Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 107 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1273–1284 / 3243 reports
Russian National Charged in Connection with Void Blizzard Espionage Campaign

Russian National Charged in Connection with Void Blizzard Espionage Campaign

In June 2026, U.S. federal prosecutors charged Denis Nikolayevich Obrezko, a Russian national, with conspiracy to commit unauthorized computer access. Obrezko is accused of facilitating cyber-espionage operations for the Russia-aligned threat group Void Blizzard by procuring virtual private servers and domain names used in attacks targeting businesses, educational institutions, and other organizations. The FBI's investigation revealed that Void Blizzard primarily relied on stolen session tokens to authenticate to victim accounts without triggering re-authentication requirements, and used U.S.-based commercial proxy services to mask the connection's location. The group targeted at least 11 U.S. companies, with the actual number of victims likely being higher. ([cyberscoop.com](https://cyberscoop.com/russian-national-charged-void-blizzard-cyber-espionage/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber-espionage groups like Void Blizzard, which have been active since at least April 2024, targeting critical sectors across NATO member states and Ukraine. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/05/27/new-russia-affiliated-actor-void-blizzard-targets-critical-sectors-for-espionage/?utm_source=openai)) The group's methods, while not technically advanced, have proven effective, highlighting the need for organizations to implement robust cybersecurity measures to protect against such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Urgent: Ivanti Sentry Vulnerability Exploited – Immediate Action Required

Urgent: Ivanti Sentry Vulnerability Exploited – Immediate Action Required

In June 2026, a critical OS command injection vulnerability (CVE-2026-10520) was discovered in Ivanti Sentry, formerly known as MobileIron Sentry. This flaw allows remote, unauthenticated attackers to execute arbitrary commands with root privileges on affected devices. Ivanti released patches on June 9, 2026, addressing the issue in versions R10.5.2, R10.6.2, and R10.7.1. However, within 24 hours, reports emerged of active exploitation, with attackers backdooring exposed Sentry gateways. The Shadowserver Foundation identified multiple compromised instances, indicating widespread exploitation. Organizations using Ivanti Sentry are urged to apply the patches immediately to mitigate the risk of unauthorized access and potential data breaches. This incident underscores the critical importance of timely patch management and proactive vulnerability assessments to safeguard enterprise networks against rapidly evolving threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA's BOD 26-04: Accelerated Patching Mandate for Federal Agencies

CISA's BOD 26-04: Accelerated Patching Mandate for Federal Agencies

In June 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive 26-04, mandating Federal Civilian Executive Branch (FCEB) agencies to remediate high-risk vulnerabilities within accelerated timeframes, as short as three days. This directive supersedes previous directives and prioritizes patching based on factors such as public exposure, inclusion in CISA's Known Exploited Vulnerabilities catalog, potential for automated exploitation, and the level of control an attacker could gain. This directive underscores the escalating threat landscape and the necessity for rapid vulnerability management. Organizations beyond the federal scope are encouraged to adopt similar practices to mitigate risks associated with known exploited vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ShinyHunters Exploit Oracle PeopleSoft CVE-2026-35273 in 2026 Data Breaches

ShinyHunters Exploit Oracle PeopleSoft CVE-2026-35273 in 2026 Data Breaches

In June 2026, Oracle disclosed a critical vulnerability (CVE-2026-35273) in PeopleSoft PeopleTools versions 8.61 and 8.62, which allows unauthenticated remote code execution. The ShinyHunters cybercriminal group exploited this zero-day flaw to breach over 100 organizations, primarily in the education sector, leading to significant data theft and extortion attempts. Oracle has released emergency mitigations and is preparing a patch to address this vulnerability. This incident underscores the increasing targeting of enterprise resource planning (ERP) systems by cybercriminals, highlighting the necessity for organizations to promptly apply security updates and implement robust monitoring to detect unauthorized access attempts.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Kyushu Electric Power Data Breach: 10.9 Million Customer Records Exposed
Utilities5 months ago

Kyushu Electric Power Data Breach: 10.9 Million Customer Records Exposed

In April 2026, Kyushu Electric Power Co., Inc., a major Japanese utility company, experienced a significant data breach involving the loss of an external storage device containing personal information of approximately 10.9 million customers. The device, used for routine data backups, was stored in a server room cabinet with multiple physical security layers. On May 26, IT staff discovered the cabinet unlocked and the device missing. The data included customer names, service addresses, electricity usage data, telephone numbers, and names of retail electricity providers. Notably, no bank account or credit card information was stored on the device. The company has notified affected customers and relevant authorities, including Japan’s Personal Information Protection Commission and the Ministry of Economy, Trade, and Industry. Investigations are ongoing, with no evidence of data leakage confirmed as of now. This incident underscores the critical importance of robust physical security measures and strict access controls for sensitive data storage. It highlights the need for organizations to regularly review and enhance their data protection protocols to prevent unauthorized access and potential data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
GreatXML Exploit: A New Threat to Windows BitLocker Encryption
Banking/Mortgage5 months ago

GreatXML Exploit: A New Threat to Windows BitLocker Encryption

In June 2026, security researcher Chaotic Eclipse disclosed a zero-day vulnerability named 'GreatXML' that allows attackers to bypass Windows BitLocker encryption. The exploit leverages artifacts left by Microsoft Defender's offline scan to gain SYSTEM-level access during Recovery Mode, effectively rendering BitLocker protections ineffective. Systems that have run an offline scan are particularly vulnerable, as the exploit involves placing specific XML files in the recovery partition and rebooting into the Windows Recovery Environment. This vulnerability poses a significant risk to data security, especially for devices that have utilized Defender's offline scanning feature. ([securityweek.com](https://www.securityweek.com/greatxml-zero-day-exploit-bypasses-bitlocker/?utm_source=openai)) The disclosure of GreatXML underscores the ongoing challenges in securing endpoint devices against sophisticated attacks. It highlights the need for organizations to reassess their reliance on built-in encryption tools and to implement additional layers of security to protect sensitive data. The incident also raises concerns about the effectiveness of current vulnerability disclosure practices and the timeliness of patches for critical security flaws.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ShinyHunters Exploit Oracle PeopleSoft Vulnerability CVE-2026-35273 in 2026

ShinyHunters Exploit Oracle PeopleSoft Vulnerability CVE-2026-35273 in 2026

Between May 27 and June 9, 2026, the cybercriminal group ShinyHunters exploited a zero-day vulnerability (CVE-2026-35273) in Oracle PeopleSoft PeopleTools versions 8.61 and 8.62. This critical flaw allowed unauthenticated remote code execution, leading to unauthorized access and data exfiltration from over 100 organizations, predominantly universities. The University of Nottingham confirmed a breach affecting approximately 500,000 current and former students' personal and academic records. Oracle released a security advisory on June 10, 2026, acknowledging the vulnerability and urging immediate mitigation measures. This incident underscores the escalating threat posed by sophisticated cybercriminal groups targeting enterprise software vulnerabilities, particularly in the education sector. The exploitation of zero-day vulnerabilities for large-scale data breaches highlights the urgent need for organizations to implement proactive security measures, including timely patch management and comprehensive monitoring of critical systems.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Unveiling Cyber-Enabled Maritime Sanctions Evasion Tactics in 2026
Maritime5 months ago

Unveiling Cyber-Enabled Maritime Sanctions Evasion Tactics in 2026

In 2026, Iranian and Russian shadow fleet vessels, along with multiple sanctions evasion networks (SENs), utilized over 36 inauthentic websites to impersonate maritime authorities and organizations. These fraudulent sites facilitated the generation of false documents and certificates, effectively replicating key layers of the maritime compliance stack. This cyber-enabled infrastructure allowed sanctioned entities to circumvent international sanctions by creating credible but fraudulent maritime organizations, increasing the risk of due diligence failures and regulatory exposure. The emergence of such sophisticated cyber-enabled sanctions evasion tactics underscores the evolving nature of maritime compliance challenges. Organizations in the maritime and shipping sectors must integrate independent verification and cyber threat intelligence into compliance workflows to proactively identify and mitigate fraudulent online infrastructure.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA's BOD 26-04: A New Era in Federal Vulnerability Management

CISA's BOD 26-04: A New Era in Federal Vulnerability Management

On June 10, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-04, mandating federal agencies to adopt a risk-based approach to vulnerability remediation. This directive requires agencies to prioritize vulnerabilities based on four criteria: inclusion in CISA's Known Exploited Vulnerabilities (KEV) catalog, public exposure of the asset, potential for automated exploitation, and the level of control an attacker could gain upon successful exploitation. Vulnerabilities meeting all four criteria must be remediated within three days, while others have extended timelines or can be deferred. ([darkreading.com](https://www.darkreading.com/cyber-risk/cisa-rewrites-federal-patching-requirements-ai-threat-era?utm_source=openai))The directive reflects growing concerns about AI-driven threats accelerating the discovery and exploitation of vulnerabilities, necessitating faster remediation processes. This shift underscores the need for agencies to enhance their vulnerability management practices to keep pace with evolving cyber threats. ([darkreading.com](https://www.darkreading.com/cyber-risk/cisa-rewrites-federal-patching-requirements-ai-threat-era?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TanStack npm Supply Chain Attack: A Wake-Up Call for CI/CD Security

TanStack npm Supply Chain Attack: A Wake-Up Call for CI/CD Security

In May 2026, TanStack's npm packages were compromised in a sophisticated supply chain attack. The attackers exploited GitHub Actions vulnerabilities, including misconfigured workflows and cache poisoning, to publish 84 malicious versions across 42 packages. This breach led to credential theft and potential malware propagation, impacting developers and CI/CD systems. ([tanstack.com](https://tanstack.com/blog/npm-supply-chain-compromise-postmortem?utm_source=openai)) This incident underscores the critical need for secure CI/CD pipeline configurations and robust supply chain security measures, as similar attacks are on the rise, targeting widely-used open-source libraries.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
OpenAI Identifies Chinese Influence Operations Leveraging ChatGPT

OpenAI Identifies Chinese Influence Operations Leveraging ChatGPT

In June 2026, OpenAI's threat intelligence team identified two distinct influence operations originating from China, utilizing ChatGPT to generate content aimed at exacerbating divisive topics such as AI and data centers. The first operation, termed "Data Center Bandwagon," produced imagery and social media posts alleging that data center expansions were increasing electricity costs for Americans. The second operation created content portraying tariffs as covert tools for nations to exert control over the global technological landscape, selectively including U.S. President Donald Trump while omitting Chinese President Xi Jinping. Both campaigns employed VPNs to mask their origins, used ChatGPT in simplified Chinese to generate content in both English and Chinese, and impersonated Americans on platforms like X and YouTube. Despite these efforts, OpenAI found minimal evidence of significant engagement beyond the operators' own amplification networks, indicating limited impact on public discourse. This incident underscores the evolving use of AI tools in state-sponsored influence operations and highlights the necessity for vigilance against such tactics. The use of generative AI by foreign actors to manipulate public opinion represents a growing challenge in the cybersecurity landscape, emphasizing the need for robust detection and mitigation strategies to counteract misinformation campaigns.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
CISA's BOD 26-04: A New Era in Risk-Based Vulnerability Management

CISA's BOD 26-04: A New Era in Risk-Based Vulnerability Management

On June 10, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) issued Binding Operational Directive (BOD) 26-04, mandating federal agencies to prioritize vulnerability remediation based on four specific criteria: public exposure of the asset, evidence of active exploitation, potential for automated exploitation, and the technical impact of the vulnerability. Vulnerabilities meeting all four criteria require remediation within three days, accompanied by a forensic assessment to determine if systems have been compromised. ([cyberscoop.com](https://cyberscoop.com/cisa-vulnerability-remediation-directive-bod-26-04/?utm_source=openai)) This directive reflects CISA's response to the accelerated threat landscape, particularly the role of artificial intelligence in rapidly identifying and exploiting vulnerabilities. By focusing on risk-based prioritization, BOD 26-04 aims to enhance the efficiency and effectiveness of federal agencies' cybersecurity efforts, ensuring that the most critical vulnerabilities are addressed promptly to mitigate potential threats. ([cyberscoop.com](https://cyberscoop.com/cisa-vulnerability-remediation-directive-bod-26-04/?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Looking for threats in a different sector?

Browse All Threat Reports