Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 139 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1657–1668 / 3243 reports
FBI's Forensic Extraction of Deleted Signal Messages from iPhone Notification Database
Law Enforcement6 months ago

FBI's Forensic Extraction of Deleted Signal Messages from iPhone Notification Database

In April 2026, the FBI successfully extracted deleted Signal messages from a defendant's iPhone by accessing the device's push notification database. This extraction was possible because the iPhone stored copies of incoming Signal messages in its internal memory, even after the app was deleted. The case involved individuals accused of vandalizing property at the ICE Prairieland Detention Facility in Texas, marking the first time authorities charged individuals for alleged 'Antifa' activities following its designation as a terrorist organization. This incident underscores the potential for forensic tools to retrieve sensitive data from secure messaging apps through unexpected avenues, highlighting the importance of understanding how device settings and notification storage can impact data security. Users are advised to review and adjust their notification settings to prevent unintended data retention.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Harvester's Linux GoGra Backdoor Exploits Microsoft Graph API
Telecommunications6 months ago

Harvester's Linux GoGra Backdoor Exploits Microsoft Graph API

In April 2026, the state-sponsored Harvester group deployed a Linux variant of its GoGra backdoor, utilizing the Microsoft Graph API and Outlook mailboxes for covert command-and-control communications. This sophisticated malware exploits legitimate Microsoft infrastructure to evade detection, targeting telecommunications, government, and IT organizations in South Asia. The Linux GoGra backdoor shares significant code similarities with its Windows counterpart, indicating a concerted effort by Harvester to expand its cross-platform capabilities. The emergence of this Linux variant underscores a growing trend among threat actors to develop multi-platform malware that leverages trusted cloud services for stealthy operations. Organizations must enhance their monitoring of cloud API interactions and implement robust security measures to detect and mitigate such advanced threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Over 1,300 Microsoft SharePoint Servers Vulnerable to Ongoing Attacks
Government Administration6 months ago

Over 1,300 Microsoft SharePoint Servers Vulnerable to Ongoing Attacks

In April 2026, Microsoft disclosed a spoofing vulnerability (CVE-2026-32201) in SharePoint Server, affecting versions 2016, 2019, and Subscription Edition. This flaw allows unauthenticated attackers to perform network-based spoofing attacks due to improper input validation. Despite the release of patches on April 14, over 1,300 internet-exposed SharePoint servers remain unpatched, leaving organizations vulnerable to unauthorized access and data manipulation. The continued exploitation of CVE-2026-32201 underscores the critical need for timely patch management. Organizations must prioritize updating their SharePoint servers to mitigate potential breaches and maintain data integrity.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Apple Addresses CVE-2026-28950: Notification Data Retention Vulnerability in iOS and iPadOS
Financial Services6 months ago

Apple Addresses CVE-2026-28950: Notification Data Retention Vulnerability in iOS and iPadOS

In April 2026, Apple released out-of-band security updates for iOS and iPadOS to address a vulnerability (CVE-2026-28950) where notifications marked for deletion were unexpectedly retained on devices. This flaw, present in versions prior to iOS 18.7.8 and iOS 26.4.2, could potentially allow unauthorized access to sensitive information through retained notifications. The issue was resolved by improving data redaction processes. This incident underscores the critical importance of timely software updates and robust data management practices. It also highlights the potential risks associated with residual data storage, emphasizing the need for organizations to implement comprehensive data protection strategies to safeguard sensitive information.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Navigating AI-Driven Vulnerability Management in 2026
Computer Software/Engineering6 months ago

Navigating AI-Driven Vulnerability Management in 2026

In 2026, the integration of artificial intelligence (AI) into cybersecurity has significantly transformed vulnerability management. AI systems now autonomously identify and exploit software vulnerabilities at unprecedented speeds, outpacing traditional security measures. This rapid evolution has led to a surge in AI-generated vulnerabilities, with AI-driven tools uncovering flaws that have remained undetected for decades. Consequently, organizations face an escalating challenge in prioritizing and remediating these vulnerabilities before they are exploited by malicious actors. The current landscape underscores the urgency for enterprises to adopt AI-enhanced security frameworks. As AI becomes a standard component of both offensive and defensive cybersecurity strategies, businesses must implement continuous threat exposure management and proactive defense mechanisms to mitigate the risks associated with AI-driven attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Microsoft Defender Zero-Day Exploits: BlueHammer, RedSun, and UnDefend
Financial Services6 months ago

Critical Microsoft Defender Zero-Day Exploits: BlueHammer, RedSun, and UnDefend

In April 2026, a security researcher known as Chaotic Eclipse publicly disclosed three zero-day vulnerabilities in Microsoft Defender: BlueHammer, RedSun, and UnDefend. These exploits allow attackers to escalate privileges to SYSTEM level and disable Defender's update mechanism, effectively turning the security tool against its users. Microsoft has patched BlueHammer (CVE-2026-33825), but RedSun and UnDefend remain unpatched as of April 22, 2026. ([tomsguide.com](https://www.tomsguide.com/computing/online-security/over-1-billion-windows-users-at-risk-after-disgruntled-security-researcher-leaks-defender-zero-days?utm_source=openai)) The public release of these exploits has led to active exploitation in the wild, with threat actors leveraging them to gain elevated privileges and disable security defenses. This incident underscores the critical importance of timely vulnerability disclosure and patch management in maintaining organizational security. ([techcrunch.com](https://techcrunch.com/2026/04/17/hackers-are-abusing-unpatched-windows-security-flaws-to-hack-into-organizations?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Mustang Panda's LOTUSLITE Variant Targets Indian Banks and South Korean Policy Circles
Banking/Mortgage6 months ago

Mustang Panda's LOTUSLITE Variant Targets Indian Banks and South Korean Policy Circles

In April 2026, cybersecurity researchers identified a new variant of the LOTUSLITE malware, attributed to the Chinese state-sponsored group Mustang Panda. This variant targeted India's banking sector and South Korean policy circles. The attack began with spear-phishing emails containing Compiled HTML (CHM) files that, when executed, deployed a backdoor communicating with a dynamic DNS-based command-and-control server over HTTPS. This backdoor facilitated remote shell access, file operations, and session management, indicating espionage-focused objectives rather than financial gain. The malware was disguised as legitimate banking software, notably referencing HDFC Bank, to deceive victims. This incident underscores the evolving tactics of nation-state actors like Mustang Panda, who are expanding their targets beyond traditional government entities to include financial institutions and policy organizations. The use of familiar yet effective techniques, such as DLL side-loading and spear-phishing, highlights the persistent threat posed by such groups and the need for organizations to remain vigilant against sophisticated cyber espionage campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft Releases Critical Patch for ASP.NET Core Vulnerability CVE-2026-40372
Financial Services6 months ago

Microsoft Releases Critical Patch for ASP.NET Core Vulnerability CVE-2026-40372

On April 21, 2026, Microsoft released an out-of-band security update to address a critical vulnerability in ASP.NET Core, identified as CVE-2026-40372. This flaw, stemming from improper verification of cryptographic signatures, allows unauthorized attackers to escalate privileges over a network. Rated with a CVSS score of 9.1, the vulnerability affects ASP.NET Core versions prior to 10.0.7. Exploitation could lead to unauthorized access and control over application components or data. The release of this patch underscores the importance of timely software updates, especially in widely used frameworks like ASP.NET Core. Organizations are urged to apply the update promptly to mitigate potential risks associated with this vulnerability.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack
Oil/Energy/Solar/Greentech6 months ago

Lotus Wiper Malware Targets Venezuelan Energy Systems in Destructive Attack

In late 2025 and early 2026, a previously undocumented malware known as Lotus Wiper targeted Venezuela's energy and utilities sector. The attack began with batch scripts that disabled system defenses and disrupted operations, paving the way for the wiper to erase recovery mechanisms, overwrite physical drives, and systematically delete files, rendering systems inoperable. ([securelist.com](https://securelist.com/tr/lotus-wiper/119472/?utm_source=openai)) This incident underscores the escalating threat of destructive malware against critical infrastructure. The absence of ransom demands suggests a focus on disruption rather than financial gain, highlighting the need for robust cybersecurity measures in essential services. ([securityweek.com](https://www.securityweek.com/new-wiper-malware-targeted-venezuelan-energy-sector-prior-to-us-intervention/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Harvester's Linux GoGra Backdoor: A New Threat in South Asia
Government Administration6 months ago

Harvester's Linux GoGra Backdoor: A New Threat in South Asia

In April 2026, the Harvester threat actor deployed a new Linux variant of its GoGra backdoor targeting entities in South Asia. The malware utilizes the Microsoft Graph API and Outlook mailboxes as covert command-and-control channels, enabling it to bypass traditional network defenses. Initial access is achieved through social engineering tactics, tricking victims into executing ELF binaries disguised as PDF documents. Once installed, the backdoor communicates with a specific Outlook mailbox folder named "Zomato Pizza," executing commands received via emails with subjects starting with "Input" and sending execution results back with the subject "Output." ([thehackernews.com](https://thehackernews.com/2026/04/harvester-deploys-linux-gogra-backdoor.html?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors like Harvester, who are expanding their toolsets to include cross-platform capabilities and leveraging legitimate cloud services to evade detection. The use of Microsoft's cloud infrastructure for command-and-control highlights the need for organizations to monitor and secure their cloud environments against such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Unveiling Critical APT Exploit Chains: A 2026 Analysis
Computer Software/Engineering6 months ago

Unveiling Critical APT Exploit Chains: A 2026 Analysis

In April 2026, Praetorian's analysis revealed that out of 500,000 vulnerability findings, only 14 endpoints were susceptible to critical exploit chains capable of full host compromise. These chains combined multiple vulnerabilities, including CVE-2025-4918 and CVE-2025-2857, to enable zero-click attacks through browser exploits. Notably, one chain was actively exploited by the Russian-aligned APT group RomCom, targeting sectors such as government, defense, and energy across Europe and North America. This incident underscores the necessity for organizations to move beyond traditional CVSS-based vulnerability assessments and adopt exploit chain analysis to identify and mitigate real-world attack paths effectively. The increasing sophistication of APT groups in leveraging complex exploit chains highlights the urgent need for enhanced threat intelligence integration and proactive security measures to protect critical infrastructure and sensitive data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Lawmakers Propose Tougher Penalties for Hospital Ransomware Attacks
Health Care / Life Sciences6 months ago

Lawmakers Propose Tougher Penalties for Hospital Ransomware Attacks

In April 2026, during a House Homeland Security Committee hearing, lawmakers discussed intensifying penalties for ransomware attacks targeting hospitals. Proposals included classifying such attacks as acts of terrorism and pursuing homicide charges when patient deaths result. These discussions were prompted by a significant rise in healthcare ransomware incidents, which doubled from 238 in 2024 to 460 in 2025, making the healthcare sector the most targeted industry. The hearing highlighted the severe operational disruptions and potential loss of life caused by these cyberattacks, emphasizing the need for stronger deterrents and legal frameworks to address the escalating threat. This incident underscores the growing urgency to enhance cybersecurity measures within the healthcare sector. The increasing frequency and severity of ransomware attacks necessitate immediate action to protect critical infrastructure and patient safety. Legislative initiatives aiming to reclassify these cybercrimes reflect a broader recognition of their potential to cause significant harm, signaling a shift towards more aggressive legal responses to deter future attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports