✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Cyberhaven's 2024 Chrome Extension Breach: A Supply Chain Attack Case Study
In December 2024, Cyberhaven, a data-loss prevention company, experienced a significant security breach when attackers compromised their Chrome Web Store account through a phishing attack. This allowed the publication of a malicious update (version 24.10.4) to their Chrome extension, which was automatically distributed to users. The compromised extension exfiltrated sensitive data, including authenticated sessions and cookies, to an attacker-controlled domain. The malicious version was available for approximately 25 hours before detection and removal. ([techcrunch.com](https://techcrunch.com/2024/12/27/cyberhaven-says-it-was-hacked-to-publish-a-malicious-update-to-its-chrome-extension/?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting browser extensions. With the increasing reliance on browser-based tools in enterprise environments, such attacks can lead to widespread data breaches and operational disruptions. Organizations must enhance their security protocols to mitigate such risks.
4 months ago
Kill Chain
INC Ransomware Group's 2025 Assault on Oceania's Healthcare Sector
Between July 2024 and December 2025, the INC Ransomware Group orchestrated a series of attacks targeting healthcare organizations across Australia, New Zealand, and Tonga. Utilizing tactics such as spear-phishing, exploitation of unpatched systems, and leveraging credentials from initial access brokers, the group infiltrated networks, exfiltrated sensitive data, and deployed ransomware to encrypt critical systems. Notably, in June 2025, INC disrupted Tonga's Ministry of Health, effectively shutting down core national services. ([darkreading.com](https://www.darkreading.com/threat-intelligence/inc-ransomware-healthcare-oceania?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks on the healthcare sector, emphasizing the need for robust cybersecurity measures, timely patch management, and comprehensive incident response strategies to safeguard patient data and ensure the continuity of essential health services.
4 months ago
Kill Chain
Critical n8n RCE Vulnerability (CVE-2025-68613) Exposes Systems to Full Compromise
In December 2025, a critical Remote Code Execution (RCE) vulnerability, identified as CVE-2025-68613, was discovered in n8n, an open-source workflow automation platform. This flaw allowed authenticated users to execute arbitrary code on the server by exploiting insufficient isolation in the workflow expression evaluation system. Successful exploitation could lead to full system compromise, including unauthorized access to sensitive data and modification of workflows. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-68613?utm_source=openai)) The vulnerability was addressed in n8n versions 1.120.4, 1.121.1, and 1.122.0. However, as of March 2026, over 40,000 unpatched instances remain exposed online, with significant concentrations in North America and Europe. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-n8n-rce-flaw-exploited-in-attacks/?utm_source=openai))
4 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing Critical Zero-Day Vulnerabilities
In March 2026, Microsoft released patches addressing 84 security vulnerabilities across its software portfolio, including two publicly disclosed zero-day flaws: CVE-2026-26127, a denial-of-service vulnerability in .NET, and CVE-2026-21262, an elevation of privilege vulnerability in SQL Server. Notably, over half of the patched vulnerabilities were related to privilege escalation, underscoring the critical need for organizations to apply these updates promptly to mitigate potential exploitation risks. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) This incident highlights the ongoing challenges in securing complex software ecosystems and the importance of timely patch management. The disclosure of zero-day vulnerabilities before patches are available increases the window of opportunity for threat actors, emphasizing the need for organizations to maintain robust vulnerability management practices.
4 months ago
Kill Chain
SAP's March 2026 Security Patches Address Critical Vulnerabilities
In March 2026, SAP released security patches addressing critical vulnerabilities in its enterprise software. Notably, CVE-2019-17571, a code injection flaw in SAP Quotation Management Insurance (FS-QUO), and CVE-2026-27685, an insecure deserialization issue in SAP NetWeaver Enterprise Portal Administration, were both patched. These vulnerabilities could allow remote code execution, potentially leading to full system compromise. ([securityweek.com](https://www.securityweek.com/sap-patches-critical-fs-quo-netweaver-vulnerabilities/?utm_source=openai)) The timely release of these patches underscores the importance of proactive vulnerability management. Organizations are urged to apply these updates promptly to mitigate risks associated with these critical flaws.
4 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Publicly Disclosed Zero-Days
In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Among these, two zero-day vulnerabilities were publicly disclosed prior to patch release: CVE-2026-21262, an elevation of privilege flaw in SQL Server, and CVE-2026-26127, a denial-of-service vulnerability in .NET. Notably, none of these vulnerabilities were reported as actively exploited in the wild at the time of release. The update also included eight critical vulnerabilities, such as CVE-2026-21536, a remote code execution flaw in the Microsoft Devices Pricing Program, which Microsoft mitigated server-side without requiring user action. This Patch Tuesday marks the first in six months without any actively exploited zero-day vulnerabilities, indicating a positive trend in Microsoft's proactive security measures. However, the presence of publicly disclosed vulnerabilities underscores the importance of timely patch application to mitigate potential risks.
4 months ago
Kill Chain
Stryker's 2026 Cyberattack: A Wake-Up Call for Healthcare Cybersecurity
In March 2026, Stryker Corporation, a leading U.S. medical technology company, experienced a significant cyberattack attributed to the pro-Palestinian hacktivist group Handala. The attackers reportedly utilized wiper malware to erase data from over 200,000 systems, including servers and mobile devices, leading to widespread operational disruptions across Stryker's global network. Employees in multiple countries, notably Ireland, were sent home as the company worked to contain the incident. Handala claimed the attack was retaliation for a missile strike that resulted in civilian casualties in Iran. This incident underscores the escalating trend of state-sponsored hacktivism targeting critical infrastructure and healthcare sectors. Organizations must enhance their cybersecurity measures to defend against sophisticated threats that aim not only to steal data but also to cause operational paralysis. The use of wiper malware highlights the need for robust data backup and recovery strategies to mitigate the impact of such destructive attacks.
4 months ago
Kill Chain
APT28's 2026 Espionage Campaign: Exploiting Office Vulnerabilities with Advanced Malware
In early 2026, the Russian state-sponsored threat actor APT28, also known as Fancy Bear, launched a sophisticated cyber-espionage campaign targeting Ukrainian military personnel. The attackers utilized spear-phishing emails containing malicious Microsoft Office documents to exploit the CVE-2026-21509 vulnerability, allowing them to execute code via OLE objects without macros or warnings. This method facilitated the deployment of two advanced malware implants: BeardShell, a custom C++ backdoor leveraging the Icedrive cloud service for command-and-control communications, and Covenant, a heavily modified open-source .NET post-exploitation framework. These tools enabled APT28 to conduct long-term surveillance, data exfiltration, and maintain persistent access to compromised systems. ([cyberpress.org](https://cyberpress.org/apt28-exploits-office-vulnerability/?utm_source=openai)) This incident underscores a significant evolution in APT28's tactics, techniques, and procedures (TTPs), highlighting their ability to rapidly weaponize newly disclosed vulnerabilities and integrate legitimate cloud services into their command-and-control infrastructure. The campaign's success emphasizes the urgent need for organizations to promptly apply security patches, enhance phishing defenses, and monitor for abuse of legitimate services in cyber operations. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/03/10/sednit-espionage-toolkit-stealing-data/?utm_source=openai))
4 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Key Vulnerabilities and Updates
In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Notably, two zero-day vulnerabilities were publicly disclosed prior to patch release: CVE-2026-21262, an elevation of privilege flaw in SQL Server, and CVE-2026-26127, a denial-of-service vulnerability in .NET. Additionally, a critical remote code execution vulnerability, CVE-2026-21536, affecting the Microsoft Devices Pricing Program, was mitigated server-side without requiring user action. While none of these vulnerabilities were reported as actively exploited in the wild, organizations are advised to apply the patches promptly to mitigate potential risks. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) The absence of actively exploited zero-day vulnerabilities in this release marks a positive shift from previous months. However, the public disclosure of certain flaws prior to patch availability underscores the importance of timely updates. Organizations should remain vigilant, as threat actors may exploit unpatched systems, emphasizing the need for robust patch management practices. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-march-2026/?utm_source=openai))
4 months ago
Kill Chain
Chinese APT Group Exploits Middle East Tensions to Target Qatar with PlugX Malware
In early March 2026, the Chinese-linked Advanced Persistent Threat (APT) group known as Camaro Dragon launched a cyber-espionage campaign targeting entities in Qatar. Within 24 hours of the escalation of Middle East tensions, the group deployed PlugX malware using war-themed lure documents that mimicked legitimate communications related to the regional conflict. The infection chain involved malicious LNK files leading to DLL hijacking of a legitimate Baidu NetDisk binary, ultimately installing the PlugX backdoor. This malware enables remote command execution, keystroke logging, screen capture, and data exfiltration. The rapid deployment and contextually relevant lures highlight the group's ability to swiftly adapt to geopolitical events for intelligence gathering purposes. This incident underscores the increasing trend of state-sponsored cyber actors exploiting current geopolitical crises to enhance the effectiveness of their campaigns. Organizations, especially those in geopolitically sensitive regions, must remain vigilant against such rapidly evolving threats and ensure robust cybersecurity measures are in place to detect and mitigate sophisticated intrusion attempts.
4 months ago
Kill Chain
AWS Data Centers in Middle East Targeted by Drone Strikes in 2026
In early March 2026, Iranian drone strikes targeted Amazon Web Services (AWS) data centers in the United Arab Emirates (UAE) and Bahrain, causing significant structural damage and service disruptions. Two facilities in the UAE were directly hit, while a third in Bahrain sustained damage from a nearby strike. These attacks led to outages across multiple AWS services, including EC2, S3, and RDS, affecting businesses, financial institutions, and government entities in the region. AWS reported that recovery efforts would be prolonged due to the extent of the physical damage. ([thenationalnews.com](https://www.thenationalnews.com/business/2026/03/03/drone-strikes-damage-amazon-data-centres-in-uae-and-bahrain-disrupting-services/?utm_source=openai)) This incident underscores the vulnerability of cloud infrastructure to physical attacks, especially in geopolitically volatile regions. Organizations relying on cloud services must reassess their disaster recovery and data sovereignty strategies to ensure resilience against both cyber and kinetic threats. ([apnews.com](https://apnews.com/article/71066b0a822c4cfd88b61e3fe79af917?utm_source=openai))
4 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Zero-Days
In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Among these, eight were rated as critical, and two vulnerabilities—CVE-2026-26127 and CVE-2026-21262—were publicly disclosed prior to patch release, though neither had been exploited in the wild. CVE-2026-21536, a remote code execution flaw in Microsoft's Devices Pricing Program, received the highest severity rating with a CVSS score of 9.8. Microsoft has proactively mitigated this issue within its cloud infrastructure, requiring no customer action. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) This update marks the first Patch Tuesday in six months without any actively exploited zero-day vulnerabilities. The absence of active exploitation provides organizations a crucial window to apply patches without the immediate pressure of ongoing attacks. However, the disclosure of vulnerabilities like CVE-2026-26127 and CVE-2026-21262 underscores the importance of timely patch management to preempt potential exploitation. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-march-2026/?utm_source=openai))
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports