Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 123 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1465–1476 / 3243 reports
CISA Contractor's GitHub Repository Exposes Sensitive AWS Credentials
Government Administration5 months ago

CISA Contractor's GitHub Repository Exposes Sensitive AWS Credentials

In May 2026, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) inadvertently exposed highly sensitive credentials by maintaining a public GitHub repository named "Private-CISA." This repository contained administrative credentials for three AWS GovCloud accounts, plaintext passwords for numerous internal CISA systems, and detailed internal documentation on software development processes. The exposure persisted for approximately six months before being discovered by a security researcher from GitGuardian, who alerted CISA. The repository was subsequently taken offline, and an investigation was initiated to assess potential impacts. This incident underscores the critical importance of stringent security practices in managing sensitive information, especially within organizations tasked with national cybersecurity. It highlights the risks associated with improper handling of credentials and the necessity for robust oversight and compliance measures to prevent similar exposures in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Microsoft Exchange Zero-Day CVE-2026-42897 Exploited in the Wild
Financial Services5 months ago

Critical Microsoft Exchange Zero-Day CVE-2026-42897 Exploited in the Wild

In May 2026, Microsoft disclosed a zero-day vulnerability, CVE-2026-42897, affecting on-premises versions of Exchange Server 2016, 2019, and Subscription Edition. This cross-site scripting (XSS) flaw allows attackers to execute arbitrary JavaScript in a user's browser by sending a specially crafted email, which, when opened in Outlook Web Access (OWA), triggers the exploit. The vulnerability has been actively exploited in the wild, leading to potential unauthorized access to users' mailboxes and session tokens. Microsoft has provided temporary mitigations through the Exchange Emergency Mitigation Service (EEMS) and manual scripts, but a permanent patch is still pending. ([notebookcheck.net](https://www.notebookcheck.net/Microsoft-Exchange-Server-zero-day-exploited-via-crafted-email.1298885.0.html?utm_source=openai)) The exploitation of CVE-2026-42897 underscores the persistent threat posed by XSS vulnerabilities, even in widely used enterprise applications. Organizations relying on on-premises Exchange Servers must remain vigilant, apply available mitigations promptly, and monitor for any signs of compromise to protect sensitive information and maintain operational integrity.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Vulnerabilities Discovered in SEPPmail Secure Email Gateway
Financial Services5 months ago

Critical Vulnerabilities Discovered in SEPPmail Secure Email Gateway

In May 2026, multiple critical vulnerabilities were identified in SEPPmail Secure Email Gateway, an enterprise-grade email security solution. These flaws, including CVE-2026-2743 (CVSS score: 10.0) and CVE-2026-44128 (CVSS score: 9.3), allowed unauthenticated remote code execution and unauthorized access to email traffic. Exploitation could lead to complete system compromise, enabling attackers to read all mail traffic and potentially use the gateway as an entry point into internal networks. ([thehackernews.com](https://thehackernews.com/2026/05/seppmail-secure-e-mail-gateway.html?utm_source=openai)) This incident underscores the persistent threat posed by vulnerabilities in email security solutions, highlighting the necessity for organizations to promptly apply security patches and conduct regular vulnerability assessments to safeguard sensitive communications.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Drupal's Upcoming Security Update: What You Need to Know
Government Administration5 months ago

Drupal's Upcoming Security Update: What You Need to Know

On May 20, 2026, Drupal plans to release a highly critical security update for all supported core branches between 17:00 and 21:00 UTC. The Drupal Security Team has advised site administrators to allocate time for these updates, as exploits may emerge shortly after the release. Affected versions include 11.3.x, 11.2.x, 10.6.x, and 10.5.x. Administrators are encouraged to update to the latest patch releases in preparation for the security window. ([drupal.org](https://www.drupal.org/psa-2026-05-18?utm_source=openai)) This proactive measure underscores the importance of timely security updates in mitigating potential vulnerabilities. Organizations relying on Drupal should prioritize these updates to maintain the integrity and security of their web platforms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
DirtyDecrypt PoC Released: Immediate Action Required for Linux Kernel CVE-2026-31635
Information Technology/IT5 months ago

DirtyDecrypt PoC Released: Immediate Action Required for Linux Kernel CVE-2026-31635

On May 19, 2026, a proof-of-concept (PoC) exploit code was released for a recently patched security flaw in the Linux kernel, identified as CVE-2026-31635 and dubbed 'DirtyDecrypt' or 'DirtyCBC'. This vulnerability, discovered by the Zellic and V12 security team, allows local privilege escalation due to a missing copy-on-write (COW) guard in the rxgk_decrypt_skb() function. The flaw enables unprivileged local users to write arbitrary bytes into the kernel's page cache of read-only files, potentially granting root privileges. Distributions with CONFIG_RXGK enabled, such as Fedora, Arch Linux, and openSUSE Tumbleweed, are affected. ([thehackernews.com](https://thehackernews.com/2026/05/dirtydecrypt-poc-released-for-linux.html?utm_source=openai)) The release of the PoC highlights the urgency for system administrators to apply the available patches promptly. This incident underscores the critical need for timely updates and vigilant monitoring of security advisories to mitigate risks associated with such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
EvilTokens Phishing Campaign: A New Threat to Microsoft 365 Security
Financial Services5 months ago

EvilTokens Phishing Campaign: A New Threat to Microsoft 365 Security

In February 2026, the phishing-as-a-service platform EvilTokens emerged, compromising over 340 Microsoft 365 organizations across five countries within five weeks. The attack exploited the OAuth device code authentication flow, tricking users into entering a short code at microsoft.com/devicelogin and completing their MFA challenge. Unbeknownst to them, this granted attackers valid refresh tokens with access to emails, files, calendars, and contacts, all without stealing passwords or bypassing MFA. This method effectively bypassed traditional identity defenses, as the OAuth consent screen has become an instinctive click for many users. ([thehackernews.com](https://thehackernews.com/2026/05/the-new-phishing-click-how-oauth.html?utm_source=openai)) The incident underscores a significant shift in phishing tactics, highlighting the exploitation of legitimate authentication processes to gain unauthorized access. As attackers increasingly leverage such methods, organizations must reassess their security protocols to address these evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft Disrupts Fox Tempest's Malware-Signing Service Operation
Financial Services5 months ago

Microsoft Disrupts Fox Tempest's Malware-Signing Service Operation

In May 2026, Microsoft disrupted Fox Tempest, a financially motivated threat actor operating a malware-signing-as-a-service (MSaaS) platform. Fox Tempest exploited Microsoft's Artifact Signing to generate over a thousand fraudulent code-signing certificates, enabling other cybercriminals to distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, under the guise of legitimate software. This operation facilitated attacks across various sectors globally, including healthcare, education, government, and financial services. The takedown involved revoking the fraudulent certificates and dismantling the infrastructure supporting Fox Tempest's operations. The incident underscores the evolving tactics of cybercriminals who abuse legitimate services to enhance the credibility of their malware, thereby evading traditional security measures. It highlights the critical need for organizations to implement robust security controls, including advanced threat detection and response capabilities, to mitigate the risks posed by such sophisticated attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
INTERPOL's Operation Ramz: A Landmark Cybercrime Crackdown in the MENA Region
Financial Services5 months ago

INTERPOL's Operation Ramz: A Landmark Cybercrime Crackdown in the MENA Region

Between October 2025 and February 2026, INTERPOL coordinated Operation Ramz, a large-scale cybercrime crackdown across 13 Middle East and North African countries. This operation led to 201 arrests, the identification of 382 additional suspects, and the seizure of 53 servers. Authorities disrupted various cybercrime activities, including phishing services, malware distribution, and financial scams, affecting nearly 4,000 victims. Notably, in Jordan, police uncovered a human trafficking scheme linked to financial fraud scams, rescuing 15 victims coerced into criminal activities. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) This operation underscores the escalating threat of cybercrime in the MENA region and highlights the effectiveness of international collaboration in combating such activities. The involvement of private sector partners like Group-IB, Kaspersky, and Team Cymru provided critical threat intelligence, facilitating the identification and dismantling of malicious infrastructures. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/kaspersky-supports-interpols-operation-ramz-in-mena-region-resulting-in-over-200-arrests?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's 2026 Takedown of Fox Tempest: A Major Blow to Cybercrime
Financial Services5 months ago

Microsoft's 2026 Takedown of Fox Tempest: A Major Blow to Cybercrime

In May 2026, Microsoft, through its Digital Crimes Unit, successfully dismantled the infrastructure of Fox Tempest, a cybercrime service that produced and sold over 1,000 fraudulent code-signing certificates. These certificates were utilized by various ransomware groups, including Rhysida and Vanilla Tempest, to make malicious software appear legitimate, thereby bypassing security defenses. The operation involved seizing domain names, websites, and Azure resources linked to Fox Tempest, effectively disrupting their malware-signing-as-a-service operations. ([axios.com](https://www.axios.com/2026/05/19/microsoft-fox-tempest-law-enforcement-takedown?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, moving upstream to exploit software verification systems. The ability to fabricate trusted certificates at scale poses a substantial threat to global cybersecurity, emphasizing the need for enhanced vigilance and robust verification processes within software supply chains.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical 'DirtyDecrypt' Vulnerability in Linux Kernel: Exploit Released
Information Technology/IT5 months ago

Critical 'DirtyDecrypt' Vulnerability in Linux Kernel: Exploit Released

In May 2026, a local privilege escalation vulnerability in the Linux kernel's rxgk module, dubbed 'DirtyDecrypt' (also known as 'DirtyCBC'), was disclosed. This flaw allows attackers to gain root access on certain Linux systems by exploiting a missing Copy-On-Write (COW) guard in the rxgk_decrypt_skb function. The vulnerability, identified as CVE-2026-31635, was patched on April 25, 2026. Successful exploitation requires the CONFIG_RXGK configuration option enabled, affecting distributions like Fedora, Arch Linux, and openSUSE Tumbleweed. A proof-of-concept exploit has been released, demonstrating the ease of exploitation on unpatched systems. This incident underscores a growing trend of privilege escalation vulnerabilities in the Linux kernel, following similar disclosures such as 'Dirty Frag,' 'Fragnesia,' and 'Copy Fail.' The rapid succession of these vulnerabilities highlights the critical need for timely patch management and vigilant system monitoring to mitigate potential security risks.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
INTERPOL's Operation Ramz: A Major Cybercrime Crackdown in the MENA Region
Banking/Mortgage5 months ago

INTERPOL's Operation Ramz: A Major Cybercrime Crackdown in the MENA Region

Between October 2025 and February 2026, INTERPOL coordinated Operation Ramz, a large-scale cybercrime crackdown across 13 Middle Eastern and North African countries. The operation led to the arrest of 201 individuals and the identification of 382 additional suspects involved in phishing, malware distribution, and online fraud. Authorities seized 53 servers and identified 3,867 victims, disrupting significant malicious infrastructure and preventing further cyber threats. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) This operation underscores the escalating threat of cybercrime in the MENA region and highlights the effectiveness of international collaboration in combating such activities. The involvement of private cybersecurity firms like Kaspersky and Group-IB demonstrates the critical role of public-private partnerships in enhancing global cybersecurity efforts. ([kaspersky.co.za](https://www.kaspersky.co.za/about/press-releases/kaspersky-supports-interpols-operation-ramz-in-mena-region-resulting-in-over-200-arrests?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
INTERPOL's Operation Ramz: A Landmark Cybercrime Crackdown in MENA
Banking/Mortgage5 months ago

INTERPOL's Operation Ramz: A Landmark Cybercrime Crackdown in MENA

Between October 2025 and February 2026, INTERPOL coordinated Operation Ramz, a significant cybercrime crackdown across 13 Middle East and North Africa (MENA) countries. This operation led to the arrest of 201 individuals and the identification of 382 additional suspects involved in various cybercrimes, including phishing, malware distribution, and financial fraud. Authorities seized 53 servers and identified 3,867 victims, highlighting the extensive impact of these cybercriminal activities. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) The success of Operation Ramz underscores the effectiveness of international collaboration in combating cybercrime. As cyber threats continue to evolve and proliferate, such coordinated efforts are crucial in disrupting malicious networks and protecting potential victims from emerging cyber scams and attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports