TLP:GREEN  ·  States / Public Sector
Print Servers Under Fire, CI/CD Pipelines Exposed:

What State Government CISOs Must Act On Today

ELEVATED. Elevated from prior GUARDED posture based on active exploitation of a PaperCut zero-day affecting all versions, a CVSS 9.8 pre-authentication remote code execution vulnerability in TeamCity with public exploit code, 9 CISA Known Exploited Vulnerabilities added in 48 hours, and a federal patch deadline arriving tomorrow (29 August) for Citrix NetScaler. Three separate exploitation vectors — print management infrastructure, CI/CD build pipelines, and VPN/ADC appliances — are under active attack simultaneously.

I am a
My sector

DateEventSignificance
26 Aug 2026CISA adds 6 new KEVs including CVE-2026-8452 (Citrix NetScaler ADC/Gateway, CVSS 8.8)Federal/aligned state agencies face 29 Aug patch deadline
27 Aug 2026CISA adds 3 additional KEVs (9 total in 48 hours)Acceleration in confirmed exploitation activity
27 Aug 2026PaperCut discloses actively exploited zero-day affecting ALL versions of NG/MFEmergency patches available only for v25 and v26; older versions have no fix
28 Aug 2026Full exploit analysis published for CVE-2026-63077 (TeamCity pre-auth RCE, CVSS 9.8)Two HTTP requests, zero credentials, full server compromise; public PoC now available
28 Aug 2026Recorded Future publishes APT28 HOOKEDGE backdoor campaign targeting government organizationsNew Russian intelligence tool actively deployed against European government; U.S. state government within historical target set
28 Aug 2026Research demonstrates 60–80% success rate exploiting AI coding agents via prompt injectionEmerging attack surface for state development teams using AI assistants

TimeframeActor/CampaignTargetStatus
19–23 Aug 2026IRGC-affiliated groupsU.S. wastewater facilities (12 states)Active disruption operations
25–26 Aug 2026UNC6201 / Murky Panda (China)Government endpointsUSB/DLL sideloading confirmed
26 Aug 2026Multiple actors (unattributed)Citrix NetScaler ADC/GatewayCVE-2026-8452 exploitation confirmed
27 Aug 2026Unknown (ransomware precedent)PaperCut NG/MF customersActive zero-day exploitation confirmed
28 Aug 2026Multiple actors (unattributed)TeamCity On-PremisesCVE-2026-63077 in-the-wild exploitation
Sep 2025–Apr 2026APT28 (Fancy Bear / Forest Blizzard)Government/diplomatic orgs (Romania, Spain, Türkiye)HOOKEDGE backdoor deployed
OngoingPUNK SPIDER (Akira), HOOK SPIDER, Qilin, EverestState/local governmentActive ransomware operations; no confirmed incidents this cycle
OngoingVolt Typhoon (UNC5135), Salt Typhoon (UNC5807)U.S. critical infrastructure / governmentPre-positioning; long dwell times expected

PaperCut disclosed an actively exploited zero-day on 27 August affecting every version of PaperCut NG and PaperCut MF. Emergency patches exist only for versions 25 and 26 — agencies running older versions have no vendor fix available.

Why this matters for state government: PaperCut is widely deployed across government agencies for centralized print management. In 2023, CVE-2023-27350 (CVSS 9.8) in the same product was weaponized by Russian actors and the Lace Tempest group to deliver Cl0p and LockBit ransomware. The pattern is clear: PaperCut exploitation → ransomware deployment within 5–7 days of public disclosure.

Indicators of compromise to hunt for: process execution of pc-app.exe with unexpected child processes; log entries containing ERROR No suitable driver found for jdbc:no:x; log entries containing ERROR DatabaseUtils - Database error looking up cardID: VALUES CAST; evidence of server.log truncation or deletion (anti-forensics).

No CVE has been assigned yet. This complicates vulnerability scanning — you cannot rely on scanner signatures to find this. Manual verification of PaperCut version and patch status is required.

T1190T1059.001T1070.004T1486

JetBrains TeamCity On-Premises versions before 2025.11.7 and 2026.1.x before 2026.1.3 contain an unauthenticated remote code execution vulnerability via XStream deserialization in the agent polling protocol. Two HTTP requests. Zero credentials. Full server compromise.

This is TeamCity's third CVSS 9.8 pre-authentication vulnerability in two years (following CVE-2024-23917 and CVE-2024-27198). CISA added it to the KEV catalog on 5 August, and a detailed exploit walkthrough with proof-of-concept was published on 28 August.

Attack path: attacker registers a rogue agent via /app/agents/v1/register (no authentication required); sends a crafted XStream payload to /app/agents/v1/commands/error; deserialization triggers code execution via a gadget chain (HSQLMetadataStorage, TiedMapEntry, BasicDataSource); attacker writes a JSP webshell to the TeamCity web root for persistent access.

Note: TeamCity Cloud was NOT affected. Compromising a CI/CD server gives attackers the ability to inject malicious code into every application built through that pipeline.

T1190T1505.003T1059.004T1195.002

APT28 (also tracked as Fancy Bear, BlueDelta, and Forest Blizzard — Russia's GRU Unit 26165) deployed a new backdoor called HOOKEDGE against government and diplomatic organizations in Romania, Spain, and Türkiye between September 2025 and April 2026. The campaign was disclosed by Recorded Future's Insikt Group on 28 August.

HOOKEDGE is a direct evolutionary successor to the HEADLACE backdoor. Delivery: macro-enabled Word documents with diplomatic-themed lures. C2: abuses the legitimate service webhook[.]site for command-and-control, staging, and exfiltration. Persistence: scheduled task executing every 30 minutes. Stealth: launches Microsoft Edge in headless mode for C2 communication; self-deletes installation artifacts.

Why this matters for state government: while current confirmed targeting is European government organizations, APT28 has historically targeted U.S. state and local government. The use of webhook[.]site — a legitimate developer tool — makes network detection challenging because the domain may be considered benign by default proxy/firewall policies.

T1566.001T1204.002T1053.005T1071.001T1564.003

CISA published 5 ICS advisories this cycle covering Rockwell OTTO, Mitsubishi CNC/FA, Ebyte, All-Line Fuel-Boss, and ASE2000 systems. State agencies with oversight of water, energy, and transportation infrastructure should ensure partner organizations are aware.

The IRGC-affiliated disruption of wastewater facilities across 12 states (reported 19–23 August) remains an active concern. MuddyWater (UNC5667), affiliated with Iran's MOIS, continues targeting Siemens S7 PLCs across 7+ states. These are distinct threat actors with separate operational mandates — MuddyWater operates under MOIS direction and should not be conflated with IRGC-affiliated groups conducting the wastewater disruption campaign.

Security research published 28 August demonstrated a 60–80% success rate exploiting Anthropic's Claude Code Opus 5 in Auto Mode via prompt injection. The attack chain requires no credentials — only that a developer asks the AI agent to visit a malicious URL. The agent then downloads and executes attacker-controlled code with the developer's full privileges.

Attack chain: malicious website → HTTP 415 failure → curl redirect → ZIP download → Python module shadowing (struct.py) → arbitrary code execution → C2 callback.

This represents an emerging governance gap. If state development teams use AI coding assistants with network access, a single malicious link in a Jira ticket or Slack channel could compromise developer workstations with access to CI/CD pipelines, source repositories, and deployment credentials.

ScenarioProbabilityTimeframeBasis
Ransomware operators weaponize PaperCut zero-day for mass exploitationHIGH (75–85%)5–7 daysDirect precedent: CVE-2023-27350 was weaponized by Cl0p/LockBit within one week of disclosure
Mass scanning and exploitation of CVE-2026-63077 (TeamCity)HIGH (80–90%)48 hoursFull PoC is public; CISA confirmed in-the-wild exploitation; low complexity attack
APT28 HOOKEDGE targeting expands to U.S. government organizationsMODERATE (40–55%)30–60 daysHistorical pattern of European campaigns preceding U.S. targeting; U.S. state gov within APT28's known target set
Ransomware incident at a U.S. state/local government entityMODERATE-HIGH (55–65%)7–14 daysPUNK SPIDER (Akira), Qilin, Everest all active; PaperCut 0-day provides new entry vector; state gov remains high-pressure target
China-nexus actors leverage TeamCity compromise for supply chain pre-positioningMODERATE (35–50%)30–90 daysConsistent with Volt Typhoon operational pattern; CI/CD access enables long-term persistence

PaperCut Zero-Day (Priority: CRITICAL):

Hunt hypothesis: Threat actors have already exploited PaperCut servers and are establishing persistence before ransomware deployment. Detection logic: Alert on any child process spawned by pc-app.exe that is not a known PaperCut component. Monitor for PowerShell, cmd.exe, or certutil execution in the PaperCut service account context. Alert on server.log file size decreasing or file deletion events. Immediate action: If PaperCut is deployed, restrict Application Server network access to trusted management IPs only via firewall rules — do this before patching if patch scheduling requires a change window.

TeamCity CVE-2026-63077 (Priority: CRITICAL):

Hunt hypothesis: Exposed TeamCity instances have been compromised and webshells are present in the web root. Detection logic: Search for .jspws files in TeamCity web root directories. Monitor HTTP access logs for requests to /app/agents/v1/register and /app/agents/v1/commands/error from non-agent IPs. Alert on new scheduled builds or build configuration changes not correlated with developer activity. Immediate action: Block unauthenticated access to /app/agents/v1/* endpoints at WAF or reverse proxy. Audit existing registered agents against known-good inventory.

APT28 HOOKEDGE (Priority: HIGH):

Hunt hypothesis: APT28 has sent spearphishing emails with macro-enabled Word documents to government staff; compromised hosts are beaconing to webhook[.]site. Detection logic: Alert on msedge.exe launched with --headless flag combined with outbound HTTPS to webhook[.]site. Monitor Sysmon Event ID 1 for scheduled task creation executing from %userprofile% directories. Alert on macro-enabled document execution followed by file writes to %userprofile% (6+ files in rapid succession). Blocking recommendation: If webhook[.]site is not required for business operations, block at web proxy/firewall. If required by development teams, implement allowlisting by user group rather than blanket access.

Volt Typhoon / Salt Typhoon Living-off-the-Land (Priority: HIGH — Ongoing):

Hunt hypothesis: China-nexus actors are present in state government networks using valid credentials and native tools, evading traditional detection. Detection logic: Baseline normal administrative behavior; alert on deviations — RDP sessions at unusual hours, ntdsutil/vssadmin usage outside maintenance windows, PowerShell remoting from non-admin workstations. Focus on network telemetry anomalies rather than endpoint signatures.

ThreatATT&CK
PaperCut Zero-Day (Priority: CRITICAL)T1190 T1059.001 T1070.004 T1486
TeamCity CVE-2026-63077 (Priority: CRITICAL)T1190 T1505.003 T1059.004 T1195.002
APT28 HOOKEDGE (Priority: HIGH)T1566.001 T1204.002 T1053.005 T1071.001 T1564.003
Volt Typhoon / Salt Typhoon Living-off-the-Land (Priority: HIGH — Ongoing)T1078 T1218 T1003 T1021.001
Hunting Hypotheses:
HUNT 01 · T1190
PaperCut servers already exploited, pre-ransomware persistence
Threat actors have already exploited PaperCut servers and are establishing persistence before ransomware deployment. Alert on any child process spawned by pc-app.exe that is not a known PaperCut component; monitor for PowerShell, cmd.exe, or certutil execution in the PaperCut service account context; alert on server.log file size decreasing or file deletion events.
HUNT 02 · T1505.003
Exposed TeamCity instances already compromised with webshells
Search for .jspws files in TeamCity web root directories. Monitor HTTP access logs for requests to /app/agents/v1/register and /app/agents/v1/commands/error from non-agent IPs. Alert on new scheduled builds or build configuration changes not correlated with developer activity.
HUNT 03 · T1566.001
APT28 spearphishing already delivered, hosts beaconing to webhook.site
APT28 has sent spearphishing emails with macro-enabled Word documents to government staff; compromised hosts are beaconing to webhook[.]site. Alert on msedge.exe launched with --headless combined with outbound HTTPS to webhook[.]site. Monitor Sysmon Event ID 1 for scheduled task creation from %userprofile% directories.
HUNT 04 · T1078
China-nexus actors present via valid credentials and native tools
China-nexus actors are present in state government networks using valid credentials and native tools, evading traditional detection. Baseline normal administrative behavior; alert on deviations — RDP sessions at unusual hours, ntdsutil/vssadmin usage outside maintenance windows, PowerShell remoting from non-admin workstations.

Financial Services
State Treasury, Revenue, Benefits Systems
Primary threat
Ransomware via PaperCut exploitation targeting systems processing financial transactions and citizen benefits.
Secondary threat
Credential harvesting campaigns (Phishing-as-a-Service platforms) targeting financial system administrators.
Actions
  • Immediately verify PaperCut deployment in revenue processing and benefits administration environments — these systems handle high-value data that increases ransom leverage
  • Enforce phishing-resistant MFA (FIDO2) on all financial system admin accounts
Energy
Public Utility Commissions, State Energy Offices
Primary threat
IRGC-affiliated disruption of operational technology; MuddyWater (MOIS) targeting Siemens S7 PLCs.
Secondary threat
Volt Typhoon pre-positioning in energy sector infrastructure for potential future disruption during geopolitical crisis.
Actions
  • Coordinate with regulated utilities to confirm awareness of CISA ICS advisories (Rockwell OTTO, Mitsubishi CNC/FA, All-Line Fuel-Boss)
  • Verify network segmentation between IT and OT environments
  • Ensure state energy oversight systems cannot be used as pivot points into utility OT networks
Healthcare
State Health Departments, Medicaid Systems
Primary threat
Ransomware targeting systems containing protected health information (PHI) — maximum pressure for payment.
Secondary threat
Supply chain risk if health IT vendors use vulnerable TeamCity instances for software builds.
Actions
  • Verify PaperCut deployment status and patch immediately — PaperCut is commonly used for print management of patient records
  • Ensure backup integrity for Medicaid claims processing systems
Government
Executive Agencies, Courts, Legislature
Primary threat
APT28 HOOKEDGE espionage targeting government officials; ransomware targeting citizen-facing services.
Secondary threat
China-nexus pre-positioning (Volt Typhoon, Salt Typhoon) targeting government networks for long-term intelligence collection — absence of detection is not evidence of absence.
Actions
  • Brief executive staff on diplomatic-themed spearphishing lures (macro-enabled Word documents)
  • Verify that macro execution policies are enforced via Group Policy
  • Monitor for scheduled task creation in user profile directories
Aviation / Logistics
State DOT, Airport Authorities, Port Operations
Primary threat
Critical infrastructure pre-positioning by nation-state actors; supply chain compromise via CI/CD vulnerabilities.
Secondary threat
ZBT router backdoors (EndlessDoors, SpeakingStone, DarkLantern) — inventory networking equipment in field offices and remote transportation monitoring sites for white-label devices from Zbtlink, DeepOrange, or WiFlyer brands.
Actions
  • State transportation agencies with custom software development should immediately audit TeamCity deployments
  • Verify that transportation management systems are segmented from general IT networks
No sector cards match the selected filters.

Restrict PaperCut NG/MF Application Server to trusted IPs via firewall ACLs. Apply the emergency patch (v25/v26) within 24 hours. Agencies on older versions: isolate PaperCut servers from domain and internet until the vendor provides a fix.
Incident Responder
Verify TeamCity On-Premises version. If running <2025.11.7 or 2026.1.x <2026.1.3, apply the security patch plugin NOW. Block unauthenticated access to /app/agents/v1/ at WAF. Search for .jspws files in the web root.
Incident Responder
Confirm Citrix NetScaler CVE-2026-8452 patch compliance — CISA deadline is 29 August. Escalate any unpatched instances to agency CISOs with an explicit risk acceptance requirement if the deadline will be missed.
Incident Responder
Hunt for PaperCut compromise indicators: pc-app.exe spawning unexpected processes, server.log deletion, JDBC error strings in logs.
SOC Analyst
No immediate actions for the selected roles.
Deploy detection for Microsoft Edge headless mode (msedge.exe --headless) with outbound connections to webhook[.]site. Evaluate blocking webhook[.]site at proxy after confirming no legitimate business use.
SOC Analyst
Implement scheduled task creation monitoring (Sysmon EID 1 + Task Scheduler audit logs) with alerting on tasks executing from %userprofile% — the APT28 HOOKEDGE persistence indicator.
SOC Analyst
Audit AI coding assistant usage across all development teams. Implement policy: AI agents must run in sandboxed containers with restricted network egress. Prohibit AI agents from executing downloaded archives or scripts.
Incident Responder
Inventory all network equipment statewide for ZBT/Zbtlink/DeepOrange/WiFlyer devices. Isolate and schedule replacement for any identified units.
Incident Responder
Enumerate PaperCut installations across all agencies — version, patch status, network exposure. Establish ongoing inventory for future vulnerability response.
Incident Responder
No 7-day actions for the selected roles.
Evaluate architectural isolation of print management infrastructure from domain admin trust paths. PaperCut's third major exploitation in three years establishes print servers as a persistent high-risk attack surface.
CISO / Exec
Assess migration from TeamCity On-Premises to cloud-hosted CI/CD (TeamCity Cloud was unaffected). Three CVSS 9.8 pre-auth vulnerabilities in two years indicates a recurring on-premises liability.
CISO / Exec
Establish governance policy for AI coding assistant usage including approved tools, sandboxing requirements, and acceptable use boundaries. This is an emerging shadow IT risk that will grow rapidly.
CISO / Exec
Conduct a proactive threat hunt for Volt Typhoon / Salt Typhoon indicators: focus on T1078 (Valid Accounts), living-off-the-land binaries, and anomalous administrative behavior patterns. These actors operate with multi-month dwell times.
Threat Hunter
Conduct a tabletop exercise simulating ransomware via PaperCut exploitation affecting citizen-facing services. Test decision-making processes for ransom payment, public communication, and service restoration priorities.
CISO / ExecIncident Responder
No 30-day actions for the selected roles.
The Bottom Line

The convergence of a PaperCut zero-day, a TeamCity CVSS 9.8 with public exploit code, and tomorrow's CISA NetScaler deadline creates a compressed action window that state IT leadership cannot defer. History tells us exactly what happens next: ransomware operators weaponize print server vulnerabilities within a week of disclosure, and nation-state actors scan for exposed CI/CD infrastructure within 48 hours of PoC publication. Several notable absences this cycle warrant attention rather than comfort: no ransomware incidents against U.S. state/local government were reported despite Akira, HOOK SPIDER, Qilin, and Everest all showing active operational status — given the historically high tempo of state government ransomware, a quiet period may indicate pre-positioning rather than disengagement. No new Volt Typhoon or Salt Typhoon activity was detected, but these China-nexus actors operate with dwell times measured in months or years — absence of detection is explicitly not evidence of absence. The question is not whether these vulnerabilities will be exploited against state government — it's whether your agencies will be patched before the exploitation wave arrives.

1
Confirm PaperCut deployment status and patch timeline across all agencies.
2
Approve emergency change windows for TeamCity patching.
3
Validate NetScaler compliance before tomorrow's federal deadline. Every hour of delay increases the probability that one of these vectors becomes your next incident.
No items found.