Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 120 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1429–1440 / 3243 reports
CISA Contractor's GitHub Repository Exposes Sensitive Government Credentials
Government Administration5 months ago

CISA Contractor's GitHub Repository Exposes Sensitive Government Credentials

In May 2026, a contractor for the U.S. Cybersecurity and Infrastructure Security Agency (CISA) inadvertently exposed sensitive credentials by publishing them in a public GitHub repository named 'Private-CISA'. The repository contained plaintext passwords, AWS GovCloud keys, and internal documentation detailing CISA's software deployment processes. This exposure raised significant concerns about operational security and the potential for unauthorized access to critical government systems. ([techradar.com](https://www.techradar.com/pro/security/cisa-contractor-apparently-leaked-highly-sensitive-government-aws-keys-on-github?utm_source=openai)) This incident underscores the critical importance of stringent access controls and the need for robust monitoring of code repositories to prevent accidental exposure of sensitive information. It also highlights the necessity for organizations to implement comprehensive security training for all personnel, including contractors, to mitigate the risk of similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Operation Ramz 2026: A Landmark in MENA Cybercrime Enforcement
Financial Services5 months ago

Operation Ramz 2026: A Landmark in MENA Cybercrime Enforcement

Between October 2025 and February 2026, INTERPOL coordinated Operation Ramz, a large-scale cybercrime crackdown across 13 countries in the Middle East and North Africa (MENA) region. The operation led to the arrest of 201 individuals and the identification of 382 additional suspects involved in phishing, malware distribution, and online fraud. Authorities seized 53 servers and identified 3,867 victims, marking a significant milestone in regional cybercrime enforcement. ([interpol.int](https://www.interpol.int/en/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) This operation underscores the escalating threat of cybercrime in the MENA region and highlights the effectiveness of international collaboration in combating such activities. The success of Operation Ramz serves as a model for future joint efforts to disrupt cybercriminal networks and protect digital infrastructures globally.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Webworm's Innovative Use of Discord and Microsoft Graph API in Cyber Attacks
Government Administration5 months ago

Webworm's Innovative Use of Discord and Microsoft Graph API in Cyber Attacks

In 2025, the China-aligned advanced persistent threat (APT) group known as Webworm expanded its operations to target governmental organizations across Europe, including Belgium, Italy, Poland, Serbia, and Spain. The group employed sophisticated backdoors, EchoCreep and GraphWorm, which utilized Discord and Microsoft Graph API for command-and-control (C&C) communications, respectively. This approach allowed Webworm to conceal malicious activities within legitimate services, complicating detection efforts. Additionally, the group leveraged custom proxy tools like WormFrp, ChainWorm, SmuxProxy, and WormSocket to establish a covert network infrastructure, further enhancing their stealth capabilities. ([eset.com](https://www.eset.com/us/about/newsroom/research/eset-research-china-aligned-webworm-european-governments-targeted/?utm_source=openai)) The incident underscores a significant evolution in cyber-espionage tactics, highlighting the increasing use of popular cloud services for C&C communications. This trend poses new challenges for cybersecurity defenses, as traditional detection methods may struggle to identify malicious activities embedded within legitimate platforms. Organizations must adapt by implementing advanced monitoring and anomaly detection systems to effectively counter such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Verizon DBIR 2026 Highlights AI-Driven Social Engineering Threats in Healthcare
Health Care / Life Sciences5 months ago

Verizon DBIR 2026 Highlights AI-Driven Social Engineering Threats in Healthcare

In 2025, the healthcare sector experienced a significant surge in social engineering attacks, as highlighted in Verizon's 2026 Data Breach Investigations Report. Threat actors, increasingly leveraging artificial intelligence, have refined their tactics to create highly targeted and context-aware phishing campaigns. These sophisticated attacks exploit the inherent urgency and complex workflows within healthcare environments, leading to a higher success rate in compromising sensitive patient data and disrupting critical services. The report underscores that social engineering, alongside system intrusions and miscellaneous errors, accounted for 81% of breaches in the sector. This trend is particularly concerning given the healthcare industry's reliance on legacy systems and the high value of medical data. The integration of AI into social engineering tactics has made it more challenging for healthcare organizations to detect and prevent these attacks. As a result, there is an urgent need for enhanced security measures, including continuous staff training, implementation of multifactor authentication, and robust incident response plans to mitigate the evolving threat landscape.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds Two Known Exploited Vulnerabilities to Catalog
Computer Software/Engineering5 months ago

CISA Adds Two Known Exploited Vulnerabilities to Catalog

On May 21, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2025-34291, an origin validation error in Langflow, and CVE-2026-34926, a directory traversal flaw in Trend Micro Apex One (on-premise). Both vulnerabilities have been actively exploited, posing significant risks to affected systems. ([thehackernews.com](https://thehackernews.com/2026/05/cisa-adds-exploited-langflow-and-trend.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched software flaws. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation and safeguard their systems against emerging cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Kimwolf DDoS Botnet Operator Arrested in Canada
Financial Services5 months ago

Kimwolf DDoS Botnet Operator Arrested in Canada

In May 2026, Jacob Butler, a 23-year-old from Ottawa, Canada, was arrested for allegedly operating the Kimwolf botnet, a variant of the AISURU botnet. Kimwolf infected over a million IoT devices, including digital photo frames and web cameras, to execute massive distributed denial-of-service (DDoS) attacks. These attacks targeted global computers and servers, notably impacting the U.S. Department of Defense Information Network (DoDIN) with record-breaking volumes nearing 30 terabits per second. The botnet's operations resulted in significant financial losses, with some victims reporting damages exceeding one million dollars. ([justice.gov](https://www.justice.gov/usao-ak/pr/canadian-man-arrested-international-authorities-charged-administrating-kimwolf-ddos?utm_source=openai)) This incident underscores the escalating threat posed by IoT-based botnets and the critical need for robust cybersecurity measures. The arrest highlights the effectiveness of international collaboration in combating cybercrime, yet it also serves as a reminder of the persistent vulnerabilities within IoT ecosystems that can be exploited for large-scale attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Understanding the Risks of BYOVD: Exploiting Vulnerable Drivers Without Hardware
Computer/Network Security5 months ago

Understanding the Risks of BYOVD: Exploiting Vulnerable Drivers Without Hardware

In May 2026, a detailed analysis titled 'Making Vulnerable Drivers Exploitable Without Hardware - The BYOVD Perspective' was published, highlighting how attackers can exploit Windows kernel mode drivers without the associated hardware. This technique, known as Bring Your Own Vulnerable Driver (BYOVD), involves loading legitimate, signed drivers with known vulnerabilities to escalate privileges or disable security mechanisms. The research underscores that many drivers can be manipulated from user mode, even in the absence of the hardware they were designed for, thereby broadening the attack surface for potential exploits. The significance of this research lies in its exposure of the ease with which attackers can leverage vulnerable drivers to compromise systems. With the increasing sophistication of cyber threats, understanding and mitigating such vulnerabilities is crucial for maintaining robust security postures. Organizations must prioritize the identification and remediation of exploitable drivers to prevent potential breaches.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Europol Dismantles 'First VPN' Used by Cybercriminals
Financial Services5 months ago

Europol Dismantles 'First VPN' Used by Cybercriminals

In May 2026, a coordinated international operation led by French and Dutch authorities, with support from Europol and Eurojust, successfully dismantled 'First VPN,' a virtual private network service extensively utilized by cybercriminals to conceal their identities and illicit activities. The operation resulted in the seizure of 33 servers, the shutdown of multiple domains, and the identification of thousands of users linked to cybercrime, including ransomware attacks and data theft. ([europol.europa.eu](https://www.europol.europa.eu/media-press/newsroom/news/cybercriminal-vpn-used-ransomware-actors-dismantled-in-global-crackdown?utm_source=openai)) The takedown of 'First VPN' underscores the increasing effectiveness of international law enforcement collaboration in targeting cybercriminal infrastructure. This action not only disrupts a critical tool for cybercriminals but also provides authorities with valuable intelligence to pursue ongoing investigations into various cyber offenses. ([eurojust.europa.eu](https://www.eurojust.europa.eu/news/eurojust-coordinated-investigation-shuts-down-criminal-vpn-network?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Security Leak: A Wake-Up Call for Credential Management
Government Administration5 months ago

CISA Security Leak: A Wake-Up Call for Credential Management

In May 2026, a contractor for the U.S. Cybersecurity and Infrastructure Security Agency (CISA) inadvertently exposed highly sensitive credentials by maintaining a public GitHub repository named 'Private-CISA.' This repository contained plaintext passwords, AWS GovCloud keys, and internal documentation detailing CISA's software development and deployment processes. Security researcher Guillaume Valadon discovered the leak, describing it as the most severe government data exposure he had encountered. The repository had been publicly accessible since at least November 2025, raising significant concerns about operational security and potential unauthorized access to critical systems. This incident underscores the persistent risks associated with improper handling of sensitive credentials and the importance of stringent access controls. It highlights the need for organizations, especially those in critical infrastructure sectors, to enforce robust security practices, conduct regular audits, and ensure that contractors adhere to strict data protection protocols to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Arrest of Kimwolf Botnet Operator Highlights IoT Security Risks
Defense/Space5 months ago

Arrest of Kimwolf Botnet Operator Highlights IoT Security Risks

In May 2026, Canadian authorities arrested Jacob Butler, also known as "Dort," in Ottawa for allegedly operating the Kimwolf botnet. This botnet infected over a million IoT devices, including digital photo frames and web cameras, and was used to launch massive Distributed Denial-of-Service (DDoS) attacks worldwide. Notably, Kimwolf was linked to attacks targeting Department of Defense Information Network IP addresses, causing significant financial losses exceeding one million dollars for some victims. The botnet was also associated with a record-breaking DDoS attack measuring nearly 30 Terabits per second. ([justice.gov](https://www.justice.gov/usao-ak/pr/canadian-man-arrested-international-authorities-charged-administrating-kimwolf-ddos?utm_source=openai)) The arrest underscores the escalating threat posed by IoT-based botnets and the critical need for enhanced security measures to protect vulnerable devices. Despite previous takedowns, the resurgence of such botnets highlights the persistent challenges in combating cybercriminal activities targeting IoT infrastructure. ([techradar.com](https://www.techradar.com/pro/security/a-massive-new-ddos-botnet-has-already-snared-1-8-million-devices-heres-what-we-know?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Defender Zero-Day Vulnerabilities: CVE-2026-41091 and CVE-2026-45498
Government Administration5 months ago

Microsoft Defender Zero-Day Vulnerabilities: CVE-2026-41091 and CVE-2026-45498

In May 2026, Microsoft disclosed two zero-day vulnerabilities in its Defender security platform: CVE-2026-41091 and CVE-2026-45498. CVE-2026-41091 is a privilege escalation flaw in the Microsoft Malware Protection Engine, allowing attackers to gain SYSTEM privileges through improper link resolution. CVE-2026-45498 is a denial-of-service vulnerability in the Microsoft Defender Antimalware Platform, enabling threat actors to disrupt Windows devices. Both vulnerabilities were actively exploited before patches were released. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added these vulnerabilities to its Known Exploited Vulnerabilities Catalog, mandating federal agencies to apply patches by June 3, 2026. This incident underscores the critical need for organizations to maintain up-to-date security measures and promptly address vulnerabilities in widely used security tools.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Vulnerability in Cisco Secure Workload: CVE-2026-20223
Computer/Network Security5 months ago

Critical Vulnerability in Cisco Secure Workload: CVE-2026-20223

In May 2026, Cisco disclosed a critical vulnerability (CVE-2026-20223) in its Secure Workload product, formerly known as Cisco Tetration. This flaw, due to insufficient validation and authentication in internal REST APIs, allowed unauthenticated remote attackers to gain Site Admin privileges by sending crafted API requests. Exploiting this vulnerability could enable attackers to access sensitive information and modify configurations across tenant boundaries. Cisco released software updates to address the issue and confirmed that, as of the advisory's publication, there was no evidence of exploitation in the wild. This incident underscores the critical importance of robust API security and timely patch management. Organizations are reminded to promptly apply security updates and review API access controls to mitigate risks associated with similar vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports