Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 138 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1645–1656 / 3243 reports
Microsoft Entra ID Agent ID Administrator Role Privilege Escalation Vulnerability
Financial Services6 months ago

Microsoft Entra ID Agent ID Administrator Role Privilege Escalation Vulnerability

In March 2026, a critical vulnerability was identified in Microsoft Entra ID's Agent ID Administrator role, designed to manage AI agent identities. This flaw allowed users with this role to take over arbitrary service principals by assigning themselves as owners and adding new credentials, potentially escalating privileges to the Global Administrator level. Microsoft addressed the issue by April 9, 2026, restricting the role's permissions to prevent such unauthorized access. This incident underscores the importance of stringent role scoping and continuous monitoring of privileged accounts to prevent similar security breaches in the future.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Understanding the 2026 AWS Cognito Refresh Token Abuse Incident
Financial Services6 months ago

Understanding the 2026 AWS Cognito Refresh Token Abuse Incident

In March 2026, AWS updated its Threat Technique Catalog to highlight a significant security concern: the abuse of Amazon Cognito refresh tokens. Threat actors have been exploiting long-lived refresh tokens to maintain unauthorized access to AWS environments. By obtaining a valid refresh token—through methods like credential theft or compromised client-side storage—attackers can continuously generate new access and ID tokens without re-authentication, effectively establishing a persistent foothold in the system. This technique allows them to operate undetected, as the legitimate user's session remains unaffected. The default lifespan of these tokens is 30 days, but they can be configured for up to 10 years, amplifying the potential risk. ([aws-samples.github.io](https://aws-samples.github.io/threat-technique-catalog-for-aws/Techniques/T1098.A006.html?utm_source=openai)) This incident underscores the evolving tactics of cyber adversaries who leverage legitimate cloud service functionalities to evade detection. Organizations must reassess their security postures, particularly concerning token management and monitoring, to mitigate such stealthy persistence mechanisms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
VECT 2.0 Ransomware's Flaw Turns It into a Data Wiper
Health Care / Life Sciences6 months ago

VECT 2.0 Ransomware's Flaw Turns It into a Data Wiper

In April 2026, researchers identified a critical flaw in the VECT 2.0 ransomware that causes it to irreversibly destroy files larger than 128 KB instead of encrypting them. This flaw affects Windows, Linux, and ESXi systems, rendering recovery impossible even if a ransom is paid. The VECT operators had partnered with TeamPCP, known for recent supply-chain attacks, aiming to deploy ransomware payloads in compromised environments. The flaw stems from improper handling of encryption nonces, leading to permanent data loss for larger files. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/broken-vect-20-ransomware-acts-as-a-data-wiper-for-large-files/?utm_source=openai)) This incident underscores the importance of robust backup strategies and highlights the potential for ransomware to cause irreversible damage due to coding errors. Organizations must prioritize resilience and ensure their data protection measures can withstand such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
CISA Mandates Immediate Patching of 'BlueHammer' Vulnerability in Microsoft Defender
Government Administration6 months ago

CISA Mandates Immediate Patching of 'BlueHammer' Vulnerability in Microsoft Defender

In April 2026, the Cybersecurity and Infrastructure Security Agency (CISA) mandated that U.S. federal agencies patch a critical vulnerability in Microsoft Defender, known as 'BlueHammer' and tracked as CVE-2026-33825. This flaw allows low-privileged local attackers to escalate their privileges to SYSTEM level by exploiting insufficient access control mechanisms. The vulnerability was publicly disclosed by a researcher named 'Chaotic Eclipse' after expressing dissatisfaction with Microsoft's vulnerability disclosure process. Microsoft addressed the issue in their April 14, 2026, Patch Tuesday release. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-microsoft-defender-flaw-exploited-in-zero-day-attacks/?utm_source=openai)) The urgency of this directive underscores the increasing trend of zero-day vulnerabilities being exploited in the wild, highlighting the necessity for organizations to promptly apply security patches. The incident also brings attention to the challenges in vulnerability disclosure processes and the potential risks associated with public disclosures of unpatched vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
UK Issues Warning on Chinese Hackers Using Botnets to Evade Detection
Telecommunications6 months ago

UK Issues Warning on Chinese Hackers Using Botnets to Evade Detection

In April 2026, the UK's National Cyber Security Centre (NCSC) and international partners issued a warning about Chinese state-sponsored hackers employing large-scale proxy networks composed of hijacked consumer devices to evade detection. These botnets, primarily consisting of compromised small office/home office (SOHO) routers and Internet of Things (IoT) devices, enable attackers to route malicious traffic through multiple nodes, obscuring their origins and complicating attribution. This tactic has been linked to groups such as Flax Typhoon and Volt Typhoon, which have targeted critical infrastructure sectors including military, government, telecommunications, and IT. The increasing use of such covert networks signifies a strategic shift in cyber operations, highlighting the need for enhanced security measures. Organizations are advised to implement multifactor authentication, monitor network edge devices, utilize dynamic threat intelligence feeds, and adopt zero-trust architectures to mitigate the risks posed by these evolving threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
GopherWhisper APT Group's 2026 Cyber Espionage Campaign
Government Administration6 months ago

GopherWhisper APT Group's 2026 Cyber Espionage Campaign

In April 2026, cybersecurity researchers identified a previously undocumented state-sponsored threat actor named GopherWhisper, active since at least 2023 and linked to China. This group targeted governmental institutions, notably in Mongolia, deploying a suite of custom malware primarily written in Go. GopherWhisper's toolkit includes backdoors such as LaxGopher, RatGopher, and BoxOfFriends, which exploit legitimate services like Slack, Discord, and Microsoft 365 Outlook for command-and-control communications. Additionally, the group utilized the CompactGopher tool to exfiltrate data via the file-sharing service file.io. These sophisticated tactics enabled the attackers to blend malicious activities with normal network traffic, complicating detection efforts. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-gopherwhisper-apt-group-abuses-outlook-slack-discord-for-comms/?utm_source=openai)) The discovery of GopherWhisper underscores a growing trend among threat actors to abuse widely used communication platforms for cyber espionage. This incident highlights the necessity for organizations to implement robust monitoring and anomaly detection systems to identify unauthorized use of legitimate services, as traditional security measures may be insufficient against such covert operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Trigona Ransomware's Custom Exfiltration Tool: A 2026 Cyber Threat Analysis
Health Care / Life Sciences6 months ago

Trigona Ransomware's Custom Exfiltration Tool: A 2026 Cyber Threat Analysis

In March 2026, the Trigona ransomware group employed a custom command-line tool named 'uploader_client.exe' to exfiltrate data from compromised environments more efficiently. This tool supports parallel uploads with five simultaneous connections per file, rotates TCP connections after 2GB of traffic to evade monitoring, selectively exfiltrates specific file types, and uses an authentication key to restrict access to stolen data. The shift to proprietary tools indicates the group's effort to maintain a lower profile during critical attack phases. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/trigona-ransomware-attacks-use-custom-exfiltration-tool-to-steal-data/?utm_source=openai)) The development of custom exfiltration tools by ransomware groups like Trigona reflects a broader trend in the cyber threat landscape, where attackers are investing in bespoke malware to enhance operational efficiency and evade detection. Organizations must adapt their security strategies to address these evolving tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GopherWhisper APT Exploits Go-Based Backdoors to Target Mongolian Government
Government Administration6 months ago

GopherWhisper APT Exploits Go-Based Backdoors to Target Mongolian Government

In January 2025, ESET researchers identified a previously undocumented China-aligned advanced persistent threat (APT) group named GopherWhisper targeting Mongolian governmental institutions. The group employs a suite of tools primarily written in Go, including injectors and loaders, to deploy various backdoors such as LaxGopher, RatGopher, and BoxOfFriends. GopherWhisper leverages legitimate services like Discord, Slack, Microsoft 365 Outlook, and file.io for command-and-control (C&C) communications and data exfiltration. The group's activities have been ongoing since at least November 2023, compromising at least 12 systems within a Mongolian government entity. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/04/23/3279634/0/en/ESET-Research-discovers-new-China-aligned-group-GopherWhisper-It-abuses-messaging-services-Discord-Slack-and-Outlook-to-spy.html?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored threat actors who exploit widely used communication platforms to evade detection. The use of Go-based malware highlights a trend towards more versatile and cross-platform attack tools, posing significant challenges for traditional security measures. Organizations must adapt their defenses to address these sophisticated techniques.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
The Gentlemen Ransomware Group's Rapid Rise in 2026
Health Care / Life Sciences6 months ago

The Gentlemen Ransomware Group's Rapid Rise in 2026

In mid-2025, a ransomware group known as 'The Gentlemen' emerged, rapidly escalating its operations to claim over 320 victims by early 2026. Operating under a Ransomware-as-a-Service (RaaS) model, the group employs sophisticated tactics, including the use of SystemBC proxy malware for covert tunneling and payload delivery. Their attacks span multiple industries and geographies, with a notable focus on corporate environments. The Gentlemen's rapid expansion and advanced techniques underscore the evolving threat landscape posed by modern ransomware groups. Organizations must remain vigilant, as the group's continued activity highlights the persistent risk of ransomware attacks targeting enterprises worldwide.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Chinese APT GopherWhisper Exploits Cloud Services in Mongolian Cyber Espionage
Government Administration6 months ago

Chinese APT GopherWhisper Exploits Cloud Services in Mongolian Cyber Espionage

In April 2026, ESET researchers uncovered a Chinese advanced persistent threat (APT) group named GopherWhisper targeting Mongolian government institutions. Active since at least November 2023, GopherWhisper deployed multiple custom backdoors—LaxGopher, CompactGopher, RatGopher, BoxOfFriends, and SSLORDoor—each utilizing different cloud services like Slack, Discord, Microsoft Outlook, and file.io for command-and-control communications and data exfiltration. This campaign compromised at least 12 systems within a Mongolian governmental institution, with indications of broader impact across the region. This incident underscores a growing trend of APT groups leveraging legitimate cloud services to evade detection and maintain persistent access. Organizations must enhance their monitoring of cloud-based communications and implement robust security measures to detect and mitigate such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Zealot AI: A Glimpse into Autonomous Cloud Attacks
Financial Services6 months ago

Zealot AI: A Glimpse into Autonomous Cloud Attacks

In April 2026, Palo Alto Networks' Unit 42 unveiled 'Zealot,' an AI-driven, multi-agent system capable of autonomously executing end-to-end cloud attacks. In a controlled environment, Zealot rapidly identified and exploited vulnerabilities within a misconfigured Google Cloud Platform, achieving data exfiltration in mere minutes. This proof-of-concept underscores the potential for AI to accelerate cyberattacks beyond human response capabilities. The demonstration highlights the urgent need for organizations to enhance their security postures. As AI technologies evolve, they not only offer defensive advantages but also equip adversaries with tools to conduct swift and sophisticated attacks, emphasizing the importance of proactive and automated defense mechanisms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft's AI-Powered Defense Strategies in 2026
Computer Software/Engineering6 months ago

Microsoft's AI-Powered Defense Strategies in 2026

In April 2026, Microsoft highlighted the transformative impact of AI on cybersecurity, emphasizing that AI models can autonomously discover vulnerabilities, chain multiple lower-severity issues into exploits, and produce proof-of-concept code, thereby compressing the window between vulnerability discovery and exploitation. To counteract these AI-driven threats, Microsoft is integrating advanced AI models into its Security Development Lifecycle (SDL) to identify vulnerabilities and develop mitigations more swiftly. Additionally, the company is partnering with industry leaders to test models like Claude Mythos Preview, aiming to enhance vulnerability detection and coordinate defensive responses. This proactive approach underscores the necessity for organizations to stay current on security updates and adopt AI-powered solutions to bolster their defenses. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/22/ai-powered-defense-for-an-ai-accelerated-threat-landscape/?utm_source=openai)) The relevance of this initiative is underscored by the rapid evolution of the threat landscape, where threat actors are increasingly leveraging AI to enhance the speed, scale, and sophistication of cyberattacks. Microsoft's commitment to integrating AI into its security operations reflects a broader industry trend towards adopting AI-driven defenses to stay ahead of emerging threats. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/02/threat-actor-abuse-of-ai-accelerates-from-tool-to-cyberattack-surface/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports