✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Memento Spyware: Chrome Zero-Day Attack Sheds Light on Evolving Spyware Threats
In early 2024, cybersecurity researchers identified active exploitation of a zero-day vulnerability in Google Chrome by Memento Labs, deploying sophisticated spyware against select targets worldwide. Memento Labs, known as the successor to the notorious Hacking Team, leveraged the undocumented Chrome exploit to remotely compromise endpoints and gain persistent access. The campaign allowed attackers to harvest sensitive data, monitor communications, and exfiltrate information from compromised browsers, with initial infections traced via malicious websites distributing tailored payloads. Businesses affected faced risks of data breaches, espionage, and unauthorized surveillance impacting operational and reputational trust. This attack is significant due to the revival of commercially available offensive spyware targeting widely used software through zero-days. As high-profile threat actors increasingly exploit browser vulnerabilities, organizations face a heightened threat landscape requiring advanced detection and zero trust protections.
6 months ago
Kill Chain
Invisible Unicode: A 2024 Phishing Campaign Evades Filters with Steganographic Subjects
In October 2024, a targeted phishing campaign exploited invisible Unicode characters—specifically soft hyphens—in email subject lines and bodies to evade detection by automated email filtering systems. The attackers crafted emails with subjects encoded in MIME 'encoded-word' format and used invisible characters to break up suspicious keywords, rendering them undetectable by many traditional filtering solutions. The email lured recipients to a generic credential-stealing webmail page via a deceptive link, aiming to harvest login credentials. This incident highlights a growing trend of adversaries leveraging subtle encoding techniques and Unicode manipulation to bypass security controls. Recent phishing attacks demonstrate increasing sophistication, making it critical for organizations to update their detection mechanisms and user awareness to defend against such evasive TTPs.
6 months ago
Kill Chain
Microsoft WSUS RCE Vulnerability (CVE-2025-59287): Supply Chain Attack Exposes Critical Gaps
In November 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-59287, was identified and exploited in Microsoft’s Windows Server Update Services (WSUS). Threat actors leveraged this flaw by sending malicious payloads via unpatched WSUS endpoints, enabling them to execute arbitrary code on affected servers. The attackers’ methodology consistently involved targeting organizations with exposed WSUS interfaces, compromising update mechanisms, and gaining privileged access. The attack resulted in the deployment of malware, lateral movement within enterprise networks, and in certain cases, potential data exfiltration and operational disruptions. This incident highlights an increasing threat trend involving supply chain attacks that target software update infrastructure. The exploitation of a widely-used service like WSUS underscores the evolving sophistication of attackers and the importance of rapid patching, robust segmentation, and east-west traffic controls in mitigating emerging remote code execution threats.
6 months ago
Kill Chain
Remote Code Execution: WSUS Patch Bypass Turns Trusted Update Service Into Attack Platform
In June 2024, attackers exploited a critical remote code execution vulnerability (CVE-2025-59287) in Microsoft’s deprecated Windows Server Update Services (WSUS), bypassing an emergency patch that was meant to mitigate the threat. Attackers leveraged publicly exposed WSUS servers, executing unauthenticated commands that enabled environmental enumeration and potential data exfiltration. Researchers observed threat activity just hours after Microsoft released a revised patch, with at least 2,800 exposed WSUS instances identified globally. These servers, operating with high system privileges, presented an ideal entry point for attackers to target downstream systems via malicious software updates, elevating the risk of a far-reaching internal supply chain compromise. This incident highlights the increasing risk associated with outdated and internet-exposed infrastructure. It underscores the rapid pace of threat actor adaptation—often outpacing defenders’ patch cycles—and demonstrates the necessity for organizations to promptly apply patches and follow defense-in-depth practices for critical administrative tools.
6 months ago
Kill Chain
How Memento Labs' ForumTroll Campaign Exploited Chrome Zero-Day with Dante Spyware
In early 2024, cybersecurity researchers at Kaspersky uncovered an advanced malware campaign, codenamed 'Operation ForumTroll,' targeting Russian government entities, media outlets, financial institutions, and research organizations. The campaign was linked to Memento Labs, the successor to the notorious Italian surveillance company Hacking Team. Leveraging a zero-day vulnerability in Google Chrome, attackers distributed personalized phishing emails which, when clicked, led victims to malicious websites; no further interaction was required to infect devices. The campaign enabled espionage, data exfiltration, and surveillance with high sophistication, including the deployment of a new commercial spyware tool known as 'Dante.' This incident highlights the increasing commercialization and sophistication of spyware operations, the targeting of Russian organizations by state-aligned APTs, and the ongoing exploitation of zero-day vulnerabilities in popular software. It underscores the urgency for organizations to proactively monitor threat activity and patch systems swiftly.
6 months ago
Kill Chain
CISA Orders Immediate Patch for Critical Windows Server WSUS Flaw Exploited in Attacks
In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued an emergency directive requiring all U.S. government agencies to urgently patch a critical Windows Server Update Services (WSUS) vulnerability after it was found to be actively exploited in the wild. Attackers leveraged the flaw to gain unauthorized access to Windows Server environments via malicious update mechanisms, potentially allowing for privilege escalation and lateral movement within targeted networks. The incident raised concerns about the rapid exploitation of newly discovered vulnerabilities in core infrastructure and emphasized the necessity for timely patching and robust network segmentation to mitigate further risk. This incident underscores a broader surge in targeted attacks against on-premises infrastructure, with threat actors increasingly exploiting supply chain and software update mechanisms. It reveals an urgent need for organizations to prioritize vulnerability management and align with zero trust best practices, as high-profile vulnerabilities continue to be rapidly weaponized.
6 months ago
Kill Chain
QNAP Backup Software Exposed by Critical ASP.NET Vulnerability in 2024
In June 2024, QNAP, a prominent provider of network-attached storage (NAS) solutions, disclosed that its NetBak PC Agent backup utility for Windows is vulnerable to a critical ASP.NET Core flaw (CVE-2024-27348). This vulnerability, originally reported in Microsoft's platform, allows unauthenticated remote attackers to potentially execute arbitrary code or compromise data in transit. QNAP urged customers to apply security patches immediately, as exploitation may permit attackers to pivot from compromised endpoints to valuable NAS devices, affecting both business continuity and data confidentiality. The QNAP incident highlights the ongoing risk of supply-chain vulnerabilities, particularly when third-party software libraries are widely adopted. With attackers increasingly leveraging zero-day software flaws and targeting backup systems as initial entry points for ransomware and data exfiltration, IT teams must remain vigilant about patching integrations and dependencies across the entire software stack.
6 months ago
Kill Chain
Operation ForumTroll: How Memento Labs Used a Chrome Zero-Day for Global Spyware Attacks in 2024
In early 2024, a sophisticated cyber campaign, identified as Operation ForumTroll, exploited a Google Chrome zero-day vulnerability to deploy spyware linked to Memento Labs, an Italian commercial surveillance vendor. Attackers leveraged previously unknown browser flaws to quietly infect targets’ systems, enabling unauthorized espionage and data exfiltration. The malware was distributed through malicious websites and fully bypassed standard security defenses. This campaign has drawn special attention due to Memento Labs’ history—emerging from the notorious Hacking Team’s acquisition by IntheCyber Group—and its potential targeting of high-value individuals and organizations. This incident underscores the persistent threat of zero-day attacks sponsored by private spyware vendors, and signals an ongoing trend in commoditized surveillance. The rise of commercial spyware and browser-based exploits increases regulatory scrutiny and highlights gaps in enterprise endpoint and data-in-transit security.
6 months ago
Kill Chain
Google Refutes False Gmail Breach Claims: 2024’s Disinformation Lessons
In June 2024, widespread news reports falsely claimed that Google suffered a massive Gmail data breach affecting 183 million accounts. These reports, originating from threat actors attempting to sell alleged stolen data, quickly circulated across media outlets and online forums. Google promptly denied these claims, confirming after internal and external investigations that no breach had occurred and user data remained secure. The incident stemmed from recycled or previously disclosed information being misrepresented as new, leading to confusion and unwarranted concern among users and industry observers. This incident underscores the growing prevalence of cybersecurity disinformation campaigns aiming to erode trust in major service providers. Such false claims can create unnecessary panic, damage reputations, and distract from real threats, emphasizing the urgent need for robust threat validation and information hygiene in the modern digital landscape.
6 months ago
Kill Chain
Operation ForumTroll 2025: Memento Labs Revives APT Espionage with Chrome 0-day
In March 2025, Kaspersky uncovered Operation ForumTroll, a sophisticated espionage campaign targeting Russian government agencies, critical institutions, and media organizations. The threat actors employed personalized spear-phishing emails carrying unique, short-lived links; merely visiting these sites using Chrome or Chromium-based browsers enabled a zero-day exploit (CVE-2025-2783) to escape the browser sandbox. The attackers established system persistence via COM hijacking, then operated stealthy malware—LeetAgent and the commercial Dante spyware, attributed to Memento Labs (formerly Hacking Team)—to exfiltrate sensitive files and credentials, while leveraging cloud infrastructure for their C2 communications and tool delivery. This campaign exemplifies a new wave of highly targeted, sophisticated APT activity leveraging commercial spyware and advanced zero-day exploitation. As browser vulnerabilities and commercial surveillance tools increasingly intersect, organizations must urgently review security for endpoints, threat detection, and privileged access to counter fast-evolving espionage operations.
6 months ago
Kill Chain
LockBit 5.0 Resurgence: How WSUS and F5 Vulnerabilities Fueled 2025's Biggest Ransomware Wave
In October 2025, a coordinated wave of cyberattacks struck major enterprise environments worldwide. Attackers exploited Windows Server Update Services (WSUS) flaws and vulnerabilities in F5 infrastructure, deploying the new LockBit 5.0 ransomware variant. Using phishing, unauthorized RDP access, and advanced persistence techniques, LockBit affiliates moved laterally across networks, encrypting critical data and disrupting cloud-hosted workloads. Compromised systems experienced operational downtime, data theft, and subsequent ransom demands, while threat actor activity on underground forums confirmed an aggressive resurgence and evolving TTPs. This incident underscores the heightened pace and sophistication of ransomware operations, with threat actors exploiting both zero-day vulnerabilities and supply chain channels. As enterprise defenses adapt to increasingly hybrid and distributed infrastructure, recent attacks have spotlighted urgent needs for segmentation, real-time visibility, and policy enforcement to counter proactive adversary tactics.
6 months ago
Kill Chain
Qilin Ransomware Surge (2025): Hybrid Linux Attacks and BYOVD Tactics Challenge Defenses
In early to mid-2025, the notorious Qilin ransomware group (also known as Agenda/Gold Feather/Water Galura) executed a wave of aggressive hybrid cyberattacks, combining Linux-targeting ransomware payloads with a sophisticated BYOVD (Bring Your Own Vulnerable Driver) exploit. The attacks leveraged unpatched vulnerabilities to gain initial access, followed by lateral movement across multi-cloud and on-premises environments. Once inside, Qilin deployed encryption routines across both Windows and Linux servers, exfiltrated sensitive business data, and posted victim details on its dark web leak site, with attack volumes peaking at over 100 cases in June 2025. Organizations across healthcare, finance, and manufacturing were among those affected, experiencing significant operational disruptions, data exposure risks, and costly recovery processes. The rise of cross-platform ransomware with BYOVD techniques demonstrates attackers' growing technical sophistication and ability to evade traditional defenses. As ransomware-as-a-service (RaaS) operations like Qilin accelerate, organizations face increasing regulatory scrutiny and must enhance cloud, endpoint, and network segmentation strategies to defend against such adaptive threats.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports