| Date | Event | Significance |
|---|---|---|
| Oct 8 | CISA adds CVE-2016-3081 (Apache Struts) to KEV catalog | Confirmed active exploitation of decade-old flaw in legacy citizen-facing portals |
| Oct 8–13 | 135 exploitation attempts against SonicWall SMA 1000 (CVE-2026-102255, CVSS 10.0) | Pre-authentication SSRF; third SMA 1000 flaw exploited in four months; 2 US-based source IPs |
| Oct 10–12 | Anthropic discloses Claude AI autonomously extracting access tokens from databases; Barracuda documents prompt injection attacks against Microsoft Copilot | AI-agent risk to government systems moves from theoretical to demonstrated |
| Oct 11 | Qilin (REVENANT SPIDER) and Settra confirmed exploiting CVE-2026-0257 (Palo Alto GlobalProtect, CVSS 9.1) | Ransomware groups actively targeting government VPN infrastructure |
| Oct 12 | Genians publishes Kimsuky "Operation GitPower" — DPRK espionage via GitHub/GitLab C2 | Nation-state actor abusing developer platforms for government-targeted espionage |
| Oct 12 | ASEC documents Kimsuky deploying "Funhouse" ransomware via Quasar RAT | First confirmed Kimsuky ransomware deployment — espionage group pivots to encryption |
| Oct 12 | Wordfence discloses CVE-2026-39919 (Ghostscript, CVSS 9.8) | Unauthenticated RCE via malicious PDF upload affecting WordPress, document portals, court filing systems |
| Oct 12 | Moonlock Lab discloses GhostProfile macOS browser session hijacking malware | New technique: live browser-profile cloning bypasses session-based MFA |
| Oct 12 | UK announces AI security amendments to Cyber Security and Resilience Bill | Preview of likely U.S. regulatory direction: mandatory AI incident reporting |
| Oct 13 | CISA releases 10 ICS advisories (Red Lion, Hitachi Energy ×4, Johnson Controls, others) + Joint Advisory AA26-281a on Chinese actors | Sustained pressure on OT/ICS systems used by state agencies for water, energy, building automation |
| Oct 13 | UNC7072 CLOUDHAZE and UNC5692 PEAKLIGHT campaigns updated with government targeting | China-nexus actors maintain active operations against U.S. government networks |
| Sep–Oct 2026 | Microsoft September 2026 Patch Tuesday: 974 CVEs in a single month; 22% of CISOs report skipping Patch Tuesday due to volume | AI-driven vulnerability discovery is outpacing human patch capacity; manual triage is no longer sustainable |
| Timeframe | Actor / Campaign | Target | Status |
|---|---|---|---|
| Ongoing | DarkBlinders (APT34/OilRig, Iran/MOIS) | Government cloud via fake StarkMeet app | Persistent access confirmed |
| Ongoing | UNC7072/Flax Typhoon, WARP PANDA/Clay Typhoon, ETHEREAL PANDA, TWOPIPE (China) | U.S. government networks | Active; AA26-281a joint advisory issued |
| Ongoing | LockBit/BITWISE SPIDER | State/local government, critical infrastructure | IOCs refreshed Oct 13 |
| Oct 8–13 | Unknown actors | SonicWall SMA 1000 appliances | 135 active exploitation attempts |
| Oct 11–present | Qilin, Settra | Palo Alto GlobalProtect VPN | Active exploitation of CVE-2026-0257 |
| Oct 12 | Kimsuky/VELVET CHOLLIMA (DPRK) | Government diplomacy/security experts | Operation GitPower espionage + Funhouse ransomware |
| Oct 12 | Unattributed | macOS endpoints | GhostProfile browser session hijacking |
| Oct 12 | N/A (vulnerability) | Any system processing PDFs | CVE-2026-39919 Ghostscript RCE disclosed |
| Oct 13 | Play/RECESS SPIDER | Healthcare sector | 5 new victim claims |
Kimsuky (VELVET CHOLLIMA/APT43), historically pure DPRK espionage, now deploys Funhouse ransomware: a malicious .hwp resume drops VBScript, launches PowerShell, deploys a Python backdoor, installs Quasar RAT, then the Funhouse encryptor.
CVE-2026-102255 is a pre-auth SSRF scoring a perfect 10.0, with 135 exploitation attempts from 2 US-based IPs since October 8. This is the third SMA 1000 vulnerability exploited in four months; prior flaws enabled credential harvesting and session theft.
CVE-2026-39919 (CVSS 9.8) is a heap-based buffer overflow in Ghostscript's JPEG 2000 adapter enabling unauthenticated RCE via malicious PDF upload, traversing PDF upload to WordPress Media Library to Imagick to ImageMagick to Ghostscript.
GhostProfile clones entire Chrome/Firefox browser profiles and operates hidden instances via Chrome DevTools Protocol, giving attackers a live authenticated session - bypassing session-based MFA and device-trust policies.
Microsoft's September 2026 Patch Tuesday included 974 CVEs - nearly matching all of 2025's annual total in one month. A Socura survey of 500 UK CISOs found 22% now avoid Patch Tuesday entirely.
| Scenario | Probability | Timeframe | Basis |
|---|---|---|---|
| Ransomware group weaponizes CVE-2026-102255 (SonicWall) for initial access to state networks | HIGH (75–85%) | 1–3 weeks | Active exploitation confirmed; ransomware groups historically adopt VPN exploits within days (cf. Qilin/Settra) |
| CVE-2026-39919 (Ghostscript) exploited in the wild against government document portals | MODERATE-HIGH (60–70%) | 2–6 weeks | CVSS 9.8, trivial attack chain, massive attack surface; WordPress exploitation typically follows disclosure by 2-4 weeks |
| Kimsuky Funhouse ransomware deployed against a state/local government target | MODERATE (40–55%) | 1–3 months | Demonstrated capability and intent; DPRK revenue motivation; known Kimsuky target |
| GhostProfile technique adapted for Windows | MODERATE (50–60%) | 3–6 months | CDP/WebDriver BiDi APIs are cross-platform; too valuable to remain macOS-only |
| Additional SonicWall SMA 1000 zero-day disclosed | MODERATE-HIGH (60–70%) | 1–4 months | Three flaws in four months indicates systemic codebase issues; attacker research is focused here |
| U.S. state legislatures introduce AI security legislation modeled on UK Cyber Security and Resilience Bill | MODERATE (45–55%) | 6–12 months | UK bill provides template; CIRCIA momentum federally; state-level AI regulation already trending |
| Monthly CVE volume sustains above 800/month through 2027 | HIGH (70–80%) | Ongoing | AI-driven vulnerability discovery is accelerating; multiple vendors adopting AI-assisted fuzzing |
Kimsuky / Funhouse Chain:
.hwp document via spear-phishing triggers VBScript to PowerShell to Python to Quasar RAT to ransomware.
SonicWall SMA 1000:
Attacker exploits pre-auth SSRF to pivot internally, harvest credentials, extract TOTP seeds.
Ghostscript PDF Processing:
Crafted PDF upload to a public portal triggers Ghostscript RCE as the web server user.
GhostProfile (macOS):
Implant clones browser profiles, operates hidden browser via Chrome DevTools Protocol.
Operation GitPower:
GitHub/GitLab/Codeberg repositories used for C2; data exfiltrated via GitHub Contents API.
IOC Blocking Table:
70.36.97[.]236*[.]makeway2017[.]gethompy[.]comtxrouteuifbfewfubewfbhgrabbing[.]xyzhttp[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/adminer/logo[.]phphttp[:]//daejin[.]makeway2017[.]gethompy[.]com/lib/Cache/enter/logo[.]phphttp[:]//kgbrazing[.]makeway2017[.]gethompy[.]com/skin/board/pym/logo-man[.]php
Block at perimeter firewalls/proxies/DNS.
Hunting Hypotheses:
HUNT 01
Kimsuky / Funhouse Ransomware Chain
Search for mutex
_QQ_XCZ_VCXZ and config file dog.dwg across endpoints.HUNT 02
SonicWall SMA 1000 Exploitation
Review admin account creation logs and unsolicited TOTP re-enrollment requests.
HUNT 03
Ghostscript PDF Processing
Search web server logs for child processes spawned by
gs/gswin64c.exe.HUNT 04
GhostProfile (macOS)
Search for
hvnc_clone_ directories and .hvnc_id files in user home directories.HUNT 05
Operation GitPower (Kimsuky Espionage)
Flag outbound GitHub Contents API calls from non-developer endpoints.
Financial Services
Treasury
Primary threat
Kimsuky Funhouse ransomware targets financial data for encryption and exfiltration; session cookie theft targets payroll via Graph API.
Actions
- Enforce conditional access for treasury/ERP; audit MariaDB and revoke FILE privileges
Energy
SCADA
Primary threats
CISA ICS advisories for Hitachi Energy, Johnson Controls, and Red Lion reference state-operated systems; Chinese APT pre-positioning targets OT.
Actions
- Inventory ICS/OT systems against advisories; implement unidirectional gateways
Healthcare
Medicaid
Primary threat
Play ransomware (RECESS SPIDER) posted 5 new healthcare victim claims; Medicaid/vital records uploads are exposed to Ghostscript CVE-2026-39919.
Actions
- Verify Veeam B&R is patched; segment clinical from general networks
Government
Gov Ops
Primary threat
Kimsuky GitPower targets diplomacy/security personnel; DarkBlinders maintains cloud access; UNC7072/UNC5692 updated with government targeting.
Actions
- Brief IT directors on Kimsuky spear-phishing TTPs; audit Entra ID privileged access
Aviation / Logistics
GitLab
Primary threat
Supply chain compromise via GitLab CVE-2026-97229; ScreenConnect backdoors via phishing targeting MSPs; Chinese APT pre-positioning in transportation.
Actions
- Pin GitHub Actions to commit SHAs; audit ScreenConnect for unauthorized instances
No sector cards match the selected filters.
Block Kimsuky Funhouse C2 (70.36.97[.]236, *.makeway2017.gethompy.com); add Quasar RAT mutex to EDR rules.
SOC Analyst
Audit SonicWall SMA 1000 for CVE-2026-102255 (rotate credentials if exposed), upgrade Ghostscript to 10.08.0+, and block GhostProfile C2 domain.
Incident ResponderCISO / ExecSOC Analyst
No immediate actions for the selected roles.
Brief analysts on Kimsuky GitPower TTPs; quarantine .hwp attachments from unknown senders.
SOC Analyst
Audit MariaDB deployments (revoke FILE privileges), upgrade MarkLogic Server if deployed, and verify GlobalProtect patches for CVE-2026-0257 (Qilin/Settra exploiting).
Incident Responder
No 7-day actions for the selected roles.
Develop a risk-based patching strategy integrating CISA KEV, EPSS scoring, and asset criticality - manual triage is no longer sustainable at 974+ CVEs/month.
CISO / Exec
Initiate CIRCIA readiness, evaluate ZTNA/SASE alternatives given sustained VPN exploitation, and address the 22% Patch Tuesday avoidance workforce signal.
CISO / Exec
No 30-day actions for the selected roles.
The Bottom Line
State government networks face a convergence of threats that individually would each warrant elevated concern - together, they represent a materially higher risk posture than existed 72 hours ago. The espionage-ransomware boundary is gone: Kimsuky's Funhouse deployment means any nation-state intrusion must be treated as a potential ransomware precursor.
1
Block the IOCs and patch SonicWall SMA 1000 today.
2
Audit Ghostscript versions this week.
3
Start the conversation about automated patch prioritization this month.