✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
AI-Powered Cyberattack Compromises 600 Fortinet Firewalls in 2026
Between January 11 and February 18, 2026, a Russian-speaking threat actor utilized generative AI services to compromise over 600 FortiGate firewalls across 55 countries. The attacker exploited exposed management interfaces and weak credentials lacking multi-factor authentication, without leveraging any known vulnerabilities. Once access was gained, AI-assisted tools were employed to automate reconnaissance, extract configurations, and facilitate lateral movement within the networks. This campaign underscores the evolving threat landscape where AI technologies are being harnessed to amplify the capabilities of less sophisticated attackers, enabling them to execute large-scale intrusions with increased efficiency. Organizations must prioritize fundamental security measures, including securing management interfaces, enforcing strong authentication protocols, and maintaining vigilant monitoring to mitigate such AI-augmented threats.
5 months ago
Kill Chain
CISA Highlights Critical Roundcube Vulnerabilities Amid Active Exploitation
In February 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities affecting Roundcube webmail software to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation. The first, CVE-2025-49113, is a deserialization flaw allowing remote code execution by authenticated users due to improper validation of the '_from' parameter in 'upload.php'. The second, CVE-2025-68461, is a cross-site scripting vulnerability via the 'animate' tag in SVG documents. Both vulnerabilities have been exploited by threat actors, including nation-state groups like APT28 and Winter Vivern, to steal login credentials and spy on sensitive communications. ([thehackernews.com](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent targeting of webmail platforms by sophisticated adversaries. Organizations using Roundcube are urged to apply the latest security patches promptly to mitigate potential risks. ([thehackernews.com](https://thehackernews.com/2026/02/cisa-adds-two-actively-exploited.html?utm_source=openai))
5 months ago
Kill Chain
Predator Spyware's Stealthy Bypass of iOS Recording Indicators
In February 2026, security researchers uncovered that Intellexa's Predator spyware can suppress iOS's camera and microphone recording indicators, allowing covert surveillance without user awareness. By injecting code into SpringBoard, the spyware intercepts sensor activity updates, preventing the green and orange dots from appearing when the camera or microphone is active. This technique requires prior full device compromise, including kernel-level access, and does not exploit new iOS vulnerabilities. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/predator-spyware-hooks-ios-springboard-to-hide-mic-camera-activity/?utm_source=openai)) This discovery highlights the evolving sophistication of commercial spyware and underscores the importance of maintaining up-to-date device security measures. Users should be aware that visual indicators alone may not reliably signal unauthorized access to device sensors, emphasizing the need for comprehensive security practices.
5 months ago
Kill Chain
AI-Assisted Cyber Attack Compromises 600+ FortiGate Devices in 2026
Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor exploited exposed management ports and weak credentials to compromise over 600 FortiGate devices across 55 countries. Utilizing commercial generative AI tools, the attacker automated scanning for vulnerable devices and executed authentication attempts, leading to unauthorized access and potential data exfiltration. This incident underscores the growing trend of cybercriminals leveraging AI to scale operations, enabling even low-skilled actors to conduct widespread attacks. Organizations must prioritize securing management interfaces, enforcing strong authentication mechanisms, and monitoring for unauthorized access to mitigate such threats.
5 months ago
Kill Chain
AI-Powered Cyberattack Compromises Hundreds of FortiGate Devices Globally
Between January 11 and February 18, 2026, a Russian-speaking, financially motivated threat actor leveraged commercial generative AI services to compromise over 600 FortiGate devices across more than 55 countries. The attackers exploited exposed management ports and weak, single-factor authentication credentials, without utilizing any known FortiGate vulnerabilities. This campaign enabled the threat actor to extract full device configurations, including credentials and network topology information, facilitating further post-exploitation activities such as Active Directory compromise and credential harvesting. ([aws.amazon.com](https://aws.amazon.com/blogs/security/ai-augmented-threat-actor-accesses-fortigate-devices-at-scale/?utm_source=openai)) This incident underscores the evolving threat landscape where AI tools lower the technical barrier for cybercriminals, allowing even those with limited skills to execute large-scale attacks. Organizations must prioritize fundamental security measures, including securing management interfaces, enforcing strong authentication protocols, and maintaining vigilant monitoring to detect and respond to such AI-augmented threats.
5 months ago
Kill Chain
Roundcube 2025 Remote Code Execution Vulnerability
In June 2025, a critical vulnerability (CVE-2025-49113) was identified in Roundcube Webmail versions prior to 1.5.10 and 1.6.11. This flaw allowed authenticated users to execute arbitrary code on the server due to improper validation of the '_from' parameter in the 'upload.php' script, leading to PHP object deserialization. Exploitation of this vulnerability could result in complete server compromise, unauthorized access to sensitive email data, and potential lateral movement within the network. ([feedly.com](https://feedly.com/cve/CVE-2025-49113?utm_source=openai)) The discovery of this vulnerability underscores the importance of rigorous input validation and prompt patch management. Organizations using affected versions of Roundcube Webmail are urged to upgrade to the latest versions to mitigate potential exploitation risks.
5 months ago
Kill Chain
Credential Theft Leads to Massive Data Breach at French Ministry of Finance
In late January 2026, the French Ministry of Finance reported a significant data breach involving unauthorized access to the national bank account registry, FICOBA. A threat actor exploited stolen credentials from a government official to access sensitive information on approximately 1.2 million bank accounts. The compromised data included bank account details (RIBs/IBANs), account holder identities, physical addresses, and, in some cases, taxpayer identification numbers. Upon detection, the Ministry promptly restricted the unauthorized access and initiated measures to notify affected individuals and financial institutions. This incident underscores the critical importance of robust access controls and credential management within governmental systems. The breach highlights the escalating risks associated with credential theft and the necessity for enhanced cybersecurity measures to protect sensitive financial data. Organizations are urged to reassess their security protocols to mitigate similar threats.
5 months ago
Kill Chain
BeyondTrust 2026 RCE Vulnerability Exploited in Ransomware Attacks
In early February 2026, BeyondTrust disclosed a critical pre-authentication remote code execution (RCE) vulnerability, CVE-2026-1731, affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. This flaw allows unauthenticated attackers to execute arbitrary operating system commands by sending specially crafted requests to vulnerable endpoints. Despite the release of patches, active exploitation began almost immediately, with threat actors deploying ransomware and exfiltrating data. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on February 13, 2026, emphasizing the urgency for organizations to apply the necessary updates. The rapid exploitation of CVE-2026-1731 underscores a concerning trend where attackers swiftly leverage newly disclosed vulnerabilities to launch ransomware campaigns. This incident highlights the critical need for organizations to implement robust patch management processes and maintain vigilant monitoring to detect and respond to such threats promptly.
5 months ago
Kill Chain
Abu Dhabi Finance Week 2026 Data Breach: A Cloud Misconfiguration Exposes VIP Passport Details
In early February 2026, Abu Dhabi Finance Week (ADFW) experienced a significant data breach due to a misconfigured cloud storage environment managed by a third-party vendor. This misconfiguration exposed scans of over 700 passports and identity cards belonging to high-profile attendees, including former British Prime Minister David Cameron and U.S. investor Anthony Scaramucci. The breach was discovered by cybersecurity researcher Roni Suchowski, who found that the sensitive documents were publicly accessible without password protection. Upon notification, ADFW promptly secured the environment and stated that access activity was limited to the researcher who identified the issue. The incident underscores the critical importance of securing cloud storage configurations to prevent unauthorized access to sensitive information. ([techradar.com](https://www.techradar.com/pro/security/abu-dhabi-finance-summit-exposes-personal-data-passport-info-of-hundreds-of-major-global-figures?utm_source=openai)) This breach highlights the ongoing risks associated with cloud misconfigurations, which continue to be a leading cause of data exposure. As organizations increasingly rely on cloud services, ensuring proper configuration and regular security audits is essential to protect sensitive data and maintain trust with stakeholders.
5 months ago
Kill Chain
Critical Vulnerabilities in EnOcean SmartServer IoT: Immediate Action Required
In February 2026, critical vulnerabilities were identified in EnOcean's SmartServer IoT versions up to 4.60.009. These flaws, CVE-2026-20761 and CVE-2026-22885, allowed remote attackers to execute arbitrary OS commands and cause memory leaks via specially crafted LON IP-852 management messages. Exploitation could lead to unauthorized control over affected devices and potential data breaches. EnOcean promptly addressed these issues by releasing SmartServer 4.6 Update 2 (v4.60.023) and provided a hardening guide to enhance security measures. Organizations utilizing SmartServer IoT are urged to update to the latest version and implement recommended security practices to mitigate risks associated with these vulnerabilities.
5 months ago
Kill Chain
Sandworm's DynoWiper Targets Poland's Energy Sector in 2025 Cyberattack
In late December 2025, Poland's energy infrastructure was targeted by a coordinated cyberattack deploying a novel data-wiping malware named DynoWiper. The attack aimed to disrupt operations across multiple renewable energy facilities, including wind and solar farms, as well as a major combined heat and power plant serving approximately 500,000 customers. ESET researchers attributed the attack to the Russian state-sponsored group Sandworm with medium confidence, noting similarities to previous incidents involving wiper malware. Fortunately, the attack was intercepted before causing significant operational disruptions. ([eset.com](https://www.eset.com/us/about/newsroom/research/eset-research-russian-sandwormapt-attacks-energy-company-poland-with-dynowiper/?utm_source=openai)) This incident underscores the evolving threat landscape where state-sponsored actors increasingly target critical infrastructure with destructive malware. The timing, coinciding with the 10th anniversary of Sandworm's 2015 attack on Ukraine's power grid, highlights the symbolic nature of such operations and the persistent risk to energy sectors globally. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/eset-research-sandworm-cyberattack-poland-power-grid-late-2025/?utm_source=openai))
5 months ago
Kill Chain
BeyondTrust's Critical RCE Vulnerability: A 2026 Cybersecurity Wake-Up Call
In February 2026, BeyondTrust disclosed a critical pre-authentication remote code execution (RCE) vulnerability, CVE-2026-1731, affecting its Remote Support (RS) and Privileged Remote Access (PRA) products. This flaw allows unauthenticated attackers to execute operating system commands remotely, potentially leading to full system compromise, unauthorized access, data exfiltration, and service disruption. The vulnerability impacts Remote Support versions 25.3.1 and prior, and Privileged Remote Access versions 24.3.4 and prior. BeyondTrust applied patches for SaaS customers on February 2, 2026, but self-hosted customers must manually apply updates to mitigate the risk. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/09/beyondtrust-remote-access-vulnerability-cve-2026-1731/?utm_source=openai)) The rapid exploitation of CVE-2026-1731 underscores the increasing speed at which threat actors leverage newly disclosed vulnerabilities. Within 24 hours of a proof-of-concept exploit being released, attackers began targeting vulnerable systems. This incident highlights the critical importance of timely patch management and proactive security measures to defend against emerging threats. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/13/beyondtrust-cve-2026-1731-poc-exploit-activity/?utm_source=openai))
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports