✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
UAC-0145's Use of ClickFix CAPTCHAs: A New Cyber Threat in Ukraine
In July 2026, the Russian state-sponsored hacking group UAC-0145, also known as Sandworm or APT44, launched a campaign targeting Ukrainian organizations. The attackers employed a technique called ClickFix, which involves fake CAPTCHA prompts on compromised websites. These prompts instructed users to execute PowerShell commands, leading to the installation of data-stealing malware such as GHETTOVIBE and SCOUTCURL. The campaign compromised at least ten websites and utilized tools like SMARTAXE to dynamically alter web content, displaying deceptive CAPTCHA checks. Additionally, the attackers distributed malicious Android APK files via messaging apps, deploying the COWARDDUCK backdoor to exfiltrate sensitive information from infected devices. This incident underscores the evolving tactics of state-sponsored threat actors, who are increasingly adopting social engineering techniques traditionally associated with financially motivated cybercriminals. The use of ClickFix by UAC-0145 highlights the need for heightened vigilance and user education to recognize and avoid such deceptive tactics.
1 week ago
Kill Chain
Surge in ACR Stealer Attacks: Protecting Your Enterprise
Between late April and mid-June 2026, Microsoft observed a significant increase in attacks utilizing the ACR Stealer malware, targeting enterprise customers to exfiltrate browser-stored passwords, authentication tokens, and sensitive documents. The attackers employed social engineering tactics, notably the 'ClickFix' method, to deceive users into executing malicious commands. These campaigns leveraged WebDAV servers and the MSHTA utility to deliver the info-stealing payloads, with some variants utilizing blockchain services for command-and-control communication. The impact includes unauthorized access to confidential information and potential compromise of enterprise systems. This surge underscores the evolving sophistication of cyber threats, particularly the use of social engineering combined with advanced delivery mechanisms. Organizations must enhance their security posture by implementing robust user education programs, restricting the execution of untrusted scripts, and monitoring for unusual network activities to mitigate such risks.
1 week ago
Kill Chain
Inc Ransomware's Exploitation of SonicWall SMA Zero-Days in 2026
In July 2026, SonicWall disclosed two critical vulnerabilities in its Secure Mobile Access (SMA) 1000 Series appliances: CVE-2026-15409, a server-side request forgery flaw, and CVE-2026-15410, a code injection vulnerability. These vulnerabilities were actively exploited by the Inc ransomware group, allowing unauthenticated attackers to gain root-level access to the appliances. The attackers leveraged these flaws to infiltrate enterprise networks, exfiltrate credentials, and deploy ransomware payloads, leading to significant operational disruptions. This incident underscores the escalating threat posed by sophisticated ransomware groups targeting critical infrastructure through zero-day vulnerabilities. Organizations must prioritize timely patching, conduct thorough forensic analyses post-patching, and implement robust monitoring to detect and mitigate such advanced persistent threats.
1 week ago
Kill Chain
CISA Issues Urgent Directive on Fortinet FortiSandbox Vulnerabilities
In July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive for federal agencies to patch two critical vulnerabilities in Fortinet's FortiSandbox platform, identified as CVE-2026-39808 and CVE-2026-25089. These flaws, disclosed in April and June 2026 respectively, allow unauthenticated attackers to execute arbitrary code remotely via command injection attacks. Despite Fortinet's initial advisories, threat intelligence firm Defused observed active exploitation of these vulnerabilities in mid-June 2026, prompting CISA to mandate immediate remediation by July 19, 2026. The exploitation of these vulnerabilities underscores a growing trend of attackers targeting critical infrastructure components. FortiSandbox, integral to many organizations' security architectures, has become a focal point for cyber threats. This incident highlights the necessity for organizations to promptly apply security patches and maintain vigilant monitoring to mitigate emerging threats.
1 week ago
Kill Chain
Understanding the 'LegacyHive' Windows Zero-Day Vulnerability
In July 2026, a security researcher known as 'Nightmare Eclipse' disclosed a zero-day vulnerability named 'LegacyHive' affecting fully patched Windows systems. This local privilege escalation flaw in the Windows User Profile Service allows attackers with local access to load other users' registry hives, including those of administrators, potentially leading to unauthorized access and control over sensitive data. The researcher released a proof-of-concept (PoC) exploit, which, while requiring additional user credentials, still poses a significant security risk. The release of 'LegacyHive' underscores a growing trend of public disclosure of zero-day vulnerabilities, often as a form of protest against perceived mishandling by software vendors. This incident highlights the critical need for organizations to implement robust security measures, including timely patch management and monitoring for unusual system activities, to mitigate the risks associated with such vulnerabilities.
1 week ago
Kill Chain
Understanding the HollowByte OpenSSL DoS Vulnerability
In July 2026, a critical vulnerability known as 'HollowByte' was identified in OpenSSL, allowing unauthenticated attackers to induce a denial-of-service (DoS) condition on servers by sending a mere 11-byte payload. This flaw exploits the TLS handshake process, where the server allocates memory based on the declared size in the handshake header without verifying the actual payload size. Consequently, attackers can cause excessive memory allocation, leading to server instability or crashes. The OpenSSL team has addressed this issue in version 4.0.1 and backported fixes to earlier versions. Organizations are urged to update their OpenSSL installations promptly to mitigate potential disruptions. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/?utm_source=openai)) The HollowByte vulnerability underscores the persistent risks associated with foundational internet security protocols. As cyber threats evolve, it is imperative for organizations to remain vigilant, ensuring timely updates and robust security practices to safeguard against emerging vulnerabilities.
1 week ago
Kill Chain
OpenSSL HollowByte Flaw: Critical DoS Vulnerability Discovered
In July 2026, a vulnerability named 'HollowByte' was discovered in OpenSSL, allowing unauthenticated attackers to trigger a denial-of-service (DoS) condition on servers by sending a malicious 11-byte payload. This flaw causes the server to allocate significant memory for a message that never arrives, leading to potential service disruptions. The OpenSSL team has silently patched this vulnerability without assigning a CVE identifier or issuing an advisory. Organizations relying on OpenSSL for secure communications should prioritize updating to the latest patched versions to mitigate this risk. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/?utm_source=openai)) The HollowByte vulnerability underscores the critical importance of timely patch management and the need for organizations to stay vigilant about silent fixes in widely used libraries. As cyber threats continue to evolve, ensuring that foundational security components like OpenSSL are up-to-date is essential to maintain robust defense mechanisms.
1 week ago
Kill Chain
Salt Typhoon Cyberattack 2024: A Wake-Up Call for Surveillance System Security
In October 2024, the Salt Typhoon cyberattack, allegedly backed by China, targeted U.S. wiretap systems, granting attackers access to sensitive intelligence and law enforcement communications collected by major U.S. internet service providers such as Verizon, AT&T, and Lumen Technologies. The breach exploited systems designed for lawful surveillance, highlighting vulnerabilities in government-mandated surveillance infrastructure. This incident underscores the critical need for robust cybersecurity measures to protect sensitive communication channels from state-sponsored cyber espionage. The Salt Typhoon attack is part of a broader pattern of advanced persistent threats linked to Beijing, raising significant national security concerns regarding foreign access to critical U.S. surveillance infrastructure.
1 week ago
Kill Chain
BoryptGrab Malware Campaign Exploits Fake GitHub Repositories in 2026
In July 2026, cybersecurity researchers uncovered a large-scale malware campaign involving 292 fake GitHub repositories impersonating legitimate software projects. These repositories distributed a variant of the BoryptGrab infostealer, which targets sensitive data from web browsers, cryptocurrency wallets, and messaging applications. The malware was delivered through trojanized installers that exploited DLL side-loading techniques, allowing attackers to harvest credentials and financial information from unsuspecting users. The campaign primarily targeted users in the United States, Germany, Romania, and Venezuela, leading to significant data breaches and financial losses. This incident underscores the growing trend of cybercriminals leveraging trusted platforms like GitHub to distribute malware. The sophistication of the campaign, including the use of search engine optimization to promote malicious repositories, highlights the need for enhanced vigilance and verification processes when downloading software from online sources.
1 week ago
Kill Chain
ACR Stealer's ClickFix Campaign: A Wake-Up Call for Cybersecurity
In mid-2026, the ACR Stealer malware exploited ClickFix social engineering tactics to infiltrate enterprise networks. By deceiving users into executing commands via fake verification prompts, attackers deployed two primary infection chains: one utilizing WebDAV and PowerShell scripts, and another employing mshta.exe with obfuscated PowerShell. Both methods aimed to exfiltrate browser-stored credentials, session tokens, and sensitive Microsoft 365 documents, including files from OneDrive and SharePoint. This incident underscores a significant shift towards sophisticated social engineering attacks that bypass traditional security measures. The reliance on user interaction highlights the critical need for enhanced user awareness and robust endpoint protection strategies to mitigate such threats.
1 week ago
Kill Chain
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
In July 2026, Microsoft disclosed CVE-2026-58644, a critical deserialization vulnerability in SharePoint Server, allowing unauthenticated remote code execution. This flaw affects SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016. Exploitation requires an attacker to send a specially crafted network request, leading to potential full server compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by July 19, 2026. The inclusion of CVE-2026-58644 in CISA's catalog underscores the urgency of addressing this vulnerability, as it has been actively exploited in the wild. Organizations using affected SharePoint versions should prioritize patching to mitigate the risk of unauthorized access and potential data breaches.
1 week ago
Kill Chain
GoSerpent Malware: A Persistent Threat to Southeast Asian Governments
In late 2025, cybersecurity researchers identified a new malware strain named GoSerpent, actively targeting government and diplomatic entities in Southeast Asia. Discovered by Kaspersky in February 2026, GoSerpent is designed to establish long-term access for intelligence gathering by connecting to external servers and deploying secondary payloads for data collection and credential dumping. The malware's capabilities include setting up SOCKS5 proxy servers, enabling attackers to route traffic through compromised hosts and mask their true IP addresses. Additional tools such as ThumbcacheService for file collection and Mimikatz for credential extraction have been employed to facilitate data exfiltration through network shared drives. ([thehackernews.com](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html?utm_source=openai)) The resurgence of GoSerpent in May 2026, with evolved tools like the Stowaway RAT and enhanced data exfiltration methods, underscores the persistent and adaptive nature of cyber threats targeting sensitive government information. This incident highlights the critical need for robust cybersecurity measures and continuous monitoring to detect and mitigate sophisticated espionage campaigns. ([thehackernews.com](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html?utm_source=openai))
1 week ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports