Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 135 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1609–1620 / 3243 reports
Lotus Wiper Attack Disrupts Venezuelan Energy Sector in 2025
Oil/Energy/Solar/Greentech6 months ago

Lotus Wiper Attack Disrupts Venezuelan Energy Sector in 2025

In December 2025, Venezuela's state-owned oil company, Petróleos de Venezuela S.A. (PDVSA), experienced a significant cyberattack that disrupted its core administrative and operational systems. The attack, attributed to a previously unknown malware dubbed 'Lotus Wiper,' employed sophisticated living-off-the-land techniques to disable system defenses and systematically delete critical data, rendering systems unrecoverable. This incident led to the temporary suspension of oil cargo deliveries and forced PDVSA to rely on manual processes, highlighting vulnerabilities in the company's technological infrastructure. ([darkreading.com](https://www.darkreading.com/cyber-risk/lotus-wiper-attack-targeted-venezuelan-energy-firms-utilities?utm_source=openai)) The Lotus Wiper attack underscores the escalating use of destructive malware targeting critical infrastructure, particularly in the energy sector. The incident serves as a stark reminder of the need for robust cybersecurity measures and incident response strategies to protect against sophisticated cyber threats that can have severe operational and economic consequences.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
NSA GRASSMARLIN CVE-2026-6807 XXE Vulnerability: A Wake-Up Call for ICS Security
Government Administration6 months ago

NSA GRASSMARLIN CVE-2026-6807 XXE Vulnerability: A Wake-Up Call for ICS Security

In April 2026, a vulnerability identified as CVE-2026-6807 was disclosed in NSA's GRASSMARLIN v3.2.1, a tool used for mapping industrial control system (ICS) networks. The flaw involves improper handling of XML input, allowing attackers to exploit XML External Entity (XXE) references to access sensitive information. This vulnerability has a CVSS v3 base score of 5.5, indicating medium severity. Notably, GRASSMARLIN reached end-of-life status in 2017, and no patches or updates are planned to address this issue. The disclosure of this vulnerability underscores the risks associated with using unsupported software in critical infrastructure environments. Organizations relying on GRASSMARLIN should assess their exposure and consider transitioning to actively maintained alternatives to mitigate potential security threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
Government Administration6 months ago

CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog

On April 28, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2024-1708, a path traversal vulnerability in ConnectWise ScreenConnect versions 23.9.7 and prior, and CVE-2026-32202, a Windows Shell protection mechanism failure. CVE-2024-1708 allows attackers to execute remote code or access sensitive data by exploiting improper path handling, while CVE-2026-32202 enables attackers to steal NTLMv2 hashes without user interaction, leading to potential unauthorized access. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2024-1708/?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by actively exploited security flaws. Organizations are urged to prioritize patching these vulnerabilities to mitigate risks associated with remote code execution and unauthorized data access, which can lead to significant operational disruptions and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding and Mitigating AI-Driven Cyberattacks
Financial Services6 months ago

Understanding and Mitigating AI-Driven Cyberattacks

In February 2026, cybersecurity researchers identified a significant evolution in attack methodologies: threat actors are now leveraging custom AI systems to automate and expedite the cyber kill chain. This advancement enables attackers to autonomously map Active Directory structures and obtain Domain Admin credentials within minutes, drastically reducing the time required for system compromise. The integration of AI into cyberattacks has rendered traditional defensive workflows insufficient, as these automated systems can adapt and execute complex attacks with unprecedented speed and precision. This development underscores a critical shift in the cybersecurity landscape, where AI-enhanced attacks are no longer theoretical but a present reality. Organizations must recognize the urgency of adapting their security strategies to counteract these sophisticated threats. The rapid adoption of AI by malicious actors necessitates a reevaluation of existing defenses to ensure they are capable of mitigating the risks posed by autonomous cyberattacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Global Surveillance Campaigns Exploit Mobile Network Vulnerabilities in 2026
Telecommunications6 months ago

Global Surveillance Campaigns Exploit Mobile Network Vulnerabilities in 2026

In April 2026, researchers from the University of Toronto's Citizen Lab uncovered two surveillance campaigns exploiting vulnerabilities in mobile network signaling protocols, SS7 and Diameter. The attackers, utilizing commercial surveillance tools, impersonated legitimate mobile operators to manipulate signaling protocols, enabling them to track individuals' locations covertly. This marks the first documented instance linking real-world attack traffic directly to mobile operator signaling infrastructure. The campaigns affected networks across multiple countries, including Cambodia, China, Israel, Italy, and the United Kingdom, highlighting the global nature of the threat. The continued exploitation of these long-known vulnerabilities underscores systemic issues within global telecommunications infrastructure. Despite previous reports and regulatory attention, such activities persist, raising concerns about accountability and oversight in the telecom industry. This incident serves as a critical reminder for national regulators, policymakers, and telecom operators to prioritize the security of signaling protocols to prevent unauthorized surveillance and protect user privacy.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Firestarter Malware: A Persistent Threat to Cisco Network Security
Government Administration6 months ago

Firestarter Malware: A Persistent Threat to Cisco Network Security

In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) and the UK's National Cyber Security Centre (NCSC) disclosed that a state-sponsored hacking group implanted a persistent backdoor, named Firestarter, on Cisco network security devices. This malware allowed attackers to maintain access even after firmware updates and standard reboots. The campaign, active since at least late 2025, targeted government and critical infrastructure networks by exploiting vulnerabilities CVE-2025-20333 and CVE-2025-20362 in Cisco's Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) software. ([cyberscoop.com](https://cyberscoop.com/cisco-firestarter-malware-cisa-warning/?utm_source=openai)) The Firestarter malware achieves persistence by manipulating the device's boot sequence, enabling it to survive standard software reboots. This incident underscores the evolving sophistication of state-sponsored cyber threats and highlights the critical need for organizations to implement comprehensive monitoring and incident response strategies to detect and mitigate such persistent threats. ([cyberscoop.com](https://cyberscoop.com/cisco-firestarter-malware-cisa-warning/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
ZionSiphon: A Wake-Up Call for Critical Infrastructure Security
Utilities6 months ago

ZionSiphon: A Wake-Up Call for Critical Infrastructure Security

In April 2026, cybersecurity researchers identified a new malware strain named ZionSiphon, specifically engineered to target Israeli water treatment and desalination facilities. The malware was designed to infiltrate operational technology (OT) environments, aiming to manipulate industrial control systems (ICS) to alter chlorine levels and hydraulic pressure, potentially compromising water safety. However, analysis revealed that ZionSiphon contained significant technical flaws, including dysfunctional country-validation logic and incomplete protocol components, rendering it non-operational in its current state. Despite its intent, the malware lacked the sophistication required to effectuate its disruptive objectives. ([dragos.com](https://www.dragos.com/blog/zionsiphon-ot-malware-analysis?utm_source=openai)) This incident underscores a growing trend of threat actors experimenting with OT-specific malware to target critical infrastructure. While ZionSiphon itself was ineffective, its development highlights the need for heightened vigilance and robust cybersecurity measures within the water sector to defend against evolving threats. ([securityweek.com](https://www.securityweek.com/zionsiphon-malware-targets-ics-in-water-facilities/?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling China's Covert Cyber Networks: Implications for Global Security
Telecommunications6 months ago

Unveiling China's Covert Cyber Networks: Implications for Global Security

In April 2026, a coalition of international cybersecurity agencies, including the UK's National Cyber Security Centre (NCSC), the U.S. Cybersecurity and Infrastructure Security Agency (CISA), and others, issued a joint advisory highlighting a significant shift in tactics by Chinese state-sponsored cyber actors. These groups have transitioned from using individually procured infrastructure to leveraging large-scale covert networks composed of compromised Small Office/Home Office (SOHO) routers, Internet of Things (IoT) devices, and smart devices. This strategy enables them to conduct reconnaissance, deliver malware, and exfiltrate data while obfuscating the origin and attribution of their activities. Notable examples include the 'Volt Typhoon' and 'Flax Typhoon' campaigns, which have targeted critical infrastructure and engaged in cyber espionage, respectively. The advisory underscores the evolving nature of cyber threats and the increasing sophistication of state-sponsored actors. Organizations are urged to enhance their cybersecurity measures, including active monitoring and mapping of covert networks, to mitigate potential risks. This development highlights the necessity for continuous vigilance and adaptation in cybersecurity practices to counter emerging threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GopherWhisper: Unveiling a New China-Aligned APT Group Exploiting Collaboration Platforms
Government Administration6 months ago

GopherWhisper: Unveiling a New China-Aligned APT Group Exploiting Collaboration Platforms

In January 2025, ESET researchers identified a previously undocumented China-aligned APT group named GopherWhisper targeting a Mongolian governmental institution. The group employs a suite of custom tools, primarily written in Go, including backdoors like LaxGopher, RatGopher, and BoxOfFriends, as well as the C++ backdoor SSLORDoor. GopherWhisper leverages legitimate services such as Discord, Slack, Microsoft 365 Outlook, and file.io for command and control (C&C) communications and data exfiltration. Analysis of C&C traffic from these platforms provided significant insights into the group's operations and post-compromise activities. ([welivesecurity.com](https://www.welivesecurity.com/en/eset-research/gopherwhisper-burrow-full-malware/?utm_source=openai)) This incident underscores the evolving tactics of APT groups in utilizing common collaboration platforms for malicious activities, highlighting the need for enhanced monitoring and security measures within such services to detect and mitigate potential threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
NASA Employees Targeted in Chinese Phishing Scheme
Defense/Space6 months ago

NASA Employees Targeted in Chinese Phishing Scheme

Between January 2017 and December 2021, Chinese national Song Wu orchestrated a sophisticated spear-phishing campaign targeting NASA, the U.S. military, universities, and private companies. By impersonating U.S. researchers and engineers, Wu successfully obtained sensitive aerospace software and source code, violating U.S. export control laws. The scheme led to unauthorized access to defense-related technologies, posing significant national security risks. In September 2024, Wu was indicted on multiple counts of wire fraud and aggravated identity theft but remains at large. This incident underscores the persistent threat of state-sponsored cyber espionage and the critical need for robust cybersecurity measures to protect sensitive information. Organizations must remain vigilant against increasingly sophisticated phishing tactics employed by foreign adversaries.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Tropic Trooper's 2026 Cyber Espionage Campaign: A Deep Dive
Computer Software/Engineering6 months ago

Tropic Trooper's 2026 Cyber Espionage Campaign: A Deep Dive

In March 2026, the advanced persistent threat group Tropic Trooper launched a targeted cyber espionage campaign against Chinese-speaking individuals in Taiwan, South Korea, and Japan. The attackers utilized a trojanized version of the SumatraPDF reader to deploy the AdaptixC2 Beacon agent, facilitating remote access through the abuse of Microsoft Visual Studio Code tunnels. This multi-stage attack began with military-themed document lures, leading to the execution of malicious payloads that established command and control channels via GitHub repositories. The campaign underscores the evolving tactics of Tropic Trooper, known for its focus on intelligence gathering in East Asia. This incident highlights the increasing sophistication of state-sponsored cyber threats, particularly in their use of legitimate tools and platforms to evade detection. Organizations must remain vigilant against such tactics, emphasizing the need for robust endpoint security, user education on phishing schemes, and continuous monitoring of network activities to detect and mitigate unauthorized access attempts.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Powered Phishing Attacks Surge in 2026
Financial Services6 months ago

AI-Powered Phishing Attacks Surge in 2026

In the first quarter of 2026, AI-powered phishing attacks have surged, becoming the primary method for initial access in cyber incidents. According to Cisco Talos' "IR Trends Q1 2026" report, over 35% of compromises investigated were initiated through sophisticated phishing campaigns. These attacks often employ AI tools like SoftrAI to create convincing credential harvesting pages targeting Microsoft Exchange and Outlook Web Access accounts. The public administration and healthcare sectors have been particularly affected, each accounting for 24% of the targeted incidents. ([blog.talosintelligence.com](https://blog.talosintelligence.com/ir-trends-q1-2026/?utm_source=openai)) This trend underscores the evolving threat landscape where cybercriminals leverage AI to enhance the effectiveness and scale of their phishing campaigns. Organizations must adapt by implementing robust multi-factor authentication, enhancing employee training to recognize advanced phishing attempts, and deploying AI-driven security solutions to detect and mitigate these sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports