TLP:GREEN  ·  States / Public Sector
Ransomware Operators Now Bypassing MFA on State VPN Infrastructure:

What State CIOs and CISOs Must Do This Week

HIGH. Elevated from ELEVATED on August 12 following confirmation of Chinese state-sponsored actors and ransomware operators simultaneously exploiting U.S. government perimeter infrastructure, and remains at HIGH based on new evidence of Gunra ransomware's evolved tradecraft directly targeting FortiOS appliances common in state networks. Gunra has published a refined playbook that exploits FortiOS VPN appliances and bypasses multi-factor authentication in the process. Three separate vulnerabilities in Johnson Controls building automation products threaten state office complexes, and a proposed $707 million cut to CISA's budget signals reduced federal defensive support.

I am a
My sector

DateDevelopmentImpact
13 Aug 2026Gunra ransomware publishes evolved TTP: FortiOS auth bypass + MFA evasion + RDP pivot to Active DirectoryDirect threat to state VPN perimeter
13 Aug 2026CISA issues triple advisory for Johnson Controls: Metasys XSS (CVE-2026-34491), Airwall hardcoded key (CVE-2026-64887), Airwall file read (CVE-2026-34492)State building automation at risk
13 Aug 2026Presidential memorandum authorizes private-sector offensive cyber operations against foreign criminal networksShifts federal cyber posture
13 Aug 2026APT36 / Transparent Tribe deploys PATCHCORD malware with novel Google Sheets and GitHub Gist C2 — evasion technique applicable to U.S. state networksNew C2 channel bypasses traditional proxy inspection
14 Aug 2026University of Birmingham/Google discloses CVE-2026-23670: software-only bypass of Windows VBS, HVCI, and EDR via memory hardware manipulationEndpoint security model challenged
11 Aug 2026California Governor announces AI Cyber Defense Fund with per-agency AI Cybersecurity OfficersSets precedent for state-level programs
OngoingProposed $707M CISA FY2027 budget cut signals reduced federal incident response and grant support for statesStates must accelerate self-sufficiency planning
OngoingUNC6779 (China/Volt Typhoon-consistent), UNC7006 (Qilin ransomware), and MuddyWater (Iran/MOIS) campaigns from prior week remain active against U.S. government networksPersistent nation-state and criminal pressure

DateActor / CampaignTargetKey Detail
1 Aug 2026MuddyWater (Iran/MOIS)U.S. water/wastewater PLCs (7+ states)Active ICS/OT intrusion campaign
11 Aug 2026Multiple actorsCisco ASA/FTD VPN infrastructureCVE-2026-20349 added to CISA KEV catalog
12 Aug 2026UNC6779 (China)U.S. government networksSNOWLIGHT espionage malware via CVE-2026-0257 (Palo Alto GlobalProtect)
12 Aug 2026UNC7006U.S. government networksQilin ransomware via same GlobalProtect vulnerability
13 Aug 2026Gunra / HOOK SPIDERGovernment, critical infrastructureNew playbook: FortiOS exploit → MFA bypass → DCSync → double extortion
13 Aug 2026APT36 / Transparent TribeSouth Asian telecom/govPATCHCORD malware with Google Sheets C2 — novel evasion technique
14 Aug 2026Researchers (PoC)Windows 11 endpointsCVE-2026-23670 VBS/HVCI bypass — no physical access required

Gunra (also tracked as HOOK SPIDER) is a Conti-derived ransomware-as-a-service operation that launched its affiliate program in January 2026. A detailed technical report published August 13 reveals their current playbook against government targets:

Initial Access: exploitation of CVE-2024-55591 and CVE-2025-24472 — authentication bypass vulnerabilities in FortiOS and FortiProxy. These are not new CVEs, but Gunra's operators are specifically scanning for unpatched state and local government appliances.

MFA Bypass: after gaining access to the FortiGate management plane, operators manipulate VDI portal authentication configuration files to disable or bypass MFA requirements. They also reactivate dormant VPN accounts that lack password change enforcement.

Lateral Movement: Impacket-based DCSync attacks extract domain credentials. OpenSSH tunnels and RDP session hijacking provide lateral movement across the Active Directory environment.

Exfiltration & Impact: data is stolen from OneDrive and SharePoint before encryption. Double extortion — pay for decryption AND to prevent data publication.

Why this matters for state government: FortiGate appliances are widely deployed across state agency branch offices. Budget constraints often delay patching cycles. Dormant VPN accounts from former employees or contractors are common in large state workforces with high turnover.

T1190T1078T1563.002T1003.006

State office complexes, courthouses, and data centers commonly run Johnson Controls Metasys for HVAC and building management. This week, CISA issued advisories for three distinct product lines:

CVEProductCVSSRisk
CVE-2026-34491Metasys v12–158.0Persistent XSS → admin session hijack → unauthorized BAS control
CVE-2026-64887Airwall ≤ v4.0.46.8Hardcoded cryptographic key identical across ALL installations globally
CVE-2026-34492Airwall ≤ v4.0.45.3Arbitrary file read via path traversal

The Airwall hardcoded key vulnerability deserves special attention: a single key, once extracted from any Airwall binary anywhere in the world, can decrypt sensitive configuration and database data on every Airwall deployment. This is a supply-chain-class vulnerability in a network micro-segmentation product that many organizations trust to isolate sensitive environments.

Separately, research published August 13 identified 6,300 internet-exposed BAS controllers within 1 kilometer of U.S. data centers, with BACnet (port 47808) and Fox/Niagara (port 1911) comprising 81% of exposure. The FrostyGoop malware (which caused a real heating outage via Modbus manipulation) demonstrates that these exposures translate to physical impact.

T1133

Active campaigns from the prior cycle (still ongoing): UNC6779 (China, consistent with Volt Typhoon) deploying SNOWLIGHT espionage malware against U.S. government networks via CVE-2026-0257 in Palo Alto GlobalProtect (CVSS 9.1); MuddyWater (Iran/MOIS) running an active ICS/OT intrusion campaign targeting water/wastewater PLCs across 7+ states; Salt Typhoon (China) with IOCs refreshed in intelligence feeds but no new campaign reporting — absence of reporting does NOT equal absence of activity for this stealth-focused actor.

New this cycle: APT36 / Transparent Tribe (Pakistan) deploying PATCHCORD malware with a novel C2 technique using the Google Sheets API and GitHub Gists. While currently targeting South Asian telecom, the C2 evasion technique — abusing legitimate cloud services to bypass proxy inspection — is directly applicable to attacks against U.S. state networks and warrants detection engineering.

T1102

CVE-2026-23670 represents an entirely new attack class. Researchers at the University of Birmingham demonstrated a software-only exploit that manipulates DDR4/DDR5 memory module configuration chips (Corsair, G.Skill, ADATA) to create memory aliases that bypass Virtualization-Based Security (VBS), Hypervisor-Protected Code Integrity (HVCI), and Endpoint Detection and Response (EDR).

No physical access is required. Microsoft issued mitigations in April 2026 that require SecureBoot to be enabled. State agencies that have not enforced SecureBoot or deployed April 2026 cumulative updates have endpoints where the entire Windows security stack can be neutralized.

T1562.001

Three policy developments reshape the federal-state cyber relationship: a proposed $707M CISA budget cut (FY2027) that, if enacted, would significantly reduce federal incident response support, threat intelligence sharing, and state/local grant programs; the California AI Cyber Defense Fund (announced August 11), which mandates AI Cybersecurity Officers per state agency with a 120-day implementation timeline; and a presidential memorandum (August 13) authorizing vetted private-sector companies to conduct offensive cyber operations against foreign criminal networks under DOJ/DHS oversight.

Implication for state CISOs: reduced CISA support combined with increased threat activity means states must accelerate self-sufficiency in threat detection, incident response, and intelligence capabilities.

ScenarioProbability (30 days)Basis
Gunra ransomware successfully compromises a U.S. state or local government entity via FortiOS exploitation75%+Documented playbook, RaaS affiliate expansion, known unpatched government appliances
Johnson Controls BAS vulnerability exploited in a government facility40%Metasys XSS requires authenticated access (lowers barrier); Airwall hardcoded key is trivially exploitable once disclosed
Volt Typhoon / Salt Typhoon pre-positioning discovered in additional state networks60%Historical pattern of discovery lag; active IOC refresh suggests ongoing operations
Copycat campaigns using Gunra's published FortiOS playbook70%Detailed TTP publication lowers barrier for other ransomware affiliates
State water/wastewater system disruption via MuddyWater ICS campaign35%Active campaign confirmed across 7+ states; OT security maturity varies widely

ATT&CK TechniqueDetection FocusHunting Hypothesis
T1190 (Exploit Public-Facing App)FortiOS/FortiProxy authentication bypass attempts; anomalous admin API calls to FortiGate management interfaces"Are there successful authentications to FortiGate admin interfaces from unexpected source IPs or at unusual hours?"
T1078 (Valid Accounts)Dormant VPN accounts reactivated without password reset; accounts authenticating after extended inactivity"Which VPN accounts were inactive >90 days and have authenticated in the past 14 days?"
T1563.002 (RDP Session Hijacking)RDP connections from VPN segments to domain controllers; tscon.exe usage"Are there RDP sessions originating from VPN address pools connecting directly to Tier 0 assets?"
T1003.006 (DCSync)Replication requests from non-DC hosts; DRS-GetNCChanges from workstations"Are any non-domain-controller hosts issuing directory replication requests?"
T1102 (Web Service C2)Google Sheets API calls from non-browser processes; GitHub Gist access from endpoints without developer tooling"Which endpoints are making API calls to sheets.googleapis.com or gist.github.com outside of browser processes?"
T1562.001 (Impair Defenses)EDR agent crashes or unloads; VBS/HVCI status changes on endpoints"Have any endpoints reported VBS or HVCI disabled after previously being enabled?"
T1133 (External Remote Services)BACnet (47808), Fox/Niagara (1911), Modbus (502) traffic crossing network boundaries"Is there any BACnet, Fox, or Modbus traffic traversing the enterprise/OT boundary or reaching the internet?"
T1547.009 (Shortcut Modification)Browser .lnk files modified to point to unexpected executables; startup folder changes"Have any browser shortcuts been modified to execute non-standard binaries?"
IOC Blocking Table:
46.30.188[.]13

Block the above at perimeter firewalls, proxies, and DNS. Hashes: 1774e15e8eb96eb89bc03cb4768fc0620e10c09c5f795297f36dcc2aa5d9dd94, ea0934472121848b80455581d289ce4480b1e5cc05678c1b90ecfc465b5ec350, 5e17360d32e9b272bb7e1b97c8e4dca34622ec9ce08fd240fe2758cc3f67dc4a, 378484112b4e837d3850b5b0802fc509202c232bb124d6944a59fe66525ba668. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.

Hunting Hypotheses:
HUNT 01 · T1078
FortiGate dormant account audit
Query FortiOS local and RADIUS-authenticated accounts for any that were inactive >90 days and have logged in within the past 2 weeks. Cross-reference with HR termination/transfer records.
HUNT 02 · T1078
Volt Typhoon living-off-the-land
Hunt for legitimate administrative tools (certutil, bitsadmin, ntdsutil, wmic) executed on perimeter devices or from VPN segments. Focus on GlobalProtect, FortiGate, and SonicWall management planes.
HUNT 03 · T1133
BAS network segmentation validation
Scan for BACnet (UDP 47808), Fox/Niagara (TCP 1911), and Modbus (TCP 502) traffic crossing from OT/facilities networks into enterprise or internet-facing segments.

Financial Services
State Treasury, Revenue, Pension Systems
Primary threat
Gunra's double extortion model specifically targets financial data. Ensure OneDrive/SharePoint DLP policies alert on bulk download of financial records from privileged accounts.
Actions
  • DCSync detection — any replication request from a non-DC host in financial system domains should trigger an immediate P1 alert
  • Segment pension and tax processing systems from the general state network — Gunra's RDP pivot technique exploits flat network architectures
Energy
State-Operated Utilities, Power Administration
Primary threat
MuddyWater's ICS campaign remains active against water/wastewater. Validate PLC firmware integrity and ensure SCADA systems are air-gapped or monitored at network boundaries.
Actions
  • BAS exposure audit — confirm no BACnet/Modbus controllers in state power facilities are internet-reachable. Reference FrostyGoop malware capabilities for threat briefing to OT staff.
  • Johnson Controls Airwall — if deployed for OT segmentation, the hardcoded key (CVE-2026-64887) means your segmentation boundary may be compromised. Patch to v4.1.0 immediately.
Healthcare
State Health Agencies, Medicaid Systems
Primary threat
Gunra ransomware has historically targeted healthcare for maximum extortion leverage. Ensure offline backups of Medicaid enrollment and claims databases are current and tested.
Actions
  • Validate that health information exchange (HIE) connections enforce mutual TLS and are not traversing compromised FortiGate appliances
  • Google Sheets/GitHub Gists C2 technique — healthcare environments often permit Google Workspace access. Monitor for API-level access to Google Sheets from non-browser processes on clinical or administrative workstations.
Government
State Agencies, Branch Offices
Primary threat
FortiOS/FortiProxy patching for CVE-2024-55591 and CVE-2025-24472 across all agency branch offices; audit VDI portal configurations for unauthorized MFA policy changes.
Actions
  • Patch Johnson Controls Metasys (v14.1.5 or v15.0.1) in all state-owned buildings. Restrict Metasys web UI to management VLAN with explicit access control lists.
  • Dormant account purge — disable all VPN/remote access accounts inactive >90 days. Require password reset + MFA re-enrollment before reactivation.
  • Evaluate California's AI Cyber Defense Fund model for applicability. Begin internal assessment of AI-augmented SOC capabilities given potential CISA funding reductions.
Aviation / Logistics
State DOT, Airport Authorities, Fleet Management
Primary threat
Johnson Controls Metasys is commonly deployed in airport terminal HVAC and state transportation management centers. Prioritize patching CVE-2026-34491 in these facilities.
Actions
  • Siemens Desigo (CVE-2026-59693, DoS) — if deployed in transportation facilities, ensure firmware is current and management interfaces are not exposed
  • Supply chain risk from Airwall — if used to segment traffic management or fleet GPS systems, validate patch status and rotate any credentials that may have been protected by the compromised hardcoded key
No sector cards match the selected filters.

Patch FortiOS/FortiProxy for CVE-2024-55591 and CVE-2025-24472 on all state devices. Audit for dormant VPN accounts reactivated without password change.
Incident Responder
Patch Johnson Controls Metasys to v15.0.1 or v14.1.5. Restrict web UI to the management VLAN.
ICS / OT
Upgrade Johnson Controls Airwall to v4.1.0. Rotate any secrets protected by Airwall encryption.
Incident Responder
Block the IOCs listed above (IP, domains, hashes) at perimeter firewalls and EDR — APT36/PATCHCORD infrastructure.
SOC Analyst
No immediate actions for the selected roles.
Confirm SecureBoot enforcement on all Windows 11 endpoints. Validate April 2026 cumulative updates are deployed.
Incident Responder
Build detection for Google Sheets API and GitHub Gist access from non-browser processes. Novel C2 channel (PATCHCORD) bypasses traditional proxy inspection.
SOC Analyst
Audit BACnet (47808), Fox/Niagara (1911), and Modbus (502) exposure across all state facilities. Confirm no internet reachability.
ICS / OT
Conduct a tabletop exercise: Gunra ransomware scenario using FortiOS initial access → MFA bypass → DCSync → double extortion.
Incident ResponderCISO / Exec
Review vendor risk posture for Johnson Controls given three CVEs across three product lines in two weeks.
CISO / Exec
No 7-day actions for the selected roles.
Conduct a proactive threat hunt for Volt Typhoon living-off-the-land activity on all perimeter devices (GlobalProtect, FortiGate, SonicWall). Focus on T1078 + T1072 patterns.
Threat Hunter
Brief the Governor's office / state legislature on the California AI Cyber Defense Fund model. Develop a proposal for a state-level AI cybersecurity program.
CISO / Exec
Formalize OT/BAS security governance: assign explicit responsibility for building automation security, establish patching SLAs, integrate facilities management into security incident response.
CISO / Exec
Evaluate zero-trust architecture acceleration for the state network perimeter. FortiOS remains the #1 exploited attack surface.
CISO / Exec
Assess state participation in MS-ISAC enhanced threat sharing given potential CISA capability reduction.
CISO / Exec
No 30-day actions for the selected roles.
The Bottom Line

The threat picture for state government is not theoretical — it is operational and immediate. Gunra ransomware operators have published a step-by-step playbook for compromising the exact FortiOS appliances that protect state agency networks. Chinese state-sponsored actors continue exploiting government VPN infrastructure for espionage. Iranian operators (MuddyWater/MOIS) are inside water treatment PLCs. And the federal safety net that states have relied on may be shrinking. The decisions made in the next 24-72 hours — patching FortiOS, securing building automation systems, auditing dormant accounts — will determine whether your state is the next headline or the one that got ahead of the threat.

1
Patch today.
2
Hunt tomorrow.
3
Plan for self-reliance this month.
No items found.