Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 122 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1453–1464 / 3243 reports
Critical Windows Zero-Day Vulnerabilities Uncovered: 'YellowKey' and 'GreenPlasma'
Financial Services5 months ago

Critical Windows Zero-Day Vulnerabilities Uncovered: 'YellowKey' and 'GreenPlasma'

In May 2026, a security researcher known as 'Nightmare Eclipse' disclosed multiple zero-day vulnerabilities affecting Windows systems, including 'YellowKey' and 'GreenPlasma'. 'YellowKey' allows attackers with physical access to bypass BitLocker encryption using a USB device, while 'GreenPlasma' enables local privilege escalation to SYSTEM level by exploiting the Windows CTFMON input service. These vulnerabilities expose critical weaknesses in Windows security mechanisms, potentially leading to unauthorized data access and system control. The rapid disclosure of these zero-days, some of which are actively exploited, underscores the urgency for organizations to implement robust security measures beyond patching, such as enforcing physical security controls, applying the principle of least privilege, and enhancing monitoring for anomalous activities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Verizon DBIR 2026 Highlights AI-Driven Surge in Vulnerability Exploitation
Financial Services5 months ago

Verizon DBIR 2026 Highlights AI-Driven Surge in Vulnerability Exploitation

In 2026, Verizon's Data Breach Investigations Report (DBIR) revealed a significant shift in cyberattack vectors, with vulnerability exploitation accounting for 31% of breaches, surpassing stolen credentials for the first time. This surge is attributed to threat actors leveraging artificial intelligence (AI) to rapidly identify and exploit software flaws, reducing the window for defense from months to mere hours. ([verizon.com](https://www.verizon.com/about/news/breach-industry-wide-dbir-finds?utm_source=openai)) The report also highlights a concerning decline in vulnerability remediation, with only 26% of critical vulnerabilities in CISA's Known Exploited Vulnerabilities catalog fully addressed in 2025, down from 38% the previous year. This trend underscores the urgent need for organizations to enhance their patch management processes and adopt proactive security measures to mitigate the evolving threat landscape. ([cyberscoop.com](https://cyberscoop.com/verizon-data-breach-investigations-report-2026/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerability in ZKTeco CCTV Cameras: CVE-2026-8598
Security/Investigations5 months ago

Critical Vulnerability in ZKTeco CCTV Cameras: CVE-2026-8598

In May 2026, a critical vulnerability (CVE-2026-8598) was identified in ZKTeco CCTV cameras, specifically affecting the SSC335-GC2063-Face-0b77 model with firmware versions prior to V5.0.1.2.20260421. This flaw involved an undocumented configuration export port that lacked authentication, potentially exposing sensitive information such as camera account credentials and open services. Exploitation of this vulnerability could lead to unauthorized access and control over the affected devices. This incident underscores the importance of securing physical security devices, as they can serve as entry points for broader network compromises. Organizations are urged to promptly update their firmware to the latest version and implement robust network segmentation to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit
Banking/Mortgage5 months ago

Microsoft Releases Mitigation for YellowKey BitLocker Bypass CVE-2026-45585 Exploit

In May 2026, a security researcher known as Nightmare-Eclipse publicly disclosed a vulnerability named 'YellowKey' (CVE-2026-45585) affecting Windows 11 and Windows Server 2025. This flaw allows attackers with physical access to bypass BitLocker encryption by exploiting the Windows Recovery Environment (WinRE), thereby gaining unauthorized access to encrypted data. The exploit involves placing specially crafted 'FsTx' files on a USB drive, booting into WinRE, and triggering an unrestricted shell with full access to the encrypted volume. The public disclosure of YellowKey highlights the ongoing risks associated with physical access attacks and underscores the importance of robust security measures beyond software-based protections. Organizations must reassess their physical security protocols and implement additional safeguards, such as requiring a PIN at startup, to mitigate such vulnerabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical XSS Vulnerability in Kieback & Peter DDC Controllers: CVE-2026-4293
Commercial Real Estate5 months ago

Critical XSS Vulnerability in Kieback & Peter DDC Controllers: CVE-2026-4293

In May 2026, a cross-site scripting (XSS) vulnerability, identified as CVE-2026-4293, was discovered in Kieback & Peter DDC Building Controllers. This flaw allows attackers to execute malicious JavaScript in a victim's browser via the controller's web interface, potentially leading to unauthorized control over the browser. Affected models include DDC4002, DDC4100, DDC4200, DDC4200-L, DDC4400, DDC4002e, DDC4200e, DDC4400e, DDC4020e, DDC4040e, and DDC520, with firmware versions up to 1.12.14 and 1.23.4, respectively. ([windowsforum.com](https://windowsforum.com/threads/kieback-peter-ddc-xss-advisory-patch-supported-controllers-isolate-legacy-ot.418939/?utm_source=openai)) This incident underscores the critical need for robust security measures in building automation systems, especially as such vulnerabilities can serve as entry points for broader network compromises. Organizations are urged to update firmware where possible and isolate legacy systems to mitigate potential risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Disrupts Fox Tempest's Malware-Signing Service
Computer Software/Engineering5 months ago

Microsoft Disrupts Fox Tempest's Malware-Signing Service

In May 2026, Microsoft disrupted a malware-signing-as-a-service (MSaaS) operation run by the threat actor Fox Tempest. This operation exploited Microsoft's Artifact Signing system to generate fraudulent code-signing certificates, enabling cybercriminals to distribute malware that appeared legitimate. Fox Tempest's service was linked to various ransomware groups, including Vanilla Tempest, Storm-0501, Storm-2561, and Storm-0249, facilitating attacks that compromised thousands of machines and networks worldwide. The disruption involved seizing domain names, websites, and Azure resources associated with Fox Tempest, effectively dismantling their infrastructure. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/05/19/exposing-fox-tempest-a-malware-signing-service-operation/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who increasingly abuse legitimate services to enhance the effectiveness of their attacks. The takedown of Fox Tempest highlights the critical need for continuous monitoring and rapid response to such threats, as well as the importance of strengthening verification processes to prevent the misuse of code-signing tools. ([blogs.microsoft.com](https://blogs.microsoft.com/on-the-issues/2026/05/19/disrupting-fox-tempest-a-cybercrime-service/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Verizon's 2026 DBIR: A Wake-Up Call on Exploited Vulnerabilities and Ransomware
Financial Services5 months ago

Verizon's 2026 DBIR: A Wake-Up Call on Exploited Vulnerabilities and Ransomware

In 2025, Verizon's Data Breach Investigations Report (DBIR) analyzed over 22,000 breaches, revealing that exploited vulnerabilities became the primary initial access vector, accounting for 31% of incidents—up from 20% the previous year. This surge underscores the challenges organizations face in timely vulnerability management, with the median time to fully patch a vulnerability increasing to 43 days from 32 days in 2024. Additionally, ransomware incidents rose to 48% of breaches, highlighting the persistent threat posed by financially motivated cybercriminals. The report also noted a decline in the remediation of critical vulnerabilities listed in CISA's Known Exploited Vulnerabilities catalog, with only 26% fully addressed by organizations in 2025, down from 38% in 2024. This trend emphasizes the need for enhanced vulnerability management practices and proactive security measures to mitigate the evolving cyber threat landscape.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CISA Credential Leak 2026: Lessons in Cybersecurity
Government Administration5 months ago

CISA Credential Leak 2026: Lessons in Cybersecurity

In May 2026, a significant security lapse was discovered involving the Cybersecurity and Infrastructure Security Agency (CISA). A contractor inadvertently exposed a public GitHub repository named 'Private-CISA,' containing sensitive credentials such as AWS GovCloud administrative keys, plaintext passwords, and SAML certificates. This repository was accessible for approximately six months, from November 2025 until its discovery in May 2026. The exposure posed substantial risks, including unauthorized access to CISA's internal systems and potential exploitation by malicious actors. ([techcrunch.com](https://techcrunch.com/2026/05/19/us-cyber-agency-cisa-exposed-reams-of-passwords-and-cloud-keys-to-the-open-web/?utm_source=openai)) This incident underscores the critical importance of stringent access controls and vigilant monitoring of code repositories. It highlights the necessity for organizations to implement robust security practices, including regular audits and the use of automated tools to detect and prevent the exposure of sensitive information. The event serves as a stark reminder of the vulnerabilities associated with misconfigured repositories and the potential consequences of credential leaks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
GitHub Breach: 3,800 Internal Repositories Exfiltrated via Malicious VS Code Extension
Computer Software/Engineering5 months ago

GitHub Breach: 3,800 Internal Repositories Exfiltrated via Malicious VS Code Extension

In May 2026, GitHub experienced a security breach where approximately 3,800 internal repositories were exfiltrated. The breach occurred after an employee's device was compromised through a malicious Visual Studio Code (VS Code) extension. The attackers, identified as TeamPCP, gained access to GitHub's internal systems via this poisoned extension. GitHub has stated that there is no evidence of customer data being affected and has initiated incident response measures, including rotating critical secrets and monitoring for further activity. This incident highlights the increasing threat posed by supply chain attacks targeting developer tools and environments. Malicious extensions in widely used platforms like VS Code can serve as entry points for attackers, emphasizing the need for enhanced security measures and vigilance in software development practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Microsoft Vulnerabilities Doubled in 2025: A Call to Action
Financial Services5 months ago

Critical Microsoft Vulnerabilities Doubled in 2025: A Call to Action

In 2025, Microsoft disclosed 1,273 vulnerabilities, a slight decrease from the previous year. However, critical vulnerabilities surged from 78 to 157, reversing a multi-year downward trend. Notably, Elevation of Privilege vulnerabilities accounted for 40% of all CVEs, and Information Disclosure flaws rose by 73%, indicating attackers' focus on stealth and reconnaissance. Cloud platforms like Azure and Dynamics 365 saw critical vulnerabilities jump from 4 to 37, highlighting the increasing risk in these environments. This trend underscores the need for organizations to prioritize vulnerabilities that enable privilege escalation, identity abuse, and lateral movement. Traditional patch management is insufficient; a comprehensive approach addressing excessive privileges, misconfigurations, and weak identity controls is essential to mitigate these evolving threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Storm-2949's Exploitation of SSPR in Microsoft 365 and Azure Breach
Financial Services5 months ago

Storm-2949's Exploitation of SSPR in Microsoft 365 and Azure Breach

In May 2026, the threat actor known as Storm-2949 executed a sophisticated attack targeting Microsoft 365 and Azure environments. Utilizing social engineering tactics, they impersonated IT support to exploit the Self-Service Password Reset (SSPR) feature, gaining unauthorized access to privileged accounts. This access enabled them to exfiltrate sensitive data from OneDrive, SharePoint, and Azure resources, including virtual machines, storage accounts, key vaults, app services, and SQL databases. The attackers leveraged legitimate administrative tools to blend into normal operations, complicating detection efforts. This incident underscores the evolving threat landscape where attackers increasingly exploit identity management systems and cloud services. Organizations must enhance their security protocols, particularly around identity verification and access controls, to mitigate such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Preventing Unauthorized AWS Account Removals: Insights from AWS CIRT
Financial Services5 months ago

Preventing Unauthorized AWS Account Removals: Insights from AWS CIRT

In May 2026, the AWS Customer Incident Response Team (CIRT) identified a tactic where threat actors, upon gaining control of a customer's AWS account, remove it from the AWS Organizations structure. This action bypasses Service Control Policies (SCPs) and other governance controls, leading to potential security risks and loss of centralized management. The attackers exploit permissions like `organizations:LeaveOrganization` to execute this maneuver, resulting in the account operating independently without the protective measures enforced by the organization. This incident underscores the importance of implementing strict IAM policies and SCPs to prevent unauthorized account removals. Organizations should regularly audit permissions, enforce the principle of least privilege, and monitor CloudTrail logs for `organizations:LeaveOrganization` API calls to detect and mitigate such threats promptly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports