Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 137 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1633–1644 / 3243 reports
CISA Adds CVE-2026-33825 to Known Exploited Vulnerabilities Catalog
Government Administration6 months ago

CISA Adds CVE-2026-33825 to Known Exploited Vulnerabilities Catalog

In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-33825 to its Known Exploited Vulnerabilities (KEV) catalog, highlighting active exploitation of a privilege escalation flaw in Microsoft Defender. This vulnerability, known as 'BlueHammer,' allows attackers with limited local access to escalate privileges to SYSTEM level due to insufficient access control granularity. The flaw was publicly disclosed by a researcher named 'Chaotic Eclipse' after dissatisfaction with Microsoft's vulnerability disclosure process, leading to the release of exploit details online. ([techradar.com](https://www.techradar.com/pro/security/cisa-puts-us-government-agencies-on-two-week-deadline-to-patch-microsoft-defender-bluehammer-zero-day-exploit?utm_source=openai)) The inclusion of CVE-2026-33825 in the KEV catalog underscores the critical nature of this vulnerability and the urgency for organizations to apply patches. CISA has mandated that Federal Civilian Executive Branch agencies remediate this vulnerability by May 6, 2026, to mitigate the risk of active exploitation. ([techradar.com](https://www.techradar.com/pro/security/cisa-puts-us-government-agencies-on-two-week-deadline-to-patch-microsoft-defender-bluehammer-zero-day-exploit?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
UNC6692's 'Snow' Malware: A New Threat via Microsoft Teams
Information Technology/IT6 months ago

UNC6692's 'Snow' Malware: A New Threat via Microsoft Teams

In April 2026, the threat group UNC6692 executed a sophisticated social engineering attack targeting enterprise networks. The attackers initiated the campaign by overwhelming victims' email inboxes with spam, creating a sense of urgency. Subsequently, they impersonated IT helpdesk staff via Microsoft Teams, convincing users to install a purported spam-blocking patch. This led to the deployment of a custom malware suite named 'Snow,' comprising components like SnowBelt (a malicious browser extension), SnowGlaze (a tunneling tool), and SnowBasin (a backdoor). These tools facilitated deep network penetration, credential theft, and domain takeover, enabling the exfiltration of sensitive data. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/threat-actor-uses-microsoft-teams-to-deploy-new-snow-malware/?utm_source=openai)) This incident underscores the evolving tactics of cyber adversaries who exploit trusted communication platforms and social engineering to bypass traditional security measures. The use of Microsoft Teams as an attack vector highlights the need for heightened vigilance and robust security protocols in enterprise environments to counteract such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Unpatched PhantomRPC Flaw in Windows Enables Privilege Escalation
Financial Services6 months ago

Unpatched PhantomRPC Flaw in Windows Enables Privilege Escalation

In April 2026, Kaspersky researchers disclosed 'PhantomRPC,' an unpatched vulnerability in Windows' Remote Procedure Call (RPC) mechanism. This flaw allows attackers with limited local access to deploy malicious RPC servers that impersonate legitimate Windows services. When higher-privileged processes connect to these rogue servers, attackers can escalate their privileges to SYSTEM or administrator levels. The vulnerability arises from how RPC handles connections to unavailable services, permitting any process to register an RPC server on the same endpoint as a legitimate service that is not running. Despite the severity, Microsoft has classified the issue as 'moderate' and has not issued a patch or CVE identifier. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/unpatched-phantomrpc-flaw-windows-privilege-escalation?utm_source=openai)) The disclosure of PhantomRPC underscores the persistent risks associated with architectural vulnerabilities in widely used operating systems. Organizations must proactively implement monitoring and privilege management strategies to mitigate potential exploitation, especially in the absence of official patches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Navigating the New Era of AI-Driven Cyber Threats
Financial Services6 months ago

Navigating the New Era of AI-Driven Cyber Threats

In April 2026, the cybersecurity community faced a significant challenge with the emergence of advanced large language models (LLMs) like Anthropic's Mythos and OpenAI's GPT-5.5. These models enabled threat actors to automate complex cyberattacks, leading to concerns about industrialized, autonomous exploitation across various platforms. Despite these advancements, experts like Ari Herbert-Voss emphasized the continued necessity of human expertise to validate and address the vulnerabilities identified by these AI systems. This incident underscores the evolving threat landscape where AI-driven attacks are becoming more sophisticated and widespread. Organizations must adapt by integrating AI into their defensive strategies while ensuring human oversight to effectively manage and mitigate these emerging threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
PhantomCore's Exploitation of TrueConf Vulnerabilities: A Wake-Up Call for Network Security
Government Administration6 months ago

PhantomCore's Exploitation of TrueConf Vulnerabilities: A Wake-Up Call for Network Security

In September 2025, the pro-Ukrainian hacktivist group PhantomCore exploited a chain of three vulnerabilities in TrueConf video conferencing software to execute remote commands on servers within Russian organizations. This campaign, active since mid-September 2025, allowed attackers to bypass authentication, gain network access, and deploy malicious payloads for reconnaissance, credential harvesting, and lateral movement. The incident underscores the critical importance of promptly patching software vulnerabilities and implementing robust network segmentation. It also highlights the evolving tactics of politically motivated threat actors targeting communication platforms to infiltrate sensitive networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Toronto Authorities Dismantle SMS Blaster Operation, Arrest Three
Banking/Mortgage6 months ago

Toronto Authorities Dismantle SMS Blaster Operation, Arrest Three

In April 2026, Canadian authorities arrested three individuals in Toronto for operating an 'SMS blaster' device that impersonated legitimate cellular towers to send phishing text messages to nearby mobile phones. These devices tricked phones into connecting by emitting stronger signals, allowing operators to distribute fraudulent messages appearing to come from trusted entities like banks or government agencies. The investigation, dubbed 'Project Lighthouse,' revealed that the operation led to 13 million instances of mobile network entrapment, temporarily disconnecting devices from their legitimate networks and potentially blocking access to emergency services. This incident underscores the evolving tactics of cybercriminals in exploiting mobile network vulnerabilities. The use of mobile SMS blasters represents a significant escalation in smishing attacks, highlighting the need for enhanced security measures and public awareness to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Silk Typhoon Hacker Extradited to US for Cyberespionage
Health Care / Life Sciences6 months ago

Silk Typhoon Hacker Extradited to US for Cyberespionage

In April 2026, Chinese national Xu Zewei was extradited from Italy to the United States to face charges of cyberespionage. Allegedly operating under the direction of China's Ministry of State Security (MSS) and affiliated with the Silk Typhoon hacking group, Xu is accused of conducting cyber intrusions between February 2020 and June 2021. These operations targeted COVID-19 research organizations and exploited vulnerabilities in Microsoft Exchange Server to gain unauthorized access, deploy malware, and exfiltrate sensitive data. The widespread exploitation impacted thousands of organizations globally before patches were available. This incident underscores the persistent threat posed by state-sponsored cyber actors targeting critical infrastructure and sensitive information. The extradition of Xu Zewei highlights the international cooperation in addressing cyber threats and the ongoing need for robust cybersecurity measures to protect against sophisticated espionage campaigns.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Deepfake Voice Attacks: The Rising Threat in 2025
Financial Services6 months ago

Deepfake Voice Attacks: The Rising Threat in 2025

In March 2025, a finance director at a multinational firm in Singapore participated in a Zoom call with individuals appearing as her senior leadership team, including the CFO. Unbeknownst to her, all participants were AI-generated deepfakes. She authorized a $499,000 transfer before the fraud was detected. This incident mirrors a 2024 attack on Arup, where $25.6 million was stolen using similar deepfake techniques. The proliferation of deepfake technology has led to a 680% increase in voice deepfake incidents in 2025, with over 100,000 attacks recorded in the United States alone. The accessibility of these tools, which require minimal audio samples and no technical expertise, underscores the urgent need for organizations to implement robust verification protocols and employee training to mitigate such sophisticated social engineering threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Navigate360 P3 Global Intel Data Breach: A Wake-Up Call for Educational Cybersecurity
Primary/Secondary Education6 months ago

Navigate360 P3 Global Intel Data Breach: A Wake-Up Call for Educational Cybersecurity

In March 2026, Navigate360's P3 Global Intel platform, an anonymous tip line used by over 30,000 schools and 5,000 public safety agencies, was reportedly breached by a hacker group known as Internet Yiff Machine. The attackers claimed to have exfiltrated approximately 93 gigabytes of data, including over 8 million law enforcement tips containing sensitive personally identifiable information (PII) of students and informants. This incident has raised significant concerns about the platform's security measures and the anonymity it promises to its users. The breach underscores the growing trend of cyberattacks targeting educational institutions, which have become increasingly frequent and sophisticated. The exposure of sensitive student data not only compromises individual privacy but also erodes trust in systems designed to enhance school safety. This incident highlights the urgent need for robust cybersecurity practices and compliance with data protection regulations within the education sector.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Analyzing GitHub's March 2026 RCE Vulnerability (CVE-2026-3854)
Computer Software/Engineering6 months ago

Analyzing GitHub's March 2026 RCE Vulnerability (CVE-2026-3854)

In March 2026, GitHub identified a critical remote code execution (RCE) vulnerability (CVE-2026-3854) affecting its platforms, including GitHub.com and GitHub Enterprise Server. The flaw allowed users with push access to execute arbitrary commands on the server during a git push operation by exploiting unsanitized push options. GitHub promptly validated the issue, deployed a fix within two hours, and confirmed no evidence of exploitation. This incident underscores the importance of rigorous input sanitization and rapid response mechanisms in mitigating supply chain vulnerabilities. As software supply chains grow increasingly complex, organizations must prioritize proactive security measures to prevent similar threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
VECT 2.0 Ransomware: A New Threat to Data Integrity
Health Care / Life Sciences6 months ago

VECT 2.0 Ransomware: A New Threat to Data Integrity

In April 2026, the VECT 2.0 ransomware emerged, targeting Windows, Linux, and ESXi systems. Due to a critical flaw in its encryption implementation, files larger than 131KB are irreversibly destroyed, rendering recovery impossible even for the attackers. This flaw effectively transforms VECT 2.0 into a data wiper rather than traditional ransomware. ([gixtools.net](https://gixtools.net/feeds/items/vect-2-0-ransomware-irreversibly-destroys-files-over-131kb-on-windows-linux-esxi/?utm_source=openai)) The incident underscores the evolving nature of cyber threats, where flawed ransomware can lead to permanent data loss. Organizations must prioritize robust backup strategies and incident response plans to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks
Health Care / Life Sciences6 months ago

Chinese Silk Typhoon Hacker Extradited to U.S. Over COVID Research Cyberattacks

In April 2026, Chinese national Xu Zewei was extradited from Italy to the United States to face charges related to cyberattacks conducted between February 2020 and June 2021. Xu, allegedly operating under the direction of China's Ministry of State Security, targeted U.S. universities and organizations to steal COVID-19 research data. He exploited vulnerabilities in Microsoft Exchange Server, compromising thousands of systems worldwide. Xu was arrested in Milan in July 2025 and now faces multiple charges, including wire fraud and aggravated identity theft. ([justice.gov](https://www.justice.gov/opa/pr/prolific-chinese-state-sponsored-contract-hacker-extradited-italy?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber espionage, particularly in the context of global health crises. The extradition highlights international cooperation in combating cybercrime and the ongoing need for robust cybersecurity measures to protect sensitive research and infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports