| Date | Event | Impact to State Government |
|---|---|---|
| Sep 4, 2026 | Chinese-speaking operators deploy SecFlow AI-agent framework (Claude, Qwen, DeepSeek) to breach government office automation systems | Demonstrates AI-accelerated full-lifecycle intrusions against government targets — credential theft, data exfiltration of 822 accounts and 1.28 GB of documents |
| Sep 4, 2026 | CVE-2026-14894 (Super Forms, CVSS 9.8) and CVE-2026-32475 (Elementor Pro, CVSS 9.8) under mass active exploitation — 440,000+ blocked attempts | Any state agency running WordPress with these plugins faces immediate webshell deployment and full site takeover |
| Sep 4, 2026 | Chrome 152 released — 6th zero-day of 2026 (V8 type confusion) | All state endpoints running Chrome require immediate update; V8 type confusion enables sandbox escape and remote code execution |
| Sep 4, 2026 | IDScan.net identified as source of Nexus dark web service; FBI investigation confirmed | 153M+ U.S./Canadian driver's licenses exposed; state DMVs and licensing boards using IDScan.net may have citizen PII in this dataset |
| Sep 4, 2026 | ASCII smuggling phishing evasion campaign peaked at 2.3 million messages/day using invisible Unicode characters | Finance-themed credential harvesting bypasses keyword-based email security — state employees are targets |
| Sep 3, 2026 | 9 new CISA ICS advisories including Rockwell Automation ControlFLASH RCE, Inductive Automation Ignition auth bypass, IXON VPN Client RCE | Directly affects state water/wastewater SCADA, transportation ICS, and building automation systems |
| Sep 3, 2026 | BeyondTrust CVE-2026-1731 (CVSS 9.8) — pre-authentication RCE added to CISA KEV with active Metasploit exploitation | State agencies using BeyondTrust for privileged remote access face unauthenticated remote code execution |
| Sep 3, 2026 | CISA/G7 joint post-quantum cryptography call to action published | Strategic planning requirement for state PKI, VPN, and certificate infrastructure |
| Ongoing | US-Iran military escalation continues — economic sanctions, Strait of Hormuz disruption, diesel at record highs | Elevated probability of Iranian cyber retaliation against U.S. government and critical infrastructure targets |
| Date | Actor / Campaign | Event | State Gov Impact |
|---|---|---|---|
| Jul 14, 2026 | Unattributed | WordPress Super Forms exploitation begins | State agency portals at risk |
| Aug 18, 2026 | Unattributed | WordPress exploitation peaks at 40,000+ requests/day | Active scanning of state sites likely |
| Aug–Sep 2026 | Chinese-speaking / UNC7032 | SecFlow AI-agent campaign active against government targets | Demonstrates AI-accelerated government intrusions |
| Feb–Jun 2026 | Unattributed | ASCII smuggling phishing peaks at 2.3M messages/day | State employee credential harvesting |
| Sep 1, 2026 | CISA | Six Rockwell Automation ICS advisories published | State water/transportation SCADA affected |
| Sep 1, 2026 | Unattributed / Nexus | IDScan.net breach surfaces; FBI investigation opens | 153M+ driver's licenses; state DMV exposure possible |
| Sep 3, 2026 | CISA | Nine additional ICS advisories (Rockwell, Ignition, IXON, Schneider) | OT remote access and SCADA platforms affected |
| Sep 3, 2026 | Unit 42 | Spring Ring vishing campaign disclosed (NTLM relay via Teams) | 150+ employees across 10+ orgs compromised via Teams |
| Sep 4, 2026 | Chrome 152 released — 6th zero-day of 2026 | All state endpoints require immediate update | |
| Sep 4, 2026 | BeyondTrust / CISA | CVE-2026-1731 (CVSS 9.8) added to KEV; Metasploit exploitation active | State privileged remote access directly exposed |
This is no longer a future concern. Chinese-speaking threat operators are actively using the SecFlow AI-agent orchestration framework — which swaps between Claude, Qwen, and DeepSeek large language models — to conduct multi-stage intrusions against government targets. The most severe confirmed breach compromised a government Office Automation system, resulting in credential theft via LSASS memory dumps and SAM/SYSTEM hive extraction, exfiltration of 822 user account records, theft of approximately 1.28 GB of administrative and health documents, and deployment of ASPX webshells, the SecBox Go-based RAT, and GLUTTON webshell-generation tooling with steganographic delivery (payloads hidden in PNG pixel values).
The campaign exploited well-known vulnerabilities — Shellshock, Ghostcat, Spring4Shell, Log4Shell, Apache Shiro deserialization, Grafana path traversal — suggesting that unpatched systems remain the primary entry point even when AI accelerates post-exploitation.
The threat actor profile overlaps with UNC7032, which targets government, financial, healthcare, and manufacturing sectors using SPINCHAIN JavaScript downloaders, EtherHiding on blockchain smart contracts, and ClickFix social engineering prompts that chain pcalua.exe to PowerShell and mshta.exe.
Why this matters for state government: the SecFlow framework's model-swapping architecture means it is model-agnostic — blocking a single AI provider does nothing. State IT leadership should anticipate AI-augmented attacks becoming the operational norm within 6–12 months.
Two critical WordPress plugin vulnerabilities are being exploited at industrial scale: CVE-2026-14894 (CVSS 9.8) — Super Forms plugin versions ≤6.3.313: unauthenticated arbitrary file upload via the super_submit_form AJAX handler. Attackers upload PHP webshells disguised as base64-encoded image data. Over 250,000 exploit attempts blocked. Fixed in version 6.3.314. CVE-2026-32475 (CVSS 9.0/9.8) — Elementor Pro: unauthenticated file upload via Form widget manipulation. Over 190,000 exploit attempts blocked. Fixed in version 4.2.2.
The observed payload is a PHP uploader webshell named Mushr00w_upl.php. Exploitation peaked at over 40,000 requests per day in mid-August and remains active.
Why this matters for state government: multiple state agencies operate WordPress-based public portals — often maintained by non-security staff with inconsistent patching practices. This is the single most urgent action item in this report.
The Nexus dark web identity theft service, advertised on the Russian cybercrime forum Exploit, has been traced to IDScan.net, a New Orleans-based identity verification company. The FBI's New Orleans field office opened a formal investigation on September 1. The breach dataset includes 153 million+ U.S. and Canadian driver's licenses, 10 million+ identification cards, 3 million+ travel documents, and 579,000+ medical cards.
IDScan.net's known clients include Hertz, Target, FedEx, Motorola Solutions, Caesars Entertainment, and Jack Henry (financial services). If any state agency — DMV, licensing boards, law enforcement — uses IDScan.net for identity verification, state employee and citizen driver's license scans may be in this dataset. This requires an immediate vendor inventory check.
A technique originally developed in AI prompt-injection research — ASCII smuggling using invisible Unicode Tags block characters (U+E0000–U+E007F) — has been repurposed for mass phishing evasion. Microsoft observed the campaign reach 2.3 million messages per day at peak volume between February and June 2026.
The technique inserts non-rendering Unicode characters into financial phishing keywords ("funding," "loan," "credit") to break keyword matching, tokenization, and NLP-based email detection. The campaign used finance-themed disposable sender domains relayed through legitimate ActiveCampaign email marketing infrastructure, making sender reputation filtering ineffective.
This cross-domain technique transfer — where AI security research produces evasion methods that are then weaponized against traditional security controls — represents a new threat category.
CISA published nine new ICS advisories on September 3, directly affecting platforms deployed in state water/wastewater, transportation, and building automation environments — most critically Rockwell Automation ControlFLASH (arbitrary command execution) and IXON VPN Client (RCE on the VPN client machine, enabling direct IT-to-OT pivot). Combined with the six Rockwell advisories from September 1, this brings the total ICS advisory count to 15+ across the past week.
Separately, CVE-2026-1731 (CVSS 9.8) affects BeyondTrust Remote Support and older Privileged Remote Access (PRA) versions — a pre-authentication remote code execution vulnerability, no credentials required. It has been added to the CISA KEV catalog, and active exploitation campaigns are deploying Metasploit Meterpreter payloads. State agencies using BeyondTrust for privileged remote access to servers, network devices, or OT systems are directly exposed.
Geopolitical context: ongoing US-Iran military exchanges have elevated diesel prices to record highs and created conditions for Iranian cyber retaliation. IRGC-affiliated actors have persistently targeted U.S. water and wastewater infrastructure, and MuddyWater (MOIS) continues supply chain compromise operations.
| Scenario | Probability | Basis |
|---|---|---|
| WordPress exploitation attempts will continue to scale; state agency sites will be probed if not already compromised | HIGH (>70%) | 440,000+ attempts already observed; automated scanning infrastructure is persistent; many state WordPress sites have inconsistent patching |
| AI-powered intrusion frameworks (SecFlow and derivatives) will appear in additional campaigns as the model-swapping architecture is replicated | MODERATE (40–60%) | The framework is model-agnostic and operationally proven; barrier to adoption by other operators is low |
| Iranian cyber retaliation against U.S. government targets will increase as military exchanges continue ahead of November midterms | MODERATE (40–60%) | Historical pattern of IRGC cyber operations during geopolitical escalation; water/energy SCADA are known Iranian targets |
| Ransomware operators (Rhysida, SafePay, Qilin) will target state or local government within the next 7 days | LOW-MODERATE (20–40%) | These groups remain active; the absence of new ransomware intelligence this cycle is likely an intelligence collection gap, not a cessation of activity |
| IDScan.net breach data will be used in targeted identity fraud against state employees and citizens within 30 days | MODERATE (40–60%) | 153M records are already available on the Nexus platform; state-issued driver's licenses are high-value for synthetic identity fraud |
| Unicode/ASCII smuggling evasion techniques will be adopted by additional phishing operators | HIGH (>70%) | The technique is simple to implement, proven effective at scale, and bypasses common email security controls |
Hunt Hypothesis: Attackers are uploading PHP webshells to state WordPress sites via unauthenticated file upload vulnerabilities in Super Forms and Elementor Pro. What to Monitor: - HTTP POST requests to /wp-admin/admin-ajax.php?action=super_submit_form from external IPs - New .php files created in WordPress upload directories (wp-content/uploads/) after July 8, 2026 - File names matching Mushr00w_upl.php or upl.php patterns - Base64-encoded content in form submissions to WordPress AJAX endpoints Detection Rule: Alert on any new PHP file creation in web-accessible directories that was not part of a sanctioned deployment or plugin update
Hunt Hypothesis: Threat actors are using ClickFix social engineering to trick users into executing PowerShell via pcalua.exe or mshta.exe proxy binaries, leading to SecBox RAT or SPINCHAIN downloader deployment. What to Monitor: - pcalua.exe spawning powershell.exe or mshta.exe — this is a known ClickFix execution chain - ASPX webshell creation on IIS servers - LSASS access by non-standard processes (credential dumping indicator) - Outbound SOCKS proxy connections on unusual ports (e.g., port 35888) - DNS queries to niestools[.]comDetection Rule: Create a SIEM correlation rule for pcalua.exe → powershell.exe or pcalua.exe → mshta.exe parent-child process chains. This has an extremely low false-positive rate in enterprise environments.
Hunt Hypothesis: Attackers are exploiting pre-auth RCE in BeyondTrust Remote Support/PRA to deploy Meterpreter payloads on privileged access infrastructure. What to Monitor: - Anomalous process execution on BeyondTrust appliances (Meterpreter indicators: metsrv.dll, reverse TCP connections to unknown IPs) - Unexpected outbound connections from BeyondTrust infrastructure - Authentication anomalies on systems accessible via BeyondTrust
Hunt Hypothesis: Phishing emails are using invisible Unicode Tags block characters to evade keyword-based detection, targeting state employees with finance-themed credential harvesting. What to Monitor: - Email messages containing characters in the Unicode Tags block (U+E0000–U+E007F) — these characters have no legitimate use in business email - Emails from domains matching patterns: capitalboost, growthfunding, loanexpress - Click-tracking redirects through acemlnd[.]com or activehosted[.]com (ActiveCampaign infrastructure) in unsolicited finance-themed emails Defensive Guidance: Implement Unicode normalization in email transport rules — strip Tags block characters before content inspection. This is a configuration change in Microsoft Defender for Office 365 transport rules.
Hunt Hypothesis: Nation-state actors (IRGC, Volt Typhoon) may exploit newly disclosed Rockwell, Ignition, or IXON vulnerabilities to access or manipulate state OT systems. What to Monitor: - Unauthorized firmware updates or configuration changes on Rockwell ControlLogix/CompactLogix PLCs - New project creation in Inductive Automation Ignition by non-standard accounts - Anomalous VPN connections via IXON VPN Client - Any IT-to-OT lateral movement across network segmentation boundaries
Hunt Hypothesis: Stolen driver's license data from the IDScan.net/Nexus breach may be used for synthetic identity fraud or targeted social engineering against state employees. What to Monitor: - Anomalous OAuth token activity in M365/Azure AD (Entra ID) sign-in logs - Password reset requests or MFA enrollment changes for accounts associated with agencies that may use IDScan.net - Social engineering attempts referencing driver's license or identity verification processes
| Threat | ATT&CK |
|---|---|
| 1. WordPress Webshell Detection (CLU-387) | T1190T1505.003T1036 |
| 2. AI-Agent / ClickFix Execution Chain (CLU-386 / UNC7032) | T1059.001T1218.011T1505.003T1003.001T1572 |
| 3. BeyondTrust Exploitation (CVE-2026-1731) | T1190T1059 |
| 4. Unicode/ASCII Smuggling in Email (CLU-389) | T1566.001T1564.001T1036 |
| 5. ICS/SCADA Monitoring (CLU-152) | T0831T0836T0886 |
| 6. Credential Theft and Identity Abuse (CLU-385) | T1078T1530 |
Top attacker 103.168.147[.]235 alone accounts for 106,000+ blocked requests. Block at perimeter firewalls, proxies, and DNS.
Block at perimeter firewalls, proxies, and DNS.
81.70.240[.]170 — SecFlow workspace/AI execution host; 43.99.61[.]170 — Java/CAS exploitation workspace, GLUTTON tooling; 152.42.200[.]25 — Shellshock/credential-testing workspace; 129.211.184[.]149 — payload distribution, C2, post-exploitation; 103.45.65[.]93 — shared SOCKS proxy (port 35888); niestools[.]com — model-routing infrastructure.
Finance-themed phishing sender domains. Additional IOCs for the campaigns discussed in this report are available through Anomali ThreatStream Next-Gen and partner feeds.
/wp-admin/admin-ajax.php?action=super_submit_form from external IPs; new .php files created in wp-content/uploads/ after July 8, 2026; file names matching Mushr00w_upl.php or upl.php patterns; base64-encoded content in form submissions. Alert on any new PHP file creation in web-accessible directories not part of a sanctioned deployment.pcalua.exe or mshta.exe proxy binaries, leading to SecBox RAT or SPINCHAIN downloader deployment. Monitor for pcalua.exe spawning powershell.exe or mshta.exe; ASPX webshell creation on IIS servers; LSASS access by non-standard processes; outbound SOCKS proxy connections on unusual ports (e.g. port 35888); DNS queries to niestools[.]com. Create a SIEM correlation rule for pcalua.exe → powershell.exe/mshta.exe parent-child process chains.*capitalboost*, *growthfunding*, *loanexpress*; click-tracking redirects through acemlnd[.]com or activehosted[.]com. Implement Unicode normalization in email transport rules.- Implement Unicode normalization in email transport rules to strip Tags block characters (U+E0000–U+E007F) before content inspection
- State financial agencies using Jack Henry platforms should assess downstream exposure from the IDScan.net breach
- Enforce MFA on all financial systems and monitor for anomalous authentication patterns
- Coordinate with plant operators for maintenance windows to apply ICS advisory patches
- Review IT-to-OT segmentation and ensure no direct internet exposure of SCADA systems given ongoing Iranian retaliation risk
- Patch the updated Schneider Electric advisory (ICSA-26-169-07) covering Easergy, EcoStruxure, PowerLogic, and Saitel platforms
- Assess whether IDScan.net was used for any patient or provider identity verification
- Validate that web-facing applications (patient portals, provider directories) are patched against Log4Shell, Spring4Shell, and Apache Shiro deserialization
- Maintain backup verification and incident response readiness — the absence of new ransomware intelligence this cycle is a collection gap, not evidence of safety
- WordPress audit is the #1 priority — inventory every WordPress installation, identify Super Forms (≤6.3.313) or Elementor Pro (<4.2.2), and patch or disable immediately
- BeyondTrust verification is #2 — confirm the version deployed across agencies; CVE-2026-1731 is pre-auth RCE with active Metasploit exploitation
- Chrome 152 push is #3 — the 6th Chrome zero-day of 2026; push via SCCM/Intune to all managed endpoints
- Determine within 7 days whether any agency uses IDScan.net; deploy detection for pcalua.exe → PowerShell/mshta.exe execution chains
- Review all nine CISA advisories for applicability to traffic management, airport operations, and port systems
- Patch IXON VPN Client immediately if used for remote OT access at transportation facilities — this provides direct remote access to OT networks
- Assess whether shared identity verification data with FedEx integrations may be affected by the IDScan.net breach
Mushr00w_upl.php or unexpected .php files created after July 8.pcalua.exe spawning powershell.exe or mshta.exe — the UNC7032/ClickFix execution chain actively targeting government organizations.September 2026 is shaping up to be a defining month for state government cybersecurity. The threats converging this week are not theoretical — they are active, scaled, and specifically relevant to state IT environments: 440,000+ exploit attempts against WordPress plugins that state agencies run; AI-powered intrusion frameworks that have already breached government systems; 153 million driver's licenses on the dark web from a vendor that may serve your agencies; 15+ ICS advisories in one week affecting the exact SCADA platforms in your water and transportation systems; and a pre-auth RCE in the privileged access tool your teams may use daily. The WordPress audit cannot wait. The BeyondTrust patch cannot wait. The Chrome update cannot wait. These are not "when we get to it" items — they are active exploitation campaigns against your technology stack. For the threats that require longer-term action — the IDScan.net vendor check, the Unicode phishing defense, the post-quantum readiness assessment — start the clock now. The adversaries already have.