| Development | Date | Severity | Why It Matters for State Government |
|---|---|---|---|
| Volt Typhoon / Salt Typhoon confirmed pre-positioned in U.S. state government and critical infrastructure networks | 25 Jul 2026 | HIGH | Nation-state actors with espionage and potential destructive capability are confirmed inside state networks; over two weeks of operational silence since confirmation warrants active hunting. |
| MuddyWater (MOIS) ICS/OT campaign targeting water/wastewater PLCs across 7+ states | 1 Aug 2026 | HIGH | Iranian state-sponsored actor actively targeting state-operated critical infrastructure; water and wastewater utilities at direct risk of disruption. |
| Gunra ransomware (#StopRansomware Advisory AA26-222a) — 51 confirmed victims, explicit regional government targeting | 10 Aug 2026 | HIGH | Active ransomware-as-a-service operation with HOOK SPIDER access broker directly targeting state and local government entities. |
| CVE-2026-20349 added to CISA KEV — Cisco ASA/FTD VPN denial-of-service, actively exploited | 11 Aug 2026 | HIGH (CVSS 8.6) | State agencies rely on Cisco ASA/FTD for remote access VPN. Unauthenticated attackers can crash the device with a single crafted HTTP request, severing remote workforce connectivity. |
| EncryptHub (LARVA-208) Teams social engineering campaign documented | 11 Aug 2026 | HIGH | Attackers impersonate "IT SUPPORT" via external Teams messages, install remote access tools, and deploy credential-stealing malware. Linked to BlackBasta ransomware operations. |
| CVE-2026-8037 exploitation confirmed by eSentire — Progress Kemp LoadMaster pre-auth RCE | 7 Aug 2026 (enriched 12 Aug) | CRITICAL (CVSS 9.6) | Full proof-of-concept published by Watchtowr Labs. Any unpatched LoadMaster appliance is trivially exploitable for complete system takeover. |
| Johnson Controls C-CURE 9000 RCE advisory (ICSA-26-204-01) | 11 Aug 2026 | MEDIUM | Physical access control systems in government buildings vulnerable to network-based remote code execution. |
| TPM 2.0 attestation forgery (CVE-2026-6726, CVE-2026-6727) | 11 Aug 2026 | STRATEGIC | Undermines hardware root-of-trust for device identity, Conditional Access, and certificate-based VPN authentication. |
| RaccoonO365 (Storm-2246) disrupted — 338 phishing sites seized | 11 Aug 2026 | POSITIVE | Microsoft seized infrastructure of a phishing-as-a-service platform that stole 5,000+ M365 credentials. Residual risk remains from distributed kits. |
| Date | Event | Actor/CVE | Impact |
|---|---|---|---|
| 25 Jul 2026 | Volt Typhoon / Salt Typhoon confirmed pre-positioned in U.S. state networks | Volt Typhoon, Salt Typhoon | Espionage, potential destructive capability |
| 1 Aug 2026 | MuddyWater ICS/OT campaign targeting water/wastewater PLCs across 7+ states | MuddyWater (MOIS) | Critical infrastructure disruption |
| 6 Aug 2026 | ABB Ability Zenon SCADA advisory published | — | ICS vulnerability exposure |
| 7 Aug 2026 | CVE-2026-8037 added to CISA KEV; PoC published | — | Pre-auth RCE on LoadMaster appliances |
| 7 Aug 2026 | ClamAV bypass PoC released (CVE-2026-20337/20338) | — | Endpoint protection evasion enabling ransomware delivery |
| 10 Aug 2026 | CISA #StopRansomware Advisory AA26-222a for Gunra ransomware (51 victims, targets regional government) | Gunra RaaS, HOOK SPIDER | Direct ransomware threat to state/local government |
| 11 Aug 2026 | CVE-2026-20349 (Cisco ASA/FTD VPN DoS) added to CISA KEV | — | Active exploitation of state VPN infrastructure |
| 11 Aug 2026 | EncryptHub Teams campaign analysis published | EncryptHub / LARVA-208 / Water Gamayun | Credential theft → ransomware via Teams |
| 11 Aug 2026 | Johnson Controls C-CURE 9000 RCE advisory | — | Physical security system compromise |
| 11 Aug 2026 | TPM 2.0 attestation forgery disclosed | — | Hardware trust erosion |
| 11 Aug 2026 | RaccoonO365 infrastructure seized (338 domains) | Storm-2246 | Phishing-as-a-service disruption |
Actor: EncryptHub (also tracked as LARVA-208 and Water Gamayun). Affiliation: Financially motivated; linked to BlackBasta ransomware operations.
This campaign represents a structural shift in initial access tactics. Attackers create onmicrosoft.com tenants, impersonate IT support staff via external Teams messages, and guide victims to install QuickAssist or AnyDesk. Once remote access is established, they deploy PowerShell-based credential stealers with AES-encrypted command-and-control communications to audiorealtek[.]com.
Why this matters for state government: most state agencies have invested heavily in email security (secure email gateways, DMARC, phishing awareness training focused on email). Microsoft Teams external messaging bypasses all of these controls entirely. If your tenant allows external Teams messages by default — which is the Microsoft default configuration — your employees are exposed.
The attack chain culminates in credential theft and ransomware deployment. Given that Gunra ransomware and its access broker HOOK SPIDER are actively targeting regional government entities, the EncryptHub Teams vector represents a plausible delivery mechanism for ransomware operations against state agencies.
CVSS: 8.6 HIGH. Status: Actively exploited, CISA KEV listed.
An unauthenticated attacker can crash Cisco Secure Firewall ASA/FTD devices by sending a crafted HTTP request to the Remote Access SSL VPN service. The device reloads, severing all active VPN sessions.
Compound risk scenario: combined with CVE-2026-8037 (LoadMaster RCE), attackers could deny VPN availability to force traffic through alternative application delivery paths where LoadMaster exploitation is staged. This is not theoretical — both vulnerabilities are confirmed under active exploitation simultaneously.
CVSS: 9.6 CRITICAL. Status: PoC public, active targeting confirmed by eSentire.
Watchtowr Labs published a complete technical walkthrough demonstrating unauthenticated OS command injection leading to full system compromise. Any internet-facing LoadMaster appliance without the patch is trivially exploitable. There is no workaround — patching is the only remediation.
CISA advisory ICSA-26-204-01 documents remote code execution in Johnson Controls C-CURE 9000 and Victor application servers. These systems control badge access, door locks, and video management in government facilities. A network attacker who compromises C-CURE could unlock doors, disable alarms, or corrupt access logs — crossing the cyber-physical boundary.
Most state government security programs do not include physical security systems in their vulnerability management cycles. This advisory demands coordination between IT security and facilities management teams.
Volt Typhoon and Salt Typhoon — both confirmed pre-positioned in U.S. state government and critical infrastructure networks as of 25 July 2026 — have produced no new operational reporting in approximately 18 days. This silence has three possible explanations: operational pause (least concerning); improved operational security making detection harder (concerning); or pre-positioning complete, actors dormant until activation trigger (most concerning).
The absence of reporting should drive proactive hunting, not complacency.
| Scenario | Probability (7-day) | Basis |
|---|---|---|
| Additional Cisco ASA/FTD exploitation attempts against state VPN infrastructure | 70% (HIGH) | KEV listing accelerates attacker adoption; PoC likely circulating |
| EncryptHub Teams campaign expands targeting to government sector | 50% (MODERATE) | Demonstrated capability + ransomware monetization model + government as high-value target |
| Gunra ransomware affiliate claims a new state/local government victim | 40% (MODERATE) | 51 confirmed victims, explicit government targeting, HOOK SPIDER access broker active |
| Volt Typhoon/Salt Typhoon operational activity surfaces publicly | 20% (LOW) | Current silence more likely reflects improved OPSEC than cessation |
| TPM attestation forgery exploited in the wild | <10% (LOW) | Requires sophisticated attacker; firmware patching timeline creates long-term window |
| ATT&CK Technique | What to Monitor | Detection Logic |
|---|---|---|
| T1566.003 (Phishing via Service) | External Teams messages from onmicrosoft.com tenants containing "IT Support," "Help Desk," "QuickAssist," or "AnyDesk" | Microsoft Defender for Cloud Apps policy; correlate with subsequent remote access software installation within 30 minutes |
| T1219 (Remote Access Software) | QuickAssist or AnyDesk installation on endpoints not authorized for remote support tools | EDR alert on process creation for QuickAssist.exe or AnyDesk.exe outside approved support team machines |
| T1059.001 (PowerShell) | PowerShell execution with encoded commands or connections to audiorealtek[.]com | Monitor for powershell.exe spawned by remote access tools; block known C2 domain at DNS/proxy |
| T1053.005 (Scheduled Task) | Scheduled task named "Google LLC Updater" | Windows Event ID 4698 (scheduled task created) with task name matching |
| T1499.004 (Application DoS) | Cisco ASA/FTD unexpected reloads or VPN service interruptions | Syslog monitoring for device reload events; SNMP trap on device restart |
| T1190 (Exploit Public-Facing Application) | LoadMaster management interface access from unexpected sources | WAF/IDS signatures for OS command injection patterns against LoadMaster; access logs for management interface |
Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
- Monitor for MFA bypass attempts on M365 accounts processing tax payments or financial transactions. RaccoonO365 disruption reduces but does not eliminate PhaaS risk — distributed kits remain operational.
- Validate LoadMaster patch status on any appliance fronting citizen-facing financial portals (tax filing, payment processing).
- Implement conditional access policies requiring compliant device state — note that TPM attestation forgery (CVE-2026-6726/6727) may weaken this control long-term.
- Maintain heightened monitoring of ICS/SCADA systems. MuddyWater's (MOIS) campaign targeting water/wastewater PLCs across 7+ states remains active.
- Verify ABB Ability Zenon installations are patched per the 6 August advisory.
- Hunt for Volt Typhoon LOTL indicators on network edge devices — this actor has documented interest in energy infrastructure and is confirmed pre-positioned in U.S. networks.
- RaccoonO365 residual risk is highest for healthcare — the platform specifically targeted 20+ U.S. healthcare organizations before disruption. Subscribers who obtained phishing kits retain capability.
- Monitor for credential harvesting targeting health information exchange (HIE) systems and Medicaid portals.
- Ensure ClamAV installations are updated — CVE-2026-20337/20338 bypass enables ransomware delivery past endpoint protection.
- Restrict Microsoft Teams external access to allow only verified partner domains. Deny external chat from generic onmicrosoft.com tenants by default.
- Patch Cisco ASA/FTD immediately (CVE-2026-20349). If patch is unavailable, restrict Remote Access VPN service to known IP ranges via ACL.
- Brief help desk and IT support staff on the EncryptHub impersonation technique — attackers pose as internal IT support via Teams. Establish a verification protocol for any remote access requests received through Teams.
- Coordinate with facilities management on Johnson Controls C-CURE 9000 network segmentation.
- Audit RDP configurations per CISA Gunra advisory AA26-222a — Gunra affiliates exploit exposed RDP as primary initial access.
- Verify LoadMaster deployments in traffic management and logistics portals — these are high-availability systems where CVE-2026-8037 exploitation could disrupt transportation operations.
- Segment ICS networks controlling traffic signals, bridge operations, and port systems from general IT infrastructure.
- Monitor for Salt Typhoon indicators — this actor has documented interest in transportation and telecommunications infrastructure.
audiorealtek[.]com at DNS resolver and web proxy. Confirmed EncryptHub C2 infrastructure.The threat landscape facing state government networks is defined by convergence this week: perimeter exploitation, collaboration platform abuse, physical security vulnerabilities, and silent nation-state presence all demand simultaneous attention. The EncryptHub Teams campaign is particularly significant because it exploits a structural gap — your email security stack is blind to it, your employees aren't trained for it, and the default Microsoft configuration permits it. The three immediate actions — restricting Teams external access, patching Cisco ASA/FTD, and confirming LoadMaster remediation — are non-negotiable this week. Each addresses an actively exploited or weaponized attack vector against technology confirmed in state government environments. Silence from Volt Typhoon and Salt Typhoon is not comfort. It is either improved tradecraft or completed preparation. The 30-day hunt recommendation is not optional — it is the only way to distinguish between an absent threat and a hidden one.