Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 1 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1–12 / 3243 reports
SonicWall SSL-VPN MFA Bypass (CVE-2026-19868): What Security Teams Must Do Now
SonicWall SSL-VPN MFA Bypass (CVE-2026-19868): What Security Teams Must Do Now
Government Administration1 day ago

SonicWall SSL-VPN MFA Bypass (CVE-2026-19868): What Security Teams Must Do Now

In November 2026, SonicWall disclosed CVE-2026-19868, a CVSS 7.1 authentication bypass vulnerability in SonicOS SSL-VPN services configured with SAML-based multi-factor authentication. Attackers possessing valid credentials for an alternate authentication method could circumvent SAML MFA controls entirely, gaining unauthorized VPN access. CISA added the flaw to its Known Exploited Vulnerabilities catalog and mandated that federal civilian executive branch agencies remediate affected Gen7 and Gen8 SonicOS appliances by November 20, 2026. The disclosure arrived alongside six additional SonicOS flaws, including two 8.8-severity management interface vulnerabilities enabling unauthenticated operations. This incident underscores a persistent and escalating pattern of threat actors targeting SSL-VPN edge appliances as primary initial-access vectors. With SonicWall devices having faced multiple zero-day exploitation campaigns throughout 2026, organizations relying on perimeter VPN as a trust boundary must reassess whether MFA alone—absent zero trust network segmentation and lateral movement controls—provides adequate protection against credential-abuse and authentication-bypass attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
APT29's DarkSword Watering-Hole Campaign: How Russia's SVR Turned Analytics Scripts Into Mobile Spy Tools
APT29's DarkSword Watering-Hole Campaign: How Russia's SVR Turned Analytics Scripts Into Mobile Spy Tools
Government Administration1 day ago

APT29's DarkSword Watering-Hole Campaign: How Russia's SVR Turned Analytics Scripts Into Mobile Spy Tools

In 2026, Russia's APT29 (Cozy Bear / Midnight Blizzard) executed a multi-vector watering-hole campaign that compromised legitimate websites—including a Ukrainian analytics provider (Plerdy), a US chemical-industry trade association, and a Bulgarian military site—as well as lookalike domains impersonating high-profile brands. Malicious JavaScript fingerprinted visiting iOS and Android devices, then delivered tailored exploit chains exploiting CVE-2025-43529, CVE-2024-27834, and the multi-stage DarkSword kit to harvest SMS, credentials, messaging-app data, and authentication tokens from thousands of unpatched mobile devices across Ukraine, Europe, and the United States. The campaign signals a structural shift in nation-state tradecraft: packaged n-day mobile exploit kits sourced from commercial surveillance vendors are lowering the barrier to mass mobile espionage. As APT29 moves beyond traditional endpoint and cloud targets toward supply-chain injection into widely used analytics scripts, organizations must treat third-party JavaScript dependencies and unmanaged mobile endpoints as first-class attack surfaces.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
D-Link DGS-3130 Zero-Days: Unpatched Switch Flaws Put Enterprise Networks at Risk
D-Link DGS-3130 Zero-Days: Unpatched Switch Flaws Put Enterprise Networks at Risk
Information Technology/IT2 days ago

D-Link DGS-3130 Zero-Days: Unpatched Switch Flaws Put Enterprise Networks at Risk

In November 2026, D-Link disclosed multiple unpatched zero-day vulnerabilities affecting its DGS-3130 series managed Gigabit stackable switches, widely deployed in SMB and metro Ethernet environments. Discovered by network engineer Giresh Kumar Enugu, the flaws reside in the D-Link Discovery Protocol (DDP) authentication, access control, and information-handling components. Successful exploitation could allow an attacker with network access to extract sensitive device data, perform unauthorized administrative operations, alter device configurations, leak SNMP community strings, or trigger service disruptions and device resets. No CVE IDs or firmware patches have been released, and D-Link is still investigating the full scope of impact across its switching portfolio. Unpatched network infrastructure vulnerabilities are an accelerating trend in 2026, with threat actors increasingly targeting edge and campus switches as initial footholds rather than endpoints. With no patch available, the risk window remains open indefinitely, making compensating controls and network segmentation critical defensive priorities for any organization running affected D-Link hardware.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
How BlackNevas and The Gentlemen Encrypted Entire VM Farms Without Breaking the Hypervisor
How BlackNevas and The Gentlemen Encrypted Entire VM Farms Without Breaking the Hypervisor
Information Technology/IT2 days ago

How BlackNevas and The Gentlemen Encrypted Entire VM Farms Without Breaking the Hypervisor

In two separate ransomware incidents investigated by Kaspersky GERT in 2025 and 2026, threat actors compromised VMware ESXi and Proxmox virtualization environments without exploiting any hypervisor escape vulnerability. In the first case, the BlackNevas ransomware group leveraged an overprivileged PRTG Network Monitor deployment that stored reusable root credentials, enabling SSH-based lateral movement across multiple ESXi hosts and full encryption of virtual workloads after disabling the execInstalledOnly security policy. In the second case, The Gentlemen ransomware group discovered plaintext administrative credentials stored in notes on a compromised sysadmin workstation, used them to authenticate as Proxmox root, activated VNC websockets, and encrypted the entire cluster. Both incidents resulted in widespread VM encryption and significant operational disruption. These incidents underscore a growing attacker pattern: ransomware operators are bypassing perimeter defenses entirely by targeting misconfigured management planes, reused privileged credentials, and flat administrative networks within virtualized infrastructure. As enterprise reliance on ESXi and Proxmox-based hyperconverged environments accelerates, the attack surface created by credential sprawl and insufficient network segmentation is becoming a primary ransomware kill chain—not a secondary one.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
October 2026 CVE Landscape: PHP2Shell, Lazarus Group Espionage, and the Ransomware Multiverse
October 2026 CVE Landscape: PHP2Shell, Lazarus Group Espionage, and the Ransomware Multiverse
Government Administration2 days ago

October 2026 CVE Landscape: PHP2Shell, Lazarus Group Espionage, and the Ransomware Multiverse

In October 2026, Recorded Future's Insikt Group identified 82 high-impact vulnerabilities across 51 vendors, with 52 carrying a Very Critical Risk Score. Among the most significant was the PHP2Shell exploit chain (CVE-2026-109618 and CVE-2026-109619), which threat actors combined with the Fragnesia Linux kernel privilege escalation vulnerability (CVE-2026-46300) to achieve root access on at least 25 servers, including US government-affiliated systems. Activity was attributed with moderate confidence to the Lazarus Group. Concurrent campaigns included Longlegs deploying Warlock ransomware, ransomware groups exploiting PAN-OS, and CL-STA-0954 targeting Fortinet products for data theft. This month's landscape reflects an accelerating convergence of nation-state espionage, ransomware-as-a-service, and botnet exploitation targeting unpatched edge appliances and web platforms. The 16-year age span of exploited CVEs—and the presence of 13 vulnerabilities surfaced only through honeypot data—underscores the persistent risk posed by legacy exposure combined with rapid weaponization of newly disclosed flaws.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
No Login Needed: How Two Barracuda ESG Flaws Chain to Unauthenticated Root Access
No Login Needed: How Two Barracuda ESG Flaws Chain to Unauthenticated Root Access
Information Technology/IT2 days ago

No Login Needed: How Two Barracuda ESG Flaws Chain to Unauthenticated Root Access

In November 2026, security researchers at watchTowr disclosed a critical two-vulnerability chain in Barracuda's Email Security Gateway (ESG) appliance, rated 9.3 and 8.6 by Mandiant respectively. CVE-2026-116606, a pre-authentication authorization bypass, allows an unauthenticated attacker to upload a crafted configuration backup and alter global appliance settings. Chained with CVE-2026-111560, a command injection flaw, an attacker can execute arbitrary commands as root with no login required. A hardcoded backup checksum secret enables forgery of valid backup files. Barracuda released patches in ESG firmware version 9.4.0.030 and above; no active exploitation has been reported as of disclosure. This disclosure follows the 2023 UNC4841 zero-day campaign against Barracuda ESG (CVE-2023-2868), reinforcing a pattern of high-severity, pre-authentication vulnerabilities targeting perimeter email appliances. As threat actors increasingly focus on network edge devices as initial access vectors, organizations relying on hardware-based email security must urgently prioritize patch cadence and network segmentation around management interfaces.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks
CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks
Oil/Energy/Solar/Greentech2 days ago

CVSS 9.4 Flaws in Subnet Solutions PowerSYSTEM Center Threaten Energy and Critical Manufacturing ICS Networks

In November 2026, CISA published ICS Advisory ICSA-26-307-01 disclosing two critical vulnerabilities (CVE-2026-63017 and CVE-2026-63774) in Subnet Solutions PowerSYSTEM Center, an industrial control system platform widely deployed in critical manufacturing and energy sectors worldwide. CVE-2026-63017, rated CVSS 9.4, allows a low-privileged authenticated user to access administrator-restricted resources via incorrect authorization (CWE-863). CVE-2026-63774, also rated CVSS 9.4, enables authenticated users to execute unauthorized SQL commands through the report designer due to insufficient input validation (CWE-89). Both vulnerabilities require adjacent network access and affect versions spanning the 2020, 2024, and 2026 product lines. Successful exploitation could expose sensitive operational data, manipulate ICS database records, and disrupt energy grid management functions. These vulnerabilities are significant because they target ICS/OT environments in energy and critical manufacturing—sectors already under elevated threat from nation-state and ransomware actors. The combination of privilege escalation and SQL injection within a single OT platform dramatically lowers the bar for insider threats and lateral movement, reflecting a broader trend of attackers targeting operational technology management layers rather than field devices alone.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-83844: The Microsoft Paint RCE Patch Your Windows Update Will Never Deliver
CVE-2026-83844: The Microsoft Paint RCE Patch Your Windows Update Will Never Deliver
Information Technology/IT2 days ago

CVE-2026-83844: The Microsoft Paint RCE Patch Your Windows Update Will Never Deliver

On October 13, 2026, Microsoft disclosed CVE-2026-83844, a critical out-of-bounds read remote code execution vulnerability in Windows Paint carrying a CVSS score of 8.1. An unauthenticated remote attacker can exploit the flaw by sending a specially crafted network packet—requiring no user interaction—to execute arbitrary code on affected systems. Microsoft released the patched build (11.2609.401.0) exclusively through the Microsoft Store, meaning standard Windows Update pipelines will not deliver the fix. Inconsistent CVE versioning between the security advisory and the NVD entry creates further confusion, risking unpatched endpoints slipping through automated vulnerability scans. This incident underscores a growing blind spot in enterprise patch management: Store-delivered application updates fall outside traditional Windows Update and WSUS workflows. As attackers increasingly target peripheral OS components, organizations relying solely on Windows Update for patching face elevated exposure windows—a trend that demands deliberate validation of non-traditional update channels across all managed endpoints.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Ghost in the Pipeline: How Storm-2603 Used a Fileless SharePoint Webshell to Stage Ransomware
Ghost in the Pipeline: How Storm-2603 Used a Fileless SharePoint Webshell to Stage Ransomware
Government Administration3 days ago

Ghost in the Pipeline: How Storm-2603 Used a Fileless SharePoint Webshell to Stage Ransomware

In December 2025, the ransomware-affiliated threat actor Storm-2603 exploited CVE-2025-53770 and CVE-2025-53771 (collectively 'ToolShell') in on-premises Microsoft SharePoint to achieve fileless remote code execution. Beginning with a low-noise vulnerability fingerprint on December 20, the actor waited three days before launching the full exploit chain on Christmas Eve—when security staffing was reduced. A modular C# webshell was injected entirely into the IIS worker process (w3wp.exe) in memory, enabling tunneling, privilege escalation via EfsPotato, credential access, and lateral movement without writing to disk. Post-exploitation activity included deployment of Velociraptor, multiple encrypted tunneling tools, an EDR-killing driver, and ultimately an attempted Warlock ransomware detonation. This incident marks a significant escalation in fileless, memory-resident attack techniques against enterprise collaboration platforms. Storm-2603's deliberate timing, use of privacy networks to obscure origin, and layered redundant persistence mechanisms reflect a maturing operational playbook that bypasses file-based detection entirely—raising the bar for defenders relying on traditional endpoint and perimeter controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical OpenSSH Flaw on Alpine Linux: How a Long Password Unlocks Accounts With No Password
Critical OpenSSH Flaw on Alpine Linux: How a Long Password Unlocks Accounts With No Password
Information Technology/IT3 days ago

Critical OpenSSH Flaw on Alpine Linux: How a Long Password Unlocks Accounts With No Password

In November 2026, OpenSSH disclosed a critical authentication bypass vulnerability affecting Alpine Linux systems running the standard openssh-server package. Attackers with network access, a valid account name, and a password between 257 and 1,024 bytes could log into accounts configured with no password—including key-only accounts and, under certain conditions, root. The flaw stems from an interaction between OpenSSH's salt-borrowing mechanism (introduced in 2016 to prevent username enumeration) and musl libc's behavior of returning a bare asterisk when crypt() receives a password exceeding 256 bytes, inadvertently matching the stored asterisk of a passwordless account. OpenSSH released version 10.6p2 and Alpine issued patched packages within one day of discovery, with no reported exploitation at time of disclosure. This incident underscores how compounding design decisions across independent open-source components—each individually reasonable—can create critical security gaps years later. As Alpine Linux is widely used in container base images and cloud-native environments, the blast radius for unpatched systems is significant, especially where password authentication remains enabled by default.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Anyone Could Rent a White House IP Address for Less Than a Dollar — Here's How It Happened
Anyone Could Rent a White House IP Address for Less Than a Dollar — Here's How It Happened
Government Administration3 days ago

Anyone Could Rent a White House IP Address for Less Than a Dollar — Here's How It Happened

Between October and November 2026, security researchers discovered that multiple residential proxy services—including Infatica, a program linked to Russian hosting operator Vladimir Fomenko whose infrastructure was used in 2016 U.S. election cyberattacks—were actively beaconing from the Executive Office of the President's network (AS2650). Layer3 Intel identified six IP addresses across 26 of 30 days, with 28 separate proxy services able to exit through the White House network, meaning anyone paying as little as 60 cents per gigabyte could route traffic through one of the most sensitive government networks in the world. The root cause was SDK-embedded proxy software silently installed via free consumer applications on staff devices. This incident underscores how supply-chain SDK compromise and insider-risk through consumer app usage can silently weaponize trusted government or enterprise networks as anonymous proxy infrastructure. As residential proxy networks proliferate—found in nearly 300 government networks and 65% of enterprise DNS environments—the risk of nation-state actors exploiting these footholds for reconnaissance, data exfiltration, or lateral movement has reached a critical threshold demanding immediate egress visibility and policy enforcement.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
APT29's Apple Zero-Day Chain: How a Patched CVE Became a 2026 Espionage Weapon
APT29's Apple Zero-Day Chain: How a Patched CVE Became a 2026 Espionage Weapon
Government Administration3 days ago

APT29's Apple Zero-Day Chain: How a Patched CVE Became a 2026 Espionage Weapon

In November 2026, CISA added CVE-2024-27834 — a Pointer Authentication bypass flaw affecting iOS, iPadOS, macOS, tvOS, watchOS, and Safari — to its Known Exploited Vulnerabilities catalog after active exploitation was confirmed. Threat actors linked to Russian state-sponsored group APT29 (Cozy Bear / Midnight Blizzard) chained this flaw with a WebKit remote code execution vulnerability (CVE-2025-43529) to deploy browser-focused infostealers. Attack vectors included compromised legitimate websites, spoofed brand domains, and a supply chain compromise of the Plerdy SEO Tracker. The exploit chain harvested browser cookies and device credentials, targeting organizations reliant on Safari-based workflows. This campaign highlights the accelerating trend of nation-state actors weaponizing patched — but unmitigated — CVEs months or years after disclosure. APT29's use of multi-vector initial access and zero-click WebKit chains signals a maturation in browser-based espionage tradecraft that directly threatens enterprises with unmonitored egress traffic and insufficient lateral movement controls.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports