✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Chinese APT Exploits Cisco AsyncOS Zero-Day in 2025: What You Need to Know
In December 2025, Cisco disclosed an unpatched, maximum-severity zero-day vulnerability (CVE-2025-20393) affecting AsyncOS running on Cisco Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances with exposed Spam Quarantine features. Leveraging this zero-day, the Chinese-nexus APT group UAT-9686 exploited systems by executing commands as root, deploying persistent backdoors (AquaShell), reverse SSH tunnels (AquaTunnel, Chisel), and evasion tools (AquaPurge). The campaign was active from late November 2025, with intrusions traced to sophisticated nation-state tooling and lateral movement, potentially compromising sensitive email infrastructure and enabling persistent access. This incident underscores ongoing risks from zero-day exploitation by advanced threat actors, especially those leveraging public-facing management interfaces and unpatched systems for initial access. The active exploitation by a Chinese APT mirrors broader trends in targeted cyberespionage against enterprise collaboration tools and highlights the urgency of proactive exposure management and segmentation.
7 months ago
Kill Chain
State-Backed Attackers Breach SonicWall SMA1000 Devices via Zero-Day Chain in 2025
In December 2025, SonicWall urgently advised customers to patch a newly identified zero-day vulnerability (CVE-2025-40602) in its SMA1000 Appliance Management Console after attackers exploited it in the wild. The attack chain combined this medium-severity local privilege escalation flaw with a critical pre-authentication deserialization vulnerability (CVE-2025-23006), allowing remote unauthenticated threat actors to execute arbitrary OS commands with root privileges on vulnerable appliances. These appliances serve as secure remote access gateways for large enterprises and critical infrastructure, amplifying the risk of broad organizational compromise and lateral movement within protected networks. The incident follows prior breaches and repeated targeting of SonicWall solutions by sophisticated, potentially state-backed actors, with over 950 SMA1000 devices found internet-exposed. Immediate remediation was urged to prevent further exploitation amidst evidence of active, targeted attacks. The SonicWall SMA1000 incident underscores a persistent trend of advanced actors leveraging zero-day exploits in network infrastructure appliances, fueling urgency around patch management and segmentation. This breach highlights the evolving complexity of attack chains targeting foundational remote access technologies and the critical need for proactive defense-in-depth and threat visibility measures.
7 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports