Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
FBI Issues Warning on Phishing Attacks Impersonating Local Government Officials
In March 2026, the FBI issued a warning about a phishing campaign where criminals impersonated U.S. city and county officials to target individuals and businesses applying for land-use permits. The attackers used publicly available information to craft convincing emails, instructing victims to pay fraudulent fees via wire transfer, peer-to-peer payment, or cryptocurrency. This scheme exploited the victims' trust in official communications, leading to financial losses and potential exposure of sensitive information. This incident underscores a growing trend of cybercriminals leveraging publicly accessible data to enhance the credibility of their phishing attacks. The increasing sophistication of such schemes highlights the urgent need for heightened vigilance and robust verification processes in all interactions involving sensitive transactions.
6 months ago
Kill Chain
Russian Hackers Exploit Phishing to Hijack Signal and WhatsApp Accounts in 2026
In March 2026, Dutch intelligence agencies reported a large-scale cyber campaign by Russian state-sponsored hackers targeting Signal and WhatsApp accounts of government officials, military personnel, and journalists. The attackers employed phishing and social engineering tactics, impersonating support chatbots to deceive users into revealing security verification codes and PINs. This enabled unauthorized access to sensitive communications and group chats. ([english.aivd.nl](https://english.aivd.nl/latest/news/2026/03/09/russia-targets-signal-and-whatsapp-accounts-in-cyber-campaign?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors exploiting human vulnerabilities rather than technical flaws. It highlights the critical need for heightened vigilance and robust security protocols to protect sensitive information in secure messaging platforms.
6 months ago
Kill Chain
Ericsson US Data Breach: Lessons in Third-Party Risk Management
In April 2025, Ericsson Inc., the U.S. subsidiary of the Swedish telecommunications company, experienced a data breach through one of its service providers. Unauthorized access occurred between April 17 and April 22, 2025, compromising sensitive personal information of employees and customers, including names, addresses, Social Security numbers, driver's license numbers, financial data, medical information, and dates of birth. The breach was detected on April 28, 2025, prompting an investigation that concluded on February 23, 2026, confirming the extent of the data exposure. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ericsson-us-discloses-data-breach-after-service-provider-hack/?utm_source=openai)) This incident underscores the critical importance of robust third-party risk management and supply chain security. As organizations increasingly rely on external service providers, ensuring these partners adhere to stringent cybersecurity standards is essential to prevent similar breaches and protect sensitive data.
6 months ago
Kill Chain
Chinese Cyber Threat Targets Asian Critical Infrastructure
Since at least 2020, a Chinese-speaking threat actor identified as CL-UNK-1068 has been conducting cyber-espionage campaigns targeting critical infrastructure sectors across South, Southeast, and East Asia. The sectors affected include aviation, energy, government, law enforcement, pharmaceuticals, technology, and telecommunications. The attackers exploit vulnerabilities in public-facing web servers to gain initial access, deploying web shells like GodZilla and AntSword to maintain control. They employ tools such as Mimikatz and LsaRecorder for credential theft, and utilize custom malware alongside open-source utilities to facilitate lateral movement and data exfiltration. ([darkreading.com](https://www.darkreading.com/threat-intelligence/chinese-cyber-threat-critical-asian-sectors?utm_source=openai))This incident underscores the persistent and evolving nature of cyber threats from state-sponsored actors, particularly those linked to China. The use of sophisticated tools and techniques highlights the need for organizations to enhance their cybersecurity measures to detect and mitigate such threats effectively. ([darkreading.com](https://www.darkreading.com/threat-intelligence/chinese-cyber-threat-critical-asian-sectors?utm_source=openai))
6 months ago
Kill Chain
Cybercriminals Exploit .arpa Domains and IPv6 to Bypass Phishing Defenses
In March 2026, cybersecurity researchers identified a sophisticated phishing campaign exploiting the .arpa top-level domain (TLD) and IPv6 reverse DNS to bypass traditional security measures. Attackers acquired IPv6 address blocks and manipulated reverse DNS zones to create deceptive subdomains under the ip6.arpa domain. These subdomains hosted phishing sites that impersonated legitimate brands, luring victims through emails promising rewards or account notifications. The use of .arpa domains, typically reserved for internet infrastructure, allowed these malicious sites to evade detection by standard domain reputation checks and email security gateways. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hackers-abuse-arpa-dns-and-ipv6-to-evade-phishing-defenses/?utm_source=openai)) This incident underscores a growing trend where threat actors exploit lesser-known internet protocols and infrastructure to conduct attacks. The abuse of reserved domains like .arpa highlights the need for enhanced monitoring and security measures that encompass all facets of the DNS ecosystem. Organizations must adapt to these evolving tactics to protect against increasingly sophisticated phishing schemes. ([infoblox.com](https://www.infoblox.com/blog/threat-intelligence/abusing-arpa-the-tld-that-isnt-supposed-to-host-anything/?utm_source=openai))
6 months ago
Kill Chain
Anthropic's AI Model Enhances Firefox Security by Identifying 22 Vulnerabilities
In January 2026, Anthropic's AI model, Claude Opus 4.6, identified 22 security vulnerabilities in Mozilla's Firefox browser during a two-week collaboration. Of these, 14 were classified as high-severity, seven as moderate, and one as low. The vulnerabilities were promptly addressed in Firefox version 148, released in February 2026. This effort involved scanning nearly 6,000 C++ files and submitting 112 unique reports, highlighting the efficiency of AI in enhancing software security. ([thehackernews.com](https://thehackernews.com/2026/03/anthropic-finds-22-firefox.html?utm_source=openai)) This incident underscores the growing role of AI in cybersecurity, demonstrating its capability to uncover significant vulnerabilities in well-established software. The collaboration between Anthropic and Mozilla exemplifies how AI can augment traditional security measures, leading to more robust and secure applications. ([blog.mozilla.org](https://blog.mozilla.org/en/firefox/hardening-firefox-anthropic-red-team/?utm_source=openai))
6 months ago
Kill Chain
FBI's Surveillance Systems Breached in 2026 by Salt Typhoon
In March 2026, the FBI confirmed a breach affecting systems used to manage surveillance and wiretap warrants. The agency identified and addressed suspicious activities on its networks, leveraging all technical capabilities to respond. While the FBI did not disclose the full scope or impact, the incident underscores the vulnerability of critical law enforcement infrastructure to cyber threats. This breach is part of a broader pattern of cyber espionage activities attributed to state-sponsored actors, notably the Chinese group known as Salt Typhoon. In 2024, Salt Typhoon compromised U.S. federal government systems used for court-authorized network wiretapping requests, highlighting the persistent and evolving nature of cyber threats targeting sensitive government operations.
6 months ago
Kill Chain
Critical Vulnerabilities in Hikvision and Rockwell Automation Devices Added to CISA KEV Catalog
In March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2017-7921 affecting Hikvision products and CVE-2021-22681 impacting Rockwell Automation devices. CVE-2017-7921 is an improper authentication flaw that allows attackers to escalate privileges and access sensitive information in Hikvision cameras. CVE-2021-22681 involves insufficiently protected credentials in Rockwell Automation's Studio 5000 Logix Designer and related controllers, enabling unauthorized users to bypass verification mechanisms and alter device configurations. Both vulnerabilities have a CVSS score of 9.8, indicating their severity and the potential risk to critical infrastructure. The inclusion of these vulnerabilities in the KEV catalog underscores the ongoing threat posed by unpatched security flaws in widely used industrial and surveillance equipment. Organizations are urged to prioritize remediation efforts to mitigate the risk of exploitation, especially given the active targeting of such vulnerabilities by malicious actors.
6 months ago
Kill Chain
React2Shell: Understanding and Mitigating the Critical React Server Components Vulnerability
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was discovered in React Server Components, affecting versions 19.0 through 19.2.0. This flaw allows unauthenticated remote code execution via a single malicious HTTP request, enabling attackers to execute arbitrary code on vulnerable servers. Exploitation was observed within hours of disclosure, with state-sponsored groups from China and North Korea actively targeting affected systems. The rapid exploitation underscores the vulnerability's severity and the need for immediate remediation. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/12/15/defending-against-the-cve-2025-55182-react2shell-vulnerability-in-react-server-components/?msockid=3159dd8396d16eca0085cb7697616f99&utm_source=openai)) The widespread use of React in web applications amplifies the risk, as many organizations may unknowingly be exposed. This incident highlights the critical importance of prompt patching and vigilant monitoring to defend against rapidly evolving cyber threats. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai))
6 months ago
Kill Chain
Microsoft Uncovers 2026 ClickFix Campaign Exploiting Windows Terminal to Deploy Lumma Stealer
In February 2026, Microsoft identified a sophisticated ClickFix social engineering campaign exploiting Windows Terminal to deploy the Lumma Stealer malware. Attackers instructed users to open Windows Terminal using the Windows + X → I shortcut and paste a hex-encoded, XOR-compressed command. This command initiated a multi-stage attack chain, leading to the download of a ZIP payload and a renamed 7-Zip binary. The process established persistence via scheduled tasks, configured Microsoft Defender exclusions, exfiltrated system and network data, and injected Lumma Stealer into 'chrome.exe' and 'msedge.exe' processes using the QueueUserAPC() technique. Lumma Stealer targeted high-value browser artifacts, including stored credentials, which were exfiltrated to attacker-controlled infrastructure. This campaign underscores the evolving tactics of threat actors who leverage legitimate tools and social engineering to bypass traditional security measures. Organizations must remain vigilant against such deceptive techniques and enhance user awareness to mitigate the risk of credential theft and data exfiltration.
6 months ago
Kill Chain
China-Linked Hackers Target South American Telecoms with TernDoor, PeerTime, BruteEntry
Since 2024, a China-linked advanced persistent threat (APT) group, identified as UAT-9244, has been targeting critical telecommunications infrastructure in South America. The attackers have deployed three previously undocumented malware implants: TernDoor, a Windows backdoor; PeerTime, a Linux-based peer-to-peer backdoor; and BruteEntry, a brute-force scanner installed on network edge devices. These tools enable the threat actors to gain persistent access, execute arbitrary commands, and expand their reach within compromised networks. ([blog.talosintelligence.com](https://blog.talosintelligence.com/uat-9244/?utm_source=openai)) This campaign underscores the evolving tactics of state-sponsored cyber espionage groups, highlighting the need for robust security measures in the telecommunications sector. The use of diverse malware targeting multiple platforms indicates a sophisticated approach to infiltrating and maintaining access to critical infrastructure. ([blog.talosintelligence.com](https://blog.talosintelligence.com/uat-9244/?utm_source=openai))
6 months ago
Kill Chain
Unveiling VOID#GEIST: A New Era of Multi-Stage Malware Attacks
In March 2026, cybersecurity researchers uncovered a sophisticated multi-stage malware campaign, dubbed VOID#GEIST, which utilizes obfuscated batch scripts to deploy encrypted remote access trojans (RATs) such as XWorm, AsyncRAT, and Xeno RAT. The attack initiates with a batch script distributed via phishing emails, leading to the execution of additional scripts and the deployment of a legitimate embedded Python runtime. This sequence culminates in the decryption and in-memory execution of malicious payloads through Early Bird Asynchronous Procedure Call (APC) injection into 'explorer.exe' processes, effectively evading traditional disk-based detection mechanisms. The campaign's modular architecture and fileless execution strategy highlight a significant evolution in malware delivery methods, emphasizing the need for advanced behavioral detection systems. The use of legitimate tools and processes underscores the increasing sophistication of threat actors in blending malicious activities with normal system operations, posing challenges for conventional security measures.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports