| Date | Development | Impact |
|---|---|---|
| 13 Aug 2026 | Gunra ransomware publishes evolved TTP: FortiOS auth bypass + MFA evasion + RDP pivot to Active Directory | Direct threat to state VPN perimeter |
| 13 Aug 2026 | CISA issues triple advisory for Johnson Controls: Metasys XSS (CVE-2026-34491), Airwall hardcoded key (CVE-2026-64887), Airwall file read (CVE-2026-34492) | State building automation at risk |
| 13 Aug 2026 | Presidential memorandum authorizes private-sector offensive cyber operations against foreign criminal networks | Shifts federal cyber posture |
| 13 Aug 2026 | APT36 / Transparent Tribe deploys PATCHCORD malware with novel Google Sheets and GitHub Gist C2 — evasion technique applicable to U.S. state networks | New C2 channel bypasses traditional proxy inspection |
| 14 Aug 2026 | University of Birmingham/Google discloses CVE-2026-23670: software-only bypass of Windows VBS, HVCI, and EDR via memory hardware manipulation | Endpoint security model challenged |
| 11 Aug 2026 | California Governor announces AI Cyber Defense Fund with per-agency AI Cybersecurity Officers | Sets precedent for state-level programs |
| Ongoing | Proposed $707M CISA FY2027 budget cut signals reduced federal incident response and grant support for states | States must accelerate self-sufficiency planning |
| Ongoing | UNC6779 (China/Volt Typhoon-consistent), UNC7006 (Qilin ransomware), and MuddyWater (Iran/MOIS) campaigns from prior week remain active against U.S. government networks | Persistent nation-state and criminal pressure |
| Date | Actor / Campaign | Target | Key Detail |
|---|---|---|---|
| 1 Aug 2026 | MuddyWater (Iran/MOIS) | U.S. water/wastewater PLCs (7+ states) | Active ICS/OT intrusion campaign |
| 11 Aug 2026 | Multiple actors | Cisco ASA/FTD VPN infrastructure | CVE-2026-20349 added to CISA KEV catalog |
| 12 Aug 2026 | UNC6779 (China) | U.S. government networks | SNOWLIGHT espionage malware via CVE-2026-0257 (Palo Alto GlobalProtect) |
| 12 Aug 2026 | UNC7006 | U.S. government networks | Qilin ransomware via same GlobalProtect vulnerability |
| 13 Aug 2026 | Gunra / HOOK SPIDER | Government, critical infrastructure | New playbook: FortiOS exploit → MFA bypass → DCSync → double extortion |
| 13 Aug 2026 | APT36 / Transparent Tribe | South Asian telecom/gov | PATCHCORD malware with Google Sheets C2 — novel evasion technique |
| 14 Aug 2026 | Researchers (PoC) | Windows 11 endpoints | CVE-2026-23670 VBS/HVCI bypass — no physical access required |
Gunra (also tracked as HOOK SPIDER) is a Conti-derived ransomware-as-a-service operation that launched its affiliate program in January 2026. A detailed technical report published August 13 reveals their current playbook against government targets:
Initial Access: exploitation of CVE-2024-55591 and CVE-2025-24472 — authentication bypass vulnerabilities in FortiOS and FortiProxy. These are not new CVEs, but Gunra's operators are specifically scanning for unpatched state and local government appliances.
MFA Bypass: after gaining access to the FortiGate management plane, operators manipulate VDI portal authentication configuration files to disable or bypass MFA requirements. They also reactivate dormant VPN accounts that lack password change enforcement.
Lateral Movement: Impacket-based DCSync attacks extract domain credentials. OpenSSH tunnels and RDP session hijacking provide lateral movement across the Active Directory environment.
Exfiltration & Impact: data is stolen from OneDrive and SharePoint before encryption. Double extortion — pay for decryption AND to prevent data publication.
Why this matters for state government: FortiGate appliances are widely deployed across state agency branch offices. Budget constraints often delay patching cycles. Dormant VPN accounts from former employees or contractors are common in large state workforces with high turnover.
State office complexes, courthouses, and data centers commonly run Johnson Controls Metasys for HVAC and building management. This week, CISA issued advisories for three distinct product lines:
| CVE | Product | CVSS | Risk |
|---|---|---|---|
| CVE-2026-34491 | Metasys v12–15 | 8.0 | Persistent XSS → admin session hijack → unauthorized BAS control |
| CVE-2026-64887 | Airwall ≤ v4.0.4 | 6.8 | Hardcoded cryptographic key identical across ALL installations globally |
| CVE-2026-34492 | Airwall ≤ v4.0.4 | 5.3 | Arbitrary file read via path traversal |
The Airwall hardcoded key vulnerability deserves special attention: a single key, once extracted from any Airwall binary anywhere in the world, can decrypt sensitive configuration and database data on every Airwall deployment. This is a supply-chain-class vulnerability in a network micro-segmentation product that many organizations trust to isolate sensitive environments.
Separately, research published August 13 identified 6,300 internet-exposed BAS controllers within 1 kilometer of U.S. data centers, with BACnet (port 47808) and Fox/Niagara (port 1911) comprising 81% of exposure. The FrostyGoop malware (which caused a real heating outage via Modbus manipulation) demonstrates that these exposures translate to physical impact.
Active campaigns from the prior cycle (still ongoing): UNC6779 (China, consistent with Volt Typhoon) deploying SNOWLIGHT espionage malware against U.S. government networks via CVE-2026-0257 in Palo Alto GlobalProtect (CVSS 9.1); MuddyWater (Iran/MOIS) running an active ICS/OT intrusion campaign targeting water/wastewater PLCs across 7+ states; Salt Typhoon (China) with IOCs refreshed in intelligence feeds but no new campaign reporting — absence of reporting does NOT equal absence of activity for this stealth-focused actor.
New this cycle: APT36 / Transparent Tribe (Pakistan) deploying PATCHCORD malware with a novel C2 technique using the Google Sheets API and GitHub Gists. While currently targeting South Asian telecom, the C2 evasion technique — abusing legitimate cloud services to bypass proxy inspection — is directly applicable to attacks against U.S. state networks and warrants detection engineering.
CVE-2026-23670 represents an entirely new attack class. Researchers at the University of Birmingham demonstrated a software-only exploit that manipulates DDR4/DDR5 memory module configuration chips (Corsair, G.Skill, ADATA) to create memory aliases that bypass Virtualization-Based Security (VBS), Hypervisor-Protected Code Integrity (HVCI), and Endpoint Detection and Response (EDR).
No physical access is required. Microsoft issued mitigations in April 2026 that require SecureBoot to be enabled. State agencies that have not enforced SecureBoot or deployed April 2026 cumulative updates have endpoints where the entire Windows security stack can be neutralized.
Three policy developments reshape the federal-state cyber relationship: a proposed $707M CISA budget cut (FY2027) that, if enacted, would significantly reduce federal incident response support, threat intelligence sharing, and state/local grant programs; the California AI Cyber Defense Fund (announced August 11), which mandates AI Cybersecurity Officers per state agency with a 120-day implementation timeline; and a presidential memorandum (August 13) authorizing vetted private-sector companies to conduct offensive cyber operations against foreign criminal networks under DOJ/DHS oversight.
Implication for state CISOs: reduced CISA support combined with increased threat activity means states must accelerate self-sufficiency in threat detection, incident response, and intelligence capabilities.
| Scenario | Probability (30 days) | Basis |
|---|---|---|
| Gunra ransomware successfully compromises a U.S. state or local government entity via FortiOS exploitation | 75%+ | Documented playbook, RaaS affiliate expansion, known unpatched government appliances |
| Johnson Controls BAS vulnerability exploited in a government facility | 40% | Metasys XSS requires authenticated access (lowers barrier); Airwall hardcoded key is trivially exploitable once disclosed |
| Volt Typhoon / Salt Typhoon pre-positioning discovered in additional state networks | 60% | Historical pattern of discovery lag; active IOC refresh suggests ongoing operations |
| Copycat campaigns using Gunra's published FortiOS playbook | 70% | Detailed TTP publication lowers barrier for other ransomware affiliates |
| State water/wastewater system disruption via MuddyWater ICS campaign | 35% | Active campaign confirmed across 7+ states; OT security maturity varies widely |
| ATT&CK Technique | Detection Focus | Hunting Hypothesis |
|---|---|---|
| T1190 (Exploit Public-Facing App) | FortiOS/FortiProxy authentication bypass attempts; anomalous admin API calls to FortiGate management interfaces | "Are there successful authentications to FortiGate admin interfaces from unexpected source IPs or at unusual hours?" |
| T1078 (Valid Accounts) | Dormant VPN accounts reactivated without password reset; accounts authenticating after extended inactivity | "Which VPN accounts were inactive >90 days and have authenticated in the past 14 days?" |
| T1563.002 (RDP Session Hijacking) | RDP connections from VPN segments to domain controllers; tscon.exe usage | "Are there RDP sessions originating from VPN address pools connecting directly to Tier 0 assets?" |
| T1003.006 (DCSync) | Replication requests from non-DC hosts; DRS-GetNCChanges from workstations | "Are any non-domain-controller hosts issuing directory replication requests?" |
| T1102 (Web Service C2) | Google Sheets API calls from non-browser processes; GitHub Gist access from endpoints without developer tooling | "Which endpoints are making API calls to sheets.googleapis.com or gist.github.com outside of browser processes?" |
| T1562.001 (Impair Defenses) | EDR agent crashes or unloads; VBS/HVCI status changes on endpoints | "Have any endpoints reported VBS or HVCI disabled after previously being enabled?" |
| T1133 (External Remote Services) | BACnet (47808), Fox/Niagara (1911), Modbus (502) traffic crossing network boundaries | "Is there any BACnet, Fox, or Modbus traffic traversing the enterprise/OT boundary or reaching the internet?" |
| T1547.009 (Shortcut Modification) | Browser .lnk files modified to point to unexpected executables; startup folder changes | "Have any browser shortcuts been modified to execute non-standard binaries?" |
Block the above at perimeter firewalls, proxies, and DNS. Hashes: 1774e15e8eb96eb89bc03cb4768fc0620e10c09c5f795297f36dcc2aa5d9dd94, ea0934472121848b80455581d289ce4480b1e5cc05678c1b90ecfc465b5ec350, 5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a, 378484112b4e837d3850b5b0802fc509202c232bb124d6944a59fe66525ba668. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
- DCSync detection — any replication request from a non-DC host in financial system domains should trigger an immediate P1 alert
- Segment pension and tax processing systems from the general state network — Gunra's RDP pivot technique exploits flat network architectures
- BAS exposure audit — confirm no BACnet/Modbus controllers in state power facilities are internet-reachable. Reference FrostyGoop malware capabilities for threat briefing to OT staff.
- Johnson Controls Airwall — if deployed for OT segmentation, the hardcoded key (CVE-2026-64887) means your segmentation boundary may be compromised. Patch to v4.1.0 immediately.
- Validate that health information exchange (HIE) connections enforce mutual TLS and are not traversing compromised FortiGate appliances
- Google Sheets/GitHub Gists C2 technique — healthcare environments often permit Google Workspace access. Monitor for API-level access to Google Sheets from non-browser processes on clinical or administrative workstations.
- Patch Johnson Controls Metasys (v14.1.5 or v15.0.1) in all state-owned buildings. Restrict Metasys web UI to management VLAN with explicit access control lists.
- Dormant account purge — disable all VPN/remote access accounts inactive >90 days. Require password reset + MFA re-enrollment before reactivation.
- Evaluate California's AI Cyber Defense Fund model for applicability. Begin internal assessment of AI-augmented SOC capabilities given potential CISA funding reductions.
- Siemens Desigo (CVE-2026-59693, DoS) — if deployed in transportation facilities, ensure firmware is current and management interfaces are not exposed
- Supply chain risk from Airwall — if used to segment traffic management or fleet GPS systems, validate patch status and rotate any credentials that may have been protected by the compromised hardcoded key
The threat picture for state government is not theoretical — it is operational and immediate. Gunra ransomware operators have published a step-by-step playbook for compromising the exact FortiOS appliances that protect state agency networks. Chinese state-sponsored actors continue exploiting government VPN infrastructure for espionage. Iranian operators (MuddyWater/MOIS) are inside water treatment PLCs. And the federal safety net that states have relied on may be shrinking. The decisions made in the next 24-72 hours — patching FortiOS, securing building automation systems, auditing dormant accounts — will determine whether your state is the next headline or the one that got ahead of the threat.