Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 118 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1405–1416 / 3243 reports
Cybercriminals Exploit Government Data in Latin America: The 2026 Antel Breach
Government Administration5 months ago

Cybercriminals Exploit Government Data in Latin America: The 2026 Antel Breach

In May 2026, the cybercriminal group La Pampa Leaks claimed to have breached Uruguay's government-sponsored identity service, TuID, managed by the state-owned telecommunications company Antel. The attackers alleged prolonged access to the platform's infrastructure, potentially exposing sensitive personal data of Uruguayan citizens, including identification numbers, full names, birth dates, email addresses, phone numbers, residential addresses, biometric information, and digital signature data. Antel confirmed the cyberattack but stated that authentication credentials and highly sensitive data remained uncompromised. Immediate containment measures were implemented, and the incident was reported to the relevant authorities. This incident underscores a growing trend in Latin America, where cybercriminals increasingly target government agencies to monetize citizen data. The public-administration sector in the region has become the most-breached industry in the past year, highlighting the urgent need for enhanced cybersecurity measures and regulatory compliance to protect sensitive information.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Privilege Escalation Vulnerability in LiteSpeed cPanel Plugin (CVE-2026-48172)
Internet5 months ago

Critical Privilege Escalation Vulnerability in LiteSpeed cPanel Plugin (CVE-2026-48172)

In May 2026, a critical privilege escalation vulnerability, CVE-2026-48172, was discovered in the LiteSpeed User-End cPanel Plugin versions 2.3 through 2.4.4. This flaw allows authenticated cPanel users to execute arbitrary scripts with root privileges by exploiting the 'lsws.redisAble' function. The vulnerability has been actively exploited in the wild, leading to unauthorized root-level access on affected servers. LiteSpeed has released version 2.4.5 to address this issue, and users are strongly advised to update immediately. ([thehackernews.com](https://thehackernews.com/2026/05/litespeed-cpanel-plugin-cve-2026-48172.html?utm_source=openai)) The exploitation of CVE-2026-48172 underscores the persistent threat posed by privilege escalation vulnerabilities in widely used web hosting platforms. This incident highlights the critical need for timely patching and vigilant monitoring of server environments to prevent unauthorized access and potential system compromises.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CVE-2026-9082: Critical SQL Injection Vulnerability in Drupal Core
Higher Education/Acadamia5 months ago

CVE-2026-9082: Critical SQL Injection Vulnerability in Drupal Core

In May 2026, a critical SQL injection vulnerability, CVE-2026-9082, was identified in Drupal Core's database abstraction API, specifically affecting deployments using PostgreSQL. This flaw allows unauthenticated attackers to execute arbitrary SQL queries by sending specially crafted requests, potentially leading to full database compromise or remote code execution. The vulnerability impacts Drupal versions from 8.9.0 up to 11.3.9. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai)) The urgency of this issue is underscored by the fact that it can be exploited anonymously, posing a significant risk to internet-facing Drupal sites using PostgreSQL. Organizations are advised to promptly upgrade to the patched versions and implement monitoring controls to detect SQL injection attempts. ([drupal.org](https://www.drupal.org/sa-core-2026-004?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
BTMOB Android RAT: Unveiling a Stealthy Mobile Threat
Banking/Mortgage5 months ago

BTMOB Android RAT: Unveiling a Stealthy Mobile Threat

In early 2025, the BTMOB Android Remote Access Trojan (RAT) emerged as a significant cybersecurity threat, evolving from the SpySolr malware. Unlike traditional banking trojans, BTMOB offers adversaries extensive capabilities, including data exfiltration, screenshot capture, activity recording, and full remote control of infected devices. Distributed primarily through phishing campaigns that mimic legitimate services, victims are lured into downloading malicious APKs from fake app stores. Once installed, BTMOB exploits Android's Accessibility Services to gain elevated permissions, enabling it to operate stealthily and grant attackers comprehensive access to the device. The malware's commercialization through a no-code APK builder interface lowers the barrier for cybercriminals, allowing rapid generation of new payloads and tailored phishing lures without coding expertise. This ease of customization and distribution has led to its proliferation beyond initial detections in Brazil, posing a global threat to Android users. ([welivesecurity.com](https://www.welivesecurity.com/en/malware/btmob-stealthy-rat-burrowing-deep-android-devices/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Urgent: CISA Directs Immediate Patching of Critical Drupal Vulnerability CVE-2026-9082
Government Administration5 months ago

Urgent: CISA Directs Immediate Patching of Critical Drupal Vulnerability CVE-2026-9082

In May 2026, a critical SQL injection vulnerability (CVE-2026-9082) was discovered in Drupal's database abstraction API, affecting versions from 8.9.0 up to 11.3.9. This flaw allows unauthenticated attackers to execute arbitrary SQL commands on PostgreSQL-backed sites, potentially leading to data disclosure, privilege escalation, and remote code execution. The vulnerability was actively exploited, with over 15,000 attack attempts targeting nearly 6,000 sites across 65 countries, primarily in the gaming and financial services sectors. In response, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch their systems by May 27, 2026, emphasizing the urgency due to active exploitation in the wild. This incident underscores the critical importance of timely patch management and the need for organizations to stay vigilant against emerging threats targeting widely used content management systems like Drupal.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
MuddyWater's 2026 Espionage Campaign: Unveiling DLL Side-Loading Tactics
Electrical/Electronic Manufacturing5 months ago

MuddyWater's 2026 Espionage Campaign: Unveiling DLL Side-Loading Tactics

In the first quarter of 2026, the Iranian state-sponsored hacking group MuddyWater conducted a cyber-espionage campaign targeting at least nine organizations across nine countries on four continents. The sectors affected included industrial and electronics manufacturing, education, public-sector bodies, financial services, and professional services. Notably, a major South Korean electronics manufacturer was infiltrated, with attackers maintaining access to its network for approximately one week in February 2026. The attackers employed DLL side-loading techniques, utilizing legitimate binaries such as 'fmapp.exe' and 'sentinelmemoryscanner.exe' to execute malicious DLLs. These tools facilitated data theft from Chromium-based browsers and enabled activities like reconnaissance, credential theft, and establishing persistence within the network. ([thehackernews.com](https://thehackernews.com/2026/05/muddywater-uses-dll-side-loading-in.html?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors in targeting critical industries. The use of legitimate software components to execute malicious payloads highlights the need for enhanced detection mechanisms. Organizations must remain vigilant against such sophisticated cyber-espionage campaigns, as similar tactics are being observed across various sectors globally. ([thehackernews.com](https://thehackernews.com/2026/05/muddywater-uses-dll-side-loading-in.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
May 2026 Cyber Threats: ClearFake Campaign and GraphRunner Malware
Financial Services5 months ago

May 2026 Cyber Threats: ClearFake Campaign and GraphRunner Malware

In May 2026, multiple sophisticated cyber threats emerged, notably the ClearFake campaign, which utilized advanced web injection techniques to deploy the Amatera Stealer malware. This malware, an evolution of the ACR Stealer, was distributed through deceptive methods such as EtherHiding and ClickFix, leading to significant data exfiltration. Additionally, the GraphRunner malware debuted, exploiting vulnerabilities in cloud services to execute unauthorized code, posing substantial risks to cloud infrastructure security. These incidents underscore a concerning trend: cybercriminals are increasingly leveraging complex, multi-stage attacks that combine social engineering with technical exploits. The rise of such sophisticated malware campaigns highlights the urgent need for organizations to enhance their cybersecurity measures and remain vigilant against evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Iranian Hackers Leverage AI and SEO Poisoning in Advanced Cyber Espionage Campaigns
Airlines/Aviation5 months ago

Iranian Hackers Leverage AI and SEO Poisoning in Advanced Cyber Espionage Campaigns

In early 2026, the Iranian state-sponsored threat actor known as Nimbus Manticore (also referred to as Screening Serpens and UNC1549) launched a series of cyber espionage campaigns targeting the aviation and software sectors across the U.S., Europe, and the Middle East. These operations utilized sophisticated techniques, including career-themed phishing lures and search engine optimization (SEO) poisoning, to distribute newly developed backdoors named MiniFast and an updated version of MiniJunk (MiniJunk V2). The campaigns involved impersonating legitimate organizations to deceive employees into downloading malicious software, leading to unauthorized access and potential data exfiltration. Notably, the MiniFast backdoor exhibited characteristics suggesting it was developed with assistance from artificial intelligence, indicating an evolution in the threat actor's capabilities. ([thehackernews.com](https://thehackernews.com/2026/05/iranian-hackers-deploy-minifast-and.html?utm_source=openai)) This incident underscores a significant shift in cyber threat tactics, with state-sponsored actors increasingly leveraging AI in malware development and employing SEO poisoning to broaden their attack vectors. Organizations must remain vigilant against such evolving threats by enhancing their cybersecurity measures and educating employees on recognizing sophisticated phishing and social engineering tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CERT-In's 12-Hour Patching Mandate: A Response to AI-Driven Cyber Threats
Financial Services5 months ago

CERT-In's 12-Hour Patching Mandate: A Response to AI-Driven Cyber Threats

In May 2026, the Indian Computer Emergency Response Team (CERT-In) issued new guidelines requiring organizations to patch critical security vulnerabilities in internet-exposed systems within 12 hours of identification. This directive aims to mitigate threats from adversaries leveraging artificial intelligence (AI) tools and large language models (LLMs) to automate vulnerability discovery and exploitation, thereby accelerating the scale and speed of cyber attacks. CERT-In emphasized that AI-assisted cyber exploitation reduces the time required for adversaries to identify, weaponize, and exploit vulnerabilities, exposed services, weak identities, insecure APIs, and misconfigured systems. As organizations become increasingly dependent on interconnected digital infrastructure, cloud ecosystems, software supply chains, operational technologies, and AI-enabled platforms, the potential impact of AI-enabled cyber threats continues to increase across sectors. ([thehackernews.com](https://thehackernews.com/2026/05/cert-in-mandates-12-hour-patching-for.html?utm_source=openai)) This development underscores the evolving cyber threat landscape, where AI technologies are being harnessed to compress attack timelines and bypass traditional security controls. Organizations are urged to adopt proactive cybersecurity measures, including continuous threat assessment, proactive exposure reduction, and operational preparedness, to effectively counter these AI-assisted threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding and Mitigating MFA Prompt Bombing Attacks in 2026
Financial Services5 months ago

Understanding and Mitigating MFA Prompt Bombing Attacks in 2026

In May 2026, a significant cybersecurity threat emerged involving Multi-Factor Authentication (MFA) prompt bombing attacks. Cybercriminals exploited push-based MFA systems by repeatedly sending authentication requests to users, aiming to induce fatigue and prompt them to approve unauthorized access. This method effectively bypassed traditional MFA protections, leading to unauthorized access to sensitive systems and data. The attacks primarily targeted organizations utilizing push-based MFA for services like Microsoft 365, VPNs, and other cloud applications, resulting in compromised accounts and potential data breaches. The prevalence of MFA prompt bombing underscores the evolving tactics of threat actors who leverage social engineering to circumvent security measures. This trend highlights the necessity for organizations to adopt more resilient authentication methods, such as number-matching codes or hardware tokens, and to implement comprehensive user education programs to recognize and resist such attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Releases Critical Patch for SharePoint RCE Vulnerability CVE-2026-45659
Financial Services5 months ago

Microsoft Releases Critical Patch for SharePoint RCE Vulnerability CVE-2026-45659

In May 2026, Microsoft addressed a critical remote code execution vulnerability, CVE-2026-45659, in SharePoint Server versions 2016, 2019, and Subscription Edition. This flaw arises from the deserialization of untrusted data, allowing authenticated attackers with minimal permissions to execute arbitrary code remotely without user interaction. The vulnerability has a CVSS score of 8.8, indicating high severity. ([thehackernews.com](https://thehackernews.com/2026/05/microsoft-patches-sharepoint-rce-flaw.html?utm_source=openai)) The prompt release of patches underscores the importance of timely updates, especially given SharePoint's role in storing sensitive corporate data. Organizations are urged to apply these updates promptly to mitigate potential exploitation risks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/26/sharepoint-vulnerability-cve-2026-45659/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
FBI Issues Warning on Kali365 Phishing Service Exploiting Microsoft 365 Accounts
Financial Services5 months ago

FBI Issues Warning on Kali365 Phishing Service Exploiting Microsoft 365 Accounts

In April 2026, the FBI identified 'Kali365,' a Phishing-as-a-Service (PhaaS) platform distributed via Telegram, enabling cybercriminals to hijack Microsoft 365 accounts. By exploiting Microsoft's OAuth 2.0 Device Authorization grant flow, attackers trick users into entering device codes on legitimate Microsoft pages, granting unauthorized access to services like Outlook, Teams, and OneDrive. This method bypasses multi-factor authentication (MFA) and does not require stealing user credentials. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-warns-of-kali365-phishing-service-targeting-microsoft-365-accounts/?utm_source=openai)) The emergence of Kali365 underscores a significant shift in cyber threats, where sophisticated phishing tools are now accessible to less-skilled attackers. This trend highlights the urgent need for organizations to reassess and strengthen their authentication protocols and user education to mitigate evolving phishing tactics. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports