✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
CHILLYHELL and ZynorRAT: Cross-Platform RATs Evade Detection, Threaten Enterprise Environments (2025)
In September 2025, security researchers from Jamf Threat Labs uncovered two sophisticated malware strains: CHILLYHELL, a modular backdoor targeting macOS systems, and ZynorRAT, a Go-based remote access trojan spreading across Windows and Linux environments. CHILLYHELL, written in C++ for Intel macOS architectures, enables persistent remote access and exfiltrates sensitive data, while ZynorRAT facilitates cross-platform attacks and lateral movement. Both threats leverage encrypted communications and modular payloads to evade detection and expand their reach, highlighting attackers’ increasing investment in multi-OS toolkits. The campaign impacted diverse sectors by undermining endpoint trust and exposing organizations to data breaches, extortion, and operational disruption. This incident reflects an ongoing surge in cross-platform malware development, with adversaries targeting heterogeneous enterprise environments using advanced, modular code. The discovery underscores heightened regulatory scrutiny around endpoint security, zero trust enforcement, and incident response as ransomware and espionage risks escalate.
6 months ago
Kill Chain
Chinese APT Bypasses Philippine Military Defenses with EggStreme Fileless Malware (2025)
In September 2025, a Chinese advanced persistent threat (APT) group breached a Philippines-based military company using a sophisticated multi-stage attack leveraging the novel fileless malware framework, EggStreme. According to Bitdefender, the attackers achieved persistence and stealth by injecting their malicious code directly into memory and utilizing DLL sideloading to execute payloads without writing files to disk. This allowed them to maintain an undetected presence, conduct espionage, and potentially exfiltrate sensitive military and government data. The breach underscores ongoing risks to national security organizations from highly resourced nation-state actors employing advanced techniques. This incident highlights the emergence of more evasive, memory-resident malware frameworks targeting defense and critical infrastructure. Fileless attack methods such as those used by EggStreme are increasingly common and harder to detect, urging organizations to adopt advanced threat detection, improved segmentation, and robust incident response capabilities.
6 months ago
Kill Chain
Akira Ransomware Exploits SonicWall SSL VPN Flaw in 2025 – What You Need to Know
In late July 2025, threat actors affiliated with the Akira ransomware group launched a wave of attacks by exploiting a vulnerability and misconfigurations in SonicWall SSL VPN appliances. Cybersecurity firm Rapid7 reported a notable surge in intrusions targeting these devices, leveraging unsecured remote access pathways for initial compromise. Once inside, attackers escalated privileges, moved laterally, and deployed ransomware to encrypt critical data, causing extensive operational disruptions for affected organizations. The attacks highlighted gaps in east-west traffic monitoring, segmentation, and visibility, leaving many networks vulnerable to rapid malware spread and data loss. This breach underscores ongoing ransomware innovation and the persistent targeting of networking appliances as low-hanging fruit for initial access. It also reveals the increasing urgency for organizations to enforce zero trust network segmentation, proactively patch perimeter devices, and continuously monitor for anomalous access to defend against evolving ransomware threats and regulatory scrutiny.
6 months ago
Kill Chain
HybridPetya: Ransomware That Bypasses UEFI Secure Boot with CVE-2024-7344
In September 2025, researchers at ESET identified a new ransomware variant named HybridPetya that combines destructive Petya/NotPetya traits with advanced UEFI attack capabilities. Leveraging the CVE-2024-7344 vulnerability, attackers were able to bypass UEFI Secure Boot, allowing the malware to execute at a privileged level prior to OS load. Initial infection vectors appear to include phishing emails and software supply-chain compromises, leading to widespread disruption of targeted organizations’ endpoints, encrypted data, and in some instances, bricked devices. The attack highlights a disturbing escalation in ransomware sophistication and targeting, with significant operational downtime and financial losses reported in affected sectors. HybridPetya represents an evolution in ransomware, merging firmware exploitation with traditional payload delivery to maximize impact. This incident underscores the expanding threat landscape as adversaries weaponize newly discovered vulnerabilities and aim higher up the trust chain, intensifying pressure on organizations to harden their endpoints and update defenses in real time.
6 months ago
Kill Chain
Apple Warns French Users of Fourth Major Spyware Campaign in 2025
In September 2025, Apple issued alerts to French users after identifying a sophisticated spyware campaign targeting their devices, marking the fourth such warning within the year. According to CERT-FR, the attack exploited vulnerabilities in Apple’s ecosystem—potentially via malicious links or zero-day exploits linked to iCloud accounts—allowing unauthorized surveillance and data exfiltration. The incident highlights persistent targeting of high-profile users in France, including journalists, activists, and officials, by advanced threat actors suspected to have nation-state-level capabilities. Impact includes compromised device privacy, risk of sensitive information leaks, and possible reputational harm to affected organizations. This incident underscores a worrying trend of recurrent, targeted campaigns using advanced spyware in Western Europe. The persistence of these attacks illustrates evolving threat actor sophistication and growing urgency for companies to strengthen device and network-level security, particularly as regulatory and public scrutiny intensifies.
6 months ago
Kill Chain
Samsung’s 2025 Critical Mobile Zero-Day: CVE-2025-21043 Exploited in the Wild
In September 2025, Samsung urgently patched a critical zero-day vulnerability (CVE-2025-21043) impacting its Android devices. The flaw, an out-of-bounds write in the libimagecodec.quram.so library, enabled remote attackers to execute arbitrary code on affected devices. This zero-day had been actively exploited in real-world attacks prior to disclosure and patch release, exposing millions of Galaxy smartphone users to the risk of compromise and potential data theft. Samsung responded by releasing its monthly security updates addressing the vulnerability before widespread exploitation could escalate. This incident underscores the persistent targeting of mobile platforms using advanced zero-day techniques, raising concerns for enterprises reliant on mobile endpoints. As threat actors innovate and focus on mobile ecosystems, rapid patch cycles and vigilant threat monitoring remain essential to protect against evolving exploitation methods.
6 months ago
Kill Chain
Mass Browser-Based Attack Hits Enterprises: 2025’s Session Hijacking Wakeup Call
In August 2025, a sophisticated wave of browser-based attacks exploited vulnerabilities in popular browser components to hijack user sessions across multiple financial and technology firms simultaneously. Attackers leveraged phishing lures and malicious advertising to distribute payloads capable of intercepting authentication tokens and session cookies, enabling widespread unauthorized access. The campaign, attributed to a financially motivated eCrime group, enabled lateral movement within compromised cloud and SaaS applications, resulting in significant data exfiltration, temporary access loss, and incident-driven downtime for several affected organizations. This incident underscores a dramatic uptick in browser-native TTPs targeting identity, session integrity, and trusted cloud access. Threat actors are exploiting the growing reliance on web-based workflows and overlooked intra-browser security, making enhanced endpoint monitoring and Zero Trust controls more urgent than ever.
6 months ago
Kill Chain
Mustang Panda’s SnakeDisk USB Worm Targets Thailand: Advanced APT Breach Breakdown
In September 2025, cybersecurity analysts revealed that the China-aligned APT group Mustang Panda leveraged a novel USB worm dubbed SnakeDisk to target networks with Thailand-based IP addresses. The malware was specifically designed to execute only on devices with these geolocations, enabling highly targeted delivery of the TONESHELL loader and the Yokai backdoor. Attackers gained initial access through infected USB drives, allowing for stealthy lateral movement and installation of persistent remote access tools, posing risks to government, defense, and commercial operations in Thailand. The campaign’s use of an undocumented worm, encrypted command channels, and evasive tactics complicated detection and response efforts for affected organizations. This highly targeted operation demonstrates the continuous evolution of advanced persistent threat techniques, with regional targeting and removable media attacks making a significant comeback. The incident underscores the urgent need for robust east-west traffic controls, endpoint security, and focused detection in the face of increasingly sophisticated nation-state cyber campaigns.
6 months ago
Kill Chain
Apple 2025 ImageIO Zero-Day Breach Highlights Spyware Risks
In September 2025, Apple urgently released backported security updates to address CVE-2025-43300, a critical out-of-bounds write vulnerability in the ImageIO component exploited by advanced spyware campaigns. Attackers leveraged malicious image files to trigger memory corruption on Apple devices, enabling remote code execution and potential device takeover. The exploit was actively seen in targeted attacks against high-profile individuals, emphasizing the risk of spyware abusing zero-day vulnerabilities for persistent surveillance. The incident underscores the growing sophistication and frequency of attacks exploiting media processing flaws. This breach highlights an intensifying trend of threat actors using zero-day vulnerabilities in consumer devices for espionage. It demonstrates how attackers pivot to less-monitored device components and rapidly weaponize novel flaws, reinforcing the urgent need for continuous patching and proactive detection of anomalous behaviors on endpoints.
6 months ago
Kill Chain
Microsoft & Cloudflare Dismantle RaccoonO365 Global Phishing Network (2025)
In September 2025, Microsoft’s Digital Crimes Unit (DCU), in partnership with Cloudflare, coordinated a global takedown of the RaccoonO365 phishing network. The PhaaS operation leveraged 338 domains to deliver convincing Microsoft 365 phishing campaigns, compromising over 5,000 credentials across 94 countries since July 2024. By obtaining a court order from the Southern District of New York, DCU seized infrastructure used by the financially motivated RaccoonO365 group, disrupting ongoing credential theft and reducing further business email compromise (BEC) risk to organizations worldwide. This incident underscores the rapid evolution and global scale of phishing-as-a-service networks, which are automating credential theft across cloud platforms. As attackers exploit trusted SaaS brands with commodity toolkits, vigilance around cloud identity and supply chain access is now a critical board-level concern.
6 months ago
Kill Chain
Chinese TA415 Breaches US Economic Policy Experts Using VS Code Remote Tunnels
In mid-2025, the China-aligned threat actor TA415 launched a sophisticated spear-phishing campaign targeting U.S. government agencies, economic policy think tanks, and academic organizations. The attackers leveraged social engineering tactics, masquerading as high-profile U.S. officials, and delivered phishing emails containing malicious links. Through these lures, TA415 exploited Visual Studio Code Remote Tunnels—a legitimate feature used for remote development—to establish persistent, covert remote access within target environments. This allowed them to conduct extended espionage operations, exfiltrate sensitive economic policy data, and evade traditional endpoint and network defenses. The attack highlights the convergence of advanced phishing techniques with legitimate remote access tools, underscoring a shift toward stealthy, “living off the land” tactics by nation-state adversaries. Organizations are urged to address internal monitoring, east-west security, and robust detection of unauthorized remote connectivity, as similar techniques are expected to proliferate across sectors.
6 months ago
Kill Chain
ChillyHell: The macOS Backdoor That Outsmarted Notarization in 2024
In early May 2024, security researchers from Jamf Threat Labs identified a new version of the previously dormant "ChillyHell" modular backdoor targeting macOS systems. Initially observed in attacks against Ukrainian officials in 2021 and reported again by Mandiant in 2023, ChillyHell resurfaced in a sample uploaded to VirusTotal and discovered to have been publicly hosted on Dropbox. The malware achieves persistence through multiple mechanisms, brute-forces passwords, exfiltrates sensitive data, and communicates over several protocols, all while leveraging Apple notarization to evade detection before its certificates were revoked. With built-in timestamp manipulation and extensive C2 capabilities, ChillyHell poses a significant risk to macOS enterprise environments, blending stealth, flexibility, and longevity in its operations. This incident underscores the growing sophistication and targeting of macOS platforms by advanced threat actors, moving beyond Windows-centric malware trends. The use of valid codesigning and notarization further demonstrates challenges for defenders, highlighting the need for robust detection controls and ongoing vigilance for notarized—but malicious—macOS software.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports