that beacons to Chinese C2 infrastructure every 35 seconds on ports 7000/7001. Any state agency or county partner using these devices has an undetectable persistent backdoor in their network.

T1078T1072T1071.001T1036.004

WARLOCK SPIDER (aliases: GOLD SALEM, Storm-2603) is a ransomware group that emerged in April 2025 and explicitly targets local government alongside 20+ other industries. Unusually, they also target Russian entities and refuse Russian members. They leverage recently disclosed RCE vulnerabilities for initial access and use Cloudflare Workers and Supabase for command and control — infrastructure that blends with legitimate cloud traffic.

The City of Pittsburg BEC incident ($913,839 in fraudulent ACH payments) demonstrates that the most financially damaging attacks against government require no malware and no zero-days. Email compromise, vendor impersonation, and a single fraudulent payment instruction were sufficient. The 5-day detection gap is typical for this attack pattern.

T1114.002T1534

ScenarioProbabilityTimeframeBasis
CVE-2026-70426 (Jenkins) exploited in the wild>80%7 daysCVSS 9.0 + public advisory + DBIR-documented hours-to-weaponization trend
Additional npm packages discovered compromised beyond keyv/cacheable50–70%7 daysWorm is self-propagating via stolen npm tokens; propagation is automated
WARLOCK SPIDER or similar RaaS group discloses a U.S. state/local government victim40–60%7 days48% ransomware rate in DBIR + explicit local-gov targeting by WARLOCK SPIDER
CVE-2026-63077 (TeamCity) used to compromise a government CI/CD pipeline60–75%14 daysActive exploitation confirmed + government listed as targeted industry
Volt Typhoon / Salt Typhoon activity detected in additional state networks30–50%30 daysKnown persistent access + living-off-the-land methodology delays detection

TeamCity Exploitation (CVE-2026-63077):

Monitor: Inbound connections to TeamCity agent polling ports from unexpected sources Detect: T1190 — unexpected process spawning from TeamCity server processes; T1059.001 — PowerShell or cmd.exe execution by TeamCity service accounts Hunt hypothesis: "If TeamCity is compromised, the attacker will access stored credentials and deployment keys" — search for T1552.001 (credential file access) by TeamCity service accounts outside normal build windows Block: Internet-facing TeamCity instances without VPN — these should not exist

npm Supply Chain Worm (keyv/cacheable):

Monitor: T1059.007 — JavaScript execution via preinstall hooks in CI/CD runners; unexpected Bun runtime downloads Detect: T1552.001 — bulk access to cloud credential files (.aws/credentials, .azure/, ~/.config/gcloud/); T1528 — npm OIDC token exchange requests from unexpected sources Hunt hypothesis: "If a CI runner is compromised, stolen tokens will be used to publish packages" — monitor npm registry API calls (registry.npmjs.org/-/whoami, /-/npm/v1/oidc/token/exchange/package/) from build infrastructure Block: Outbound connections from CI runners to unexpected GitHub repositories (T1567.001 exfiltration via code repository commits) Investigate: Any .claude or .vscode directory modifications on build servers

Zbtlink ENDLESSDOORS Backdoor:

Block immediately: Egress to 47.107.224[.]89, 47.100.190[.]96, 45.32.81[.]152, 43.248.136[.]125 on ports 7000/7001 Block: DNS resolution for rbdg4nzqadui[.]wikaba[.]com, zbtctl[.]epplink[.]net, online-string[.]com Detect: T1071.001 — periodic beaconing every 35 seconds to the above infrastructure; T1036.004 — processes named kworker that are not legitimate kernel threads (check /proc/[pid]/exe symlink) Hunt hypothesis: "If Zbtlink routers exist in our environment, they are actively beaconing" — scan asset inventory for models: CPE2801, WE1026-5G-WD, WE1326, WE2007, WE2008-DSIM, WE2416, WE3326, WE5927, WE5931, WE5931AC, WE826-T3-DSIM, WG108, WG1602, WG1608-DSIM, WG209, WG2105, WG2107, WG259, WG3526, Z8102AX-2DSIM

Volt Typhoon / Salt Typhoon Living-off-the-Land:

Hunt: T1078 (Valid Accounts) — authentication from service accounts at unusual times or from unusual source IPs; T1072 (Software Deployment Tools) — legitimate admin tools (PsExec, WMI, PowerShell Remoting) used in unusual patterns Detect: Network device configuration changes outside change windows; new scheduled tasks or services created by accounts that don't normally perform administration Key principle: These actors deliberately operate within normal administrative noise. Detection requires behavioral baselines, not signature matching.

BEC / ACH Fraud:

Monitor: T1114.002 — mail forwarding rules created on finance staff mailboxes; T1534 — internal emails requesting payment changes Detect: New inbox rules forwarding to external addresses; login from unusual geographies on finance team accounts Investigate: Any ACH payment modification request that arrives solely via email without phone verification

ThreatATT&CK
TeamCity Exploitation (CVE-2026-63077)T1190 T1059.001 T1552.001
npm Supply Chain Worm (keyv/cacheable)T1059.007 T1552.001 T1528 T1567.001
Zbtlink ENDLESSDOORS BackdoorT1071.001 T1036.004
Volt Typhoon / Salt Typhoon Living-off-the-LandT1078 T1072
BEC / ACH FraudT1114.002 T1534
IOC Blocking Table:
47.107.224[.]8947.100.190[.]9645.32.81[.]15243.248.136[.]125rbdg4nzqadui[.]wikaba[.]comzbtctl[.]epplink[.]netonline-string[.]com

Block the above at perimeter firewalls, proxies, and DNS. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.

Financial Services
State Treasury, Revenue, Comptroller
Primary threat
BEC/ACH fraud (validated by Pittsburg incident) and ransomware (WARLOCK SPIDER targeting government finance)
Actions
  • Enforce dual-authorization for all ACH payments exceeding $50,000 with mandatory out-of-band voice verification to a pre-registered vendor phone number
  • Audit mail forwarding rules on all finance staff mailboxes weekly — attackers establish persistence via T1114.002 before executing fraud
  • Implement payment velocity alerts: flag any single ACH transaction exceeding historical norms for the vendor relationship
Energy
Public Utility Commissions, State Energy Offices
Primary threat
Nation-state pre-positioning (Volt Typhoon) and ICS/SCADA targeting (BANISHED KITTEN)
Actions
  • Validate network segmentation between IT and OT environments — Volt Typhoon's methodology involves lateral movement from IT into operational technology
  • Audit remote access to SCADA systems: ensure no direct internet exposure, enforce MFA on all jump hosts
  • Review CISA ICS advisories for Schneider IGSS, MikroTik RouterOS, and libiec61850 — apply patches to any deployed systems even without confirmed exploitation
Healthcare
State Health Departments, Medicaid Systems
Primary threat
Ransomware (48% of breaches per DBIR) and supply chain compromise affecting patient data systems
Actions
  • Prioritize Jenkins and TeamCity patching in any development environments supporting health information exchanges or Medicaid eligibility systems
  • Audit npm dependencies in patient portal web applications — the keyv/cacheable dependency chain reaches into common frameworks
  • Ensure offline backups of Medicaid enrollment databases are tested and recoverable within 72 hours
Government
All State Agencies
Primary threats
CI/CD pipeline compromise, MSP supply chain attacks, and credential theft
Actions
  • Confirm TeamCity patch status across all agencies by August 7 (FCEB deadline August 8)
  • Verify N-able N-central hotfix (2026.3 HF1) is applied — coordinate with MSP partners who manage state endpoints
  • Implement conditional access policies blocking legacy authentication protocols
  • Brief all agency help desks on CHATTY SPIDER callback phishing TTPs — this group uses voicemail-themed emails directing recipients to call attacker-controlled numbers
Aviation / Logistics
State DOT, Port Authorities, Airport Authorities
Primary threat
Nation-state espionage (Salt Typhoon targeting transportation networks) and supply chain hardware backdoors
Actions
  • Conduct network device inventory specifically targeting Chinese-manufactured equipment — Zbtlink routers and similar devices may exist in traffic management or port operations networks
  • Audit VPN concentrators and edge devices for unauthorized configuration changes — Volt Typhoon's preferred persistence mechanism
  • Validate that GPS/ADS-B systems and freight management platforms are segmented from general IT networks

Patch JetBrains TeamCity to 2026.1.3 or 2025.11.7. CVE-2026-63077 is actively exploited with FCEB deadline August 8. Verify no instances are internet-exposed without VPN.
Incident Responder
Audit all Node.js projects for compromised packages: keyv@6.0.0, cacheable@2.5.1, flat-cache@6.1.24, file-entry-cache@11.1.6, cache-manager@7.2.10, all @cacheable/* packages published August 4. Pin to known-good versions. Rotate all npm tokens, AWS keys, Azure secrets, GCP credentials, and GitHub tokens on any affected CI runner.
Threat Hunter
Confirm N-able N-central updated to 2026.3 HF1 or later. CVE-2026-18577 bypasses the previous patch. If externally managed, obtain written confirmation from MSP.
Incident ResponderCISO / Exec
Block Zbtlink ENDLESSDOORS C2 at perimeter firewall (IPs and domains listed in IOC table above). Scan asset inventory for affected router models.
SOC Analyst
No immediate actions for the selected roles.
Upgrade Jenkins to 2.576 or LTS 2.568.2 (CVE-2026-70426, CVSS 9.0). Review Agent/Connect permissions — remove unnecessary access. If upgrade is delayed, apply SECURITY-3911 workaround plugin immediately.
Threat Hunter
Brief accounts payable on BEC patterns validated by Pittsburg incident. Mandate out-of-band phone verification for all ACH changes. Review dual-authorization thresholds.
CISO / Exec
Pin all GitHub Actions to commit SHAs instead of version tags. Implement npm audit with --audit-level=critical as a blocking gate in CI pipelines. Add lockfile integrity verification to build processes.
Threat Hunter
Deploy detection rules for npm supply chain indicators: monitor for Bun runtime downloads on build servers, preinstall hook execution spawning network connections, and bulk credential file access by Node.js processes.
SOC Analyst
No 7-day actions for the selected roles.
Brief executive leadership on DBIR 2026 findings. Exploitation is now the #1 initial access vector (31%). Median critical vulnerability remediation is 43 days. Evaluate whether current patching SLAs are adequate given the documented hours-to-weaponization trend.
CISO / Exec
Initiate proactive threat hunt for Volt Typhoon / Salt Typhoon living-off-the-land indicators. Focus on anomalous valid account usage (T1078), unusual software deployment tool activity (T1072), and network device configuration changes outside approved windows.
Threat Hunter
Evaluate supply chain integrity controls. The keyv/cacheable worm's ability to forge sigstore provenance attestations means cryptographic verification alone is insufficient. Implement defense-in-depth: lockfile pinning + hash verification + behavioral analysis + network egress controls on build infrastructure.
CISO / Exec
Update incident response playbooks to include CI/CD pipeline compromise scenarios. Current playbooks likely assume endpoint or server compromise — a compromised build pipeline can inject malicious code into every downstream deployment.
Incident ResponderCISO / Exec
Audit network hardware procurement for Chinese-manufactured devices. Establish policy requiring firmware integrity verification for all network equipment before deployment.
CISO / Exec
Decision required by August 7: CIO/CISO must confirm TeamCity patch status across all agencies (FCEB compliance deadline August 8).
CISO / Exec
Schedule a CI/CD compromise tabletop exercise within 30 days — scenario: attacker gains access to Jenkins/TeamCity and injects code into a citizen-facing application deployment.
CISO / ExecIncident Responder
Validate that cyber insurance covers supply chain compromise originating from third-party development tools and MSP platforms.
CISO / Exec
No 30-day actions for the selected roles.
The Bottom Line

Three concurrent CI/CD attack vectors, two simultaneous npm supply chain campaigns, an unpatched MSP authentication bypass, confirmed nation-state persistence in state networks, and a validated $913K government BEC loss — all within a single reporting cycle. The convergence is not coincidental. Adversaries have identified development and deployment infrastructure as the highest-leverage target in the government attack surface: compromise the pipeline, and every downstream application is potentially poisoned. The DBIR's confirmation that exploitation has overtaken credential theft as the #1 initial access vector marks a structural shift in the threat landscape. Patching SLAs designed for a credential-theft-dominant environment are no longer adequate. The documented hours-to-weaponization trend means the window between public disclosure and active exploitation is now measured in hours, not weeks. State agencies face a specific compounding risk: the CI/CD systems requiring urgent patching this week are the same systems that deploy patches to everything else. Prioritize accordingly.

1
Confirm your TeamCity patch status today. The three-day window before the FCEB deadline is not a planning horizon — it is an action deadline.
2
Audit your npm dependencies today. The supply chain worm is not a future risk — it is actively propagating right now, stealing credentials from any Node.js development environment that pulls affected dependencies.
3
Verify your N-central hotfix today. The adversaries are not waiting for your next change window.
No items found.