Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 104 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1237–1248 / 3243 reports
Fortinet FortiSandbox Critical Vulnerabilities CVE-2026-39813 and CVE-2026-39808
Computer/Network Security4 months ago

Fortinet FortiSandbox Critical Vulnerabilities CVE-2026-39813 and CVE-2026-39808

In April 2026, Fortinet disclosed two critical vulnerabilities in its FortiSandbox product: CVE-2026-39813 and CVE-2026-39808, both with a CVSS score of 9.1. CVE-2026-39813 is a path traversal vulnerability in the JRPC API, allowing unauthenticated attackers to bypass authentication via specially crafted HTTP requests. CVE-2026-39808 is an OS command injection flaw that enables unauthorized code execution through crafted HTTP requests. These vulnerabilities affect FortiSandbox versions 4.4.0 through 4.4.8 and 5.0.0 through 5.0.5. Fortinet has released patches to address these issues. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/04/16/fortinet-fortisandbox-vulnerabilities-cve-2026-39813-cve-2026-39808/?utm_source=openai)) The exploitation of these vulnerabilities could lead to full system compromise, undermining the integrity of the security infrastructure. Organizations are urged to apply the patches promptly to mitigate potential risks. ([action1.com](https://www.action1.com/vulnerabilities/cve-2026-39813/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerability in Splunk Enterprise: CVE-2026-20253
Financial Services4 months ago

Critical Vulnerability in Splunk Enterprise: CVE-2026-20253

In June 2026, a critical vulnerability (CVE-2026-20253) was disclosed in Splunk Enterprise versions 10.0.x and 10.2.x, stemming from an unauthenticated PostgreSQL sidecar service endpoint. This flaw allows remote attackers to perform arbitrary file creation or truncation without credentials, potentially leading to remote code execution by exploiting PostgreSQL's lo_export function. While no active exploitation has been reported, a public proof-of-concept is available, increasing the risk for unpatched or exposed systems. The incident underscores the importance of promptly addressing vulnerabilities in widely used enterprise tools. Organizations must ensure timely patching and robust network segmentation to mitigate such risks, especially given the rapid dissemination of exploit proofs in the cybersecurity community.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
EvilTokens: The Phishing Service That Bypasses MFA Without Stealing Passwords
Financial Services4 months ago

EvilTokens: The Phishing Service That Bypasses MFA Without Stealing Passwords

In early 2026, the EvilTokens Phishing-as-a-Service platform emerged, exploiting the OAuth 2.0 device authorization grant flow to compromise over 340 Microsoft 365 organizations across multiple countries within five weeks. This method bypasses traditional password theft by tricking users into completing legitimate multi-factor authentication (MFA) processes on genuine Microsoft login pages, thereby granting attackers access tokens without raising typical security alarms. The attackers then gain persistent access to corporate emails, files, and other sensitive resources, facilitating data exfiltration and business email compromise (BEC) attacks. This incident underscores the evolving sophistication of phishing techniques that render conventional MFA defenses insufficient. Organizations must reassess their security protocols to address these advanced threats, emphasizing the need for continuous monitoring and user education on emerging phishing tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Inside the Modern SOC: Navigating 2026's Identity-Based Cyber Threats
Financial Services4 months ago

Inside the Modern SOC: Navigating 2026's Identity-Based Cyber Threats

In 2025, Unit 42 responded to over 750 major cyber incidents across various industries and countries. A significant trend observed was the rapid acceleration of attack timelines, with some adversaries moving from initial access to data exfiltration in just 72 minutes—a fourfold increase from the previous year. This surge is largely attributed to the integration of AI by threat actors, enhancing their speed and efficiency. Additionally, identity-based attacks have become predominant, with 65% of initial accesses driven by techniques such as social engineering and credential misuse. ([paloaltonetworks.com](https://www.paloaltonetworks.com/blog/2026/02/unit-42-global-ir-report/?utm_source=openai)) The current cybersecurity landscape underscores the urgency for organizations to adapt to these evolving threats. The rise in AI-driven attacks and the exploitation of identity vulnerabilities necessitate a reevaluation of security strategies. Implementing robust identity and access management, enhancing monitoring capabilities, and adopting AI-driven defense mechanisms are crucial steps to mitigate these accelerated and sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft 365 Copilot 'SearchLeak' Vulnerability (CVE-2026-42824) Exposes Sensitive Data
Financial Services4 months ago

Microsoft 365 Copilot 'SearchLeak' Vulnerability (CVE-2026-42824) Exposes Sensitive Data

In June 2026, a critical vulnerability chain known as 'SearchLeak' was discovered in Microsoft 365 Copilot Enterprise, identified as CVE-2026-42824. This exploit allowed attackers to steal sensitive data from users' mailboxes, OneDrive, and SharePoint accounts through specially crafted URLs. The attack combined a parameter-to-prompt injection, an HTML rendering race condition, and a content-security-policy bypass enabled by Bing server-side request forgery. Microsoft addressed this vulnerability at the beginning of June 2026, assigning it a critical severity rating. The 'SearchLeak' incident underscores the evolving nature of cyber threats targeting AI-integrated enterprise tools. It highlights the necessity for organizations to implement robust security measures, conduct regular vulnerability assessments, and stay informed about emerging attack vectors to protect sensitive data effectively.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
UNC6508's Prolonged Infiltration of REDCap Servers Exposes Medical Research Vulnerabilities
Health Care / Life Sciences4 months ago

UNC6508's Prolonged Infiltration of REDCap Servers Exposes Medical Research Vulnerabilities

Between September 2023 and November 2025, the Chinese state-sponsored group UNC6508 infiltrated vulnerable REDCap servers at a North American medical research institution. They deployed custom malware named Infinitered, which harvested credentials and established a backdoor, enabling prolonged data exfiltration. The attackers exploited REDCap's widespread use in medical research to access sensitive information undetected for over a year. This incident underscores the persistent threat posed by nation-state actors targeting critical research sectors. The sophisticated methods employed, including the abuse of legitimate features for data exfiltration, highlight the evolving tactics in cyberespionage campaigns.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Council of Europe Probes ShinyHunters Data Breach Allegations
Government Administration4 months ago

Council of Europe Probes ShinyHunters Data Breach Allegations

In June 2026, the Council of Europe, representing 46 member states and over 700 million people, began investigating claims by the cyber extortion group ShinyHunters of a significant data breach. ShinyHunters alleged they had stolen over 429,000 documents containing sensitive HR and payroll data from multiple departments, including payslips, personnel files, and CVs, encompassing personal and financial information such as names, dates of birth, addresses, salaries, and bank account details. The group threatened to leak the data if their demands were not met by June 16, 2026. This incident underscores the escalating threat posed by cyber extortion groups like ShinyHunters, who have been linked to numerous high-profile data breaches targeting organizations worldwide. Their tactics often involve exfiltrating large volumes of sensitive data and leveraging it for ransom, highlighting the critical need for robust cybersecurity measures and proactive threat detection to safeguard organizational data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Zero-Day Vulnerability in Cisco SD-WAN vManage Exploited in the Wild
Telecommunications4 months ago

Critical Zero-Day Vulnerability in Cisco SD-WAN vManage Exploited in the Wild

In June 2026, Cisco disclosed a critical vulnerability (CVE-2026-20262) in its Catalyst SD-WAN Manager, formerly known as SD-WAN vManage. This flaw allowed authenticated remote attackers with low-level privileges to execute arbitrary commands as root by exploiting insufficient input validation during file uploads. The vulnerability affected all deployment types, including on-premises, Cisco SD-WAN Cloud-Pro, Cisco SD-WAN Cloud (Cisco Managed), and Cisco SD-WAN for Government (FedRAMP). Cisco's Product Security Incident Response Team (PSIRT) became aware of active exploitation of this zero-day vulnerability earlier in the month and strongly advised customers to apply the released security updates promptly. The exploitation of CVE-2026-20262 underscores a concerning trend of attackers targeting critical infrastructure components through zero-day vulnerabilities. Organizations must remain vigilant, ensuring timely patch management and robust security practices to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
DOJ's Landmark Seizure of Deepfake Sites Under TAKE IT DOWN Act
Entertainment/Movie Production4 months ago

DOJ's Landmark Seizure of Deepfake Sites Under TAKE IT DOWN Act

In June 2026, the U.S. Department of Justice (DOJ) seized the domains CFAKE.com and SOCFAKE.com, which hosted nonconsensual AI-generated nude images and videos of women, including politicians, celebrities, and royalty. This action marked the first publicly announced domain seizure under the TAKE IT DOWN Act, a law enacted in May 2025 to combat the distribution of nonconsensual intimate imagery, including deepfakes. The DOJ's operation, in coordination with authorities from Italy and France, underscores the international effort to address the proliferation of such exploitative content. The enforcement of the TAKE IT DOWN Act highlights the growing concern over the misuse of artificial intelligence to create and disseminate deepfake pornography. As AI technology becomes more accessible, the potential for abuse increases, necessitating robust legal frameworks and international cooperation to protect individuals from digital exploitation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
UNC6508's Year-Long Espionage on U.S. Research Institutions
Health Care / Life Sciences4 months ago

UNC6508's Year-Long Espionage on U.S. Research Institutions

Between September 2023 and November 2025, the China-aligned threat actor UNC6508 conducted a covert cyber-espionage campaign targeting U.S. academic, medical, and military research institutions. The attackers exploited vulnerabilities in REDCap servers to deploy custom malware named Infinitered, enabling them to steal credentials and maintain persistent access. This operation led to the exfiltration of sensitive data related to defense intelligence, military strategy, artificial intelligence, and medical research. ([darkreading.com](https://www.darkreading.com/threat-intelligence/china-nexus-actor-us-researchers-undetected?utm_source=openai)) This incident underscores the evolving sophistication of state-sponsored cyber threats, highlighting the need for enhanced security measures in research institutions. The use of tailored malware and novel data exfiltration techniques by UNC6508 reflects a broader trend of advanced persistent threats employing innovative methods to achieve their objectives.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
U.S. Government Restricts Access to Anthropic's Advanced AI Models
Computer Software/Engineering4 months ago

U.S. Government Restricts Access to Anthropic's Advanced AI Models

In June 2026, the U.S. government issued an export control directive requiring Anthropic to suspend access to its advanced AI models, Fable 5 and Mythos 5, for all foreign nationals, including those within the United States. This action was taken due to national security concerns over potential vulnerabilities that could allow the models to be exploited for identifying software flaws. As a result, Anthropic disabled these models for all users to ensure compliance. This unprecedented move underscores the growing tension between technological advancement and national security, highlighting the challenges in regulating AI technologies. The directive has sparked international debate over the balance between innovation and security, with European leaders expressing concerns about overreliance on American AI providers and advocating for greater technological sovereignty.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Palo Alto Networks PAN-OS GlobalProtect VPN Authentication Bypass Vulnerability (CVE-2026-0257)
Financial Services4 months ago

Palo Alto Networks PAN-OS GlobalProtect VPN Authentication Bypass Vulnerability (CVE-2026-0257)

In May 2026, Palo Alto Networks disclosed CVE-2026-0257, a high-severity authentication bypass vulnerability in the GlobalProtect portal and gateway components of PAN-OS software. This flaw allows unauthenticated remote attackers to forge valid session cookies, enabling unauthorized VPN connections into corporate networks. Active exploitation of this vulnerability was observed starting May 17, 2026, with attackers attempting to access GlobalProtect portals. While no post-access behavior or lateral movement has been identified, the potential for unauthorized access to sensitive internal resources poses a significant risk. The inclusion of CVE-2026-0257 in the U.S. Cybersecurity and Infrastructure Security Agency's (CISA) Known Exploited Vulnerabilities catalog underscores the urgency for organizations to address this issue. The active exploitation highlights a broader trend of attackers targeting VPN infrastructures to gain unauthorized access, emphasizing the need for robust authentication mechanisms and timely patch management to mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports