| Development | Date | Why It Matters to State Government |
|---|---|---|
| Payroll Pirates / Storm-2657 M365 AitM campaign disclosed | Aug 7 | Government explicitly listed as target sector. Automated session hijack evades standard BEC detection. State payroll and HR staff are the intended victims. |
| CVE-2026-18577 (N-able N-central) added to CISA KEV | Aug 3 | Authentication bypass in RMM tool used by MSPs serving state agencies. Active exploitation confirmed. Hotfix available since Aug 2. |
| ABB Ability Zenon ICS advisory (ICSA-26-218-01) | Aug 6 | SCADA/HMI platform used in water treatment and building automation. Multiple vulnerabilities allow security bypass and unauthorized control. |
| VeloCloud Orchestrator critical RCE corroborated by German BSI | Aug 7 | Second independent authority confirms unauthenticated root-level RCE in SD-WAN management platform used by distributed state networks. |
| Claude Code RCE via malicious pull requests | Aug 7 | AI coding assistants can be weaponized through project configuration — relevant for state dev teams adopting AI tools. |
| Chrome 151 patches 6 critical vulnerabilities | Aug 7 | Rendering and authentication flaws affecting all managed endpoints. |
| CVE-2026-63077 (TeamCity) KEV deadline | Aug 8 | FCEB compliance deadline is tomorrow. Unauthenticated RCE, CVSS 9.8, actively exploited. |
| Date | Event | Severity |
|---|---|---|
| Jul 25 | Salt Typhoon & Volt Typhoon persistent access in state/National Guard networks disclosed | CRITICAL |
| Aug 2 | N-able releases Hotfix 1 for CVE-2026-18577 | HIGH |
| Aug 3 | CISA adds CVE-2026-18577 (N-central auth bypass) to KEV | HIGH |
| Aug 4 | keyv/cacheable npm supply chain worm discovered (CI/CD token theft) | HIGH |
| Aug 5 | CVE-2026-63077 (TeamCity RCE, CVSS 9.8) added to KEV | CRITICAL |
| Aug 6 | CISA publishes ABB Zenon, Johnson Controls TL280, Mitsubishi CC-Link ICS advisories | HIGH |
| Aug 7 | Payroll Pirates M365 AitM campaign targeting government disclosed | HIGH |
| Aug 7 | BSI corroborates VeloCloud Orchestrator critical RCE | HIGH |
| Aug 8 | TeamCity KEV remediation deadline (tomorrow) | CRITICAL |
What it is: An active adversary-in-the-middle phishing campaign that steals M365 session tokens, rendering MFA ineffective. Attackers use voicemail-themed lures with six-stage redirect chains (Google Meet → Google Ads → AWS S3 → AitM proxy) and residential proxies to avoid geolocation-based detection.
Why state government should care: Government is explicitly listed as a target sector. Post-compromise, attackers use Microsoft Graph API to enumerate payroll, HR, and finance staff — then silently monitor mailboxes for weeks before attempting payroll diversion. The campaign has targeted hundreds of organizations in July 2026.
Novel tradecraft: Automated session refresh at precise 8-hour intervals from rotating residential proxy IPs maintains access indefinitely without triggering conditional access anomalies. This evades every standard BEC detection rule (no inbox rule creation, no MFA changes, no lateral phishing).
Confirmed indicator: Domain country[.]is used for geolocation API calls during proxy selection. Anomalous User-Agent strings: Firefox 131.0, Firefox 151.0, and Python Requests appearing on sessions claiming to be Microsoft Outlook clients.
What it is: An incomplete patch bypass of CVE-2026-18556 in N-able N-central (versions through 2026.3.1) that allows authentication bypass and full account takeover. CVSS 8.1.
Why state government should care: Many state agencies rely on managed service providers (MSPs) that use N-central for remote monitoring and management. A compromised MSP gains trusted access to every client endpoint — this is the supply chain nightmare scenario. CISA's KEV addition confirms active exploitation in the wild.
Remediation: N-central 2026.3 Hotfix 1 (released August 2). If your MSP manages state endpoints via N-central, demand written confirmation of patch status today.
Three ICS advisories in 48 hours affect platforms deployed in state water treatment, building automation, and industrial control environments: ABB Ability Zenon (ICSA-26-218-01) — multiple vulnerabilities allowing security bypass, system crashes, and unauthorized control actions in SCADA/HMI systems; Johnson Controls TL280 — information disclosure vulnerability in building access control; Mitsubishi CC-Link — vulnerabilities in industrial networking protocol implementations.
Combined with the ongoing multi-state water utility PLC alert (BANISHED KITTEN / IRGC-affiliated targeting of water and wastewater PLCs across 7+ U.S. states), the OT attack surface for state infrastructure is expanding faster than patching cadence.
CVSS 9.8. Actively exploited. FCEB compliance deadline is August 8. If your agency runs JetBrains TeamCity for CI/CD pipelines and has not patched, you are non-compliant tomorrow and exposed to a trivially exploitable, unauthenticated remote code execution vulnerability.
From the prior cycle and still unresolved: Chinese MSS-affiliated groups Salt Typhoon and Volt Typhoon maintain persistent access in state and National Guard networks using living-off-the-land techniques. Additional tracked actors with government targeting confirmed active as of August 7: APT29 (Russia/SVR), Sandworm (Russia/GRU), APT28 (Russia/GRU), APT41 (China/MSS), Turla (Russia/FSB), MuddyWater (Iran/MOIS), and APT40 (China/MSS).
Ransomware actors with confirmed state/local government targeting remain active: WARLOCK SPIDER (aliases GOLD SALEM/Storm-2603) and ROYAL SPIDER.
Intelligence collection confirms the following malware families actively targeting government entities: XWORM, MIRAI (IoT/OT), BEACON (Cobalt Strike), SNOWLIGHT, BEAVERTAIL, CADDYWIPER (destructive), and Latrodectus/BLACKWIDOW.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| Payroll Pirates targets state HR/payroll staff | HIGH (75-85%) | 1-2 weeks | Government explicitly listed; campaign scaling rapidly; hundreds of orgs targeted in July |
| Ransomware wave targeting state/local gov after 72-hour quiet period | MODERATE (50-60%) | 1-3 weeks | Operational pauses historically precede new campaigns; Cactus, INC, Qilin all active |
| MSP compromise via N-central leading to state endpoint access | MODERATE (45-55%) | 2-4 weeks | KEV confirms active exploitation; MSP supply chain is proven attack path |
| ICS exploitation attempt against state water/building systems | MODERATE (40-50%) | 1-3 months | Advisory volume increasing; BANISHED KITTEN precedent; Zenon/Johnson Controls exposure |
| VeloCloud Orchestrator exploitation in state SD-WAN | MODERATE (40-50%) | 2-4 weeks | Root-level RCE, corroborated by two authorities, common in distributed government networks |
| What to Detect | ATT&CK Technique | Detection Logic |
|---|---|---|
| AitM session hijack | T1557, T1539 | M365 sign-ins where reported client = "Microsoft Outlook" but User-Agent contains "Firefox" or "Python Requests" |
| Residential proxy authentication | T1090.002 | Block/alert on sign-ins from known residential proxy ASNs (Luminati/Bright Data, SOAX, Smartproxy) |
| 8-hour session refresh pattern | T1078.004 | Recurring M365 sign-in events at 6-10 hour intervals from rotating IPs with same SessionID |
| Graph API enumeration | T1087.003 | Bulk Users.Read.All or Mail.Read calls from newly authenticated sessions; alert on enumeration of payroll/HR/finance distribution lists |
| Email hiding rules | T1564.008 | New inbox rules that delete or move messages matching keywords: "payroll," "direct deposit," "ACH," "bank" |
| N-central auth bypass | T1190 | Monitor N-central management console for authentication anomalies; unexpected admin sessions |
| ICS unauthorized commands | T0855, T0831 | Anomalous write commands to Zenon HMI stations; unexpected parameter modifications |
| Type | Value | Context |
|---|---|---|
| User-Agent | Firefox 131.0, Firefox 151.0, Python Requests | Anomalous UAs on M365 sessions claiming Outlook client (Payroll Pirates) |
| CVE | CVE-2026-63077 | TeamCity unauthenticated RCE, CVSS 9.8, KEV deadline Aug 8 |
| CVE | CVE-2026-18577 | N-central authentication bypass, CVSS 8.1, KEV active exploitation |
| CVE | CVE-2026-9198 | Langflow vulnerability (developer tooling) |
| Advisory | ICSA-26-218-01 | ABB Ability Zenon ICS vulnerabilities |
| Advisory | WID-SEC-2026-2702 | VeloCloud Orchestrator critical RCE (BSI) |
country[.]is is the geolocation API domain used by Payroll Pirates for residential proxy selection — block at DNS/proxy layer. Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds.
- Implement phishing-resistant authentication (FIDO2/passkeys) for all staff with access to payment systems
- Enable Graph API audit logging
- Brief payroll and accounts payable teams on voicemail-themed lure patterns
- Verify Zenon patch status per ICSA-26-218-01
- Confirm network segmentation between IT and OT
- Audit for living-off-the-land indicators (LOLBins) on systems adjacent to SCADA networks
- Enforce conditional access requiring managed devices for M365 access to systems containing PHI
- Verify offline backup integrity for Medicaid/benefits systems
- Brief HR staff on AitM lure patterns
- Confirm TeamCity patching before August 8 KEV deadline
- Demand MSP attestation on N-central patch status
- Implement 8-hour session anomaly detection
- Review conditional access policies for residential proxy blocking
- Audit VeloCloud Orchestrator exposure and patch status
- Verify SD-WAN management plane is not internet-accessible
- Segment transportation ICS from enterprise network
The threat environment facing state government IT this week is defined by a single theme: trusted systems being turned against you. Your M365 tenant — trusted. Your MSP's RMM tool — trusted. Your CI/CD pipeline — trusted. Your SD-WAN orchestrator — trusted. Every major finding this cycle involves adversaries exploiting that trust relationship. The Payroll Pirates campaign is particularly insidious because it operates below the detection threshold of conventional BEC monitoring. Your MFA is not broken — it is bypassed. Your conditional access policies are not failing — they are being satisfied by residential proxies that look like legitimate home workers. The 8-hour automated refresh pattern means compromised sessions persist indefinitely without any of the traditional indicators that trigger investigation. The actions in this brief are specific, prioritized, and time-bound. The conditional access changes and detection rules for Payroll Pirates can be implemented today. The MSP attestation call can happen this morning. The TeamCity patch status can be confirmed in the next hour.