✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Malicious OAuth Apps in Microsoft 365: A 2025 Cloud Identity Wake-Up Call
In October 2025, security researchers discovered widespread abuse of OAuth applications within Microsoft 365 environments, exposing tenants to covert identity compromise. Threat actors leveraged both legitimate and custom-built ("traitorware" and "stealthware") OAuth apps to establish persistent, unauthorized access by obtaining illicit consent to sensitive permissions, often evading detection for years. The incident, analyzed across 8,000+ organizations, revealed that nearly 10% had malicious or risky apps, often due to default configurations allowing broad consent and weak app governance, resulting in increased risk of credential theft, data exposure, and lateral movement. This incident underscores the growing threat of cloud identity attacks exploiting trusted cloud-native mechanisms like OAuth. As organizations accelerate Microsoft 365 adoption and attackers pivot to persistent, stealthy access models, regular auditing of app permissions and stronger identity threat detection become urgent priorities for reducing cloud risk.
6 months ago
Kill Chain
Microsoft Windows Smart Card Authentication Breakdowns After 2025 Security Update
In October 2025, Microsoft released security updates to address a cryptographic vulnerability (CVE-2024-30098) in Windows platforms, triggering widespread smart card authentication failures. The update, which altered default behavior from using CSP to KSP for RSA-based smart card certificates, disrupted authentication services across Windows 10, Windows 11, and Windows Server systems. Affected organizations reported issues such as failed logins, inability to sign documents, and critical service interruptions in workflows dependent on certificate-based authentication. The root cause was traced to a registry change designed to mitigate a feature bypass risk, inadvertently impacting legacy compatibility and 32-bit applications. This incident highlights how routine security hardening can introduce substantial operational risk, particularly for enterprises relying on legacy authentication methods. As businesses continue their path to zero trust and increase dependency on certificate-based systems, compatibility breakdowns following security improvements are becoming more prominent, amplifying pressures for comprehensive testing and rapid response strategies.
6 months ago
Kill Chain
CVE-2025-33073: Windows SMB Zero-Day Highlights Risks of Privilege Escalation and Patch Gaps
In October 2025, threat actors began actively exploiting a high-severity privilege escalation vulnerability (CVE-2025-33073) in Windows SMB services, affecting Windows 10, Windows 11 (up to 24H2), and all supported Windows Server releases. The flaw, caused by improper access control in SMB, allows attackers to gain SYSTEM-level privileges by tricking victims into connecting to a malicious SMB server via a crafted script or application. With proof-of-concept details publicly available before Microsoft’s June 2025 patch, threat actors rapidly weaponized the exploit, prompting emergency guidance from CISA for federal agencies and warnings for all organizations to remediate immediately. This incident highlights renewed attacker focus on privilege escalation vectors and supply chain weaknesses in ubiquitous network protocols. The rapid exploitation window, following public disclosure but prior to broad patch deployment, underlines the need for continuous vulnerability management, robust segmentation, and vigilant detection of lateral movement.
6 months ago
Kill Chain
Over 75,000 WatchGuard Firebox VPN Devices Vulnerable to Critical RCE Flaw
In October 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-9242, was disclosed in WatchGuard Firebox network security appliances. Nearly 76,000 public-facing Firebox devices worldwide are exposed, primarily in the United States and Europe. The flaw resides in the Fireware OS 'iked' process, which handles IKEv2 VPN negotiations. Attackers can exploit the vulnerability without authentication by sending specially crafted IKEv2 packets, leading to out-of-bounds memory writes and potentially full device compromise. WatchGuard has issued patches, but thousands remain unprotected, as many affected devices run versions that are end-of-life or unpatched. This incident underscores a continuing trend of attackers targeting network infrastructure with VPN-centric vulnerabilities, particularly impacting organizations reliant on legacy or unpatched systems. The rise of critical edge device exploits heightens urgency for patching and proactive segmentation, especially as regulatory scrutiny around infrastructure security tightens.
6 months ago
Kill Chain
Iranian Nation-State Hackers Target John Bolton’s Email in 2021 Security Breach
In July 2021, former U.S. National Security Adviser John Bolton's personal email account was compromised by cyber actors believed to be linked to the Islamic Republic of Iran. The attackers gained unlawful access, extracted emails containing potentially sensitive information, and leveraged these materials to threaten and attempt to coerce Bolton, including by referencing classified content and threatening public disclosure. The FBI became aware when Bolton’s representative reported the intrusion and subsequent extortion attempts, with the threat actor referencing previous high-profile leaks to amplify pressure. It remains unclear if any sensitive materials were publicly disseminated, but the incident elevated concerns around the exposure of classified or sensitive government information through personal communication channels. This incident highlights a persistent risk from nation-state actors targeting senior government officials, leveraging cyber-intrusions for espionage and psychological operations. With the proliferation of similar tactics against political, governmental, and critical infrastructure targets globally, this attack reflects an urgent need for heightened security controls on personal communications of high-profile public figures.
6 months ago
Kill Chain
F5 Supply Chain Breach 2025: China-Linked Attack Exposes Global BIG-IP Risk
In October 2025, F5 Networks disclosed a major cybersecurity incident involving a China-linked nation-state group (UNC5291) that gained unauthorized access to its infrastructure. Attackers reportedly maintained covert access for at least a year, stealing F5 BIG-IP source code and information on as-yet-undisclosed vulnerabilities. While F5 stated there’s no evidence of active exploitation of these flaws, the breach affects more than 266,000 exposed BIG-IP instances worldwide. The attackers leveraged advanced persistence techniques and deployed specialized malware, raising serious concerns about global supply chain integrity. This breach highlights the persistent targeting of critical infrastructure vendors by highly resourced nation-state actors. Government agencies and enterprises face heightened urgency as regulatory bodies issue emergency directives to patch devices, with compliance and operational risks elevated by the scale and sophistication of the attack.
6 months ago
Kill Chain
Critical Multi-Vendor Vulnerabilities Exploited in September 2025: Key Lessons for Zero Trust and Compliance
In September 2025, a wave of critical vulnerabilities across major vendors – including Cisco, TP-Link, Sitecore, and Adminer – were actively exploited by threat actors in high-impact campaigns. Attackers leveraged CVEs such as CVE-2025-20333 and CVE-2025-20362 in Cisco ASA devices to deploy advanced malware (RayInitiator and LINE VIPER), and exploited deserialization flaws in Sitecore (CVE-2025-53690) and Adminer SSRF (CVE-2021-21311) to enable data exfiltration, lateral movement, and persistent control. The vulnerabilities affected a diverse range of enterprise products and cloud platforms, enabling remote code execution and privilege escalation via sophisticated attack chains and, in some cases, public proof-of-concept exploits. This wide-ranging exploitation underscores the growing sophistication of attacker tradecraft and the urgent need for proactive, risk-driven vulnerability management. Given the increasing regulatory and operational impact of such incidents, organizations must prioritize patching, improve detection for abuse of critical CVEs, and strengthen security posture across hybrid environments.
6 months ago
Kill Chain
F5 Breach 2024: Nation-State Actors Steal Source Code and Vulnerabilities
In early 2024, F5 Networks suffered a significant security breach attributed to a sophisticated nation-state actor, which resulted in the theft of BIG-IP source code and undisclosed vulnerability details. The attackers leveraged targeted intrusion tactics, exploiting gaps in F5's internal protections to gain access to proprietary codebases and sensitive vulnerability information. This breach elevated the risk for F5’s enterprise and government customers, as the exposed vulnerabilities could facilitate future attacks on critical infrastructure globally. The incident highlights both supply chain implications and the heightened impact of intellectual property theft. This attack underscores a strategic shift where advanced threat actors seek not only data but also exploit software supply chains and zero-day vulnerabilities, raising urgent concerns for organizations dependent on key network infrastructure vendors. With regulatory scrutiny sharpening around supply chain risk and software assurance, incidents like this set new urgency for proactive defense and vendor risk management.
6 months ago
Kill Chain
Satellite Communications Exposed: 2025’s Unencrypted Data Crisis
In mid-2025, a landmark study revealed that a vast portion of global geostationary satellite communications—including critical infrastructure, government, corporate, and consumer data—are transmitted unencrypted. Security researchers, using inexpensive commercially available satellite equipment, intercepted highly sensitive transmissions such as internal communications, private calls and SMS, and in-flight internet traffic. Because thousands of geostationary transponders broadcast across enormous geographic areas, these unprotected signals can be passively accessed by unauthorized parties from virtually anywhere within satellite coverage zones, putting confidential data at significant risk of interception and exploitation. This incident underscores a persistent and growing concern regarding the lack of robust encryption in satellite communications, even as regulations and cyber threats evolve rapidly. Increasing satellite connectivity for aviation, maritime, and remote access drives urgency around encryption, as adversaries and data brokers exploit these vulnerabilities on a global scale.
6 months ago
Kill Chain
Adobe AEM Forms Zero-Day (CVE-2025-54253) Actively Exploited for Remote Code Execution
In October 2025, a maximum-severity vulnerability (CVE-2025-54253) in Adobe Experience Manager (AEM) Forms was discovered to be actively exploited in the wild. The flaw, allowing unauthenticated remote code execution via authentication bypass, affected AEM Forms on JEE versions 6.5.23 and earlier. Researchers from Searchlight Cyber originally reported the issue in April, but public exploit code and detailed writeups emerged before Adobe issued a patch in August. Attackers were able to exploit the misconfiguration to gain complete control over unpatched systems, endangering both public and private sector organizations. This incident underscores the increasing threat posed by delayed patching and public disclosure of unpatched zero-days. It highlights the importance of rapid vulnerability management, particularly for federal agencies under BOD 22-01, and serves as a warning for organizations to prioritize patching high-impact application flaws to protect critical business operations.
6 months ago
Kill Chain
Hackers Exploit Cisco SNMP Zero-Day to Deploy Rootkit on Switches
In October 2025, threat actors exploited a zero-day vulnerability (CVE-2025-20352) in Cisco networking devices, leveraging flaws in the Simple Network Management Protocol (SNMP) to gain remote code execution on affected IOS and IOS XE switches. Trend Micro reported that attackers primarily targeted Cisco 9400, 9300, and legacy 3750G series devices, deploying rootkits on switches and unprotected Linux systems. These rootkits established a persistent backdoor, allowing attackers to control device behavior, evade logging, bypass security controls, and move laterally across VLANs. Cisco acknowledged active exploitation and classified the issue as a zero-day, urging immediate firmware and ROM analysis if compromise is suspected. The incident highlights the continued targeting of network infrastructure via legacy vulnerabilities and sophisticated rootkits, as well as the pressing need for organizations to update detection capabilities, even on older or end-of-life systems. The use of unpatched infrastructure and the absence of robust endpoint detection provided attackers with a broad attack surface, underpinning the current urgency around zero trust networking and east-west traffic monitoring.
6 months ago
Kill Chain
Nation-State Breach of F5 Sparks CISA Emergency Directive for Federal Agencies
In mid-2024, F5 Networks disclosed that a sophisticated nation-state attacker gained prolonged, unauthorized access to its internal systems, compromising BIG-IP source code and undisclosed vulnerability details. The breach, detected in August, prompted the US Cybersecurity and Infrastructure Security Agency (CISA) to issue an emergency directive compelling federal agencies to immediately identify, patch, or disconnect thousands of F5 products in their environments. While no direct federal compromises have been reported yet, the theft of sensitive product and security information could facilitate widespread exploitation across both federal agencies and private organizations relying on F5 systems. This incident underscores heightened risks to supply chain integrity and critical infrastructure posed by persistent nation-state campaigns. With attackers targeting widely deployed technology vendors, government and industry face urgent pressure to enhance monitoring, rapid patching, and zero trust defenses to mitigate risks from downstream exploitation of software supply chains.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports