✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Unveiling the Azure DevOps MCP Server Vulnerability
In July 2026, a critical vulnerability was discovered in Microsoft's Azure DevOps Model Context Protocol (MCP) server. This flaw allowed attackers to embed invisible comments within pull request descriptions, which, when processed by AI coding agents, could execute unauthorized actions across projects. The exploit leveraged the absence of prompt-injection guardrails in the MCP server's handling of pull request descriptions, enabling attackers to access sensitive data and perform actions beyond their permissions. This incident underscores the growing risks associated with integrating AI agents into development workflows without robust security measures. As AI tools become more prevalent, ensuring they operate within strict security boundaries is imperative to prevent similar vulnerabilities.
4 days ago
Kill Chain
International Authorities Dismantle Kratos Phishing Platform
In July 2026, German and U.S. law enforcement agencies, in collaboration with Indonesian authorities, dismantled the Kratos phishing-as-a-service (PhaaS) platform. This operation led to the seizure of over 200 servers and the arrest of the alleged developer in Indonesia. Kratos enabled approximately 1,800 cybercriminal groups to conduct around 15,000 phishing campaigns monthly, targeting victims across more than 30 countries, primarily in Europe and the United States. The platform's advanced techniques allowed attackers to bypass multi-factor authentication (MFA) by capturing session cookies, granting unauthorized access to Microsoft 365 accounts. The takedown of Kratos underscores the escalating sophistication of phishing operations and the critical need for organizations to adopt robust security measures. The incident highlights the importance of implementing phishing-resistant authentication methods and continuous monitoring to detect and mitigate such advanced threats.
4 days ago
Kill Chain
CVE-2026-11374: Critical ManageEngine SSO Vulnerability Exposes Accounts to Takeover
In June 2026, a critical vulnerability (CVE-2026-11374) was identified in ManageEngine's ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus when integrated with AD360. This flaw allowed unauthenticated attackers to predict Single Sign-On (SSO) tickets, leading to potential account takeovers. The vulnerability stemmed from the generation of predictable SSO tickets, enabling attackers to impersonate legitimate users and gain unauthorized access to sensitive systems. ManageEngine promptly addressed the issue by releasing patches for the affected products, enhancing the randomness of SSO ticket generation to prevent exploitation. This incident underscores the importance of robust authentication mechanisms and the need for organizations to stay vigilant against evolving attack vectors targeting identity and access management systems. The rise in sophisticated authentication bypass techniques highlights the necessity for continuous monitoring and timely application of security patches to safeguard critical infrastructure.
4 days ago
Kill Chain
Unveiling North Korea's IT Worker Scheme Funding Russia's Military Operations
In July 2026, DTEX researchers uncovered that North Korea's IT worker scheme is funneling money through a network of front companies and intermediaries, including sanctioned entities, to support Russia's military efforts in Ukraine. The investigation revealed that between December 2025 and February 2026, approximately $1.97 million from North Korean IT workers flowed through Korea Ryonbong General Corp, a sanctioned defense entity procuring weapons for North Korea's military programs. This scheme extends beyond funding North Korea's weapons program, contributing to various regime objectives, including manufacturing weapons supplied to Russia's military. ([cyberscoop.com](https://cyberscoop.com/north-korea-it-worker-scheme-funds-russia-war-ukraine/?utm_source=openai)) This incident highlights the evolving nature of cyber-enabled financial schemes and the increasing collaboration between sanctioned states to circumvent international restrictions. The use of IT worker schemes to fund military operations underscores the need for heightened vigilance and robust compliance measures within the global tech industry.
4 days ago
Kill Chain
Understanding the 'LegacyHive' Zero-Day Vulnerability in Windows
In July 2026, a security researcher known as Nightmare Eclipse disclosed a zero-day vulnerability named 'LegacyHive' affecting the Windows User Profile Service. This flaw allows non-administrative users to load and modify other users' registry hives, potentially leading to privilege escalation and unauthorized access to sensitive data. The vulnerability impacts fully patched versions of Windows 10, Windows 11, and Windows Server editions as of July 2026. Microsoft has acknowledged the issue and is investigating, but has not yet released an official patch. In the interim, ACROS Security has provided free unofficial micropatches through their 0Patch platform to mitigate the risk. The disclosure of 'LegacyHive' underscores the ongoing challenges posed by zero-day vulnerabilities and the importance of timely patching. Organizations are advised to apply available mitigations promptly and monitor for official updates from Microsoft to protect their systems against potential exploitation.
5 days ago
Kill Chain
Qilin Ransomware Exploits PAN-OS Vulnerability CVE-2026-0257
In May 2026, a critical authentication bypass vulnerability (CVE-2026-0257) was identified in Palo Alto Networks' PAN-OS GlobalProtect portal and gateway, allowing unauthenticated attackers to establish unauthorized VPN connections. Despite patches released on May 13, 2026, threat actors, notably the Qilin ransomware gang, exploited this flaw to infiltrate corporate networks. By June 2026, multiple intrusions were reported, leading to widespread ransomware deployments and significant operational disruptions. The exploitation of CVE-2026-0257 underscores the persistent threat posed by ransomware groups leveraging known vulnerabilities. Organizations must prioritize timely patch management and enhance monitoring to detect unauthorized access attempts, especially as ransomware tactics continue to evolve and target critical infrastructure components.
5 days ago
Kill Chain
Critical SharePoint RCE Flaw Exploited to Steal Machine Keys
In July 2026, a critical vulnerability identified as CVE-2026-50522 was discovered in Microsoft SharePoint Server versions 2016, 2019, and Subscription Edition. This deserialization flaw allows unauthenticated remote attackers to execute arbitrary code over the network. Exploitation of this vulnerability enables attackers to steal machine keys, facilitating the creation of valid authentication tokens to impersonate users and access SharePoint resources with elevated privileges. Microsoft addressed this issue in their July security updates, but active exploitation was observed shortly after a proof-of-concept exploit became publicly available. ([cvefeed.io](https://cvefeed.io/vuln/detail/CVE-2026-50522?utm_source=openai)) The rapid exploitation of CVE-2026-50522 underscores the critical need for organizations to promptly apply security patches and monitor for unauthorized access. The ability of attackers to maintain persistent access by stealing machine keys highlights the importance of comprehensive security measures beyond patching, including credential rotation and continuous monitoring. ([thehackernews.com](https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html?utm_source=openai))
5 days ago
Kill Chain
Authorities Dismantle Kratos Phishing Platform and Arrest Developer
In July 2026, German and U.S. authorities dismantled the Kratos phishing-as-a-service (PhaaS) platform, arresting its developer in Indonesia. Kratos enabled cybercriminals to create fake Microsoft authentication pages, facilitating the theft of email addresses and passwords. Over 1,800 clients used Kratos to conduct approximately 15,000 phishing campaigns monthly, affecting victims in over 35 countries, primarily in Europe and the United States. The platform's operator reportedly earned at least €300,000 since 2024. The takedown involved seizing more than 200 servers, effectively rendering the service inoperable. This incident underscores the persistent threat posed by sophisticated phishing services that lower the barrier to entry for cybercriminals. The successful operation highlights the importance of international collaboration in combating cybercrime and the need for organizations to remain vigilant against evolving phishing tactics.
5 days ago
Kill Chain
Emerging Ransomware Tactics: BitLocker and Office Printers in 2026
In mid-2026, two Latin American organizations experienced ransomware attacks where adversaries exploited misconfigured Remote Desktop Protocol (RDP) and Microsoft SQL Server (MSSQL) services to gain unauthorized access. The attackers utilized Microsoft's BitLocker to encrypt critical data and disseminated ransom notes via compromised office printers. The ransom demands were notably low, around $3,000, indicating a shift towards targeting smaller organizations with modest financial extortion. These incidents underscore the critical need for stringent security configurations and proactive monitoring to prevent such breaches. The use of built-in tools like BitLocker for malicious purposes highlights a growing trend where attackers leverage legitimate software to evade detection. Additionally, the exploitation of office printers as a communication channel for ransom demands reveals an innovative tactic in ransomware operations, emphasizing the importance of securing all network-connected devices.
5 days ago
Kill Chain
Unveiling Project CAV3RN: APT34's Covert Cyberespionage Tactics
In June 2026, Kaspersky's Threat Intelligence Reporting service detailed Project CAV3RN, a sophisticated modular cyberespionage framework targeting Israeli entities. Active since December 2025, the framework underwent a significant architectural shift in April 2026, transitioning from a three-component system to a controller-based architecture with a WebSocket-enabled C2 communication component and an extensible plugin system. Subsequently, a new .NET Native AOT communication module was identified, utilizing Outlook calendar events accessed via Microsoft Graph for command and control (C2) communications. This module also employs a DNS AAAA-based recovery mechanism to retrieve configuration settings if Microsoft Graph authentication fails. ([securelist.com](https://securelist.com/project-cav3rn-cyberespionage-framework-using-outlook-and-dns/120757/?utm_source=openai)) The emergence of Project CAV3RN underscores the evolving tactics of state-sponsored threat actors, particularly the Iranian-linked group APT34 (OilRig). Their innovative use of legitimate services like Microsoft Graph and DNS for covert communications highlights the need for organizations to enhance monitoring of cloud services and implement robust detection mechanisms to identify and mitigate such sophisticated threats.
5 days ago
Kill Chain
Introducing Google's Gemini 3.5 Flash Cyber: Revolutionizing Vulnerability Detection
On July 21, 2026, Google's DeepMind announced the release of Gemini 3.5 Flash Cyber, an AI model designed to rapidly identify, validate, and patch software vulnerabilities. Built upon the 3.5 Flash architecture, this specialized model is tailored for cybersecurity applications, offering a cost-effective and efficient alternative to larger models. Initially, Gemini 3.5 Flash Cyber will be available exclusively to governments and trusted partners through CodeMender, an AI-powered agent for vulnerability discovery and patching. In evaluations, the model demonstrated superior performance, uncovering more unique vulnerabilities compared to its predecessors and other models, including Anthropic's Claude Opus 4.6. For instance, when tested on the V8 JavaScript Engine, Gemini 3.5 Flash Cyber identified 55 unique confirmed issues, surpassing the 47 found by Gemini 3.5 Flash and the 36 by Opus 4.6. This advancement underscores Google's commitment to enhancing software security through AI-driven solutions. ([deepmind.google](https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/?utm_source=openai)) The introduction of Gemini 3.5 Flash Cyber is particularly relevant in the current cybersecurity landscape, where the rapid identification and remediation of vulnerabilities are critical. As AI models become more adept at discovering security flaws, tools like Gemini 3.5 Flash Cyber provide defenders with a proactive means to address potential threats before they can be exploited. This development reflects a broader trend towards integrating AI into cybersecurity practices to bolster defenses against increasingly sophisticated attacks. ([deepmind.google](https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/?utm_source=openai))
5 days ago
Kill Chain
Critical ServiceNow AI Platform Vulnerability CVE-2026-6875 Exploited in the Wild
In July 2026, a critical vulnerability (CVE-2026-6875) was identified in the ServiceNow AI Platform, allowing unauthenticated attackers to execute arbitrary code by escaping the platform's script sandbox. ServiceNow promptly released patches throughout June 2026 to address this flaw. However, by mid-July, threat intelligence firm Defused reported active exploitation of this vulnerability in the wild, posing significant risks to organizations utilizing the platform. ([thehackernews.com](https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html?utm_source=openai)) The exploitation of CVE-2026-6875 underscores the increasing targeting of AI platforms by cyber adversaries. This incident highlights the urgency for organizations to apply security patches promptly and to enhance monitoring of AI-driven systems to mitigate emerging threats.
5 days ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports