| Development | Why It Matters |
|---|---|
| CVE-2026-0257 (Palo Alto GlobalProtect, CVSS 9.1) — three actor clusters confirmed exploiting against U.S. government | Chinese espionage group UNC6779 deploys SNOWLIGHT malware for persistent access; UNC7006 deploys Qilin/AGENDA ransomware; UNC7018 conducts reconnaissance. Same vulnerability, three different threat outcomes. |
| CVE-2026-20349 (Cisco ASA/FTD, CVSS 8.6) — added to CISA KEV August 11 | Unauthenticated remote DoS against SSL VPN service. Active exploitation confirmed. Can knock state VPN infrastructure offline. |
| CVE-2026-1281 & CVE-2026-1340 (Ivanti EPMM, CVSS 9.8 each) — active government-targeting campaign | Unauthenticated RCE against mobile device management. A compromised MDM can push malicious configurations to every managed mobile device in the state fleet. |
| Gunra Ransomware — CISA joint advisory aa26-222a published August 10 | RaaS operation explicitly targeting regional government entities. Confirms ongoing ransomware threat to state/local government. |
| MuddyWater (Iran/MOIS) ICS campaign — active since August 1, targeting water/wastewater PLCs across 7+ states | Nation-state actor with MOIS affiliation conducting active OT intrusions against state-operated water treatment infrastructure. |
| ABB Ability Zenon ICS/SCADA advisory (CISA icsa-26-218-01) | Vulnerabilities in SCADA/HMI platform used in water treatment and energy. Relevant to state critical infrastructure oversight. |
| Volt Typhoon / Salt Typhoon — no new reporting, but Chinese exploitation activity (UNC6779) continues | UNC6779's espionage mission against U.S. government via VPN exploitation is consistent with Volt Typhoon's documented pre-positioning pattern. Operational silence from named Volt Typhoon ≠ absence of activity. |
| Date | Event | Significance |
|---|---|---|
| Jul 25, 2026 | Volt Typhoon / Salt Typhoon confirmed pre-positioned in U.S. state government and critical infrastructure networks | PRC actors already inside; 18+ days of operational silence suggests completed pre-positioning |
| Aug 1, 2026 | MuddyWater (Iran/MOIS) launches ICS/OT campaign targeting water/wastewater PLCs across 7+ states | Active threat to state-operated water treatment infrastructure |
| Aug 6, 2026 | CISA publishes ABB Ability Zenon ICS advisory (icsa-26-218-01) | SCADA/HMI vulnerabilities in water and energy environments |
| Aug 10, 2026 | CISA publishes Gunra ransomware joint advisory (aa26-222a) | RaaS explicitly targeting regional government |
| Aug 11, 2026 | CISA adds CVE-2026-20349 (Cisco ASA/FTD) to KEV catalog | Confirmed active exploitation of state VPN infrastructure |
| Aug 11, 2026 | EncryptHub (LARVA-208) documented weaponizing Microsoft Teams for credential theft and ransomware delivery | Social engineering bypass of email security controls |
| Aug 13, 2026 | Three actor clusters (UNC6779, UNC7006, UNC7018) confirmed exploiting CVE-2026-0257 against U.S. government | Espionage + ransomware convergence on single VPN vulnerability |
| Aug 13, 2026 | Ivanti EPMM exploitation campaign (CVE-2026-1281/1340) confirmed targeting government | MDM platform becomes attack vector against entire mobile fleet |
CVE-2026-0257 (CVSS 9.1) is an authentication bypass in PAN-OS GlobalProtect VPN that allows unauthenticated attackers to gain access to protected networks. What makes this extraordinary is the diversity of actors exploiting it simultaneously:
- UNC6779 (China, espionage): active since February 2025, targeting U.S. government across 14 industries. Deploys SNOWLIGHT malware — a persistent implant designed for long-term data exfiltration via legitimate remote support tools.
- UNC7006 (financially motivated): deploys network scanning tools (NETSCAN), AnyDesk for remote access, and AGENDA/Qilin ransomware for encryption.
- UNC7018 (unknown motivation): conducts internal reconnaissance against government and non-profit targets in the Americas.
The implication is stark: a single unpatched GlobalProtect instance simultaneously exposes your network to Chinese intelligence collection AND ransomware encryption. Incident response must plan for both scenarios concurrently.
CVE-2026-1281 and CVE-2026-1340 (both CVSS 9.8) enable unauthenticated remote code execution against Ivanti Endpoint Manager Mobile. An active campaign is targeting government organizations specifically.
The strategic risk here is unique: MDM platforms have privileged access to push configurations, applications, and policies to every managed device. A compromised EPMM instance doesn't just give attackers one foothold — it gives them a distribution mechanism to the entire mobile fleet.
CISA's joint advisory (aa26-222a) confirms Gunra as a ransomware-as-a-service operation with affiliates (including HOOK SPIDER and goldenmask) explicitly targeting regional government entities. Gunra's TTPs include disabling security tools, inhibiting system recovery, and exploiting privilege escalation vulnerabilities before encryption.
The ABB Ability Zenon advisory adds to the ongoing MuddyWater (Iran/MOIS) ICS campaign targeting water/wastewater PLCs since August 1. State agencies overseeing water treatment, energy distribution, or transportation SCADA systems face compounding OT risk from both nation-state actors and unpatched vendor vulnerabilities.
UNC6779's exploitation of GlobalProtect against U.S. government targets is operationally consistent with the Volt Typhoon pre-positioning pattern documented since July 2025. The use of SNOWLIGHT malware and legitimate remote support tools for persistence — rather than destructive payloads — indicates an intelligence collection and access-maintenance mission. These actors are building capability for future disruption, not immediate impact.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| Ransomware deployment via unpatched GlobalProtect (CVE-2026-0257) against a U.S. state agency | HIGH (75-85%) | 1-3 weeks | UNC7006 already deploying Qilin ransomware via this vector; government explicitly targeted; patch lag common in state IT |
| Ivanti EPMM exploitation leading to mobile fleet compromise at a government organization | MODERATE-HIGH (60-70%) | 2-4 weeks | Active campaign confirmed; CVSS 9.8 unauthenticated RCE; many state agencies use Ivanti for MDM |
| Cisco ASA/FTD VPN outage at state agency due to CVE-2026-20349 exploitation | MODERATE (50-60%) | 1-2 weeks | CISA KEV confirmed active exploitation; Cisco ASA widely deployed in state government |
| Chinese espionage implant (SNOWLIGHT) discovered in state government network via GlobalProtect | MODERATE (40-50%) | Already occurring | UNC6779 active since Feb 2025; discovery depends on detection capability, not actor activity |
| Gunra ransomware incident at state or local government entity | HIGH (70-80%) | 2-6 weeks | CISA advisory confirms active targeting of regional government; RaaS model enables rapid affiliate scaling |
| ICS/SCADA disruption at state-operated water or energy facility | MODERATE (35-45%) | 1-3 months | MuddyWater (MOIS) campaign active; ABB Zenon vulnerabilities disclosed; exploitation requires OT-specific knowledge |
| ATT&CK Technique | What to Hunt | Detection Approach |
|---|---|---|
| T1190 — Exploit Public-Facing Application | Anomalous authentication events on GlobalProtect, Cisco ASA, Ivanti EPMM admin portals | Alert on successful VPN authentications without corresponding MFA events; monitor for authentication bypass patterns |
| T1078 — Valid Accounts | Accounts accessing VPN that bypass normal authentication flow post-CVE-2026-0257 exploitation | Correlate VPN session creation with identity provider logs — sessions without IdP authentication = compromise indicator |
| T1219 — Remote Access Software | AnyDesk, TeamViewer, or other RMM tools launched from VPN-connected segments | Baseline legitimate RMM usage; alert on AnyDesk processes spawned by non-IT accounts or from unexpected network segments |
| T1486 — Data Encrypted for Impact | Qilin/AGENDA ransomware deployment indicators | Monitor for mass file rename operations (.qilin, .agenda extensions); alert on vssadmin shadow copy deletion |
| T1562.001 — Impair Defenses | Gunra disabling security tools pre-encryption | Alert on security service stops (Windows Defender, EDR agents); monitor for sc stop and taskkill targeting security processes |
| T1059 — Command and Scripting Interpreter | Post-exploitation command execution via Ivanti EPMM RCE | Monitor EPMM server process trees for unexpected child processes (cmd.exe, powershell.exe, bash) |
| T0831/T0855 — ICS Manipulation/Unauthorized Commands | Anomalous commands to PLCs and SCADA systems | Monitor OT network traffic for commands outside normal operational patterns; alert on configuration changes during non-maintenance windows |
Hunting Hypotheses:
HUNT 01
"Has CVE-2026-0257 been exploited in our environment?"
Search GlobalProtect logs for authentication events that lack corresponding RADIUS/LDAP/SAML authentication records. Look for VPN sessions established without MFA challenge completion.
HUNT 02
"Is SNOWLIGHT present in our network?"
Hunt for legitimate remote support tool installations (not deployed by IT) on systems that recently connected via VPN. Look for scheduled tasks or services with generic names that execute remote access binaries.
HUNT 03
"Has our Ivanti EPMM been compromised?"
Review EPMM server access logs for requests to API endpoints associated with CVE-2026-1281/1340. Check for unexpected MDM policy pushes or application deployments not initiated by administrators.
HUNT 04
"Are Gunra precursors present?"
Search for NETSCAN or Advanced IP Scanner execution, credential dumping tool artifacts, and lateral movement via RDP/SMB from unexpected source hosts.
Financial Services
State Treasury, Revenue, Pension Systems
Primary threat
Ivanti EPMM exploitation campaign explicitly targets financial services — verify MDM patch status for mobile devices accessing financial systems.
Actions
- Monitor for Qilin/AGENDA ransomware indicators in environments processing financial transactions
- Validate that payment processing and banking integration systems are segmented from general VPN access
Energy
State Energy Oversight, Utility Coordination
Primary threat
ABB Ability Zenon SCADA vulnerabilities (CISA icsa-26-218-01) directly affect energy sector HMI systems.
Actions
- Coordinate with utility operators on patch status for ABB Ability Zenon
- MuddyWater (Iran/MOIS) ICS campaign (active since August 1) targets energy infrastructure — validate OT network monitoring and segmentation
- Ensure SCADA systems are not accessible from IT networks that may be compromised via perimeter appliance exploitation
Healthcare
State Health Agencies, Medicaid Systems
Primary threats
Ransomware (Gunra, Qilin) targeting government creates direct risk to health data systems and Medicaid processing.
Actions
- Mobile devices used by field health workers managed via Ivanti EPMM are at risk if MDM is compromised
- Validate backup integrity for health records systems — ransomware recovery capability is critical for continuity of care coordination
Government
State Agencies, Citizen PII Systems
Primary threats
Confirm deployment status of Palo Alto GlobalProtect, Ivanti EPMM, and Cisco ASA across all agencies — centralized IT may not have visibility into agency-level deployments.
Actions
- Validate that Gunra ransomware incident response playbooks are current and tested — CISA advisory aa26-222a provides specific TTPs for tabletop exercises
- Ensure citizen PII databases (tax, DMV, health, criminal justice) have network segmentation preventing direct access from VPN-connected endpoints
- Review Microsoft Teams external messaging policies — EncryptHub social engineering via Teams remains an active threat vector from the prior cycle
Aviation / Logistics
State DOT, Airport Authorities, Port Systems
Primary threat
Transportation SCADA systems may use ABB Ability Zenon for traffic management and logistics coordination.
Actions
- Verify deployment and patch status of ABB Ability Zenon in transportation systems
- UNC7018's targeting of government and non-profit in the Americas may include transportation infrastructure reconnaissance
- Ensure logistics and supply chain management systems are segmented from general state network VPN access points
No sector cards match the selected filters.
Confirm Palo Alto GlobalProtect deployment status. If deployed, verify PAN-OS is patched against CVE-2026-0257 (CVSS 9.1). Three active threat clusters — including Chinese espionage — are exploiting this against U.S. government NOW.
Incident Responder
Patch Cisco ASA/FTD against CVE-2026-20349 (CVSS 8.6). CISA KEV confirmed active exploitation August 11. Affects Remote Access SSL VPN — unauthenticated DoS causes device reload.
Incident Responder
Confirm Ivanti EPMM deployment and patch status. CVE-2026-1281 and CVE-2026-1340 (both CVSS 9.8) enable unauthenticated RCE. Active government-targeting campaign confirmed.
Incident Responder
Verify Progress Kemp LoadMaster patched against CVE-2026-8037 (CVSS 9.6). Public PoC with active exploitation confirmed (from prior cycle).
Incident Responder
Enable enhanced logging on all perimeter VPN/firewall appliances. Ensure authentication events, admin access, and configuration changes are captured and forwarded to SIEM.
SOC Analyst
No immediate actions for the selected roles.
Deploy detection rules for SNOWLIGHT malware indicators and unauthorized AnyDesk usage from VPN segments. Chinese espionage actor UNC6779 uses legitimate remote tools post-exploitation.
SOC Analyst
Verify Johnson Controls C-CURE 9000 and Victor application server patching per CISA advisory icsa-26-204-01 Update A. Network-accessible RCE in physical security systems.
ICS / OT
Review ABB Ability Zenon deployments in water treatment and energy SCADA environments. Apply vendor patches per CISA icsa-26-218-01. Validate IT/OT network segmentation.
ICS / OT
Brief leadership on the Gunra ransomware CISA advisory (aa26-222a). Validate backup integrity, test restoration procedures, and confirm the incident response retainer is active.
CISO / Exec
Audit VPN authentication configurations — ensure MFA is enforced and cannot be bypassed. CVE-2026-0257 exploitation specifically bypasses authentication controls.
IAM Analyst
No 7-day actions for the selected roles.
Commission a comprehensive assessment of all perimeter appliances (Palo Alto, Cisco ASA, SonicWall, Kemp LoadMaster, Ivanti) for patch currency and configuration hardening. Four CRITICAL/HIGH CVEs in active exploitation this cycle indicates systemic perimeter risk.
CISO / Exec
Evaluate a zero-trust network access (ZTNA) overlay for VPN infrastructure. Perimeter appliance monoculture creates a catastrophic single point of failure. Defense-in-depth requires layered access controls beyond VPN alone.
CISO / Exec
Conduct a tabletop exercise simulating simultaneous espionage discovery AND ransomware encryption — the dual-threat scenario presented by CVE-2026-0257 exploitation. IR plans must account for both tracks concurrently.
CISO / ExecIncident Responder
Add redundant OSINT and threat intelligence feeds (state ISAC automated feed, CISA AIS) to reduce single-source dependency for threat detection and corroboration.
Threat Hunter
Conduct network segmentation validation between IT and OT environments. Confirm that compromised perimeter appliances cannot provide a path to SCADA/ICS systems.
ICS / OT
No 30-day actions for the selected roles.
The Bottom Line
The message today is unambiguous: state government perimeter infrastructure is under active, multi-actor assault. Chinese espionage operators and ransomware syndicates are not waiting for your next patch cycle — they are exploiting the same vulnerabilities, against the same targets, right now. The convergence of UNC6779 (espionage), UNC7006 (ransomware), and UNC7018 (reconnaissance) on a single Palo Alto GlobalProtect vulnerability is a scenario that demands immediate verification and action — not next sprint, not next quarter. Today. For CISOs and CIOs: the decisions required are binary. Do you run Palo Alto GlobalProtect? Ivanti EPMM? Unpatched Cisco ASA? If yes to any, you have a 24-hour action window. If you don't know the answer, that itself is the first problem to solve.
1
The adversary has already done their reconnaissance. The question is whether your defenses will be ready when they press the button.
2
Do you run Palo Alto GlobalProtect, Ivanti EPMM, or unpatched Cisco ASA? If yes to any, you have a 24-hour action window.
3
If you don't know the answer to that question, that itself is the first problem to solve.