Threat Advisory • Attack Report • TA2026192

Storming the Capitol Network: Nation-State Ops Against the USA Government

HiveForce Labs tracked 18 months of sustained cyber-threat telemetry against the USA Government sector — federal, state, local, tribal, and territorial (SLTT) agencies. The dataset spans 76 weaponized CVEs (87% CISA KEV, 45% zero-day), a Qilin-led ransomware wave, and persistent nation-state espionage from APT41, Silk Typhoon, Salt Typhoon, Star Blizzard, and Kimsuky.

Section 01

Summary

The USA Government sector faces one of the world’s most persistent and diverse cyber-threat surfaces. Between January 2025 and July 2026, HiveForce Labs tracked 76 vulnerabilities weaponized against federal, state, local, tribal, and territorial (SLTT) government targets — 87% of which are listed in CISA KEV. Ransomware activity dominates the current picture, with Qilin, INC, Safepay, and Medusa accounting for the majority of victim postings. State-aligned actors from China (APT41, Silk/Salt Typhoon), Russia (Star Blizzard, Cold River), Iran, and North Korea (Kimsuky) continue espionage, while criminal groups exploit legacy on-premises infrastructure — particularly Exchange, FortiOS, Ivanti Connect Secure, and BeyondTrust.

Key Observations

• Legacy on-premises Exchange, Fortinet, Ivanti, and BeyondTrust products remain the most targeted entry points.
• 87% CISA KEV coverage indicates adversaries are exploiting vulnerabilities the U.S. government itself has flagged as actively exploited.
• Qilin alone posted 43 USA government victims — 39% of Data Leak Site posts across the top six tracked groups.
• 72% of malware/campaign advisories remain unattributed, reflecting the complexity of contemporary intrusion-set overlap.

---

Section 02

Attack Details

Over eighteen months, HiveForce Labs tracked 156 distinct malware and campaign advisories targeting the USA Government sector — a volume unmatched by any other vertical. The intrusion set spans China-nexus espionage groups (APT41, Silk Typhoon, Salt Typhoon, FishMonger, PlushDaemon, ToddyCat, ToyMaker), Russian operators (Star Blizzard, Cold River), Iranian/DPRK-linked actors (Kimsuky, Water Gamayun), independent groups (TeamPCP, Mora_001, UAT-6382), and a sprawling ransomware-as-a-service criminal ecosystem.

The exploitation surface is disturbingly consistent. Of the 76 CVEs weaponized, five vendors — Microsoft, Cisco, Fortinet, Ivanti, VMware — account for 42% of volume, and the top-seven exploited products (Exchange, FortiOS, Ivanti Connect Secure, BeyondTrust PRA/RS, SimpleHelp, VMware vCenter, Cisco IOS-XE) map onto mail, VPN, remote-support, virtualization, and network fabric. 87% of exploited CVEs are CISA KEV, and 45% were zero-day — adversaries operate at the exact edge where known criticality meets a documented patch.

Ransomware defines the picture: 50 of 156 advisories (32%) are ransomware families. Qilin alone posted 43 U.S. government victims (~39% of the top-six total), peaking at five posts/month across September–November 2025. INC (20), Safepay (12), Medusa (10), DragonForce (8), Ransom House (8), InterLock (7), and Rhysida (5) round out a top tier posting a new victim roughly every three days.

Infostealers are the second-largest malware category (18%) — Rhadamanthys, StealC, Lumma, Vidar — feeding harvested credentials to Initial Access Brokers who sell to Qilin, INC, and Medusa affiliates. Backdoors/RATs represent 19%: AsyncRAT and ValleyRAT dominate commodity use, while BRICKSTORM, MemFun, and Getpass anchor higher-tier espionage. State actors increasingly wrap commodity payloads with custom loaders (MimicRAT, SilentPrism, DarkWisp), while criminal affiliates borrow nation-state tradecraft (DLL sideloading, ClickFix, LOLBins).

Most uncomfortably: 78% of weaponized CVEs are 2+ years old, 21% are 6+ years old, and 89% have vendor patches available. Adversaries are largely exploiting known, patchable, KEV-listed vulnerabilities that government tenants have failed to remediate — a remediation-velocity failure, not a disclosure failure.

Top Threat Actor — APT41

Chinese state-sponsored group (also Wicked Panda, Brass Typhoon, Winnti Group) running multiple parallel campaigns against USA federal and SLTT targets — the single most active named actor in the tracking window.

Top CVE — CVE-2023-3519 (Citrix NetScaler ADC/Gateway)

CVE-2023-3519 is an unauthenticated RCE, CISA KEV-listed, weaponized by multiple actors including state-nexus groups — representative of the network-edge appliance flaws dominating USA government exposure.

Top Malware Family — AsyncRAT

An open-source RAT reused across affiliate ecosystems, frequently paired with Rhadamanthys and Lumma Stealer in multi-stage intrusions; its lineage complicates attribution.

Top Ransomware Group — Qilin

Highest USA-government victim-posting RaaS group (43 posts, peaking at 5/month Sep–Nov 2025). Formerly Agenda; runs Rust/Go payloads; 24.6% of all USA-government ransomware Data Leak Site posts tracked.

Malware Type Distribution

• Ransomware: 32% — the criminal ecosystem's continued high-pressure focus on government.
• Infostealers: 18% — increasingly feed ransomware pipelines via Initial Access Brokers.
• Backdoors + RATs: 19% — consistent with sustained state-sponsored espionage.
• Botnets: 6.4% — skew toward IoT-based DDoS against municipal websites.
• Loader/Dropper: 5.1% — wraps commodity payloads with custom evasion.

CVE Age & Exposure Surface

• Only 22% of CVEs are ≤1 year old; 78% target vulnerabilities disclosed 2+ years ago.
• 21% of tracked CVEs are 6+ years old, indicating systemic legacy patching gaps.
• 89% patch availability + 87% CISA KEV membership: most compromises occur on officially flagged, patchable vulnerabilities.
• ~30% of exploited CVEs sit on VPN/firewall/remote-access appliances; ~29% on public web/collaboration/middleware — ~60% combined internet-facing exposure. Edge/IoT/firmware adds 17%.

---

Section 03

CVEs — Top Priority

Highest-priority vulnerabilities weaponized against the USA Government sector. Per-row zero-day/KEV status was not distinguishable from the source extraction and is omitted — see aggregate figures in Section 02 (87% CISA KEV, 45% zero-day).

Patch column reflects confirmed availability where indicated in the source.

---

Section 04

Recommendations

---

Section 05

Potential MITRE ATT&CK TTPs

---

Section 06

Indicators of Compromise (IOCs)

Representative indicators by attack/malware name, covering ransomware groups, malware families, and espionage implants observed against the USA Government sector: Qilin, INC, Safepay, Medusa, DragonForce, InterLock, Rhysida, AsyncRAT, Rhadamanthys, Lumma, StealC, Vidar, ValleyRAT, BRICKSTORM, MemFun, Getpass, and MimicRAT. Lists below are truncated to representative samples per family.

---

Section 07

References

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://attack.mitre.org/
• https://www.cisa.gov/news-events/cybersecurity-advisories
• https://www.ic3.gov/
• https://www.cisecurity.org/ms-isac