✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
FortiBleed: Unprecedented Credential Harvesting Compromises 30,000+ Fortinet Devices
In June 2026, a large-scale credential harvesting operation, dubbed 'FortiBleed,' targeted Fortinet firewalls and VPN gateways, compromising over 30,000 internet-facing devices across nearly 200 countries. The attackers, suspected to be Russian-speaking threat actors, utilized automated tools to collect and verify login credentials, exploiting weak or default passwords without leveraging any known Fortinet vulnerabilities. This campaign affected various sectors, including government, telecommunications, healthcare, education, financial services, and critical infrastructure, with significant concentrations in India and the United States. The operation underscores the critical importance of robust password policies and the implementation of multi-factor authentication to safeguard network security devices. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/sweeping-credential-harvesting-heist-compromises-30k-fortinet-devices?utm_source=openai))
1 month ago
Kill Chain
CISA Adds CVE-2026-48907 to Known Exploited Vulnerabilities Catalog
In June 2026, a critical vulnerability identified as CVE-2026-48907 was discovered in the Joomla Content Editor (JCE) extension, allowing unauthenticated attackers to create new editor profiles and upload arbitrary PHP code, leading to remote code execution. This flaw affects JCE versions prior to 2.9.99.5. The Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on June 16, 2026, following evidence of active exploitation. Joomla released patches on June 3 and June 6, 2026, to address this issue. ([securityweek.com](https://www.securityweek.com/joomla-litespeed-vulnerabilities-exploited-in-attacks/?utm_source=openai)) The active exploitation of CVE-2026-48907 underscores the persistent threat posed by web application vulnerabilities, particularly in widely used content management systems like Joomla. Organizations are urged to promptly apply the latest security updates to mitigate potential risks associated with this vulnerability.
1 month ago
Kill Chain
Unveiling the VHDX-Based Remcos RAT Attack: A 2026 Cybersecurity Challenge
In June 2026, a sophisticated malware campaign was identified, utilizing a VHDX disk image within a ZIP archive to deliver the Remcos Remote Access Trojan (RAT). Upon extraction, the VHDX file auto-mounted on Windows systems, revealing an obfuscated JavaScript file named 'Partnerschaft_fur_neue_Angebotsanfrage.js', indicating potential targeting of German-speaking users. This JavaScript initiated a multi-stage infection chain involving PowerShell scripts and .NET loaders, ultimately injecting the Remcos RAT into the 'backgroundTaskHost.exe' process. The malware established communication with a command-and-control server at animal342[.]duckdns[.]org:53552, enabling remote surveillance and data exfiltration. Notably, the campaign employed techniques such as WMI for process execution and Base64 encoding with XOR decryption to evade detection by traditional security measures. This incident underscores the evolving tactics of cybercriminals who leverage legitimate system features and complex obfuscation methods to bypass security controls. The use of VHDX files as malware containers highlights the need for enhanced vigilance and advanced detection mechanisms to counter such sophisticated threats.
1 month ago
Kill Chain
Understanding the MongoBleed Vulnerability (CVE-2025-14847) and Its Impact
In December 2025, a critical vulnerability known as MongoBleed (CVE-2025-14847) was disclosed, affecting multiple versions of MongoDB Server from 3.6 through 8.2.3. This flaw allows unauthenticated attackers to exploit improper handling of zlib-compressed network traffic, leading to the leakage of uninitialized heap memory. As a result, sensitive data such as credentials, session tokens, and API keys could be exfiltrated from affected servers. The vulnerability has been actively exploited in the wild, with approximately 87,000 MongoDB instances exposed globally, primarily in the United States, China, and Germany. Organizations are strongly advised to apply security patches immediately or disable compression and restrict network exposure to mitigate the risk. ([infoq.com](https://www.infoq.com/news/2026/01/mongodb-mongobleed-vulnerability/?utm_source=openai)) The MongoBleed incident underscores the critical importance of timely patch management and the need for robust security measures to protect against vulnerabilities in widely used database systems. The rapid exploitation of this flaw highlights the evolving threat landscape and the necessity for organizations to remain vigilant in securing their infrastructure.
1 month ago
Kill Chain
Introducing Sulla: Praetorian's Open-Source SMB Secret Scanner
In June 2026, Praetorian released Sulla, an open-source tool designed to scan SMB shares for exposed credentials across enterprise networks. Sulla automates the discovery of readable SMB shares, traverses their file structures, and scans contents for sensitive information using the Titus detection library. This tool addresses the challenge of manually reviewing numerous network shares, which is often tedious and inefficient. By integrating Sulla into their Continuous Threat Exposure Management platform, Guard, Praetorian ensures that SMB secrets are identified promptly as they appear in environments. The release of Sulla highlights the growing need for automated tools to detect and mitigate the risks associated with exposed credentials in network shares. As organizations increasingly rely on complex network infrastructures, tools like Sulla become essential in proactively identifying and addressing security vulnerabilities, thereby enhancing overall cybersecurity posture.
1 month ago
Kill Chain
Critical Vulnerability in SolarWinds Serv-U: CVE-2026-28318
In early June 2026, a high-severity vulnerability (CVE-2026-28318) was identified in SolarWinds Serv-U, a widely used file transfer server. This flaw allows unauthenticated attackers to crash the Serv-U service by sending specially crafted POST requests with the 'Content-Encoding: deflate' header, leading to a denial-of-service (DoS) condition. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed active exploitation of this vulnerability and added it to their Known Exploited Vulnerabilities catalog on June 5, 2026. Organizations are urged to apply the available patch or implement recommended mitigations promptly to prevent service disruptions. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/06/08/cisa-patch-actively-exploited-solarwinds-serv-u-dos-vulnerability-cve-2026-28318/?utm_source=openai)) The exploitation of CVE-2026-28318 underscores the persistent targeting of file transfer services by threat actors. Given the critical role of such services in business operations, this incident highlights the necessity for organizations to maintain vigilant patch management practices and to monitor for emerging threats to ensure operational resilience.
1 month ago
Kill Chain
Earth Lusca's Advanced Windows Malware Targets Government Entities
Between 2023 and 2024, the Chinese state-sponsored threat group Earth Lusca, also known as FishMonger, expanded its cyber espionage operations by deploying Windows variants of the previously Linux-based SprySOCKS malware. These sophisticated backdoors targeted government organizations in Taiwan, Thailand, Pakistan, and Honduras, focusing on sectors such as foreign affairs, technology, and telecommunications. The Windows versions, identified as WIN_DRV and WIN_PLUS, introduced advanced capabilities including kernel-level stealth mechanisms, enabling the malware to hide processes, network connections, and files, thereby evading detection. Both variants support over 30 command-and-control commands, facilitate communication over multiple protocols, and possess functionalities like keystroke logging and SOCKS proxy support. The emergence of these Windows variants underscores a significant evolution in Earth Lusca's tactics, highlighting the group's commitment to enhancing its toolset for broader and more effective cyber espionage campaigns. This development reflects a broader trend among nation-state actors to adapt and refine their malware to target diverse operating systems, emphasizing the need for organizations to implement comprehensive, cross-platform cybersecurity measures.
1 month ago
Kill Chain
DragonForce Ransomware's Innovative Exploitation of Microsoft Teams in 2025
In December 2025, the DragonForce ransomware group executed a sophisticated attack against a major U.S. services company. They exploited an unknown vulnerability in an SQL or MSSQL server to gain initial access. Subsequently, they deployed a custom Go-based malware named 'Backdoor.Turn,' which abused Microsoft Teams' Traversal Using Relays around NAT (TURN) protocol to conceal command-and-control (C2) communications within legitimate Teams traffic. This allowed the attackers to evade detection while exfiltrating data and deploying ransomware to encrypt the victim's systems. This incident underscores a concerning trend where threat actors leverage trusted cloud-based collaboration platforms to mask malicious activities. The abuse of Microsoft Teams' infrastructure for C2 communications highlights the need for organizations to scrutinize even legitimate traffic and implement robust monitoring mechanisms to detect anomalies within trusted services.
1 month ago
Kill Chain
Fortinet FortiSandbox Vulnerabilities Under Active Exploitation
In June 2026, multiple critical vulnerabilities in Fortinet's FortiSandbox platform—specifically CVE-2026-39813, CVE-2026-39808, and CVE-2026-25089—were actively exploited by threat actors. These flaws allowed unauthenticated attackers to escalate privileges and execute unauthorized code remotely through low-complexity command injection attacks that required no user interaction. Fortinet had released patches for these vulnerabilities in April 2026, but unpatched systems remained at significant risk. The exploitation of these vulnerabilities underscores the persistent targeting of security appliances by cyber adversaries. Organizations relying on FortiSandbox for threat detection must ensure timely application of security updates to mitigate potential breaches and maintain the integrity of their security infrastructure.
1 month ago
Kill Chain
GhostTree Attack: Exploiting NTFS Junctions to Evade Detection
In May 2026, Varonis Threat Labs identified a novel evasion technique named 'GhostTree' that exploits NTFS junctions in Windows systems. By creating recursive directory loops, attackers can generate an effectively infinite number of file paths, causing Endpoint Detection and Response (EDR) tools to hang during recursive scans. This manipulation allows malicious files to remain undetected, as the scanning process becomes trapped in the loop and fails to complete. The technique requires only standard user permissions, making it accessible without administrative rights. ([varonis.com](https://www.varonis.com/blog/ghosttree-ntfs-trick?utm_source=openai)) The discovery of GhostTree underscores the evolving sophistication of malware evasion tactics. As attackers increasingly exploit legitimate system features to bypass security measures, organizations must enhance their detection capabilities and adopt comprehensive monitoring strategies to identify and mitigate such advanced threats.
1 month ago
Kill Chain
SprySOCKS Windows Variant: A New Threat to Government Cybersecurity
In 2023 and 2024, the China-linked cyber-espionage group FishMonger, also known as Earth Lusca and Aquatic Panda, deployed a Windows variant of the SprySOCKS backdoor against government organizations in Honduras, Taiwan, Thailand, and Pakistan. This variant utilizes malicious kernel drivers to evade detection, allowing the backdoor to conceal its processes and files by intercepting system calls and modifying outputs. The attackers likely gained initial access through exploiting vulnerabilities in public-facing servers. The emergence of this Windows variant underscores the evolving tactics of nation-state actors in enhancing malware stealth capabilities. Organizations should be vigilant about the use of kernel drivers in malware, as they pose significant challenges to detection and mitigation efforts.
1 month ago
Kill Chain
Hazy Hawk's 2026 Subdomain Takeover: A Wake-Up Call for DNS Security
In April 2026, the threat actor group known as Hazy Hawk executed a coordinated subdomain takeover campaign targeting 34 major U.S. universities, including MIT, Harvard, and Stanford. By exploiting abandoned DNS records pointing to decommissioned cloud services, they hijacked these subdomains to host explicit content, which was subsequently indexed by search engines under the universities' trusted .edu domains. This incident underscores the critical need for organizations to maintain rigorous DNS hygiene and promptly remove or update DNS entries associated with decommissioned services to prevent unauthorized subdomain takeovers.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports