TLP:GREEN  ·  States / Public Sector
The Vulnerability Surge Is Real:

What State CISOs Must Do This Week

ELEVATED. Unchanged from the prior cycle. The convergence of seven CISA KEV additions in four days, a novel AI-developed Chinese-nexus implant targeting government servers, and active social engineering campaigns against enterprise identity platforms sustains ELEVATED posture. Escalation to HIGH is possible within 7 days if ransomware operators weaponize the current KEV surge. A Chinese-speaking threat actor (UAT-10147) has deployed a first-of-its-kind AI-developed cross-platform implant specifically targeting government IIS and Linux servers, while UNC6040 is stealing Microsoft 365 and Okta credentials through phone-based social engineering that bypasses every email security control you own.

I am a
My sector

DateDevelopmentWhy It Matters for State Government
Aug 20CISA adds CVE-2026-72529 (TrueConf Server RCE, CVSS 9.8) to KEVUnauthenticated RCE in on-premises video conferencing — exploited by Head Mare hacktivist/espionage group
Aug 20CISA ICS Advisory ICSA-26-232-01: Johnson Controls Simplex credential extractionFire alarm and life safety systems in state buildings allow local attackers to extract user passwords
Aug 20Cisco Talos publishes UAT-10147/SPECTRE analysisChinese-speaking actor deploys AI-developed implant with BYOVD EDR-killing and Linux rootkit against government IIS servers
Aug 20Google Threat Intelligence reports UNC6040 vishing campaignAttackers impersonate IT support via phone, steal M365/Okta/Salesforce credentials, persist for months before extortion
Aug 21Salt Typhoon/Earth Estries IOC refresh (SNAPPYBEE loader)Updated indicators for active telecom/government espionage campaign; see ThreatStream for current indicator set
Aug 19CISA adds CVE-2026-64849 (MLflow SSRF, CVSS 9.3) to KEVAI/ML platform vulnerability enables access to cloud metadata and internal services — no authentication required
Aug 18CISA adds CVE-2026-33824 (Windows IKE RCE, CVSS 9.8) and CVE-2026-55040 (SharePoint auth bypass, CVSS 9.1) to KEVNetwork-accessible RCE and confirmed ransomware delivery via SharePoint
Aug 18ErrTraffic MaaS platform offering Cruciferra EDR-killer via BYOVD for $380/monthCommoditized nation-state-grade EDR neutralization now available to low-tier ransomware operators
Aug 19CISA Advisory AA26-231A: MuddyWater targeting Siemens PLCsIran/MOIS campaign against water/wastewater systems confirmed in 7+ U.S. states
OngoingClickFix social engineering (92 active variants) targeting enterprise usersFake Cloudflare verification pages hijack clipboard to execute PowerShell via Win+R — bypasses standard phishing training

TimeframeEventActor/SourceImpact
Aug 1–12MuddyWater ICS intrusions against water/wastewater in 7+ statesMuddyWater (Iran/MOIS)Critical infrastructure — OT/SCADA
Aug 18CVE-2026-33824 (Windows IKE RCE) and CVE-2026-55040 (SharePoint) added to KEVCISANetwork-perimeter and collaboration platform risk
Aug 18ErrTraffic MaaS platform offering Cruciferra EDR-killer via BYOVD for $380/montheSentireCommoditized nation-state-grade evasion
Aug 19CVE-2026-64849 (MLflow SSRF) added to KEVCISAAI/ML platform exploitation
Aug 19CISA Advisory AA26-231A — Siemens S7 PLC targeting confirmedCISA/MuddyWaterWater/wastewater SCADA
Aug 20CVE-2026-72529 (TrueConf RCE) added to KEV; Head Mare exploitation confirmedCISA/KasperskyVideo conferencing infrastructure
Aug 20Johnson Controls Simplex credential extraction advisoryCISA ICS-CERTPhysical security/life safety systems
Aug 20UAT-10147 SPECTRE implant analysis publishedCisco TalosGovernment IIS/Linux servers
Aug 20UNC6040 vishing → M365/Okta credential theftGoogle TIGIdentity and SaaS platforms
Aug 21Salt Typhoon/Earth Estries IOC refresh (SNAPPYBEE loader)ThreatStreamTelecom/government espionage

A Chinese-speaking intrusion actor designated UAT-10147 has deployed SPECTRE — a cross-platform implant targeting both Windows IIS servers and Linux systems. What makes this significant: AI-assisted development (Cisco Talos confirms the implant's code was generated using AI workflows — a first for a commodity-tier actor operating at production scale); BYOVD EDR neutralization (exploits CVE-2019-16098 and CVE-2021-21551 to load vulnerable drivers and kill endpoint detection); full Linux kernel rootkit capability; and NTFS Alternate Data Stream persistence, storing C2 configuration in C:\Windows\System32\drivers\etc\hosts:cache — invisible to standard file system browsing. C2 pattern: HTTP POST to /api/v1/register and /api/v1/output on compromised IIS servers.

Why this matters for state government: state agencies host hundreds of IIS-based .gov web applications. UAT-10147 joins VAULT PANDA/UNC6588 (reported last cycle) as the second Chinese-nexus actor actively deploying web shells against government IIS infrastructure. The AI-assisted development angle means these actors can iterate faster than your patching cycle.

Associated malware families: SPECTRE, BADIIS, Gh0stCringe, Havoc, Meterpreter, Quasar RAT.

T1564.004T1071.001T1562.001

UNC6040 is a financially motivated group conducting vishing (voice phishing) campaigns. The kill chain: attacker calls an employee, impersonates IT support; instructs the employee to install a trojanized Salesforce Data Loader; harvests credentials for Okta, Microsoft 365, and Salesforce; and persists in the environment for months before extortion.

This bypasses email security gateways, anti-phishing tools, and URL filtering entirely. The attack vector is a phone call. State employees — particularly those in agencies using Salesforce for constituent services — are directly in the crosshairs.

T1204.002T1078

CISA has now issued advisories for four distinct Johnson Controls products relevant to state government: Simplex Incident Manager (credential extraction, ICSA-26-232-01, Aug 20); Metasys (cross-site scripting in building automation); C-CURE 9000 (remote code execution in physical access control); and Airwall (network segmentation bypass).

These systems control fire alarms, HVAC, physical access, and network segmentation in state office buildings, courthouses, and data centers. This is no longer a per-product patching problem — it's a vendor-level risk requiring consolidated assessment.

Seven KEV additions in four days is abnormal — the typical cadence is 2–3 per week:

CVEProductCVSSExploitation Status
CVE-2026-72529TrueConf Server9.8Active — Head Mare
CVE-2026-64849MLflow9.3Active — KEV confirmed
CVE-2026-33824Windows IKE9.8Active — KEV confirmed
CVE-2026-55040SharePoint9.1Active — ransomware delivery confirmed
CVE-2025-62593(Enriched this cycle)CriticalActive

The Windows IKE vulnerability (CVE-2026-33824) is particularly dangerous for state networks: it's network-accessible, requires no authentication, and affects a protocol running on every Windows server with VPN or IPsec configured.

Iran's MOIS-affiliated MuddyWater group has conducted confirmed intrusions against water and wastewater systems in seven or more U.S. states (August 1–12). CISA Advisory AA26-231A specifically calls out Siemens S7 Series PLCs. State agencies operating water treatment facilities with Siemens controllers must treat this as an active, ongoing campaign — not a historical advisory.

ScenarioProbabilityTimeframeBasis
Ransomware operators weaponize one or more of the 7 recent KEV additions (CVE-2026-33824 highest risk)70%7–14 daysHistorical KEV-to-ransomware adoption timelines; SharePoint already confirmed in ransomware delivery
ClickFix social engineering campaigns (92 active variants) target state government employees specifically60%7 daysGovernment sector already in targeting scope; 92 campaigns indicate MaaS-scale distribution
Volt Typhoon silence breaks with new advisory or incident disclosure40%14 daysExtended quiet periods historically precede capability demonstrations; last update May 2026
UAT-10147 or VAULT PANDA web shell discovered on a U.S. state .gov IIS server35%30 daysTwo distinct Chinese-nexus actors confirmed targeting government IIS; state agencies have large IIS footprints
Ransomware group exploits Johnson Controls vulnerability for initial access to state facility network25%30 daysOT/IT convergence in building systems creates lateral movement path; credential extraction enables pivot

PriorityWhat to HuntATT&CK TechniqueDetection Method
CRITICALNTFS Alternate Data Stream creation on system filesT1564.004 (Hide Artifacts: NTFS File Attributes)Sysmon Event ID 15 (FileCreateStreamHash) — alert on ADS creation at C:\Windows\System32\drivers\etc\hosts
CRITICALHTTP POST to /api/v1/register or /api/v1/output on IIS serversT1071.001 (Application Layer Protocol: Web)IIS logs + WAF rules; these are SPECTRE C2 beacon endpoints
HIGHBYOVD driver loading (CVE-2019-16098, CVE-2021-21551)T1562.001 (Impair Defenses: Disable/Modify Tools)Monitor for known vulnerable driver hashes; Windows Defender Vulnerable Driver Blocklist alerts
HIGHInbound connections to port 4307/TCPT1190 (Exploit Public-Facing Application)Firewall logs — TrueConf Server attack vector
HIGHSalesforce Data Loader installations on non-admin workstationsT1204.002 (User Execution: Malicious File)Application allowlisting alerts; EDR new-process monitoring
MEDIUMOkta/M365 authentication from new devices following phone calls to helpdeskT1078 (Valid Accounts)Correlate helpdesk ticket timestamps with Okta/Azure AD sign-in anomalies
MEDIUMIIS web shell indicators (new .aspx files in web roots, unusual w3wp.exe child processes)T1505.003 (Server Software Component: Web Shell)File integrity monitoring on IIS content directories; process tree analysis
Hunting Hypotheses:
HUNT 01
UAT-10147 has already deployed web shells on state .gov IIS servers that have not been ...
UAT-10147 has already deployed web shells on state .gov IIS servers that have not been detected. - Hunt: Audit all .aspx/.asp files modified in the last 90 days across state IIS servers. Look for files with obfuscated content, base64-encoded payloads, or files created by the IIS worker process (w3wp.exe).
HUNT 02
SPECTRE C2 persistence exists via NTFS ADS on state endpoints.
SPECTRE C2 persistence exists via NTFS ADS on state endpoints. - Hunt: Run dir /r C:\Windows\System32\drivers\etc\ across all Windows servers. Any file showing alternate data streams (:cache, :config, or similar) warrants immediate investigation.
HUNT 03
UNC6040 has already compromised state employee M365 accounts via prior vishing.
UNC6040 has already compromised state employee M365 accounts via prior vishing. - Hunt: Review Okta/Azure AD sign-in logs for accounts that registered new MFA devices or authenticated from new locations in the past 60 days. Cross-reference with helpdesk tickets mentioning "IT support called me."
HUNT 04
Johnson Controls Simplex credentials have been extracted and are being used for lateral...
Johnson Controls Simplex credentials have been extracted and are being used for lateral movement. - Hunt: Audit Simplex admin account usage logs. Look for logins from non-standard workstations or outside maintenance windows.

Financial Services
State Treasury, Revenue, Benefits Systems
Primary threat
UNC6040 vishing targeting Salesforce/M365 credentials. State revenue and benefits agencies using Salesforce for constituent management are direct targets.
Secondary threat
CVE-2026-55040 (SharePoint auth bypass) confirmed in ransomware delivery. State financial systems often integrate with SharePoint for document workflows.
Actions
  • Restrict Salesforce Data Loader installation to named admin workstations via application control
  • Audit all Salesforce Connected Apps and OAuth tokens weekly
  • Implement conditional access policies requiring compliant devices for M365 access
Energy
State-Operated Utilities, Grid Coordination
Primary threat
MuddyWater (Iran/MOIS) active campaign against water/wastewater Siemens S7 PLCs (CISA AA26-231A). Any state-operated utility with Siemens controllers is in the confirmed target set.
Secondary threat
Volt Typhoon pre-positioning doctrine targets energy infrastructure for disruption during geopolitical crisis. The current 14-day silence is not reassurance.
Actions
  • Implement network segmentation between IT and OT per CISA recommendations
  • Verify Siemens PLC firmware versions against the advisory
  • Deploy passive OT network monitoring if not already in place
  • Restrict engineering workstation internet access
Healthcare
State Health Agencies, Medicaid Systems, Public Hospitals
Primary threats
CVE-2026-64849 (MLflow SSRF) — state health agencies increasingly use ML/AI for fraud detection and population health analytics. If MLflow is deployed, it's exploitable without authentication.
Secondary threat
VAULT PANDA/UNC6588 (China/MSS) confirmed targeting U.S. healthcare with AI-assisted web shells. Health data is a high-value espionage target.
Actions
  • Inventory all AI/ML platforms across health IT
  • Upgrade MLflow to v3.15.0+ immediately
  • Restrict ML platform network access to internal-only with no public-facing endpoints
Government
All State Agencies, .gov Web Applications
Primary threat
UAT-10147 SPECTRE implant targeting government IIS servers with BYOVD + rootkit. State .gov web applications are the attack surface.
Secondary threat
ClickFix social engineering (92 active campaigns) — fake Cloudflare verification pages trick users into executing clipboard-hijacked PowerShell via Win+R. Current phishing training likely does not cover this kill chain.
Actions
  • Commission an IIS web shell assessment across all state-hosted web applications
  • Enable the WDAC vulnerable driver blocklist
  • Deploy NTFS ADS monitoring via Sysmon
  • Audit IIS content directories for unauthorized files
Aviation / Logistics
State DOT, Airport Authorities, Port Systems
Primary threats
CVE-2026-33824 (Windows IKE RCE, CVSS 9.8) — transportation systems relying on IPsec VPN tunnels between facilities are exposed to this network-accessible, unauthenticated RCE.
Secondary threat
Johnson Controls building automation vulnerabilities affect airport terminals, transit facilities, and DOT buildings.
Actions
  • Identify all Windows systems with IKE/IPsec services enabled
  • Prioritize patching on internet-facing VPN concentrators and site-to-site tunnel endpoints
  • Consider temporary mitigation by restricting IKE (UDP 500/4500) to known peer IPs only
No sector cards match the selected filters.

Block inbound port 4307/TCP at all perimeter firewalls. Confirm no TrueConf Server instances exist in state infrastructure inventory. (CVE-2026-72529)
SOC Analyst
Deploy detection for NTFS ADS creation on C:\Windows\System32\drivers\etc\hosts — Sysmon Event ID 15. Alert on any :cache stream. (UAT-10147/SPECTRE)
SOC Analyst
Audit Johnson Controls Simplex Incident Manager deployments across all state facilities. Restrict local management interface access to named admin accounts pending vendor patch. (ICSA-26-232-01)
ICS / OT
Add WAF deny rules for HTTP POST to /api/v1/register and /api/v1/output on all state IIS applications. (SPECTRE C2)
SOC Analyst
Verify Windows IKE patch status (CVE-2026-33824) on all internet-facing systems. Emergency patch or restrict UDP 500/4500 to known peers.
Incident Responder
No immediate actions for the selected roles.
Issue a vishing awareness bulletin to all state employees: "IT support will NEVER request software installation via phone call." Include the UNC6040 scenario.
CISO / Exec
Inventory and upgrade MLflow deployments to v3.15.0+ across all state agencies. If no MLflow exists, document confirmation. (CVE-2026-64849)
Incident Responder
Audit all Salesforce Connected Apps and OAuth tokens. Revoke unrecognized Data Loader connections. Restrict Data Loader to approved admin workstations. (UNC6040)
SOC Analyst
Create an IIS web shell detection rule: alert on new .aspx file creation in web content directories or unusual w3wp.exe child processes (cmd.exe, powershell.exe).
SOC Analyst
Update phishing awareness training to include the ClickFix kill chain (fake Cloudflare page → clipboard hijack → Win+R → PowerShell execution).
CISO / Exec
No 7-day actions for the selected roles.
Commission a comprehensive IIS web shell assessment across all state-hosted .gov web applications. Two distinct Chinese-nexus actors (UAT-10147, VAULT PANDA) confirmed targeting this surface.
CISO / Exec
Implement Windows Defender Application Control (WDAC) vulnerable driver blocklist on all state endpoints to prevent BYOVD attacks. (CVE-2019-16098, CVE-2021-21551)
Incident Responder
Conduct a consolidated Johnson Controls vendor risk assessment covering Metasys, Simplex, C-CURE, and Airwall deployments. Four distinct product vulnerabilities warrant vendor-level engagement.
CISO / Exec
Tabletop exercise: ransomware scenario exploiting CVE-2026-33824 (Windows IKE) for initial access with BYOVD-based EDR neutralization. Test the IR playbook against commodity actors with APT-grade tooling.
CISO / ExecIncident Responder
Deploy passive OT network monitoring for all state-operated water/wastewater facilities with Siemens PLCs. Validate segmentation between IT and OT networks.
ICS / OT
No 30-day actions for the selected roles.
The Bottom Line

The threat landscape facing state government this week is defined by speed and convergence. Seven KEV additions in four days means adversaries are finding and exploiting critical vulnerabilities faster than most organizations can patch. The emergence of AI-assisted malware development (UAT-10147/SPECTRE) means the gap between "commodity" and "nation-state" capability is collapsing — budget-constrained state agencies can no longer assume that sophisticated implants are reserved for high-value private sector targets. The window between vulnerability disclosure and exploitation is shrinking. The window between exploitation and ransomware deployment is shrinking. Act accordingly.

1
Patch or mitigate CVE-2026-33824 (Windows IKE) today. It's network-accessible, unauthenticated, CVSS 9.8, and on KEV. Ransomware weaponization is a matter of days, not weeks.
2
Hunt for IIS web shells now. Two distinct Chinese-nexus actors are confirmed targeting government IIS. If you haven't looked, you don't know you're clean.
3
Issue the vishing bulletin. UNC6040's phone-based attack bypasses every technical email security control. Your people are the detection layer for this threat, and they need to know it exists.
No items found.