✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
2024 Smart Building Zero-Day: Global Infrastructure Exposed
In early 2024, cybersecurity researcher Gjoko Krstic uncovered hundreds of zero-day vulnerabilities within legacy building automation systems still widely deployed in hospitals, schools, and commercial facilities globally. The investigation, codenamed "Project Brainfog," revealed that outdated codebases, some as old as 18 years, exposed critical physical infrastructure to remote compromise by unauthenticated attackers. Exploitable weaknesses in authentication, encryption, and access controls allowed for the manipulation of HVAC, security, and energy systems, putting sensitive environments such as medical and educational facilities at operational risk, and making them potential targets for ransomware and espionage. This incident highlights the growing threat of unpatched operational technology in critical sectors, as attackers increasingly target IoT and building control systems for both sabotage and lateral movement. As digital-physical convergence accelerates, organizations must rapidly modernize and secure these legacy environments to mitigate cascading risks.
6 months ago
Kill Chain
Insider at L3Harris Sells Cyber Exploits to Russian Broker in 2024 Breach
In early 2024, Peter Williams, a former executive at L3Harris Trenchant, a U.S. defense contractor, pleaded guilty to stealing and illicitly selling confidential cyber exploit information to a Russian broker. The insider utilized privileged access to exfiltrate sensitive data on cybersecurity vulnerabilities and offensive research, subsequently marketing this intelligence to foreign entities, including actors associated with the Russian cyber underground. The breach exposed L3Harris Trenchant's internal detection gaps, ultimately triggering a federal investigation and leading to Williams' prosecution in U.S. District Court. This incident underscores the growing threat posed by insider actors within critical infrastructure and defense sectors. It highlights the need for advanced detection, segmentation, and strict policy enforcement to counter the insider risk—especially as nation-state and organized crime demand for zero-day vulnerabilities and advanced cyber tools continues to escalate.
6 months ago
Kill Chain
CISA & NSA Issue 2024 Guidance to Harden Microsoft Exchange Servers
In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) issued joint guidance targeting administrators of Microsoft Exchange servers. This proactive measure follows a history of critical vulnerabilities in Exchange, which have enabled advanced threat actors and ransomware groups to access sensitive organizational email systems, often through unpatched servers and weak configurations. By outlining best practices for hardening Exchange, the agencies aim to help organizations mitigate risks from exploitation, data theft, and business disruption associated with increasingly sophisticated attack vectors seen throughout 2023 and 2024. This guidance reflects the heightened urgency around securing ubiquitous enterprise communications tools following high-profile breaches exploiting on-premise infrastructure. With persistent evolution in offensive capabilities and regulatory scrutiny increasing, consistently applying infrastructure hardening and Zero Trust controls is now critical for organizations of all sizes.
6 months ago
Kill Chain
Conduent’s 2024 Data Breach: Over 10 Million Records Stolen in Major BPO Attack
In June 2024, business process outsourcing giant Conduent confirmed a major data breach after attackers gained unauthorized access to its systems, exposing sensitive information of approximately 10.5 million individuals across the United States. The breach came to light following regulatory disclosures and was attributed to exploitation of a third-party vulnerability, allowing attackers to access personal data used in Conduent's healthcare and government services contracts. Impacted data reportedly includes names, social security numbers, addresses, and related identifiers tied to outsourced processing for public sector and healthcare organizations. This breach underscores persistent risks faced by organizations managing data at scale for critical sectors, with attackers increasingly targeting supply chain or third-party gaps. Growing regulatory scrutiny and rising consumer awareness are amplifying the urgency for improved data protection, robust access controls, and ongoing monitoring against sophisticated threat behaviors.
6 months ago
Kill Chain
CISA Orders Urgent Patch of VMware Tools Flaw Exploited by Chinese Hackers
In October 2024, Chinese state-sponsored hackers exploited a high-severity vulnerability in Broadcom’s VMware Aria Operations and VMware Tools software, targeting U.S. federal agencies through a software supply-chain attack. The attackers leveraged the unpatched flaw to gain unauthorized access, move laterally within networks, and potentially exfiltrate sensitive data. The Cybersecurity and Infrastructure Security Agency (CISA) responded by issuing an emergency directive, mandating all federal agencies to immediately patch the affected systems amid evidence of ongoing compromise. This incident underscores the persistent risks of vulnerable supply-chain components and the growing sophistication of state-sponsored adversaries. In light of increased regulatory scrutiny and rising exploitation of critical infrastructure platforms, organizations must prioritize rapid vulnerability management and layered defense strategies.
6 months ago
Kill Chain
Multi-Vector Attacks Surge: DNS Poisoning, Supply-Chain Compromise, and Rust Malware in 2025
In October 2025, a major multi-vector cyberattack was uncovered leveraging DNS poisoning, a sophisticated software supply-chain compromise, and the deployment of a new strain of Rust-based malware capable of evading traditional detection mechanisms. The attackers exploited vulnerabilities in third-party supplier code to infiltrate enterprise networks, enabling lateral movement via compromised DNS servers. Shortly thereafter, remote access trojans (RATs) and other post-exploitation tools were deployed, resulting in significant data exfiltration and disruption across multiple sectors. Incident response teams collaborated internationally to isolate affected systems and assess the operational damage. This event highlights a tightening attacker focus on high-value targets and critical infrastructure, driven by advances in malware tooling, zero-day exploitation, and the mainstream use of modern programming languages like Rust for stealthy payloads. The breach exemplifies how defenders must adapt to increasingly layered threats that combine classic attack vectors with contemporary tactics.
6 months ago
Kill Chain
New 'Brash' Chromium Exploit Exposes Enterprise Browser Risks in 2025
In October 2025, a severe vulnerability affecting Chromium-based browsers was publicly disclosed by security researcher Jose Pino. Nicknamed "Brash," this exploit targets the Blink rendering engine by manipulating specific DOM operations, allowing any attacker to crash a victim's browser with a single specially crafted URL. The vulnerability impacted Chrome, Edge, Brave, and other browsers using Chromium, raising concerns about both service disruption and potential for more severe follow-on attacks. The flaw could be triggered in as little as 15–60 seconds, posing a high risk for denial-of-service campaigns and widespread user impact until an emergency patch was released. The Brash exploit underscores increasing risks from 'zero-click' browser attacks. As reliance on web-based applications rises, threat actors increasingly target foundational browser components. This incident highlights the need for continuous monitoring and rapid browser patching in enterprise environments to counter such fast-moving threats.
6 months ago
Kill Chain
Russian Ransomware Leverages AdaptixC2: 2025's Open-Source Attack Surge
In mid-2025, threat intelligence sources reported that Russian ransomware groups had begun leveraging the open-source AdaptixC2 framework to orchestrate highly targeted, advanced ransomware campaigns. AdaptixC2, originally designed for penetration testing, was weaponized to facilitate command-and-control communications, enable lateral movement, and automate deployment of ransomware binaries across hybrid cloud and enterprise environments. The attackers exploited weak internal segmentation and monitoring deficiencies, achieving extensive encryption of critical systems, data exfiltration, and ransom demands that disrupted multiple sectors, including finance and healthcare. This incident reflects a broader trend: threat actors are rapidly operationalizing legitimate open-source red team tools for malicious purposes. Organizations must respond to this evolution in attacker strategies, as post-exploitation frameworks become increasingly prevalent in real-world breaches, complicating detection and increasing regulatory and operational risk.
6 months ago
Kill Chain
CISA Alerts on Five New Actively Exploited Vulnerabilities in Critical Platforms (2025)
On October 20, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) Catalog, adding five actively exploited vulnerabilities across products from Apple, Kentico, Microsoft, and Oracle. These critical flaws—ranging from authentication bypasses in Kentico Xperience to a server-side request forgery in Oracle E-Business Suite and improper SMB access control in Microsoft Windows—are being leveraged by threat actors to gain unauthorized access, escalate privileges, or exfiltrate data. The directive mandates federal agencies to urgently remediate these risks to safeguard the federal enterprise and critical infrastructure from rapidly evolving threats. The continued expansion of the KEV Catalog highlights the persistent challenge organizations face in tracking and rapidly remediating high-impact vulnerabilities, especially as exploit techniques become more sophisticated and widely disseminated. The urgency is underscored by both regulatory pressure and the increase in observed exploitation campaigns targeting these vulnerabilities across public and private sectors.
6 months ago
Kill Chain
CISA Warns of Active Exploitation: Motex LANSCOPE CVE-2025-61932 Added to KEV List
In October 2025, CISA added CVE-2025-61932 to its Known Exploited Vulnerabilities catalog after confirmation that attackers were actively exploiting an improper verification of source vulnerability in Motex LANSCOPE Endpoint Manager. This flaw enables malicious actors to bypass authentication controls or inject unauthorized communications by exploiting weak checks on communication channels. As a result, federal networks and enterprises using the affected endpoint management platform face increased risk of unauthorized access, lateral movement, and potential data compromise. The vulnerability was discovered as part of ongoing efforts to monitor critical endpoint management systems for exploitation in the wild and is considered a significant risk vector, especially for organizations reliant on enterprise management tools. The inclusion of this vulnerability in CISA’s KEV catalog underscores a broader surge in attacks targeting endpoint management platforms, reflecting the ongoing evolution of attacker techniques against core IT infrastructure. Timely patching and visibility into east-west traffic is increasingly essential, as threat actors exploit gaps before organizations can remediate newly disclosed weaknesses.
6 months ago
Kill Chain
Critical DoS Flaw in NIHON KOHDEN CNS-6201 Exposes Legacy Healthcare Systems
In October 2025, a critical security vulnerability (CVE-2025-59668) was disclosed in the NIHON KOHDEN Central Monitor CNS-6201—a medical device used globally in healthcare environments. The flaw, a NULL pointer dereference triggered by a specially crafted UDP packet, allows attackers to remotely cause a denial-of-service (DoS) condition, resulting in abnormal termination of the monitoring process. Exploitation requires no authentication as long as the device is network-accessible. Affected models are end-of-support, placing healthcare environments at heightened risk if legacy equipment remains unsegmented or exposed. This exposure highlights continuing challenges associated with legacy medical devices, the urgency of network segmentation, and the importance of proactive vulnerability management in healthcare. Similar technique trends surrounding unauthenticated DoS vulnerabilities in critical infrastructure increase regulatory, patient-safety, and operational risk considerations.
6 months ago
Kill Chain
CISA Adds Adobe/Magento & WSUS Exploits to 2025 KEV Catalog
In October 2025, CISA added two newly discovered, actively exploited vulnerabilities—CVE-2025-54236 impacting Adobe Commerce and Magento, and CVE-2025-59287 impacting Microsoft Windows Server Update Services—to its Known Exploited Vulnerabilities (KEV) Catalog. Both vulnerabilities are believed to be leveraged by threat actors to gain unauthorized access and facilitate lateral movements within victim networks. Federal Civilian Executive Branch (FCEB) agencies are now required by BOD 22-01 to remediate these specific threats by the mandated due date, minimizing risk to critical government infrastructure and mission-critical digital assets. This inclusion highlights a rising trend of attackers weaponizing public-facing application and misconfigured update service vulnerabilities, reflecting an escalation in both attack sophistication and speed of exploitation. Organizations of all types face mounting regulatory and operational pressure to harden security posture and accelerate remediation response times.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports