Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 127 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1513–1524 / 3243 reports
Critical Exim Vulnerability CVE-2026-45185: Immediate Action Required
Information Technology/IT5 months ago

Critical Exim Vulnerability CVE-2026-45185: Immediate Action Required

In May 2026, a critical vulnerability identified as CVE-2026-45185 was discovered in Exim, a widely used open-source mail transfer agent. This use-after-free flaw in certain GnuTLS configurations allows unauthenticated remote attackers to execute arbitrary code by exploiting the BDAT body parsing path during TLS shutdown. The vulnerability affects Exim versions 4.97 through 4.99.2 when built with GnuTLS and with STARTTLS and CHUNKING enabled. Exploitation could lead to unauthorized access to email data and potential further compromise of affected systems. ([thehackerwire.com](https://www.thehackerwire.com/vulnerability/CVE-2026-45185/?utm_source=openai)) The discovery of this vulnerability underscores the ongoing risks associated with widely deployed open-source software and the importance of timely patching. The incident also highlights the evolving landscape of cyber threats, where attackers increasingly target foundational internet services to gain broad access.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft's May 2026 Patch Tuesday: 137 Vulnerabilities Addressed
Financial Services5 months ago

Microsoft's May 2026 Patch Tuesday: 137 Vulnerabilities Addressed

In May 2026, Microsoft released its Patch Tuesday updates addressing 137 security vulnerabilities across its product suite, including Windows, Office, and SharePoint. Notably, this update cycle did not include any zero-day vulnerabilities, marking a rare occurrence. Among the patches, 30 were classified as critical, with several remote code execution flaws that could allow attackers to gain control over affected systems. Organizations are advised to prioritize these updates to mitigate potential risks. ([securityonline.info](https://securityonline.info/microsoft-patch-tuesday-may-2026-netlogon-rce-sso-bypass/?utm_source=openai)) This incident underscores the ongoing challenges in software security, highlighting the importance of timely patch management. The absence of zero-day vulnerabilities in this cycle is encouraging, yet the high number of critical flaws emphasizes the need for vigilance in cybersecurity practices.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
FamousSparrow APT's Persistent Attacks on Azerbaijani Energy Sector in 2026
Oil/Energy/Solar/Greentech5 months ago

FamousSparrow APT's Persistent Attacks on Azerbaijani Energy Sector in 2026

In late December 2025 through February 2026, the China-linked Advanced Persistent Threat (APT) group known as FamousSparrow targeted an Azerbaijani oil and gas company. The attackers exploited a vulnerable Microsoft Exchange server to gain initial access, deploying sophisticated techniques such as a two-stage DLL sideloading mechanism to evade detection and install remote access tools like Deed RAT and Terndoor. Despite remediation efforts, the group conducted multiple attack waves, indicating a persistent and strategic cyber espionage campaign. ([bitdefender.com](https://www.bitdefender.com/en-us/blog/businessinsights/famoussparrow-apt-targets-azerbaijani-oil-gas-industry?utm_source=openai)) This incident underscores a significant shift in cyber threat landscapes, with Chinese APTs expanding their focus to regions traditionally influenced by other state actors. The use of advanced evasion techniques highlights the evolving sophistication of cyber adversaries, emphasizing the need for robust and proactive cybersecurity measures in critical infrastructure sectors. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/china-famoussparrow-apt-south-caucasus-energy-firm?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
AI Agents Enable Sophisticated Cyberattacks in Latin America
Government Administration5 months ago

AI Agents Enable Sophisticated Cyberattacks in Latin America

In late 2025 and early 2026, two cyber campaigns, 'Shadow-Aether-040' and 'Shadow-Aether-064,' targeted organizations in Mexico and Brazil, respectively. These campaigns utilized AI agents to automate various stages of their attacks, including vulnerability identification, exploitation, and persistence. The attackers employed AI tools to generate custom hacking scripts dynamically, making detection by traditional security measures more challenging. The Mexican campaign compromised six government entities, leading to data theft, while the Brazilian campaign focused on financial institutions to steal sensitive financial data. ([darkreading.com](https://www.darkreading.com/cloud-security/ai-agents-generate-custom-hacking-tools?utm_source=openai)) This incident underscores a significant evolution in cyber threats, where AI is leveraged to enhance the speed and sophistication of attacks. The use of AI in cyberattacks is expected to increase, necessitating advanced defensive strategies to counteract these emerging threats. ([darkreading.com](https://www.darkreading.com/cloud-security/ai-agents-generate-custom-hacking-tools?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Google Introduces Intrusion Logging to Bolster Android Security
Computer Software/Engineering5 months ago

Google Introduces Intrusion Logging to Bolster Android Security

In May 2026, Google introduced 'Intrusion Logging' as part of Android's Advanced Protection Mode, aiming to enhance forensic analysis of sophisticated spyware attacks. This opt-in feature records encrypted logs of device activities, including app installations, network connections, and screen unlocks, storing them securely in the user's Google account. The logs are designed to assist security researchers and users in investigating potential device compromises, with data automatically deleted after 12 months. ([techcrunch.com](https://techcrunch.com/2026/05/12/google-launches-new-android-security-feature-to-help-uncover-spyware-attacks/?utm_source=openai)) The launch of Intrusion Logging marks a significant advancement in mobile security, providing users, especially those at high risk like journalists and activists, with tools to detect and analyze unauthorized access. This development reflects a growing industry focus on user-controlled security measures and the need for robust defenses against evolving spyware threats. ([techcrunch.com](https://techcrunch.com/2026/05/12/google-launches-new-android-security-feature-to-help-uncover-spyware-attacks/?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
GemStuffer: Exploiting RubyGems for Data Exfiltration from U.K. Council Portals
Computer Software/Engineering5 months ago

GemStuffer: Exploiting RubyGems for Data Exfiltration from U.K. Council Portals

In May 2026, cybersecurity researchers identified a campaign named 'GemStuffer' that exploited over 150 RubyGems packages to exfiltrate data scraped from U.K. council portals. Unlike traditional supply chain attacks aimed at compromising developers, GemStuffer utilized the RubyGems repository as a channel to store and retrieve collected public-sector data. The attackers fetched information from local government portals, packaged the data into valid RubyGems archives, and published them back to the repository using hardcoded API keys. This method allowed the exfiltrated data to be retrieved through standard package operations, effectively turning the RubyGems infrastructure into a data staging platform. The incident underscores the evolving nature of supply chain threats, highlighting that package registries can be misused not only for malware distribution but also as persistent, publicly accessible data channels. Organizations are advised to monitor their software supply chains closely and implement robust security measures to detect and prevent such abuses.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Microsoft's May 2026 Patch Tuesday: Addressing 138 Security Vulnerabilities
Information Technology/IT5 months ago

Microsoft's May 2026 Patch Tuesday: Addressing 138 Security Vulnerabilities

In May 2026, Microsoft released patches for 138 security vulnerabilities across its product portfolio, including Windows, Office, and Azure services. Of these, 30 were rated Critical, with notable flaws such as CVE-2026-41096, a heap-based buffer overflow in Windows DNS, and CVE-2026-41089, a stack-based buffer overflow in Windows Netlogon. These vulnerabilities could allow unauthorized remote code execution without authentication. Importantly, none of the vulnerabilities were reported as publicly known or under active attack at the time of release. This comprehensive update underscores the ongoing necessity for organizations to maintain vigilant patch management practices. The inclusion of critical vulnerabilities affecting core services like DNS and Netlogon highlights the potential for significant security breaches if left unaddressed. Organizations are advised to prioritize these updates to mitigate risks associated with remote code execution and privilege escalation.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's May 2026 Patch Tuesday: A Comprehensive Security Update
Information Technology/IT5 months ago

Microsoft's May 2026 Patch Tuesday: A Comprehensive Security Update

In May 2026, Microsoft released a comprehensive Patch Tuesday update addressing 137 vulnerabilities across its product suite, including 13 rated as critical. Notably, this release did not include any zero-day vulnerabilities, marking a departure from previous months. Critical vulnerabilities such as CVE-2026-33109 and CVE-2026-42823 affecting Azure, and CVE-2026-42898 in Microsoft Dynamics 365, were highlighted due to their high CVSS scores and potential impact on enterprise systems. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-may-2026/?utm_source=openai)) The substantial number of vulnerabilities reflects a growing trend where artificial intelligence models are increasingly utilized to uncover previously undetected defects in code. This shift underscores the importance for organizations to promptly apply patches and enhance their security postures to mitigate emerging threats. ([microsoft.com](https://www.microsoft.com/en-us/msrc/blog/2026/05/a-note-on-patch-tuesday?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Windows 11 May 2026 Patch Tuesday: Critical Security Updates and Exciting New Features
Information Technology/IT6 months ago

Windows 11 May 2026 Patch Tuesday: Critical Security Updates and Exciting New Features

On May 12, 2026, Microsoft released cumulative updates KB5089549 and KB5087420 for Windows 11 versions 25H2/24H2 and 23H2, respectively. These updates addressed 137 security vulnerabilities, including critical flaws in Secure Boot and Remote Desktop Connection. Additionally, the updates introduced new features such as Xbox Mode and expanded archive format support in File Explorer. ([windowsreport.com](https://windowsreport.com/windows-11-may-2026-patch-tuesday-update-kb5089549-out-now/?utm_source=openai)) The release underscores Microsoft's commitment to enhancing system security and user experience. Organizations are advised to promptly apply these updates to mitigate potential threats and benefit from the latest features.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's May 2026 Patch Tuesday: A Comprehensive Security Update
Financial Services6 months ago

Microsoft's May 2026 Patch Tuesday: A Comprehensive Security Update

In May 2026, Microsoft released its Patch Tuesday updates addressing 120 security vulnerabilities, including 17 classified as 'Critical.' Notably, this release marked the first in nearly two years without any zero-day vulnerabilities being disclosed or exploited. The critical flaws encompassed remote code execution and elevation of privilege vulnerabilities across various Microsoft products, including Office, Word, and Excel. The absence of zero-day vulnerabilities in this release is a positive development; however, the high number of critical vulnerabilities underscores the ongoing need for organizations to promptly evaluate and deploy these updates to mitigate potential security risks. ([computerweekly.com](https://www.computerweekly.com/news/366642908/Microsoft-releases-rare-zero-day-free-Patch-Tuesday-update?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical RCE Vulnerabilities in Fortinet's FortiSandbox and FortiAuthenticator: Immediate Action Required
Financial Services6 months ago

Critical RCE Vulnerabilities in Fortinet's FortiSandbox and FortiAuthenticator: Immediate Action Required

In May 2026, Fortinet disclosed critical remote code execution (RCE) vulnerabilities in its FortiSandbox and FortiAuthenticator products. These flaws, identified as CVE-2026-44277 and CVE-2026-26083, could allow unauthenticated attackers to execute arbitrary code or commands on unpatched systems via crafted HTTP requests. FortiAuthenticator versions 6.5.7, 6.6.9, and 8.0.3, and FortiSandbox versions 4.4.9 and above, have been patched to address these issues. Organizations using these products are urged to update immediately to mitigate potential exploitation risks. The disclosure underscores the persistent targeting of Fortinet products by threat actors, often leveraging such vulnerabilities in ransomware and cyber-espionage campaigns. This incident highlights the critical importance of timely patch management and continuous monitoring to defend against evolving cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Signal Phishing Attacks 2026: A Wake-Up Call for Cybersecurity
Government Administration6 months ago

Signal Phishing Attacks 2026: A Wake-Up Call for Cybersecurity

In early 2026, Russian state-sponsored hackers launched a sophisticated phishing campaign targeting high-profile Signal and WhatsApp users, including government officials, military personnel, and journalists. The attackers impersonated official support accounts, deceiving victims into sharing verification codes or scanning QR codes, thereby granting unauthorized access to their accounts and sensitive communications. This campaign exploited social engineering tactics rather than technical vulnerabilities, highlighting the persistent threat posed by human-centric attack vectors. In response, Signal introduced enhanced in-app security features to combat such phishing and social engineering attempts. These measures include displaying 'Name not verified' warnings for new contacts, prompting users to confirm new requests while reminding them that Signal will never ask for registration codes or PINs, and providing enriched safety tips. These proactive steps aim to bolster user awareness and resilience against evolving social engineering threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports