Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 10 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 109–120 / 3243 reports
PHP2Shell: Millions of Exploit Attempts Targeting Critical PHP RCE Flaws to Deploy Mirai's Potassium Botnet
PHP2Shell: Millions of Exploit Attempts Targeting Critical PHP RCE Flaws to Deploy Mirai's Potassium Botnet
Information Technology/IT2 weeks ago

PHP2Shell: Millions of Exploit Attempts Targeting Critical PHP RCE Flaws to Deploy Mirai's Potassium Botnet

In October 2026, threat actors launched millions of exploitation attempts against two critical PHP vulnerabilities—CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2)—targeting unauthenticated remote code execution via crafted HTTP requests. Attackers attempted to deploy the Mirai-derived Potassium botnet, which uses ChaCha20-encrypted configuration, ENS-based C2 resolution, and supports 24 DDoS flood commands across ICMP, TCP, UDP, and OpenVPN protocols. Cloudflare observed hundreds of thousands of exploit attempts within two hours of public disclosure, escalating to millions by October 22. Over 34.4 million PHP services remained vulnerable as of October 23, prompting precautionary shutdowns of government, hospital, and school websites across Asia, Europe, and North America. PHP2Shell is drawing comparisons to Log4Shell due to its deep engine-level origin dating to PHP 5.4 (2012), meaning no application-layer fix suffices. With 56.6 million web properties running PHP and patches unavailable for end-of-life branches, organizations face a prolonged exposure window. The rise of ASLR-bypass techniques and automated exploit toolkits signals escalating attacker sophistication targeting cloud-hosted and shared-hosting PHP environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
MythicRatatoskr & Yggdrasil: How Sandworm Used a Mesh Network Backdoor to Wipe Ukrainian Infrastructure
MythicRatatoskr & Yggdrasil: How Sandworm Used a Mesh Network Backdoor to Wipe Ukrainian Infrastructure
Transportation2 weeks ago

MythicRatatoskr & Yggdrasil: How Sandworm Used a Mesh Network Backdoor to Wipe Ukrainian Infrastructure

In July 2025, Russian-aligned threat actor UAC-0099 (aka Earth Sirrush) gained initial access to a Ukrainian logistics company via a spear-phishing email deploying the MATCHWOK backdoor. A day later, the group introduced a previously undocumented implant called MythicRatatoskr, which routed command-and-control traffic through the Yggdrasil peer-to-peer mesh network to evade detection. Over two months later, on September 17, 2025, UAC-0099 handed off access to Sandworm, which executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy—destroying operational data across the compromised environment. This incident marks the first documented abuse of the Yggdrasil mesh network by a state-aligned threat actor for C2 infrastructure, signaling a new evasion frontier. The coordinated handoff between UAC-0099 and Sandworm reflects a maturing division-of-labor model among Russian APT groups, raising the operational risk bar for critical infrastructure defenders globally.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
70,000 Credentials Stolen: How Threat Actor k0t Industrialized Enterprise Firewall and VPN Exploitation in 2026
70,000 Credentials Stolen: How Threat Actor k0t Industrialized Enterprise Firewall and VPN Exploitation in 2026
Information Technology/IT2 weeks ago

70,000 Credentials Stolen: How Threat Actor k0t Industrialized Enterprise Firewall and VPN Exploitation in 2026

Between February and June 2026, a threat actor tracked as k0t (aliases: CryptoFeel, Member19, QazWsxShop) executed a large-scale credential harvesting campaign against internet-exposed Fortinet FortiGate and Palo Alto Networks GlobalProtect devices worldwide. Leveraging public scanning tools such as FOFA and ZoomEye, k0t enumerated vulnerable edge appliances and exploited CVE-2025-64446 (FortiWeb path traversal) and CVE-2026-0257 (PAN-OS authentication bypass) via bespoke Python scripts. Post-exploitation actions included Active Directory enumeration, persistence via MeshCentral, Atera, and AnyDesk, and data exfiltration through Rclone to Wasabi S3 and MEGA. Over 70,000 credentials were harvested, with victims spanning Asia Pacific, Latin America, Europe, and MENA. This campaign underscores the accelerating role of initial access brokers (IABs) feeding ransomware groups such as Qilin and The Gentlemen. With edge device exploitation now industrialized through automated scanning and off-the-shelf exploit scripts, organizations relying solely on perimeter firewalls face systemic credential exposure risk—making zero trust segmentation and encrypted east-west traffic controls critically urgent.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm
MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm
Transportation2 weeks ago

MythicRatatoskr: How UAC-0099 and Sandworm Used a Decentralized Mesh Network to Destroy a Ukrainian Logistics Firm

On July 16, 2025, Russia-aligned threat group UAC-0099 gained initial access to a Ukrainian grain logistics company via a spearphishing email delivering the MATCHWOK backdoor. Within 24 hours, a previously undocumented Go-based implant named MythicRatatoskr was deployed, routing its command-and-control traffic covertly through the Yggdrasil decentralized mesh network—the first documented abuse of this experimental peer-to-peer infrastructure by a state-aligned actor. UAC-0099 subsequently handed off access to Sandworm (GRU Unit 74455), which on September 17, 2025 executed a destructive data-wiping attack using the SDelete utility pushed via Active Directory Group Policy, permanently destroying data across the organization. This incident underscores a maturing pattern of operational collaboration among Russia-aligned APT groups, where specialized initial-access actors broker footholds to destructive-capability teams. The novel use of Yggdrasil for C2 concealment signals a broader adversarial trend toward experimental peer-to-peer and decentralized overlay networks to evade traditional perimeter and egress security controls, raising urgent detection and policy-enforcement challenges for defenders worldwide.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust
eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust
Financial Services2 weeks ago

eMudhra Intermediate CA Compromise: When Weak Entropy Breaks the Entire Chain of Trust

In October 2026, Palo Alto Networks Unit 42 disclosed that eight intermediate certificate authority (CA) private keys belonging to Indian CA eMudhra Limited were compromised due to a critical cryptographic defect introduced during certificate generation. Insufficient entropy during key generation allowed attackers to mathematically derive private keys directly from the corresponding public certificates. With access to these keys, adversaries could sign unauthorized TLS certificates, enabling meddler-in-the-middle (MitM) traffic interception, domain impersonation, and session hijacking across any domain protected by eMudhra-issued certificates. Major browser and OS vendors moved swiftly to revoke trust in the affected intermediates, and eMudhra revoked all eight certificates. This incident underscores the fragility of global PKI trust hierarchies and the cascading risk posed by a single CA's cryptographic failure. As certificate lifespans compress to 47 days and supply-chain attacks targeting cryptographic infrastructure grow more frequent, organizations must adopt automated certificate lifecycle management and continuous CT log monitoring to detect and respond to unauthorized certificate issuance before adversaries exploit it.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
When the Lock Is Made of Paper: The eMudhra TLS Certificate Meltdown of 2026
When the Lock Is Made of Paper: The eMudhra TLS Certificate Meltdown of 2026
Banking/Mortgage2 weeks ago

When the Lock Is Made of Paper: The eMudhra TLS Certificate Meltdown of 2026

In October 2026, Indian Certificate Authority eMudhra Limited was found to have issued eight TLS certificates bearing catastrophically weak private keys, ranging from just 3 to 8 bits of entropy instead of the standard 384 bits required for NIST P-384 elliptic curve cryptography. The defect, likely introduced through misconfigured or example key-generation code promoted to production, rendered the certificates trivially breakable by any adversary capable of mounting a man-in-the-middle position. VPN users, non-browser TLS clients, and any relying party that trusted eMudhra's root were immediately exposed to potential traffic interception and decryption. Certificate Transparency logs surfaced the anomaly, but only after issuance, underscoring the reactive nature of current PKI oversight mechanisms. This incident arrives amid a broader wave of PKI supply-chain failures and state-sponsored traffic-interception campaigns such as Salt Typhoon, highlighting that the integrity of encrypted communications depends entirely on the rigor of every CA in the trust store. Regulators and enterprises are now under pressure to enforce continuous CT-log monitoring, automate certificate validation pipelines, and adopt network-layer encryption that does not rely solely on TLS certificate trust.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
KSMBD Zero-Day Alert: Two Unpatched CVSS 9.0 Linux RCE Flaws Exposed on Public Mailing Lists
KSMBD Zero-Day Alert: Two Unpatched CVSS 9.0 Linux RCE Flaws Exposed on Public Mailing Lists
Information Technology/IT2 weeks ago

KSMBD Zero-Day Alert: Two Unpatched CVSS 9.0 Linux RCE Flaws Exposed on Public Mailing Lists

In October 2026, Trend Micro's Zero Day Initiative publicly disclosed two critical remote code execution vulnerabilities in the Linux kernel's KSMBD SMB server module, each rated CVSS 9.0, before any mainline kernel patch was available. ZDI-CAN-33774 requires no authentication and affects any Linux server with KSMBD active on port 445, exploiting a race condition in SMB protocol dispatch. ZDI-CAN-33549 targets SMB Direct over RDMA via an integer underflow enabling heap overflow. Neither flaw has received a CVE or upstream fix, leaving exposed systems in a prolonged window of unmitigated risk across enterprise Linux file-serving environments. The premature public disclosure—driven by a policy that AI-discovered bugs are inherently public—highlights a growing tension between responsible disclosure norms and AI-accelerated vulnerability research. With no patch and no CVE assigned, defenders have limited tooling to prioritize or track remediation, increasing the urgency for network-layer controls such as segmentation, egress filtering, and inline IPS to compensate while kernel fixes work through distribution pipelines.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
APT41's BlackX Bootkit: How a Cybercriminal Tool Became a Nation-State Weapon Against Diplomats
Government Administration2 weeks ago

APT41's BlackX Bootkit: How a Cybercriminal Tool Became a Nation-State Weapon Against Diplomats

In early 2026, Kaspersky GReAT uncovered a sophisticated APT campaign attributed with medium confidence to APT41 (FishMonger), targeting diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. The attackers deployed a UEFI bootkit dubbed BlackX—a reverse-engineered or purchased derivative of the BlackLotus bootkit—exploiting the Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot on fully patched machines. Post-exploitation payloads included a cloud-storage-based RAT communicating over Google Drive, OneDrive, and Yandex.Disk, and a Rust-based implant (OxiDLLRunner) for plugin-based command execution, enabling persistent kernel-level espionage against high-value diplomatic targets. This incident highlights a dangerous patch-activation gap: Microsoft's CVE-2022-21894 fix requires manual registry and scheduled-task steps most administrators never take. As APT groups increasingly borrow cybercriminal tooling and exploit dormant patch gaps, organizations running unactivated UEFI mitigations across hybrid and cloud-connected endpoints face heightened espionage risk in 2026 and beyond.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical VeloCloud Orchestrator Zero-Day (CVE-2026-114625): Attackers Escalate to Full SD-WAN Control
Critical VeloCloud Orchestrator Zero-Day (CVE-2026-114625): Attackers Escalate to Full SD-WAN Control
Information Technology/IT2 weeks ago

Critical VeloCloud Orchestrator Zero-Day (CVE-2026-114625): Attackers Escalate to Full SD-WAN Control

In October 2026, Arista disclosed an actively exploited critical SQL injection zero-day (CVE-2026-114625, CVSS 9.9) in the VeloCloud Orchestrator (VCO), the central management plane for VeloCloud SD-WAN networks. Any authenticated user—even one holding the lowest read-only customer role—could exploit the flaw to escalate to full operator-level privileges, potentially compromising the orchestrator host, its data, and downstream VeloCloud Edge devices. Fixes were released in VCO 5.2.3.18, 6.1.3.10, and 6.4.2.12; cloud-hosted instances were patched by Arista. Two attacker-controlled IPs were observed actively exploiting the vulnerability in the wild before the patch was available. This is the third VCO zero-day exploited since July 2026, signaling a sustained, targeted campaign against SD-WAN management infrastructure. The pattern—unauthenticated flaws followed by an authenticated privilege-escalation bug—suggests attackers are systematically mapping and chaining VCO weaknesses to achieve persistent, high-privilege control over enterprise network fabrics at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ARTEX AI at Machine Speed: How Storm-0940 Turned ConnectWise Into a Master Key for 2,250+ Targets
ARTEX AI at Machine Speed: How Storm-0940 Turned ConnectWise Into a Master Key for 2,250+ Targets
Information Technology/IT2 weeks ago

ARTEX AI at Machine Speed: How Storm-0940 Turned ConnectWise Into a Master Key for 2,250+ Targets

In October 2026, Microsoft attributed a sophisticated supply chain attack against ConnectWise's Cloud Backup application to Storm-0940, a China state-aligned threat actor active since at least 2021. The adversary deployed ARTEX, a Go-based agentic AI penetration testing framework, to automate password spraying, OAuth application abuse, and reconnaissance at machine speed—targeting over 2,250 tenants at 2,900 sign-in attempts per minute. Between October 10–14, 2026, attackers generated over 151,000 failed logon events before gaining access on October 15 by compromising ConnectWise cloud application identities, enabling authentication into customer environments without interactive user sign-in. Privileged access was achieved at several organizations within under three hours of initial targeting. This incident marks a critical inflection point in nation-state cyber operations: the weaponization of agentic AI frameworks compresses attack timelines from days to hours, renders traditional detection windows insufficient, and exploits the trust relationships inherent in managed service provider ecosystems—amplifying blast radius across hundreds of downstream organizations simultaneously.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
php2shell: CISA Demands Immediate Action on Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619
php2shell: CISA Demands Immediate Action on Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619
Information Technology/IT2 weeks ago

php2shell: CISA Demands Immediate Action on Critical PHP RCE Vulnerabilities CVE-2026-109618 and CVE-2026-109619

In October 2026, CISA issued an urgent alert disclosing two critical unauthenticated remote code execution vulnerabilities in PHP, designated CVE-2026-109618 and CVE-2026-109619 and collectively dubbed 'php2shell.' These flaws affect all PHP installations serving web requests across versions 8.1 through 8.4, enabling attackers to execute arbitrary code without any authentication. CISA directed organizations to immediately upgrade to patched releases (PHP 8.5.12, 8.4.27, 8.3.36, or 8.2.35), take unpatched PHP systems offline, and monitor for PHP worker processes spawning shells or downloading attacker tooling. The breadth of PHP's deployment across web infrastructure makes this a high-severity, wide-blast-radius exposure. The php2shell vulnerabilities underscore an accelerating trend of attackers targeting foundational web runtime components rather than application-layer logic. As exploit weaponization timelines compress from weeks to hours post-disclosure, organizations with large PHP footprints—especially those running legacy or embedded PHP dependencies—face elevated risk of pre-patch compromise through automated scanning campaigns.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
How Storm-0940 Used AI to Hack Hundreds of Companies in Hours via ConnectWise
How Storm-0940 Used AI to Hack Hundreds of Companies in Hours via ConnectWise
Information Technology/IT2 weeks ago

How Storm-0940 Used AI to Hack Hundreds of Companies in Hours via ConnectWise

Beginning September 2026, Storm-0940, a China-state aligned threat actor active since 2021, weaponized ARTEX—an open-source agentic AI penetration-testing framework—to automate large-scale attacks against hundreds of organizations across aerospace, defense, financial services, government, and technology sectors globally. The actor exploited a supply chain compromise of ConnectWise's multi-tenant cloud backup application, using ARTEX to conduct password spraying at 2,900 attempts per minute, OAuth token theft, and Microsoft Graph reconnaissance. In several confirmed intrusions, privileged cloud access was achieved in under three hours, with follow-on activity including application credential modification, privileged role self-assignment, and persistent backdoor establishment across victim Microsoft 365 tenants. This incident marks a watershed moment in nation-state offensive operations: AI-driven automation has collapsed the attacker dwell-time advantage that defenders historically relied upon. As agentic AI frameworks become commoditized and open-source, the barrier to executing sophisticated, multi-stage supply chain compromises at machine speed is dramatically lowered, forcing organizations to rethink detection and response timelines and elevate cloud identity governance to a board-level priority.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports