✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
F5 2024 Breach: Nation-State Attack Highlights Supply Chain Risks
In June 2024, F5—a leading provider of application security and delivery products—disclosed a sophisticated cyberattack attributed to a nation-state actor. The breach was first discovered on August 9, 2023, and involved unauthorized, prolonged access to F5’s BIG-IP product development environment and its internal engineering knowledge platform. Although the attackers exfiltrated files containing segments of BIG-IP source code and limited customer configuration details, external forensic reviews confirmed no tampering with F5’s supply chain processes or build systems. No customer-facing platforms, including NGINX and Distributed Cloud Services, were affected, and the company found no evidence of critical vulnerabilities or malicious code insertion. This incident is particularly important due to increasing nation-state supply chain attacks targeting core infrastructure vendors. It highlights growing risks to software development environments and the potential cascade effects on enterprise and government clients dependent on widely used technologies.
6 months ago
Kill Chain
Chinese APT Exploits ArcGIS Tool for Stealthy Persistence and Credential Theft
In 2025, a Chinese state-sponsored Advanced Persistent Threat (APT) group, attributed to Flax Typhoon, maintained over a year of undetected access to an organization's network by exploiting a public-facing ArcGIS geo-mapping server. The attackers leveraged stolen administrator credentials to upload a malicious Java Server Object Extension (SOE) acting as a covert web shell, allowing them to execute commands via a REST API and escalate privileges internally. Persistence was further established by deploying SoftEther VPN Bridge, enabling encrypted outbound connectivity and facilitating lateral movement, data exfiltration, and credential harvesting within the victim's environment. This incident underscores the increasing sophistication of APTs exploiting legitimate third-party software and obscure admin features for stealthy, long-term persistence. The method's novelty, combined with highly targeted credential theft and the use of living-off-the-land techniques, highlights urgent gaps in detection, segmentation, and secure configuration, especially in public-facing or critical GIS applications.
6 months ago
Kill Chain
Framework’s 2025 Secure Boot Bypass: How Signed UEFI Debug Tools Created a Supply-Chain Crisis
In October 2025, firmware security researchers revealed a supply-chain vulnerability affecting nearly 200,000 Framework Linux laptops, caused by the inclusion of signed UEFI shells with the powerful 'mm' (memory modify) command. This legitimate but dangerous command, intended for hardware debugging, could be used by attackers with local or physical access to bypass Secure Boot by overwriting memory critical to the boot process—disabling signature verification and enabling the loading of bootkits like BlackLotus or HybridPetya. The issue was not the result of an external compromise but a manufacturing oversight, impacting several Framework 13 and Framework 16 models, with firmware updates and mitigation guidance swiftly issued. This vulnerability highlights a growing risk in hardware supply-chain security, where trusted vendor-signed components can inadvertently enable sophisticated attacks that persist even after OS reinstalls. As attackers increasingly target firmware and boot processes, the incident underscores the urgency for robust device-level and manufacturing-time security controls.
6 months ago
Kill Chain
Oracle EBS Zero-Day: How ShinyHunters and Clop Launched 2025's Most Notorious Data Extortion Attacks
In October 2025, Oracle silently released out-of-band patches for a critical zero-day vulnerability (CVE-2025-61884) in its E-Business Suite, following active exploitation by the ShinyHunters extortion group. The flaw allowed attackers to perform unauthenticated Server-Side Request Forgery (SSRF) and potentially remote code execution, leading to unauthorized access and data theft from affected servers. Clop ransomware actors also launched parallel extortion campaigns targeting Oracle EBS customers, leveraging separate yet related zero-day vulnerabilities to steal sensitive corporate data and demand ransom payments. Multiple exploits and proofs-of-concept were shared publicly, increasing organizational risk and pressure for rapid patching. This incident underscores the growing sophistication and collaboration among ransomware and extortion groups exploiting enterprise zero-day vulnerabilities for data theft and financial gain. The release and weaponization of public exploits highlight a rising trend of supply chain risk and the urgent need for continuous vulnerability management, proactive patching strategies, and advanced east-west traffic controls.
6 months ago
Kill Chain
Microsoft October 2025 Patch Tuesday: Six Zero-Days and 172 Vulnerabilities Addressed
In October 2025, Microsoft released security patches addressing 172 vulnerabilities across its product suite, including six actively-exploited zero-day flaws. These vulnerabilities exposed users to potential remote code execution, privilege escalation, and data leakage risks. The zero-days were exploited prior to patch release, affecting Windows, Office, and other core services. Security researchers and threat intelligence teams observed active exploitation in the wild, prompting urgent patching and incident response from enterprises globally. Microsoft’s rapid disclosure and remediation response helped to mitigate further threat actor activity and contain the immediate risk. The significance of this Patch Tuesday lies not only in the sheer number of vulnerabilities and zero-days but also in the increasing prevalence of opportunistic and targeted attacks against widely-used software. Organizations are under heightened pressure to maintain timely patch cycles, given growing regulatory scrutiny and sophisticated attacker TTPs.
6 months ago
Kill Chain
Pixnapping: The 2025 Android Vulnerability Stealing MFA Codes Pixel by Pixel
In October 2025, researchers unveiled a new Android vulnerability called 'Pixnapping,' enabling malicious applications with zero special permissions to exfiltrate sensitive screen data—such as multi-factor authentication (MFA) codes, chat messages, and emails—pixel by pixel via a GPU-based side-channel attack. The attack exploits the way Android's SurfaceFlinger composes app windows and leverages a graphics compression side-channel (GPU.zip) to reconstruct sensitive on-screen information. Pixnapping affects modern and fully patched Android 13–16 devices from Google and Samsung, and researchers demonstrated that 2FA codes could be exfiltrated in under 30 seconds, while more extensive data (such as chat logs) could be compromised within hours. Although Google attempted a patch in September, an effective fix is only expected in the December 2025 Android update, with GPU vendors yet to announce mitigation plans. This incident underscores a growing trend in side-channel and screen-based attacks, reflecting how even trusted software stacks and hardware abstraction layers can be used to bypass isolation. The Pixnapping method exposes the gaps in mobile OS zero-trust models—and with rising adoption of MFA and privacy-driven apps, the risk to enterprises and consumers is heightened.
6 months ago
Kill Chain
Windows 10 End-of-Support: Patch Tuesday Signals Urgent Lifecycle Risk in 2025
In October 2025, Microsoft released KB5066791, the final mandatory Patch Tuesday update for Windows 10 as the operating system officially reached end-of-support status. This update addressed six zero-day vulnerabilities and 172 additional flaws. With free support and security updates discontinued, only customers enrolled in extended security updates (ESUs) are eligible for further patches. The shift leaves millions of endpoints—including in enterprise and consumer environments—potentially vulnerable to emerging threats targeting unpatched or unsupported Windows 10 systems as threat actors historically target end-of-life platforms for exploitation. The update also modified components like the Azure validation chain and removed outdated drivers, signaling a definitive end to mainstream security support. This event is particularly significant due to the accelerated exploitation trends observed following previous Microsoft OS end-of-life events. Attackers rapidly pivot to leverage newly found or previously unreported vulnerabilities, resulting in heightened lateral movement and potential compliance risks. Organizations must act swiftly to upgrade, implement segmentation, and enhance detection capabilities to avoid becoming easy targets.
6 months ago
Kill Chain
How Hacktivists Used Hashtags and DDoS to Disrupt in 2025
In early 2025, a surge in global hacktivist operations was observed, coordinated primarily via Telegram and X (formerly Twitter), with attackers leveraging hashtags to claim credit, issue threats, and organize campaigns. Over 120 hacktivist groups, originating in the MENA region but targeting organizations worldwide—including government, finance, and critical infrastructure—conducted highly visible DDoS attacks. These operations favored impact and propaganda over technical sophistication, resulting in significant service disruptions and reputational challenges for numerous victims, with attack announcements and proof frequently disseminated in near real-time. The campaign reflects a broader shift toward open, social-media-driven hacktivist tactics that often transcend regional geopolitics. As DDoS tools become more accessible and social platforms amplify coordination, all organizations—regardless of direct involvement in conflicts—face increased risk from ideologically motivated cyberattacks.
6 months ago
Kill Chain
Windows 11 Recall: New AI Feature Raises Alarming Data Security Concerns
In May 2025, security researchers highlighted significant privacy and security concerns in the Windows 11 Recall feature, an AI-powered function that automatically captures and stores screenshots and context of user activity. Although designed to enhance productivity by allowing seamless search and recall, the feature stores sensitive information—including potential credentials, private messages, and payment data—without robust controls or proven encryption. The built-in privacy filtering was found to be unreliable, enabling attackers or malware to leverage Recall’s artifacts to reconstruct user activity or exfiltrate high-value data. Because the Recall database is accessible without administrative privilege, organizations relying on default configurations could unintentionally expose critical information or face regulatory risks. This incident underscores the urgent need for organizations to review new operating system features before broad deployment, especially as attackers increasingly target post-compromise artifacts and AI-powered data collectors. High-profile attention to Recall has driven further debate on privacy standards and compliance, with heightened scrutiny from both regulators and security leaders.
6 months ago
Kill Chain
SolarWinds & MOVEit: The Wake-Up Call for Modern Supply Chain Cybersecurity
In recent years, a wave of major supply chain cyberattacks—most notably the SolarWinds compromise in 2020 and the MOVEit Transfer breach in 2023—have demonstrated how adversaries exploit trusted vendors to bypass defenses at scale. In the SolarWinds incident, attackers injected malicious code into the Orion software updates, leading to undetected access across 18,000 organizations, including government agencies and Fortune 500 companies. Just three years later, a zero-day vulnerability in MOVEit’s file transfer software enabled ransomware group Clop to exfiltrate and manipulate sensitive data from more than 2,000 global organizations, impacting over 62 million individuals. These incidents not only inflicted operational and reputational damage but also instigated regulatory and legal scrutiny, highlighting that even the most secure organizations remain vulnerable through third-party dependencies. Supply chain attacks now pose an elevated risk as threat actors increasingly target software providers, managed service firms, and widely used platforms to maximize reach and disruption. Rising regulatory expectations on supply chain oversight, combined with new TTPs like supply chain ransomware and identity abuse, solidify supply chain risk as a top boardroom and CISO concern.
6 months ago
Kill Chain
Fortra GoAnywhere MFT Breach: How CVE-2025-10035 Enabled a Major Ransomware Attack
In September 2025, Fortra disclosed that its GoAnywhere Managed File Transfer (MFT) platform suffered from a critical vulnerability (CVE-2025-10035) that was actively exploited by threat actors. Attackers leveraged this flaw—reportedly requiring a private cryptographic key, the origins of which are still unclear—to gain unauthorized access, moving laterally within cloud-based environments and exfiltrating data. Notably, Microsoft attributed ransomware intrusions and multi-stage attacks to a criminal group tracked as Storm-1175, leading to business disruptions and heightened risk for GoAnywhere users. Fortra responded by patching its services, investigating suspicious activity, and notifying affected customers, though questions remain regarding the root cause and extent of private key compromise. This incident highlights the growing risk of supply chain and third-party software vulnerabilities being exploited in ransomware campaigns. The exploitation of cryptography-dependent mechanisms signals an evolving sophistication among threat actors, pressing organizations to reconsider approaches to privileged cryptographic assets and drive urgency in patch management.
6 months ago
Kill Chain
Flax Typhoon Turns ArcGIS Features Into Espionage Backdoor: 2024 Breach Analysis
In early 2024, security researchers revealed that Chinese state-backed group Flax Typhoon covertly infiltrated ArcGIS server environments, maintaining backdoor access for over a year by exploiting legitimate software features. By compromising a backend administrator account, attackers deployed a malicious Server Object Extension (SOE) that blended with normal operations, enabling a persistent webshell and establishing a hidden workspace inaccessible to others. Critically, the attackers embedded their access into system backups, ensuring reinfection even after potential forensics or restoration activities. This sophisticated campaign allowed Flax Typhoon to spy on entities across the U.S., Europe, and Taiwan with minimal use of detectable malware. The incident demonstrates a significant shift towards using trusted enterprise software as an attack vector and reveals how recovery mechanisms like backups become liabilities if not properly verified. Similar living-off-the-land techniques are rising in frequency, challenging traditional security monitoring and incident response strategies.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports