✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
INTERPOL's Operation Ramz Dismantles SniperDz Phishing Platform
In a coordinated effort from October 2025 to February 2026, INTERPOL led Operation Ramz, targeting cybercriminal activities across 13 countries in the Middle East and North Africa. This operation resulted in 201 arrests, the identification of 3,867 victims, and the seizure of 53 servers. A significant outcome was the dismantling of SniperDz, a decade-old Phishing-as-a-Service platform, and the arrest of its primary developer in Algeria. SniperDz provided cybercriminals with ready-made phishing kits and infrastructure, facilitating global credential theft. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) The takedown of SniperDz underscores the persistent threat posed by Phishing-as-a-Service platforms, which lower the barrier to entry for cybercriminals and enable widespread credential theft. This incident highlights the importance of international collaboration in combating cybercrime and the need for organizations to remain vigilant against evolving phishing tactics.
1 month ago
Kill Chain
Europol Dismantles 'AudiA6' Crypto Laundering Service Used by Ransomware Gangs
In June 2026, an international law enforcement operation led by Europol dismantled 'AudiA6,' a cryptocurrency laundering service that processed over €336 million for ransomware gangs and cybercriminal networks between 2022 and 2025. The operation resulted in the arrest of two alleged administrators in Georgia, the seizure of more than 30 servers, 25 domains, over 80 vehicles, multiple properties, and the freezing of approximately €692,000 in cryptocurrency assets. 'AudiA6' was linked to over 15 international cybercrime investigations and was also associated with the dark web forum 'Dark2Web,' which facilitated illicit services and connections among cybercriminals. ([fdicoig.gov](https://www.fdicoig.gov/news/investigations-press-releases/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering?utm_source=openai)) This takedown underscores the growing industrialization of cryptocurrency laundering services that support the global cybercrime economy. The operation highlights the increasing reliance of ransomware groups on sophisticated laundering platforms to obscure illicit proceeds, emphasizing the need for enhanced international cooperation and advanced forensic capabilities to combat such threats. ([dig.watch](https://dig.watch/updates/europol-audia6-crypto-laundering-network?utm_source=openai))
1 month ago
Kill Chain
CISA Adds CVE-2026-10520 to Known Exploited Vulnerabilities Catalog
In June 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-10520 to its Known Exploited Vulnerabilities (KEV) Catalog. This critical OS Command Injection vulnerability in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to execute code with root privileges. The flaw poses significant risks to federal enterprises and has been actively exploited in the wild. Organizations are urged to update to the patched versions immediately to mitigate potential threats. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-10520?utm_source=openai)) The inclusion of CVE-2026-10520 in the KEV Catalog underscores the ongoing threat posed by command injection vulnerabilities. This incident highlights the importance of timely patch management and proactive vulnerability assessments to prevent unauthorized access and potential data breaches.
1 month ago
Kill Chain
CompleteFTP 'Short-Sleeve' RSA and DSA Key Vulnerability Exposed
In June 2026, researchers identified a vulnerability in RSA and DSA key generation within the CompleteFTP software, leading to the creation of 'short-sleeve' keys with predictable zero-bit patterns. This flaw, stemming from a type mismatch in big-integer code, resulted in the generation of weak cryptographic keys that could be easily factored, compromising the security of encrypted communications. The issue affected CompleteFTP versions 10.0.0 through 23.0.4, spanning from December 2016 to December 2023. EnterpriseDT, the developers of CompleteFTP, promptly released version 26.1.0 on May 8, 2026, which includes a tool to detect and regenerate vulnerable keys. ([enterprisedt.jp](https://www.enterprisedt.jp/doc23/html/howtoserverkeys.html?utm_source=openai)) This incident underscores the critical importance of rigorous code review and adherence to cryptographic standards in software development. It also highlights the necessity for organizations to regularly audit their cryptographic implementations to identify and mitigate potential vulnerabilities that could be exploited by attackers.
1 month ago
Kill Chain
Russian National Charged in Connection with Void Blizzard Espionage Campaign
In June 2026, U.S. federal prosecutors charged Denis Nikolayevich Obrezko, a Russian national, with conspiracy to commit unauthorized computer access. Obrezko is accused of facilitating cyber-espionage operations for the Russia-aligned threat group Void Blizzard by procuring virtual private servers and domain names used in attacks targeting businesses, educational institutions, and other organizations. The FBI's investigation revealed that Void Blizzard primarily relied on stolen session tokens to authenticate to victim accounts without triggering re-authentication requirements, and used U.S.-based commercial proxy services to mask the connection's location. The group targeted at least 11 U.S. companies, with the actual number of victims likely being higher. ([cyberscoop.com](https://cyberscoop.com/russian-national-charged-void-blizzard-cyber-espionage/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber-espionage groups like Void Blizzard, which have been active since at least April 2024, targeting critical sectors across NATO member states and Ukraine. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/?utm_source=openai)) The group's methods, while not technically advanced, have proven effective, highlighting the need for organizations to implement robust cybersecurity measures to protect against such threats.
1 month ago
Kill Chain
Urgent: Ivanti Sentry Vulnerability Exploited – Immediate Action Required
In June 2026, a critical OS command injection vulnerability (CVE-2026-10520) was discovered in Ivanti Sentry, formerly known as MobileIron Sentry. This flaw allows remote, unauthenticated attackers to execute arbitrary commands with root privileges on affected devices. Ivanti released patches on June 9, 2026, addressing the issue in versions R10.5.2, R10.6.2, and R10.7.1. However, within 24 hours, reports emerged of active exploitation, with attackers backdooring exposed Sentry gateways. The Shadowserver Foundation identified multiple compromised instances, indicating widespread exploitation. Organizations using Ivanti Sentry are urged to apply the patches immediately to mitigate the risk of unauthorized access and potential data breaches. This incident underscores the critical importance of timely patch management and proactive vulnerability assessments to safeguard enterprise networks against rapidly evolving threats.
1 month ago
Kill Chain
CISA's BOD 26-04: Accelerated Patching Mandate for Federal Agencies
In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 26-04, mandating Federal Civilian Executive Branch (FCEB) agencies to remediate high-risk vulnerabilities within accelerated timeframes, as short as three days. This directive supersedes previous directives and prioritizes patching based on factors such as public exposure, inclusion in CISA's Known Exploited Vulnerabilities catalog, potential for automated exploitation, and the level of control an attacker could gain. This directive underscores the escalating threat landscape and the necessity for rapid vulnerability management. Organizations beyond the federal scope are encouraged to adopt similar practices to mitigate risks associated with known exploited vulnerabilities.
1 month ago
Kill Chain
ShinyHunters Exploit Oracle PeopleSoft CVE-2026-35273 in 2026 Data Breaches
In June 2026, Oracle disclosed a critical vulnerability (CVE-2026-35273) in PeopleSoft PeopleTools versions 8.61 and 8.62, which allows unauthenticated remote code execution. The ShinyHunters cybercriminal group exploited this zero-day flaw to breach over 100 organizations, primarily in the education sector, leading to significant data theft and extortion attempts. Oracle has released emergency mitigations and is preparing a patch to address this vulnerability. This incident underscores the increasing targeting of enterprise resource planning (ERP) systems by cybercriminals, highlighting the necessity for organizations to promptly apply security updates and implement robust monitoring to detect unauthorized access attempts.
1 month ago
Kill Chain
Kyushu Electric Power Data Breach: 10.9 Million Customer Records Exposed
In April 2026, Kyushu Electric Power Co., Inc., a major Japanese utility company, experienced a significant data breach involving the loss of an external storage device containing personal information of approximately 10.9 million customers. The device, used for routine data backups, was stored in a server room cabinet with multiple physical security layers. On May 26, IT staff discovered the cabinet unlocked and the device missing. The data included customer names, service addresses, electricity usage data, telephone numbers, and names of retail electricity providers. Notably, no bank account or credit card information was stored on the device. The company has notified affected customers and relevant authorities, including Japan’s Personal Information Protection Commission and the Ministry of Economy, Trade, and Industry. Investigations are ongoing, with no evidence of data leakage confirmed as of now. This incident underscores the critical importance of robust physical security measures and strict access controls for sensitive data storage. It highlights the need for organizations to regularly review and enhance their data protection protocols to prevent unauthorized access and potential data breaches.
1 month ago
Kill Chain
GreatXML Exploit: A New Threat to Windows BitLocker Encryption
In June 2026, security researcher Chaotic Eclipse disclosed a zero-day vulnerability named 'GreatXML' that allows attackers to bypass Windows BitLocker encryption. The exploit leverages artifacts left by Microsoft Defender's offline scan to gain SYSTEM-level access during Recovery Mode, effectively rendering BitLocker protections ineffective. Systems that have run an offline scan are particularly vulnerable, as the exploit involves placing specific XML files in the recovery partition and rebooting into the Windows Recovery Environment. This vulnerability poses a significant risk to data security, especially for devices that have utilized Defender's offline scanning feature. ([securityweek.com](https://www.securityweek.com/greatxml-zero-day-exploit-bypasses-bitlocker/?utm_source=openai)) The disclosure of GreatXML underscores the ongoing challenges in securing endpoint devices against sophisticated attacks. It highlights the need for organizations to reassess their reliance on built-in encryption tools and to implement additional layers of security to protect sensitive data. The incident also raises concerns about the effectiveness of current vulnerability disclosure practices and the timeliness of patches for critical security flaws.
1 month ago
Kill Chain
ShinyHunters Exploit Oracle PeopleSoft Vulnerability CVE-2026-35273 in 2026
Between May 27 and June 9, 2026, the cybercriminal group ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools versions 8.61 and 8.62. This critical flaw allowed unauthenticated remote code execution, leading to unauthorized access and data exfiltration from over 100 organizations, predominantly universities. The University of Nottingham confirmed a breach affecting approximately 500,000 current and former students' personal and academic records. Oracle released a security advisory on June 10, 2026, acknowledging the vulnerability and urging immediate mitigation measures. This incident underscores the escalating threat posed by sophisticated cybercriminal groups targeting enterprise software vulnerabilities, particularly in the education sector. The exploitation of zero-day vulnerabilities for large-scale data breaches highlights the urgent need for organizations to implement proactive security measures, including timely patch management and comprehensive monitoring of critical systems.
1 month ago
Kill Chain
Unveiling Cyber-Enabled Maritime Sanctions Evasion Tactics in 2026
In 2026, Iranian and Russian shadow fleet vessels, along with multiple sanctions evasion networks (SENs), utilized over 36 inauthentic websites to impersonate maritime authorities and organizations. These fraudulent sites facilitated the generation of false documents and certificates, effectively replicating key layers of the maritime compliance stack. This cyber-enabled infrastructure allowed sanctioned entities to circumvent international sanctions by creating credible but fraudulent maritime organizations, increasing the risk of due diligence failures and regulatory exposure. The emergence of such sophisticated cyber-enabled sanctions evasion tactics underscores the evolving nature of maritime compliance challenges. Organizations in the maritime and shipping sectors must integrate independent verification and cyber threat intelligence into compliance workflows to proactively identify and mitigate fraudulent online infrastructure.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports