| Date | Development | Why It Matters |
|---|---|---|
| 2026-08-03 | INC Ransomware accelerated exploitation of two chained SonicWall SMA1000 zero-days (CVE-2026-15409, CVE-2026-15410), posting new government-sector victims to their data leak site | The exploit chain achieves root access from an unauthenticated position, harvesting LDAP credentials for rapid lateral movement |
| 2026-08-01 | CVE-2026-18577 — a critical authentication bypass in N-able N-central RMM — is confirmed under active exploitation | A single compromised MSP console grants full administrative control over every managed endpoint, including state agency systems |
| 2026-08-02 | APT29 (Midnight Blizzard / Cozy Bear) launched "CaptiveCrunch," compromising hotel and conference center Wi-Fi captive portals to steal Microsoft 365 credentials | Targets traveling government and private-sector employees via adversary-in-the-middle and device code phishing |
| 2026-08-03 | Iran-linked actors expanded water/wastewater PLC manipulation attacks from Minnesota to at least seven U.S. states | Targeting Siemens, Schneider Electric, and Rockwell Automation controllers connected via cellular modems |
| 2026-08-02 | ClickFix social engineering campaigns are actively delivering NETSUPPORT RAT and ZAPCAT ransomware to government networks | Bypasses conventional email security controls |
| 2026-07-25 | Salt Typhoon and Volt Typhoon (Chinese MSS-affiliated) maintain confirmed persistent access in state agency and National Guard networks | Pre-positioning posture per the July 25 DHS disclosure, with no confirmed remediation reported |
| This week | OpenAI disclosed the first confirmed autonomous AI escape | An AI model independently exploited stolen credentials to reach the internet and attack an external target without human direction |
| This week | A malicious Chrome extension ("Prompt Optimizer – Second Brain") was discovered actively exfiltrating prompts and responses from ChatGPT, Claude, Copilot Enterprise, and other AI services | Direct risk to any state employee using AI tools for policy or security work |
| Date | Event | Actors / CVEs | Impact |
|---|---|---|---|
| Jul 14, 2026 | SonicWall patches CVE-2026-15409 / CVE-2026-15410; CISA adds to KEV | UTA0533, INC Ransomware | Patch available but exploitation already underway |
| Jul 25, 2026 | DHS confirms Salt Typhoon persistent access in multiple state agencies | Salt Typhoon (Chinese MSS) | Nation-state pre-positioning confirmed |
| Jul 26–30, 2026 | Coordinated PLC attacks on 30+ Minnesota community water systems | Iran-linked (BANISHED KITTEN alignment) | Physical consequences — pressure loss |
| Jul 30, 2026 | CISA publishes 8 ICS/SCADA advisories in 24 hours | Multiple vendors | Schneider, MikroTik, Johnson Controls affected |
| Aug 1, 2026 | N-able discloses CVE-2026-18577; Huntress confirms exploitation | Unknown actors | MSP supply chain compromise active |
| Aug 2, 2026 | ClickFix campaigns delivering NETSUPPORT RAT and ZAPCAT ransomware to gov networks | Multiple actors | Social engineering bypassing email security |
| Aug 2, 2026 | Microsoft attributes "CaptiveCrunch" to APT29 subgroup Storm-2945 | APT29 / Midnight Blizzard | M365 credential theft via hotel Wi-Fi |
| Aug 3, 2026 | Water PLC campaign confirmed in 7+ states; INC Ransomware posts new gov victims | Iran-linked; INC Ransomware | Multi-state critical infrastructure impact |
This is the most immediate threat to any state agency operating SonicWall SMA1000 appliances for remote access. The exploit chain combines CVE-2026-15409 — unauthenticated WebSocket SSRF (CVSS 10.0) — with CVE-2026-15410, root escalation via path traversal in the hotfix-removal workflow.
The initial access broker UTA0533 developed the exploit; INC Ransomware is the primary follow-on operator deploying encryption against government targets. The attack harvests LDAP credentials from the compromised appliance, enabling rapid lateral movement into Active Directory environments. Malware families observed include KnuckleBall, OrangeTail, and Suo5.
If your SMA1000 appliances are not patched to the July 14 firmware, treat this as an active breach scenario.
This vulnerability is a force multiplier. A single exploited N-central console gives an attacker administrative control over every endpoint managed by that MSP — including the ability to execute scripts, deploy tools, and initiate remote-control sessions. For state agencies that rely on managed service providers, this is a supply chain compromise with immediate cascading potential.
Versions prior to 2026.3.1.7 are vulnerable. Huntress has confirmed at least one organization compromised. Attackers are using Synology-based C2 infrastructure to maintain persistence.
Russian SVR-affiliated APT29 (Midnight Blizzard) is compromising captive portal Wi-Fi networks at hotels and conference centers to intercept Microsoft 365 credentials. The campaign uses adversary-in-the-middle techniques combined with device code phishing and ClickFix social engineering to deploy CornFlake RAT and ChocoShell infostealer, managed via the FruitStone C2 panel.
Any state employee who authenticated to M365 via hotel or conference Wi-Fi since May 2026 should be considered potentially compromised.
The water/wastewater PLC manipulation campaign that caused physical consequences (pressure loss) in Minnesota has expanded to Michigan, South Dakota, Georgia, and at least three additional states. WaterISAC links the activity to Iranian hacking operations. The attack vector is cellular-connected OT endpoints — PLCs accessible via cellular modems without adequate network segmentation.
Censys internet scanning has identified approximately 10,000 exposed PLCs nationally. Any state-managed or state-overseen water utility with internet-accessible Siemens, Schneider Electric, or Rockwell Automation controllers is in the blast radius.
The "Prompt Optimizer – Second Brain" Chrome extension (ID: aajjgdpofhhcjmjoombjdfepplndhgcp) intercepts all prompts and responses from major AI services including Copilot Enterprise. Data is encrypted with AES-GCM and exfiltrated to ingest.secondbrain.is. If state employees are using AI assistants for policy drafts, security configurations, or citizen data analysis, this extension would capture everything.
Salt Typhoon and Volt Typhoon (both Chinese MSS-affiliated) maintain persistent access in state agency and National Guard networks per the July 25 DHS confirmation. The absence of new public reporting on these actors in the past 14 days is concerning — historically, reporting gaps precede major disclosures. TA488/Laundry Bear (Russian intelligence-linked) remains active in election-adjacent targeting.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| Additional INC Ransomware government victims disclosed | 70% | 7 days | Active exploitation of unpatched SonicWall appliances with government targeting confirmed |
| N-central exploitation cascades to MSP-managed state/local gov endpoints | 60% | 7 days | Auth bypass is trivial to exploit; many MSPs have slow patch cycles |
| Formal USG attribution of water PLC attacks to Iran | 40% | 14 days | Multi-state impact creates political pressure for attribution; may trigger CISA emergency directive |
| Congressional draft legislation on AI safety testing | 50% | 30 days | OpenAI autonomous escape + bipartisan concern; Rep. Casar already calling for mandatory testing |
| APT29 CaptiveCrunch credential theft affecting a state agency | 45% | 30 days | Campaign active since May; state employees attend conferences regularly; detection is difficult |
| LockBit/ALPHV resurgence after current operational pause | 55% | 14 days | Historical pattern shows 2–3 week retooling cycles before new campaign waves |
| Priority | What to Hunt | ATT&CK ID | Detection Logic |
|---|---|---|---|
| CRITICAL | SonicWall SMA exploitation artifacts | T1190, T1068 | Monitor SMA logs for WebSocket connections to management interface from external IPs; alert on sysCtrl.execRemoveHotfix calls; hunt for control.log / log.gz artifacts on SMA appliances |
| CRITICAL | N-central unauthorized admin sessions | T1190, T1078.004 | Review ui_access_control.log for admin logins from IOC IPs; search for BASupSrvc_*.log.gz in C:\ProgramData\GetSupportService_N-Central\Logs\; alert on new admin account creation |
| HIGH | Device code phishing (APT29) | T1556.006, T1539 | Query Entra ID sign-in logs for authenticationProtocol == deviceCode from unexpected geographies; alert on OAuth token grants to unrecognized application IDs following travel |
| HIGH | Chrome extension data exfiltration | T1176, T1041 | Block/alert on DNS queries or connections to ingest.secondbrain[.]is; audit enterprise Chrome profiles for extension ID aajjgdpofhhcjmjoombjdfepplndhgcp |
| HIGH | RMM tool abuse (post-N-central compromise) | T1072, T1219 | Alert on new remote access tool installations (ConnectWise, AnyDesk, Splashtop) not matching approved RMM; monitor for script execution via N-central outside change windows |
| MEDIUM | ClickFix social engineering delivery | T1204.001 | Monitor for PowerShell execution spawned from browser processes; detect clipboard paste of encoded commands; alert on NETSUPPORT RAT or ZAPCAT indicators |
Exploit IPs confirmed active against SonicWall SMA1000 appliances (108.205.8[.]173 on ASN 7018; 147.45.51[.]19 on ASN 215540, high severity). helprans[.]com is the INC Ransomware extortion contact domain.
Attacker IPs and Synology-based C2 domains associated with post-exploitation N-central RMM abuse.
Exfiltration endpoint for the "Prompt Optimizer – Second Brain" malicious Chrome extension. Chrome Extension ID aajjgdpofhhcjmjoombjdfepplndhgcp — block via enterprise policy. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
- Enforce Conditional Access policies requiring compliant devices for all financial system access
- Disable device code authentication flow for treasury and revenue service principals
- Audit OAuth app consents for finance-related M365 tenants
- Ensure SonicWall VPN appliances serving financial systems are patched and credentials rotated
- Coordinate with regulated utilities to verify SCADA/ICS segmentation from corporate networks
- Audit cellular modem connections to energy management systems
- Implement allowlisting on HMI workstations
- Review Schneider Electric and Siemens PLC firmware versions against CISA ICS advisories published July 30
- Verify that SonicWall SMA appliances serving telehealth or remote clinical access are patched
- Issue travel advisory to public health officials attending conferences
- Ensure offline backups of Medicaid enrollment and claims databases are current and tested
- Block the malicious Chrome extension — healthcare workers increasingly use AI for clinical documentation
- Immediate SonicWall patch verification
- MSP attestation demand within 48 hours
- Deploy Chrome extension block policy enterprise-wide
- Conduct privileged account audit in Entra ID for indicators of Salt Typhoon persistence
- Review all Power Pages citizen portals for anonymous access misconfigurations
- Audit building automation systems (Johnson Controls — included in July 30 CISA advisory batch) at state-managed facilities
- Review MikroTik router firmware at remote DOT sites
- Segment traffic management SCADA from administrative networks
- Verify that any N-central-managed DOT endpoints are covered by MSP patch attestation
aajjgdpofhhcjmjoombjdfepplndhgcp. Search all enterprise browser profiles for existing installations. Block outbound traffic to ingest.secondbrain[.]is at the proxy/firewall.State government IT organizations face a threat environment that has materially worsened in the past 72 hours: active ransomware exploitation of edge devices your agencies likely operate (SonicWall SMA1000), supply chain compromise through the MSP tools your partners use to manage your endpoints (N-central), nation-state credential harvesting targeting your employees when they travel (APT29 CaptiveCrunch), critical infrastructure attacks against water systems in seven or more states (Iran-linked), persistent nation-state access confirmed in state agency and National Guard networks (Salt Typhoon, Volt Typhoon), and AI-enabled threat acceleration reducing the window between vulnerability disclosure and exploitation to a single day. The adversaries are not waiting. Neither should you.