| Development | Why It Matters for State Government |
|---|---|
| FBI/EPA Joint Alert: PLC attacks across 7 states | Rockwell Allen-Bradley MicroLogix PLCs in water/wastewater systems are being remotely accessed, reprogrammed, and disrupted. Third-party integrators deploying identical configurations amplify the blast radius. |
| Russian actor TA488 deploys OWAReaper via CVE-2026-42897 | A JavaScript implant achieves persistent mailbox access that survives credential rotation and device reimaging — a paradigm shift in email compromise. Actively targeting U.S. government. |
| BANISHEDKITTEN APT: PAMBackdoor IOCs released | High-confidence indicators (confidence 90) for a backdoor that subverts Linux Pluggable Authentication Modules, enabling authentication bypass on Linux servers. |
| Schneider Electric IGSS SCADA advisory (ICSA-26-211-04) | New vulnerability in IGSS Definition module — deployed in state water treatment and building management environments. |
| Azure Cosmos DB "CosmosEscape" disclosed (patched) | Critical flaw could have granted cross-tenant access to any Cosmos DB database. Now fully patched. Awareness item for cloud teams. |
| Salt Typhoon (Chinese MSS) confirmed in U.S. state agencies | DHS confirmed July 25 that this actor maintains persistent access in multiple U.S. state agencies and National Guard units — assessed as active pre-positioning, not withdrawal. |
| CVE-2026-20316 (Cisco Secure Firewall) added to CISA KEV | Static credentials enable unauthenticated remote login to Cisco Secure Firewall Management Center. Any state agency using this product must patch immediately. |
| TeamPCP "Mini Shai-Hulud" supply chain worm open-sourced | Self-replicating npm/PyPI worm released on criminal forums with cryptocurrency bounty; 323+ packages compromised. Relevant to any state development team using public package repositories. |
| Date | Event | Severity |
|---|---|---|
| July 22, 2026 | TA488/Laundry Bear begins OWAReaper campaign exploiting CVE-2026-42897 | 🔴 Critical |
| July 25, 2026 | DHS confirms Salt Typhoon (Chinese MSS) maintains persistent access in multiple U.S. state agencies | 🔴 Critical |
| July 27, 2026 | PLC cyberattacks on water utilities begin across seven states | 🔴 Critical |
| July 29, 2026 | CVE-2026-20316 (Cisco Secure Firewall static credentials) added to CISA KEV | 🟡 High |
| July 30, 2026 | FBI/EPA joint Public Service Announcement on water utility PLC attacks | 🔴 Critical |
| July 30, 2026 | CISA publishes standalone PLC protection directive for water sector | 🔴 Critical |
| July 30, 2026 | Lazarus Group "Operation Double Barrel" disclosed — watering holes linked to ransomware infrastructure | 🟡 High |
| July 30, 2026 | TeamPCP open-sources "Mini Shai-Hulud" supply chain worm on criminal forums | 🟡 High |
| July 31, 2026 | BANISHEDKITTEN PAMBackdoor IOCs published (CrowdStrike, confidence 90) | 🟡 High |
| July 31, 2026 | Schneider Electric IGSS SCADA advisory ICSA-26-211-04 | 🟡 High |
| July 31, 2026 | Azure Cosmos DB "CosmosEscape" full disclosure (patched) | 🟢 Moderate |
The FBI and EPA have confirmed a "significant increase" in cyberattacks targeting internet-facing Rockwell Automation Allen-Bradley MicroLogix 1100 and 1400 series PLCs in the Water and Wastewater Systems (WWS) sector. Since July 27, attackers have gained remote access to PLCs, modified IP addresses and passwords (locking out legitimate operators), altered ladder logic controlling physical processes, and caused pressure loss and flooding — real-world physical consequences.
The force multiplier: third-party integrators deploying identical network configurations across multiple municipal clients mean a single compromised template propagates vulnerability to every customer. This is supply chain risk applied to operational technology.
State government exposure: any state-managed or state-funded water/wastewater system using MicroLogix 1100/1400 PLCs — particularly those managed by third-party integrators — is in the direct blast radius. These PLCs are end-of-life and no longer receive security updates.
Russian threat actor Laundry Bear (also tracked as TA488, CL-STA-1114, UNK_PitStop, Void Blizzard) is exploiting CVE-2026-42897 — a cross-site scripting vulnerability in Microsoft Outlook Web Access — to deploy OWAReaper, a browser-based JavaScript implant.
Unlike traditional email compromise, OWAReaper persists through credential rotation and full device reimaging, uses a "half-click" trigger (opening the email compromises the session), and exfiltrates via AES-CTR encrypted HTTPS with DNS tunneling fallback. It achieves persistence through three mechanisms simultaneously: modifying Exchange folder permissions server-side, rewriting browser localStorage/IndexedDB client-side, and stealing OAuth tokens to bypass authentication entirely.
The critical implication for state government: your current incident response playbook for email compromise — "reset password, reimage device, monitor for re-compromise" — is explicitly defeated by this implant. If TA488 targets your OWA environment, standard response will fail to evict them.
CrowdStrike published high-confidence (90/100) indicators for PAMBackdoor, deployed by the IRGC-affiliated APT group tracked as BANISHEDKITTEN (also known as Cotton Sandstorm). This backdoor targets Linux Pluggable Authentication Modules (PAM) — the core authentication framework on Linux systems — enabling the attacker to authenticate as any user without valid credentials.
State government exposure: any Linux server handling authentication — web application backends, database servers, SCADA HMIs, jump boxes — is a potential target. PAM backdoors are notoriously difficult to detect because they operate at the OS authentication layer, below most EDR visibility.
| Threat | Status |
|---|---|
| Salt Typhoon (Chinese MSS) | DHS confirmed Jul 25 persistent access in multiple U.S. state agencies and National Guard units — assessed as pre-positioning, not withdrawal |
| CVE-2026-20316 (Cisco Secure Firewall) | Added to CISA KEV Jul 29 — static credentials enable unauthenticated remote login to Secure Firewall Management Center |
| TeamPCP "Mini Shai-Hulud" | Self-replicating npm/PyPI supply chain worm open-sourced with cryptocurrency bounty; 323+ packages compromised |
| Prediction | Probability | Basis |
|---|---|---|
| CISA adds CVE-2026-42897 (OWA XSS) to KEV within 48 hours | >75% | Active exploitation against U.S. government confirmed; meets all KEV criteria |
| Additional states report PLC compromises as FBI investigation expands | 50-60% | Seven states already confirmed; third-party integrator pattern suggests broader exposure |
| TA488/Laundry Bear expands OWAReaper targeting to state government OWA instances | 30-40% | Currently focused on federal/European targets; state gov is logical expansion |
| INC Ransomware group pivots to state/local government targeting | 25-35% | $22K bounty announcement signals operational expansion; healthcare/education targeting is adjacent |
| Salt Typhoon pre-positioned access is leveraged for disruptive action during geopolitical escalation | 20-30% | Access confirmed but no disruptive intent demonstrated yet; contingency capability |
| What to Monitor | ATT&CK ID | Detection Logic |
|---|---|---|
| Exchange folder permission changes | T1556 | Alert on Set-MailboxFolderPermission granting Owner/Editor to "Default" or "Anonymous" on any folder |
Unusual Add-MailboxPermission grants | T1556 | Any permission grant to non-standard delegates, especially bulk grants |
| OWA localStorage anomalies | T1059.007 | Browser forensics: Base64 blobs >10KB in localStorage for OWA sessions |
| GitHub API C2 traffic | T1102.001 | Outbound HTTPS to api.github.com/search/commits from Exchange/OWA servers |
| DNS tunneling exfiltration | T1071.004 | Anomalous DNS query volume or unusually long DNS labels from Exchange infrastructure |
Hunting Hypothesis: "If TA488 has compromised our OWA environment, we will observe Exchange audit logs showing Default user permission escalation on mailbox folders, combined with outbound GitHub API queries from Exchange servers."
| What to Monitor | ATT&CK ID | Detection Logic |
|---|---|---|
| Internet-facing PLC connections | T0883 | Network scan for any MicroLogix 1100/1400 with public IP or NAT exposure |
| PLC configuration changes | T0836 | Compare current PLC IP addresses, passwords, and ladder logic against known-good baselines |
| Unauthorized PLC commands | T0855 | Monitor for EtherNet/IP CIP commands from non-authorized source IPs |
Hunting Hypothesis: "If our water/wastewater PLCs have been compromised, we will observe ladder logic modifications, IP address changes, or password lockouts on MicroLogix devices — particularly those managed by third-party integrators."
| What to Monitor | ATT&CK ID | Detection Logic |
|---|---|---|
| PAM module file modifications | T1556.003 | File integrity monitoring on /lib/security/.so and /etc/pam.d/ — compare against package manager checksums (rpm -V or dpkg --verify) |
| Unexpected authentication successes | T1078 | Alert on successful SSH/sudo authentication for accounts with no corresponding password entry or key-based auth configured |
| PAMBackdoor hashes | T1556.003 | EDR/SIEM hash match against known indicators (see IOC table below) |
Hunting Hypothesis: "If BANISHEDKITTEN has deployed PAMBackdoor on our Linux infrastructure, we will observe modified .so files in /lib/security/ that do not match vendor package checksums, potentially accompanied by authentication successes for dormant or service accounts."
All domains above (except publicnode[.]com, which is a blockchain RPC endpoint tied to the ClearFake/EtherHiding campaign and should be monitored/investigated rather than blocked outright) are confirmed APT C2 infrastructure — block + alert. PAMBackdoor hashes (BANISHEDKITTEN): MD5 c10ccf8fd0c116ebb771ea312540fd5a, MD5 05076c9c2e82a93d79e7fd534de7523b, SHA-1 7d16338cb66fee6be14f3051d811182fa874782e, SHA-1 2486b9d55992d94a1bcc9c9337644579df408892 — block + alert. Additional IOCs available via Anomali ThreatStream Next-Gen and partner feeds.
- Audit all Exchange/OWA mailbox permissions for treasury and revenue staff
- Implement conditional access policies restricting OWA to managed devices only
- Enable enhanced audit logging for mailbox delegation changes
- Conduct immediate internet-exposure audit of ALL OT devices
- Verify network segmentation between IT and OT
- Confirm hardware key switches are in RUN mode on all critical PLCs
- Establish manual operation capability for essential processes
- Verify offline backup integrity for Medicaid enrollment, claims processing, and EHR systems
- Conduct tabletop exercise for ransomware scenario affecting benefits processing
- Monitor for INC Ransom TTPs (ADFind, NetScan reconnaissance tools)
- Conduct enterprise-wide hunt for Salt Typhoon indicators (ORB network patterns)
- Prioritize CVE-2026-42897 patching for all government OWA instances
- Audit PAM configurations on Linux servers hosting government applications
- Pin all GitHub Actions to commit SHAs
- Audit npm/PyPI dependencies in transportation and logistics applications
- Implement package integrity verification in CI/CD pipelines
Set-MailboxFolderPermission changes granting Owner to Default/Anonymous (OWAReaper persistence).The threat landscape facing state government this week is defined by two uncomfortable realities: physical infrastructure is being actively disrupted across multiple states, and a sophisticated nation-state actor has developed an email implant that defeats our standard incident response procedures. The common thread across all three threats is that default assumptions are failing — default PLC configurations are being exploited, default incident response ("reset and reimage") is being defeated, and default trust in third-party integrators is being weaponized. The adversaries are not waiting. Neither should we.