Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 11 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 121–132 / 3243 reports
When the Number 4 Kills a Certificate Authority: The eMudhra PKI Collapse
When the Number 4 Kills a Certificate Authority: The eMudhra PKI Collapse
Computer/Network Security2 weeks ago

When the Number 4 Kills a Certificate Authority: The eMudhra PKI Collapse

In April 2025, Indian certificate authority eMudhra conducted a key generation ceremony that produced critically weak private keys for eight intermediate SSL/TLS certificates. The keys were so poorly generated — some as small as the integer 4 — that security researcher Scott Helme reconstructed all eight on a laptop in under one second. Major browser vendors including Chrome, Firefox, Apple, and Microsoft revoked trust within days. Mozilla removed eMudhra's root certificate entirely, and Google announced imminent Chrome root removal. Facing regulatory scrutiny from CERT-In, a 40% share price collapse, and reputational damage, eMudhra's board voted to exit the certificate authority business altogether. This incident highlights how a single procedural failure in a cryptographic ceremony can instantaneously nullify an entire trust hierarchy. As PKI underpins HTTPS, code signing, and enterprise identity, the fragility exposed here is resonating across the industry at a moment when regulators and browser consortiums are tightening CA accountability standards and scrutinizing key generation practices globally.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
SafePay Ransomware Has Breached 600+ Critical Infrastructure Organizations: What Security Teams Must Do Now
SafePay Ransomware Has Breached 600+ Critical Infrastructure Organizations: What Security Teams Must Do Now
Government Administration2 weeks ago

SafePay Ransomware Has Breached 600+ Critical Infrastructure Organizations: What Security Teams Must Do Now

Since August 2024, the SafePay ransomware group has breached more than 600 critical infrastructure organizations across North America, South America, Europe, and Australia. Operating as a private, affiliate-free group, SafePay gains initial access through credential exposure, brute-force attacks, and exploitation of VPN edge devices—particularly leveraging Mullvad VPN IP addresses and phished account profiles. Once inside, actors perform double-extortion: exfiltrating sensitive data before encrypting systems, then threatening public release if ransoms go unpaid. Recovery is further undermined by deliberate deletion of shadow copies and wiping of network-attached storage backups. A joint advisory from CISA, FBI, USSS, and international partners was published October 21, 2026. SafePay has rapidly filled the vacuum left by dismantled ransomware operations such as BlackCat (ALPHV) and LockBit, emerging as one of the most active ransomware threats globally. With valid credentials bypassing prevention controls in 63% of post-access scenarios, the incident underscores escalating risks tied to identity abuse, VPN exploitation, and insufficient lateral movement controls across hybrid and cloud environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Plex2Shell: How Attackers Chained Four CVEs Into a 9.8 Critical RCE—and What It Means for Your Cloud Security Posture
Plex2Shell: How Attackers Chained Four CVEs Into a 9.8 Critical RCE—and What It Means for Your Cloud Security Posture
Information Technology/IT2 weeks ago

Plex2Shell: How Attackers Chained Four CVEs Into a 9.8 Critical RCE—and What It Means for Your Cloud Security Posture

In October 2026, CISA issued an urgent advisory warning that threat actors were actively chaining four vulnerabilities in Plex Media Server—collectively dubbed Plex2Shell—to achieve unauthenticated remote code execution on exposed servers. The exploit chain, assigned a critical CVSS score of 9.8, begins with an unauthenticated SSRF flaw (CVE-2026-96652) that allows attackers to reach internal APIs, progresses through a URL injection flaw (CVE-2026-96654) to invoke plugin functions, escalates via an authenticated SSRF (CVE-2026-96655), and culminates in arbitrary file write (CVE-2026-96656) to plant malicious shared libraries. Active exploitation was observed as early as October 17, 2026, initially targeting honeypots to deploy cryptominers. Federal agencies were directed to patch or mitigate by October 23, 2026. Plex2Shell illustrates the accelerating trend of researchers publishing full exploit chains and PoC code within days of responsible disclosure, dramatically compressing the window between public knowledge and mass exploitation. With over 36,000 Plex servers estimated to be internet-exposed, chained CVE attacks against consumer-grade media infrastructure highlight how attacker tooling now commoditizes multi-stage exploits for rapid, widespread campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
eMudhra CA Compromise: When 8 Stolen Keys Put the Entire Web PKI at Risk
eMudhra CA Compromise: When 8 Stolen Keys Put the Entire Web PKI at Risk
Banking/Mortgage2 weeks ago

eMudhra CA Compromise: When 8 Stolen Keys Put the Entire Web PKI at Risk

In October 2026, Indian certificate authority eMudhra suffered a significant PKI compromise when eight intermediate CA private keys were exposed — six used for TLS certificate issuance and two for code signing. A researcher identifying only as 'Wayne' notified Mozilla on October 17, demonstrating possession of all eight private keys by signing a common message with each. Google, Mozilla, Apple, and the Go project responded within hours, distributing revocation blocks through OneCRL, CRLite, CRLSets, and patched Go releases. The root cause of the key exposure remains unknown, and it is unclear whether attackers had already leveraged the compromised keys to issue fraudulent certificates enabling HTTPS interception or software impersonation. This incident underscores the systemic fragility of the web's certificate trust ecosystem. CA compromises — from DigiNotar in 2011 to Symantec in 2017 and now eMudhra in 2026 — recur with regularity, and each event exposes how dependent enterprises are on browser vendors for emergency revocation, leaving non-browser applications and custom PKI consumers dangerously exposed until manual patching is completed.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Plex2Shell, Siemens & SiteGuard: CISA's 2026 KEV Mandate Exposes the Real Cost of Delayed Patching
Plex2Shell, Siemens & SiteGuard: CISA's 2026 KEV Mandate Exposes the Real Cost of Delayed Patching
Government Administration2 weeks ago

Plex2Shell, Siemens & SiteGuard: CISA's 2026 KEV Mandate Exposes the Real Cost of Delayed Patching

In October 2026, CISA added six vulnerabilities to its Known Exploited Vulnerabilities catalog, including four chained flaws in Plex Media Server collectively dubbed Plex2Shell (CVE-2026-96652, CVE-2026-96654, CVE-2026-96655, CVE-2026-96656). Security researchers confirmed that threat actors are actively weaponizing these vulnerabilities to achieve unauthenticated remote code execution, deploying cryptocurrency miners and proxy malware. Additionally, a DLL sideloading flaw in Siemens Software Center (CVE-2026-110936) is being exploited via ClickFix campaigns, and a command injection bug in EG Secure Solutions SiteGuard Server Edition (CVE-2026-106931) has been confirmed exploited. FCEB agencies face mandatory patch deadlines of October 23 and November 3, 2026. The Plex2Shell campaign exemplifies an accelerating trend of attackers chaining medium-severity vulnerabilities to achieve high-impact outcomes such as cryptojacking and proxy deployment. The breadth of affected vendors—media servers, industrial software, and web application firewalls—underscores that no technology category is immune, and that delayed patching in hybrid cloud environments creates critical exposure windows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Inside the Vasilek Operation: How Cyber Partisans Hid a Backdoor in VMware Tools for Two Years
Inside the Vasilek Operation: How Cyber Partisans Hid a Backdoor in VMware Tools for Two Years
Health Care / Life Sciences2 weeks ago

Inside the Vasilek Operation: How Cyber Partisans Hid a Backdoor in VMware Tools for Two Years

Between early 2024 and December 2025, a Belarus-aligned threat group known as Partisan Zmiy (Cyber Partisans) conducted a covert, nearly two-year espionage campaign inside a Russian healthcare organization's network. The attackers deployed the Vasilek backdoor (v1.5.8) by masquerading malicious executables as VMware Tools components—planting a rogue loader service ('vmauad') and replacing the legitimate 'vmtools.dll' with a malicious version. Vasilek leveraged Telegram for command-and-control and data exfiltration, activated GOST tunnels on a tight weekly schedule, and employed extensive operational security measures including timestomping, log clearing via 'Evlx,' and hostname binding. The group refrained from deploying its known Pryanik wiper, preserving access to exploit trusted relationships with subsidiary medical institutions. This incident exemplifies a maturing shift among hacktivist-aligned threat actors toward long-duration, low-noise espionage over destructive operations. The abuse of trusted virtualization infrastructure—specifically VMware Tools directories—to conceal persistent backdoors underscores the growing risk of supply-chain-adjacent persistence techniques in healthcare and critical infrastructure environments.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action
CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action
Government Administration2 weeks ago

CISA KEV Alert: Six Actively Exploited Vulnerabilities Across Plex, Siemens, and EG Secure Demand Immediate Action

In October 2026, CISA added six actively exploited vulnerabilities to its Known Exploited Vulnerabilities Catalog, spanning Plex Media Server (four CVEs covering SSRF, URI scheme injection, and path traversal), EG Secure Solutions SiteGuard Server Edition (OS command injection), and Siemens Software Center (uncontrolled search path element). These vulnerabilities collectively enable attackers to achieve initial access, remote code execution, and full system control. Federal agencies operating under BOD 26-04 face mandatory remediation timelines, while CISA urges all organizations to prioritize patching these high-risk flaws across publicly exposed assets before threat actors can leverage pre-patch compromise windows. This catalog addition reflects a sustained attacker focus on commercial media platforms, enterprise security gateways, and industrial software distribution infrastructure. The breadth of affected vendors—consumer-grade to OT-adjacent—signals that ransomware groups and nation-state actors are actively scanning for unpatched instances, making rapid remediation and network segmentation critical defensive priorities across all sectors.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Bronze Sandcastle: How China's Newest APT Turns Trusted Apps Into Backdoor Loaders
Bronze Sandcastle: How China's Newest APT Turns Trusted Apps Into Backdoor Loaders
Government Administration2 weeks ago

Bronze Sandcastle: How China's Newest APT Turns Trusted Apps Into Backdoor Loaders

Between August 2025 and August 2026, a previously undocumented China-aligned threat cluster tracked as Bronze Sandcastle conducted cyber-espionage campaigns against organizations in the Philippines, Taiwan, Afghanistan, Namibia, and South Korea. The group's signature technique is DLL sideloading via legitimate Sandboxie executables, where a malicious sbiedll.dll is planted alongside trusted, digitally signed binaries to execute attacker-controlled code in memory. Encrypted config.ini payloads deploy a full-featured backdoor capable of keylogging, screenshot capture, network enumeration, and C2 communication over public file-sharing services and GitHub repositories, minimizing static detection and leaving minimal disk artifacts. Bronze Sandcastle exemplifies a maturing pattern among China-nexus APTs: abusing trusted application ecosystems and living-off-the-land techniques to bypass endpoint defenses. As DLL sideloading variants proliferate across APT41, Mustang Panda, and now Bronze Sandcastle, defenders face mounting pressure to shift from file-based detection toward behavioral monitoring of in-memory execution chains and anomalous outbound traffic.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
SafePay Ransomware: How 600+ Organizations Were Compromised Through Unpatched VPNs and Flat Networks
SafePay Ransomware: How 600+ Organizations Were Compromised Through Unpatched VPNs and Flat Networks
Government Administration2 weeks ago

SafePay Ransomware: How 600+ Organizations Were Compromised Through Unpatched VPNs and Flat Networks

Since August 2024, the SafePay ransomware group has compromised at least 600 victims across critical infrastructure sectors in North America, South America, Europe, and Australia. Threat actors gain initial access by exploiting unpatched VPN and edge-device vulnerabilities—including CVE-2020-3259, CVE-2023-20269, CVE-2023-27532, CVE-2024-40711, and CVE-2024-40766—and through brute-force credential attacks using Mullvad VPN exit nodes. Once inside, actors employ living-off-the-land binaries (PsExec, WinRM, RDP), disable security tooling, escalate privileges via UAC bypass and token impersonation, and exfiltrate data with FileZilla, RClone, WinSCP, and Backblaze B2 before encrypting files with a hybrid ChaCha20/RSA scheme and demanding cryptocurrency ransoms. SafePay ranked among the most active ransomware groups in 2026, demonstrating that double-extortion operations targeting unpatched edge devices and flat, under-segmented networks remain highly effective. The group's systematic abuse of legitimate administrative tools underscores a growing industry-wide challenge: distinguishing malicious LOTL activity from routine IT operations without robust east-west visibility and zero-trust segmentation controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
PHP2Shell: How Two Critical RCE Flaws in the PHP Runtime Expose Every Cloud Workload Running PHP
PHP2Shell: How Two Critical RCE Flaws in the PHP Runtime Expose Every Cloud Workload Running PHP
Information Technology/IT2 weeks ago

PHP2Shell: How Two Critical RCE Flaws in the PHP Runtime Expose Every Cloud Workload Running PHP

In October 2026, the PHP project issued emergency patches for two critical remote code execution vulnerabilities—CVE-2026-109618 and CVE-2026-109619, collectively dubbed PHP2Shell—rated 9.2 on the CVSS v4.0 scale. Discovered by researchers at Wiz, Calif, and OpenAI's Codex Security team, the flaws reside in the PHP runtime engine itself, meaning every web application running on a vulnerable PHP version is exposed regardless of application-level security. Attackers can execute arbitrary code without authentication, with Apache mod_php servers at highest risk. Early exploit attempts were observed by Cloudflare before patches shipped, and organizations including BambooHR and Dutch government portals took services offline as a precaution. Fixed versions are PHP 8.5.12, 8.4.27, 8.3.36, and 8.2.35. This incident underscores a growing trend of AI-assisted vulnerability research accelerating exploit development timelines from months to days. The PHP2Shell flaws affect an estimated 77% of all websites using server-side languages, making this one of the broadest-impact web infrastructure vulnerabilities in recent years and raising urgent questions about runtime-layer security hygiene.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
22.6 Million PHP Instances at Risk: What Security Teams Must Do Now About CVE-2026-109618 and CVE-2026-109619
22.6 Million PHP Instances at Risk: What Security Teams Must Do Now About CVE-2026-109618 and CVE-2026-109619
Internet2 weeks ago

22.6 Million PHP Instances at Risk: What Security Teams Must Do Now About CVE-2026-109618 and CVE-2026-109619

In October 2026, Unit 42 researchers disclosed two critical remote code execution vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619—each carrying a CVSS 4.0 score of 9.2. CVE-2026-109618 exploits improper control flow in out-of-memory error handling via longjmp(), leaving request memory uninitialized and enabling reliable RCE through OOM triggers. CVE-2026-109619 allows attackers to read or branch on freed global memory during subsequent requests, also achieving arbitrary code execution. Palo Alto Networks Cortex Xpanse identified over 22.6 million potentially exposed instances globally, and at least one European government proactively took its public website offline. Proof-of-concept code has been observed by Unit 42 researchers, indicating active weaponization risk. These vulnerabilities reflect a broadening attacker focus on foundational web runtime environments rather than application-layer logic alone. As PHP continues to underpin millions of web servers and content management systems worldwide, critical runtime flaws like these represent a systemic risk that demands immediate patching, attack surface management, and inline threat prevention—particularly as autonomous vulnerability discovery tools lower the bar for exploitation at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
One Stolen API Key, 300+ Compromised Tenants: Inside the ConnectWise Cloud Backup Supply Chain Attack
One Stolen API Key, 300+ Compromised Tenants: Inside the ConnectWise Cloud Backup Supply Chain Attack
Information Technology/IT2 weeks ago

One Stolen API Key, 300+ Compromised Tenants: Inside the ConnectWise Cloud Backup Supply Chain Attack

In October 2026, ConnectWise disclosed unauthorized access to application identities associated with its Cloud Backup product (formerly SkyKick), a SaaS solution serving managed service providers (MSPs). A threat actor used compromised API credentials to authenticate into Microsoft 365 Entra tenants across more than 1,000 organizations, with over 300 successful sign-ins confirmed by third-party researchers at Huntress and Todyl. The attacker escalated privileges to Global Administrator in at least two tenants and planted persistent backdoor credentials. ConnectWise responded by disabling Cloud Backup, SaaS Security, and Cloud Management services while engaging an incident response firm and revoking compromised certificates. This incident exemplifies the accelerating risk of supply-chain credential abuse targeting MSP platforms. Attackers increasingly exploit the trusted, high-permission relationships between SaaS vendors and their downstream customers, turning a single compromised vendor identity into a master key across hundreds of enterprise Microsoft 365 environments—amplifying blast radius far beyond what a direct breach would achieve.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports