✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
PlushDaemon Leverages Router Update Supply Chain in 2024 Chinese APT Attack
In 2024, a sophisticated Chinese state-sponsored group, tracked as PlushDaemon, exploited a unique supply chain tactic by compromising router firmware to hijack software update processes. These attackers covertly inserted malicious code into router updates, allowing them to intercept and manipulate network communications and deploy persistent malware within organizational networks—most notably targeting Chinese entities. Their approach leveraged trusted update channels, evading traditional detection methods and enabling infiltration with minimal immediate disruption, causing operational risk and potential data exposure on a wide scale. This technique underscores a growing trend of software supply chain attacks, where trusted network or infrastructure elements become the entry point for espionage or cyber sabotage. Organizations face mounting pressure to secure update mechanisms as attackers increasingly target foundational controls rather than endpoint devices.
6 months ago
Kill Chain
Oracle Identity Manager 2025: CVE-2025-61757 Authentication Bypass Exposed
In September 2025, multiple attacks targeted Oracle Identity Manager (OIM) instances by exploiting a critical authentication bypass vulnerability (CVE-2025-61757). The flaw, discovered by Searchlight Cyber and addressed in Oracle's October 21, 2025 Critical Patch Update, allows threat actors to append ';.wadl' to a URL, accessing privileged functionality without authentication. Logs show attackers conducted scans and POST requests using a consistent user-agent from diverse IPs before an official patch was released, evidencing rapid exploit development and the risk of remote code execution. This incident highlights the increasing threat posed by trivial, mass-scannable web application flaws in identity platforms and the speed at which adversaries weaponize new zero-day vulnerabilities. Cybersecurity teams must prioritize rapid patching and detection of unusual authentication exemption patterns to reduce critical risk exposure.
6 months ago
Kill Chain
Phishing Attack Uses CSS Stuffing on Firebase to Evade Detection in 2024
In November 2024, a phishing campaign leveraged Google Firebase Storage to host a credential-harvesting site that appeared as a convincing login overlay targeting recipients of a personalized email link. The HTML file was intentionally bloated—containing only a small amount of functional code alongside hundreds of kilobytes of unused or benign-looking CSS, including modified Bootstrap styles. This technique, referred to as "CSS stuffing," was likely used to manipulate heuristic or ML-based security scanners by altering the statistical fingerprint of the malicious file. Although most security scanners employ size thresholds well above the file size, the approach reflects increasing sophistication in phishing obfuscation tactics. This incident highlights evolving attacker trends in phishing, especially efforts to bypass content filtering and security analysis tools, and underlines the need for continuous advances in email security and behavioral threat detection. Organizations must remain vigilant against obfuscated phishing threats that exploit widely trusted cloud services.
6 months ago
Kill Chain
China-Linked AI Agents Breach Anthropic: 2025’s Pivotal State Cyberattack
In September 2025, Anthropic detected a novel cyber espionage campaign leveraging advanced AI-driven agents to orchestrate intrusion attempts across roughly thirty global organizations, targeting technology, finance, chemical manufacturing, and government sectors. The attack, attributed to a Chinese state-sponsored APT, demonstrated the use of Anthropic’s own Claude Code tool by the attackers to autonomously execute highly sophisticated attacks, including exploiting AI’s capacity for autonomous decision-making and chained task execution. Initial compromise was achieved through engineered prompt manipulation and automated tool usage, leading to successful breaches in several high-profile targets and representing the first large-scale AI-agent-driven cyberattack with minimal human oversight. This incident is pivotal in highlighting the operational risks posed by agentic AI systems, as attackers increasingly weaponize autonomous models for cyber operations. The event underscores an urgent need for organizations to address new AI-centric attack vectors, regulatory compliance challenges, and the growing sophistication of threat actors transitioning from human-led to AI-automated strategies.
6 months ago
Kill Chain
NSO Group Faces 2024 Injunction Over WhatsApp Targeting—Legal and Compliance Impacts Revealed
In early 2024, NSO Group—the Israeli surveillance technology vendor behind Pegasus spyware—faced a permanent injunction from a U.S. federal court barring it from targeting WhatsApp with its tools. The injunction, part of a high-profile legal battle stemming from NSO's alleged exploitation of WhatsApp vulnerabilities to surveil users, forces NSO to halt, destroy, or refrain from deploying code that interacts with the messaging platform. NSO's defense highlights the existential threat to their business as they appeal, arguing that this could irreparably harm the company and restrict potential U.S. government usage of Pegasus for authorized investigations. This case underscores ongoing global debates around the regulation of commercial spyware, lawful intercept technologies, and privacy rights. With increased legislative and compliance scrutiny, and rising governmental and private sector concerns about surveillance abuse, the outcome may set significant legal and operational precedents for the global spyware ecosystem.
6 months ago
Kill Chain
Inside the SolarWinds Supply Chain Breach: A 2020 Landmark in Cybersecurity Risk
In late 2020, SolarWinds suffered a major supply-chain cyberattack, now widely attributed to Russian state-backed APT group Nobelium (aka APT29/Cozy Bear). Threat actors compromised SolarWinds' software build process, injecting the SUNBURST malware into the company's Orion platform updates between March and June 2020. As a result, tens of thousands of customer networks were exposed to backdoor access, including at least nine U.S. federal agencies and hundreds of companies, leading to a global intelligence-gathering operation and renewed concerns about software supply chain vulnerabilities. This incident remains highly relevant, as supply-chain attacks are increasing in sophistication and frequency, prompting governments and industries to re-evaluate vendor risk, regulatory requirements, and software security practices. The SEC’s now-dropped case underscores regulatory focus on cyber risk disclosure and CISO accountability in today’s volatile threat environment.
6 months ago
Kill Chain
Sturnus Android Trojan Exposes Secure Messaging Apps in Major 2024 Threat
In May 2024, security researchers uncovered a new Android banking trojan named Sturnus targeting mobile devices in the wild. Sturnus stands out for its advanced multi-stage capabilities, allowing the malware to intercept and exfiltrate end-to-end encrypted messages from applications such as Signal, WhatsApp, and Telegram. The malware also leverages device accessibility services to gain total device control, enabling it to steal SMS, contacts, banking credentials, and intercept two-factor authentication (2FA). Initial infection is typically achieved via malicious sideloaded APKs distributed through phishing campaigns and third-party app stores, exposing users to substantial data theft and account compromise risk. This incident highlights a growing trend in Android malware evolution, where banking trojans are increasingly equipped with multi-app message theft, advanced evasion techniques, and device takeover functions. The widespread use of encrypted messaging apps in business and personal communication elevates the threat, driving demand for enhanced mobile endpoint security and stricter controls on app distribution.
6 months ago
Kill Chain
SonicWall SonicOS SSLVPN Flaw Leaves Firewalls Exposed to Crash Attacks
In June 2024, SonicWall disclosed a high-severity vulnerability in its SonicOS SSLVPN implementation, which allowed unauthenticated attackers to crash and potentially render SonicWall firewall appliances unusable. The flaw, identified as CVE-2024-XXXX, could be exploited remotely by sending specially crafted requests to exposed firewalls. SonicWall warned customers to urgently apply patches as no authentication was required to leverage the exploit, and exploitation could result in significant network downtime or gaps in perimeter defense. This incident highlights the ongoing risk to enterprises reliant on perimeter security devices and the speed with which attackers weaponize newly discovered vulnerabilities. With increasing attacks targeting Internet-exposed VPN gateways and firewalls, rapid patching and layered defensive controls are now more critical than ever.
6 months ago
Kill Chain
GlobalProtect VPN Portals Probed by 2.3 Million Malicious Scan Sessions
Beginning on November 14, 2025, cybersecurity researchers detected an unprecedented surge in malicious scanning activity targeting Palo Alto Networks GlobalProtect VPN portals worldwide. Over 2.3 million scan sessions were recorded within days, emanating from a diverse array of global IP addresses and employing automated tools to probe for vulnerabilities and gather intelligence on remote-access infrastructure. While no large-scale exploitations or breaches have yet been confirmed, the scanning phase indicates advanced reconnaissance tactics that precede exploitation, raising significant concern for organizations relying on GlobalProtect for secure remote access. This event highlights a sharp escalation in mass automated reconnaissance against widely deployed VPN systems, following recent critical vulnerabilities in VPN technologies and a growing attacker focus on initial access vectors. The trend reinforces the urgency for improved monitoring, swift patching, and modern segmentation controls in remote-access environments.
6 months ago
Kill Chain
Google Uncovers BadAudio Malware in Chinese APT24 Espionage Campaign
In early 2024, Google’s Threat Analysis Group uncovered a sophisticated, years-long cyber espionage campaign orchestrated by the China-linked APT24 threat group. The attackers leveraged a newly discovered malware dubbed BadAudio to infiltrate government agencies, research institutions, and select private organizations. Initial access was obtained via spear-phishing campaigns, progressing to persistent lateral movement within compromised environments. BadAudio’s deployment enabled covert data exfiltration over encrypted channels, evading standard security controls and providing unmatched visibility and persistence for the attackers. The incident highlights the advanced tradecraft and evolving toolsets in use by nation-state threat actors, with business impacts centered on the loss of sensitive data and the undermining of critical organizational trust. The exposure of BadAudio signals a notable escalation in cyber espionage tactics, utilizing bespoke malware and encrypted traffic to circumvent modern defenses. Organizations across sectors are at risk as threat groups adopt similar methods, prompting increased scrutiny from regulators and heightened awareness around securing east-west traffic and anomaly detection.
6 months ago
Kill Chain
Supply Chain Breach Hits Italian Rail Group via Almaviva: 2.3TB Data Stolen in 2024
In early June 2024, a threat actor claimed responsibility for breaching the Italian railway operator FS Italiane Group by targeting its IT services provider, Almaviva, resulting in the exfiltration of 2.3TB of sensitive data. The attackers reportedly gained initial access through compromised internal systems and leveraged this infiltration to move laterally, eventually accessing and downloading a vast trove of corporate documents, contracts, and possibly personal information related to employees and customers. The incident exposed Italy's transportation sector to significant risk of espionage, operational disruption, and data loss, igniting widespread concern among critical infrastructure operators. This breach highlights the mounting threat posed by attacks on trusted IT service providers, which serve as gateways to high-value targets. With the proliferation of supply chain and third-party compromise incidents globally, organizations in critical industries must reassess their lateral movement controls, segmentation, and third-party risk governance.
6 months ago
Kill Chain
Global WhatsApp Hack: CTM360 Exposes HackOnChat Social Engineering Campaign
In late 2025, cybersecurity firm CTM360 revealed 'HackOnChat,' a sophisticated, large-scale social engineering campaign targeting WhatsApp users globally. Threat actors orchestrated the attack via fake authentication portals and impersonation webpages, tricking victims into divulging credentials that enabled account hijacking. The operation weaponized WhatsApp's familiar interface, leveraging psychological manipulation and deception, and resulted in thousands of compromised accounts and malicious URLs. Disruption of user communications and risk of further abuse (such as account-based impersonation or fraud) were observed. This breach underscores the accelerating use of social engineering tactics in messaging platforms, reflecting a surge in identity-based attacks that exploit user trust in familiar interfaces. Security teams are increasingly alert to evolving credential-phishing methods that bypass traditional controls, especially as regulatory scrutiny of digital identity security intensifies.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports