✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
LummaC2 Infostealer's Impact on Latin America in 2025
In 2025, LummaC2, also known as Lumma Stealer, emerged as a significant cybersecurity threat in Latin America and the Caribbean. This malware-as-a-service (MaaS) infostealer targeted various industries by exfiltrating sensitive data from browsers and cryptocurrency wallets. Its distribution methods included phishing, malvertising, and abuse of trusted platforms, making it accessible to threat actors with minimal technical skills. The widespread use of LummaC2 led to substantial data breaches and financial losses across the region. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/?utm_source=openai)) The prominence of LummaC2 underscores the evolving cyber threat landscape in Latin America, highlighting the need for enhanced cybersecurity measures. The region's rapid digitalization, coupled with persistent gaps in resources and workforce development, continues to expose it to sophisticated cyber threats. ([publications.iadb.org](https://publications.iadb.org/en/2025-cybersecurity-report-vulnerability-and-maturity-challenges-bridging-gaps-latin-america-and?utm_source=openai))
3 months ago
Kill Chain
UAC-0247's AGINGFLY Malware Targets Ukrainian Healthcare and Government Sectors
Between March and April 2026, the Ukrainian Computer Emergency Response Team (CERT-UA) identified a surge in cyberattacks targeting healthcare institutions, emergency services, and local government bodies. The threat actor, designated as UAC-0247, employed phishing emails disguised as humanitarian aid offers to deliver malicious LNK files. These files exploited Windows utilities to execute remote code, leading to the deployment of multi-stage loaders and custom malware, notably the AGINGFLY backdoor. AGINGFLY facilitated persistent remote control, enabling attackers to steal credentials from Chromium-based browsers and WhatsApp, and to deploy additional tools like SILENTLOOP and RAVENSHELL for further exploitation. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-agingfly-malware-used-in-attacks-on-ukraine-govt-hospitals/?utm_source=openai)) This campaign underscores a concerning evolution in cyber threats, with attackers leveraging sophisticated social engineering tactics and dynamic malware to infiltrate critical infrastructure. The focus on healthcare and government sectors highlights the urgent need for enhanced cybersecurity measures to protect sensitive data and maintain operational integrity in essential services.
3 months ago
Kill Chain
Critical SSO Vulnerability in Cisco Webex Services Exposes User Impersonation Risk
In April 2026, Cisco disclosed a critical vulnerability (CVE-2026-20184) in its Webex Services, specifically affecting the integration of single sign-on (SSO) with Control Hub. This flaw, due to improper certificate validation, allowed unauthenticated remote attackers to impersonate any user within the service by supplying a crafted token. Exploiting this vulnerability could grant unauthorized access to legitimate Cisco Webex services, posing significant security risks. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL?utm_source=openai)) Cisco has addressed this vulnerability in the Webex service. However, organizations using SSO integration must upload a new identity provider (IdP) SAML certificate to Control Hub to prevent service interruption. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL?utm_source=openai))
3 months ago
Kill Chain
Dahua DVRs Compromised: A 2026 Cybersecurity Wake-Up Call
In April 2026, a significant cybersecurity incident was identified involving Dahua Digital Video Recorders (DVRs). Attackers exploited default credentials and unpatched vulnerabilities to gain unauthorized access to these devices. Once compromised, the DVRs were co-opted into botnets, facilitating further malicious activities such as distributed denial-of-service (DDoS) attacks and unauthorized surveillance. This breach underscores the critical need for device owners to change default passwords and regularly update firmware to mitigate such risks. This incident highlights a broader trend of cybercriminals targeting Internet of Things (IoT) devices with default settings and outdated software. As IoT adoption continues to rise, ensuring robust security practices for these devices becomes increasingly vital to prevent their exploitation in large-scale cyberattacks.
3 months ago
Kill Chain
Unveiling the Hidden Threat: Shadow Admins in Active Directory
In April 2026, security researchers highlighted the escalating threat of 'shadow admins' within Active Directory (AD) environments. These are user accounts that, while not members of traditional administrative groups, possess elevated privileges due to misconfigurations or oversight. Such accounts can be exploited by attackers to gain unauthorized access, leading to potential domain-wide compromises. The increasing complexity of IT infrastructures, including cloud integrations and virtualization, has amplified the prevalence and risk associated with shadow admins. The significance of this issue is underscored by the growing trend of attackers leveraging indirect privilege paths to infiltrate systems. Organizations are urged to conduct thorough audits of their AD configurations, implement the principle of least privilege, and employ continuous monitoring to detect and remediate shadow admin accounts promptly.
3 months ago
Kill Chain
Critical Windows Task Host Vulnerability (CVE-2025-60710) Exploited in the Wild
In November 2025, Microsoft disclosed CVE-2025-60710, a privilege escalation vulnerability in the Windows Task Host component affecting Windows 11 and Windows Server 2025. This flaw allows local attackers with basic user permissions to gain SYSTEM privileges through low-complexity attacks, potentially leading to full control over compromised devices. The vulnerability arises from improper link resolution before file access, commonly referred to as 'link following'. On April 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-60710 to its Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. This inclusion underscores the critical need for organizations to apply the available patches promptly to mitigate potential security risks.
3 months ago
Kill Chain
Dragon Boss Solutions' 2026 Adware Supply Chain Attack: A Wake-Up Call for Cybersecurity
In March 2026, security researchers uncovered a sophisticated adware campaign orchestrated by Dragon Boss Solutions LLC, a company claiming to engage in 'search monetization research.' The campaign involved digitally signed software that, under the guise of legitimate applications, deployed payloads with SYSTEM privileges to disable antivirus protections across thousands of endpoints. This operation leveraged an unregistered update domain, allowing potential attackers to hijack the update mechanism and push malicious payloads to over 25,000 infected systems worldwide, including those within critical infrastructure sectors such as education, utilities, government, and healthcare. This incident underscores the evolving nature of adware threats, which are increasingly adopting advanced techniques to escalate privileges and disable security measures. The exploitation of unregistered domains in software update mechanisms highlights a significant supply chain vulnerability, emphasizing the need for organizations to scrutinize third-party software components and ensure the integrity of their update processes to prevent similar attacks.
3 months ago
Kill Chain
AgingFly Malware: A New Threat to Critical Infrastructure
In March 2026, a sophisticated cyberattack targeted Ukrainian local governments and hospitals, deploying a new malware family named 'AgingFly.' The attack began with phishing emails offering humanitarian aid, leading recipients to compromised or fake websites. These sites delivered malicious files that, once executed, initiated a multi-stage infection process. The final payload, AgingFly, enabled attackers to steal authentication data from Chromium-based browsers and the WhatsApp messenger, and provided remote control capabilities over infected systems. CERT-UA attributed these attacks to the threat actor group UAC-0247. This incident underscores the evolving tactics of cyber adversaries, including the use of AI-generated content and advanced multi-stage malware delivery mechanisms. Organizations, especially those in critical sectors, must remain vigilant against such sophisticated social engineering attacks and enhance their cybersecurity defenses accordingly.
3 months ago
Kill Chain
Microsoft's April 2026 Patch Tuesday: Addressing Critical Vulnerabilities and Zero-Day Exploits
In April 2026, Microsoft released a substantial Patch Tuesday update addressing 167 vulnerabilities across its product suite, marking it as the second-largest patch release in the company's history. This update included two zero-day vulnerabilities: CVE-2026-32201, a spoofing flaw in Microsoft SharePoint Server that was actively exploited in the wild, and CVE-2026-33825, an elevation of privilege issue in Microsoft Defender that had been publicly disclosed prior to patching. Additionally, eight critical vulnerabilities were addressed, affecting components such as Windows Internet Key Exchange (IKE) Service Extensions and Microsoft Word. The prevalence of elevation of privilege vulnerabilities, accounting for 57% of the patches, underscores the critical need for organizations to prioritize these updates to mitigate potential security risks. ([notebookcheck.net](https://www.notebookcheck.net/Microsoft-April-2026-Patch-Tuesday-fixes-167-vulnerabilities-and-two-zero-days.1274388.0.html?utm_source=openai)) The urgency of this update is heightened by the active exploitation of CVE-2026-32201 and the public disclosure of CVE-2026-33825, which could lead to increased targeting by threat actors. Organizations are advised to promptly apply these patches to protect their systems from potential attacks leveraging these vulnerabilities. ([notebookcheck.net](https://www.notebookcheck.net/Microsoft-April-2026-Patch-Tuesday-fixes-167-vulnerabilities-and-two-zero-days.1274388.0.html?utm_source=openai))
3 months ago
Kill Chain
Strengthening Defenses Against the Rise of EDR Killers Utilizing BYOVD Techniques
In early 2026, security researchers observed a significant increase in the use of EDR (Endpoint Detection and Response) killers employing the Bring Your Own Vulnerable Driver (BYOVD) technique. This method involves attackers introducing legitimate, signed drivers with known vulnerabilities into target systems to disable security defenses. ESET's analysis identified nearly 90 unique EDR killer tools exploiting 35 vulnerable drivers, enabling ransomware groups to neutralize security measures before deploying their payloads. The proliferation of these tools, available through underground marketplaces and public proof-of-concept exploits, has heightened concerns among cybersecurity professionals. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/edr-killer-ecosystem-expansion-requires-stronger-byovd-defenses/?utm_source=openai)) The current relevance of this incident lies in the evolving threat landscape, where the commodification of EDR killers has made sophisticated attack techniques accessible to a broader range of cybercriminals. This trend underscores the urgent need for organizations to implement robust defenses against BYOVD attacks, including monitoring for unauthorized driver installations and enhancing endpoint security measures. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/edr-killer-ecosystem-expansion-requires-stronger-byovd-defenses/?utm_source=openai))
3 months ago
Kill Chain
Microsoft's April 2026 Patch Tuesday: Addressing Critical SharePoint Vulnerabilities
In April 2026, Microsoft released a significant Patch Tuesday update addressing 167 vulnerabilities across its product suite, including an actively exploited zero-day in SharePoint Server (CVE-2026-32201). This spoofing vulnerability allowed unauthorized attackers to perform cross-site scripting (XSS) attacks, potentially leading to data exfiltration and unauthorized access. The update also included fixes for another zero-day in Microsoft Defender and several critical remote code execution flaws. ([notebookcheck.net](https://www.notebookcheck.net/Microsoft-April-2026-Patch-Tuesday-fixes-167-vulnerabilities-and-two-zero-days.1274388.0.html?utm_source=openai)) The scale and severity of this update underscore the increasing sophistication and frequency of cyber threats targeting widely used enterprise platforms. Organizations are urged to prioritize patching to mitigate risks associated with these vulnerabilities, especially given the active exploitation of the SharePoint flaw. ([crowdstrike.com](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-april-2026/?utm_source=openai))
3 months ago
Kill Chain
April 2026 Patch Tuesday: Addressing Critical Vulnerabilities Across Major Platforms
In April 2026, multiple critical vulnerabilities were disclosed across major software vendors, including Microsoft, Adobe, SAP, and Fortinet. Notably, Microsoft addressed 167 security flaws, among them an actively exploited zero-day in SharePoint Server (CVE-2026-32201) allowing spoofing attacks, and a publicly disclosed privilege escalation vulnerability in Microsoft Defender (CVE-2026-33825). SAP patched a severe SQL injection vulnerability (CVE-2026-27681) in its Business Planning and Consolidation and Business Warehouse products, which could lead to arbitrary database command execution. Adobe released fixes for critical vulnerabilities in Acrobat Reader, including an actively exploited remote code execution flaw (CVE-2026-34621). Fortinet addressed critical issues in FortiSandbox, such as an authentication bypass (CVE-2026-39813) and an OS command injection vulnerability (CVE-2026-39808). These vulnerabilities, if exploited, could lead to unauthorized access, data exfiltration, and system compromise, underscoring the importance of timely patching and vigilant security practices. The current threat landscape is characterized by immediate, real-world exploitation of these vulnerabilities, highlighting the urgency for organizations to apply these patches promptly to mitigate potential risks.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports