✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Critical Unauthenticated RCE Vulnerability in Oracle PeopleSoft Exploited: CVE-2026-35273
In early June 2026, Oracle disclosed a critical vulnerability (CVE-2026-35273) in its PeopleSoft Enterprise PeopleTools, specifically within the Updates Environment Management component. This flaw, present in versions 8.61 and 8.62, allows unauthenticated attackers with network access via HTTP to execute remote code, potentially leading to full system compromise. The vulnerability was actively exploited between May 27 and June 9, 2026, before Oracle released a patch on June 10. Over 100 organizations were affected, with data exfiltration reported from nearly 300 PeopleSoft instances. The cyber extortion group ShinyHunters is believed to be behind these attacks, though some experts suggest possible impersonation. ([techradar.com](https://www.techradar.com/pro/security/oracle-warns-customers-of-critical-peoplesoft-attack-after-hundreds-of-servers-hacked-by-apparent-shinyhunters-data-theft-attacks?utm_source=openai)) This incident underscores the persistent threat posed by unauthenticated remote code execution vulnerabilities in widely used enterprise applications. The rapid exploitation of CVE-2026-35273 highlights the importance of timely patch management and proactive monitoring to detect and mitigate such threats before they can cause significant damage.
1 month ago
Kill Chain
ShinyHunters' Exploitation of Oracle PeopleSoft CVE-2026-35273: A Wake-Up Call for Higher Education
In late May 2026, the cybercriminal group ShinyHunters exploited a zero-day vulnerability, CVE-2026-35273, in Oracle PeopleSoft PeopleTools versions 8.61 and 8.62. This flaw allowed unauthenticated remote code execution, leading to the compromise of over 100 organizations, predominantly in the U.S. higher education sector. The University of Nottingham confirmed significant student data theft following the group's data leak. Oracle disclosed the vulnerability on June 10, 2026, and released a critical patch, urging immediate application to mitigate further risks. This incident underscores the critical importance of timely patch management and proactive vulnerability monitoring. The exploitation of unpatched systems by threat actors like ShinyHunters highlights the need for organizations to enhance their cybersecurity posture to prevent similar breaches.
1 month ago
Kill Chain
Conti Ransomware Member Pleads Guilty to Wire Fraud Conspiracy
In June 2026, Ukrainian national Oleksii Lytvynenko pleaded guilty to conspiracy to commit wire fraud for his role in the Conti ransomware group. Lytvynenko admitted to joining Conti in September 2021, developing malware used in attacks, and possessing data from 12 victims, including eight in the United States. Conti was responsible for over 1,000 ransomware attacks globally, resulting in at least $150 million in ransom payments. Lytvynenko faces up to 20 years in prison, with sentencing scheduled for September 10, 2026. This case underscores the persistent threat posed by ransomware groups and highlights the importance of international cooperation in combating cybercrime. Organizations should remain vigilant, as threat actors continue to evolve their tactics and rebrand under new identities, necessitating robust cybersecurity measures and proactive defense strategies.
1 month ago
Kill Chain
Tchap Messenger Breach: Data of 73,000 French Government Employees Exposed
In June 2026, the French government's encrypted messaging platform, Tchap, experienced a security breach when a threat actor gained access through a compromised user account. This intrusion led to the exposure of data from public chat rooms, affecting over 73,000 public sector employees. The compromised information included users' names, email addresses, avatar images, and their affiliated public sector organizations. Private conversations remained encrypted and were not accessed during the breach. This incident underscores the persistent threat posed by social engineering attacks and highlights the importance of securing even internal communication platforms. Organizations must remain vigilant and continuously enhance their security measures to protect sensitive information from unauthorized access.
1 month ago
Kill Chain
Urgent: CISA's Directive on Patching Critical Ivanti Sentry Vulnerability
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued a directive mandating federal agencies to patch a critical vulnerability (CVE-2026-10520) in Ivanti Sentry devices within three days. This OS command injection flaw allows unauthenticated remote attackers to execute code with root privileges. Despite Ivanti's initial statement of no evidence of exploitation, reports emerged of attackers backdooring exposed Sentry gateways. This incident underscores the escalating threat landscape where critical vulnerabilities are rapidly exploited. Organizations must prioritize timely patching and robust vulnerability management to mitigate risks associated with such high-severity flaws.
1 month ago
Kill Chain
Ukrainian National's Guilty Plea Highlights Ongoing Ransomware Threats
In June 2026, Ukrainian national Oleksii Oleksiyovych Lytvynenko pleaded guilty to conspiracy to commit wire fraud for his involvement in the Conti ransomware attacks between 2021 and 2022. Lytvynenko and his co-conspirators deployed Conti ransomware on victim networks in the United States and abroad, stealing data and encrypting devices to extort Bitcoin ransom payments. He admitted to possessing data stolen from eight U.S. victims and four overseas victims and to developing malware loaders used in these attacks. The Conti ransomware operation, active from 2019 to 2022, targeted over 1,000 victims worldwide, collecting over $150 million in ransom payments. The group was known for large-scale attacks against healthcare organizations, governments, and enterprises before shutting down in 2022 following internal leaks and increased law enforcement pressure. Former Conti members have since splintered into other ransomware groups, including BlackCat, Black Basta, and Hive.
1 month ago
Kill Chain
Arch Linux AUR Compromise 2026: A Wake-Up Call for Open-Source Security
In June 2026, over 400 packages in the Arch User Repository (AUR) were compromised to distribute a Linux rootkit and infostealer malware. Attackers spoofed trusted publishers to inject malicious preinstall scripts that downloaded and executed the 'atomic-lockfile' npm package. This malware targeted sensitive information, including credentials and access tokens, and utilized eBPF rootkit capabilities to conceal its presence. The incident underscores the vulnerabilities inherent in community-maintained repositories and the critical need for stringent package verification processes. This breach highlights the escalating threat of supply chain attacks, particularly within open-source ecosystems. Organizations must enhance their security postures by implementing robust monitoring and validation mechanisms to detect and prevent such infiltrations.
1 month ago
Kill Chain
China-Linked Hackers Backdoor Linux Login Systems for Nearly a Decade
In June 2026, cybersecurity firm Sygnia uncovered that the China-linked threat group known as Velvet Ant had infiltrated Linux systems by backdooring the Pluggable Authentication Modules (PAM) and OpenSSH components, enabling unauthorized access and credential harvesting. This sophisticated attack, which began as early as 2016, involved replacing trusted login programs with malicious versions, allowing the attackers to maintain persistent access and evade detection. The incident underscores the evolving tactics of nation-state actors targeting critical infrastructure components that are often overlooked, highlighting the need for organizations to implement rigorous integrity checks and continuous monitoring of authentication systems to detect and mitigate such stealthy intrusions.
1 month ago
Kill Chain
Google's Legal Battle Against AI-Driven Smishing Attacks
In June 2026, Google initiated legal action against a Chinese cybercrime network known as 'Outsider Enterprise.' This group utilized Google's Gemini AI to create and distribute phishing-as-a-service (PhaaS) kits, enabling the generation of fraudulent websites and the dispatch of massive SMS phishing ('smishing') campaigns. These campaigns impersonated reputable brands, deceiving recipients into providing personal and financial information. The operation involved over 9,000 fake websites and more than 1 million fraudulent web domains, leading to financial losses estimated in the millions and affecting hundreds of thousands of victims. ([techcrunch.com](https://techcrunch.com/2026/06/12/google-sues-alleged-chinese-cybercrime-operation-that-used-ai-to-send-scam-texts/?utm_source=openai)) This incident underscores the escalating threat posed by cybercriminals leveraging advanced AI technologies to conduct large-scale, sophisticated phishing attacks. The use of AI in such malicious activities highlights the urgent need for enhanced security measures and regulatory frameworks to combat AI-driven cyber threats effectively.
1 month ago
Kill Chain
Miasma Worm's 2026 Attack on Microsoft GitHub: A Wake-Up Call for Developers
In June 2026, Microsoft faced a significant supply chain attack when the Miasma worm infiltrated 73 of its GitHub repositories, including those under Azure, Azure-Samples, Microsoft, and MicrosoftDocs. The attackers utilized previously compromised contributor credentials to push malicious commits, introducing configuration files that executed credential-harvesting payloads upon opening in AI coding tools or IDEs. This breach led to the temporary disabling of the affected repositories, disrupting critical workflows and CI/CD pipelines. ([computing.co.uk](https://www.computing.co.uk/news/2026/security/microsoft-s-github-repositories-taken-offline-amid-miasma-supply-chain-attack?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting trusted development environments. The Miasma worm's ability to exploit AI coding tools highlights the need for enhanced security measures in software development processes to prevent similar breaches in the future.
1 month ago
Kill Chain
Critical Vulnerability in Ivanti Sentry: CVE-2026-10520
In June 2026, a critical OS command injection vulnerability, CVE-2026-10520, was identified in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1. This flaw allows remote, unauthenticated attackers to execute arbitrary code with root privileges. Within 24 hours of disclosure, attackers exploited this vulnerability to backdoor exposed Ivanti Sentry appliances, compromising enterprise mobile gateways. ([techtimes.com](https://www.techtimes.com/articles/318221/20260611/ivanti-sentry-actively-exploited-cvss-100-flaw-backdoors-enterprise-mobile-gateways.htm?utm_source=openai)) The rapid exploitation underscores the urgency for organizations to promptly apply security patches. The availability of a public proof-of-concept exploit increases the risk of widespread attacks, emphasizing the need for immediate remediation. ([noise.getoto.net](https://noise.getoto.net/2026/06/10/cve-2026-10520-cve-2026-10523-multiple-critical-vulnerabilities-affecting-ivanti-sentry/?utm_source=openai))
1 month ago
Kill Chain
Phishing Attacks Decline 20% in 2026, But AI Enhances Threats
In 2026, phishing attack volumes decreased by 20% for the second consecutive year. However, the sophistication and effectiveness of these attacks have significantly increased, largely due to the integration of artificial intelligence (AI) by cybercriminals. AI tools enable attackers to craft highly convincing phishing lures and automate the creation of fraudulent websites, leading to more targeted and successful campaigns. ([zscaler.com](https://www.zscaler.com/blogs/security-research/one-click-compromise-threatlabz-2026-phishing-and-initial-access-report?utm_source=openai)) This trend underscores a shift in cybercriminal strategies from mass, indiscriminate attacks to focused, high-yield operations. Organizations must recognize that while the quantity of phishing attempts has declined, the quality and potential impact of these attacks have escalated, necessitating enhanced vigilance and advanced security measures.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports