Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 14 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 157–168 / 3243 reports
AWS Security Agent Achieves 89% Success Rate in Autonomous CVE Exploitation
AWS Security Agent Achieves 89% Success Rate in Autonomous CVE Exploitation
Financial Services3 weeks ago

AWS Security Agent Achieves 89% Success Rate in Autonomous CVE Exploitation

AWS Security Agent, now integrated into AWS Continuum, demonstrated autonomous penetration testing capabilities by successfully exploiting 33 of 37 recently disclosed CVEs in a controlled benchmark environment. The AI-powered agent operated from minimal starting information—just endpoint URLs and single-line hints—to discover vulnerabilities, construct working exploits, and extract hidden flags across diverse software platforms including web frameworks, container registries, ML platforms, and ecommerce stacks. The 89.2% success rate spanned eight vulnerability classes from SQL injection to complex multi-step XSS-to-admin-cookie chains, with some exploits requiring sophisticated chaining of six different attack primitives. Two failures occurred when the agent's aggressive exploitation accidentally destroyed target systems before flag extraction, highlighting the critical need for non-destructive guardrails in autonomous security testing tools. This development represents a significant advancement in AI-driven cybersecurity testing, coinciding with the rapid proliferation of AI agents across enterprise security operations and the growing sophistication of both defensive and offensive AI capabilities in 2025.

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical CVE-2026-0322 RCE Flaw in Palo Alto Networks PAN-OS Under Active Attack
Critical CVE-2026-0322 RCE Flaw in Palo Alto Networks PAN-OS Under Active Attack
Government Administration3 weeks ago

Critical CVE-2026-0322 RCE Flaw in Palo Alto Networks PAN-OS Under Active Attack

Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interface that enables authenticated attackers to execute arbitrary code with root privileges. The flaw affects PA-Series, VM-Series firewalls and Panorama systems, with active exploitation detected from three IP addresses geolocated in the United States. The company confirmed very limited exploitation targeting management interfaces and released patches across multiple PAN-OS versions, while CISA added the vulnerability to its Known Exploited Vulnerabilities catalog requiring federal agencies to patch by October 17, 2026. This incident reflects the continuing trend of threat actors targeting network infrastructure vulnerabilities, particularly management interfaces of critical security appliances, as organizations increasingly rely on firewall technologies for perimeter defense and zero trust architecture implementation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Critical Drupal Field UI Vulnerability Exposes 150K+ Sites to Remote Code Execution
Critical Drupal Field UI Vulnerability Exposes 150K+ Sites to Remote Code Execution
Computer Software/Engineering3 weeks ago

Critical Drupal Field UI Vulnerability Exposes 150K+ Sites to Remote Code Execution

In October 2026, the Drupal Security Team disclosed a critical remote code execution vulnerability (CVE-2026-108097) in Drupal core's Field UI module, affecting versions 10.6.x, 11.3.x, and 11.4.x. The flaw allows unauthenticated attackers to execute arbitrary code on vulnerable servers when exploited through contributed modules, with at least one known exploit path requiring no authentication. Patches were released on October 14, 2026, with affected versions updated to 11.4.10, 11.3.19, and 10.6.19. Over 151,000 Drupal sites (28.5% of reporting sites) were running vulnerable versions that received no security updates. This vulnerability represents a growing trend of critical web application flaws targeting content management systems, particularly as organizations increasingly rely on third-party modules and plugins. The incident highlights the persistent challenge of supply chain security in web applications, where core platform vulnerabilities can be weaponized through seemingly unrelated contributed components.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Escalates Four Critical Vulnerabilities to KEV Status Following Active Exploitation
CISA Escalates Four Critical Vulnerabilities to KEV Status Following Active Exploitation
Government Administration3 weeks ago

CISA Escalates Four Critical Vulnerabilities to KEV Status Following Active Exploitation

On October 14, 2026, CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. The vulnerabilities include CVE-2026-0322 affecting Palo Alto Networks PAN-OS (code injection), CVE-2026-76519 in Cisco Secure Email Gateway (path traversal), and CVE-2026-105133/105134 targeting Ahsay AhsayCBS backup solutions (authentication bypass and command injection). These vulnerabilities pose significant risks as they grant attackers substantial control over compromised systems, making them priority targets for threat actors. This KEV addition comes amid heightened focus on vulnerability management following BOD 26-04, which establishes risk-based prioritization requirements for federal agencies. The timing reflects ongoing concerns about sophisticated threat actors exploiting unpatched systems for initial access and lateral movement across enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
PEERSTITCH Malware Exposes Critical Gaps in Network Security Architecture
PEERSTITCH Malware Exposes Critical Gaps in Network Security Architecture
Telecommunications3 weeks ago

PEERSTITCH Malware Exposes Critical Gaps in Network Security Architecture

In September 2024, threat actors tracked as CL-STA-0954 exploited CVE-2024-47575 (FortiJump) to compromise a telecommunications organization's FortiManager appliance, leading to the exfiltration of configurations and cryptographic material for over 500 managed FortiGate firewalls. The attackers deployed PEERSTITCH, a sophisticated memory-resident ARM64 malware that operates without persistent files or network connections, using inter-process communication to establish covert channels within FortiOS daemons. The threat actors demonstrated advanced tradecraft by maintaining long-term access, intercepting network traffic, establishing unauthorized VPN sessions, and impersonating the management platform to target additional infrastructure. This incident highlights the growing threat of centralized management platform attacks, where compromising a single appliance can expose the security posture of hundreds of downstream devices and client networks, representing a critical supply chain risk for managed service providers.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AdFection Campaign: How Mercenary Spyware Exploited Digital Advertising to Target Media and Government
AdFection Campaign: How Mercenary Spyware Exploited Digital Advertising to Target Media and Government
Marketing/Advertising/Sales3 weeks ago

AdFection Campaign: How Mercenary Spyware Exploited Digital Advertising to Target Media and Government

In 2024, researchers at The Citizen Lab uncovered AdFection, the first documented zero-click mercenary spyware campaign delivered through targeted online advertising. The Israeli company Discover-Tech, operating as a legitimate advertising firm, facilitated infections by directing millions of devices to contact Candiru spyware servers through malicious ads displayed across 120,000 websites and 70,000 mobile apps. At least 45 devices at Al Jazeera were successfully compromised, with the spyware capable of remote device takeover, data theft, and surveillance through microphones and cameras. The campaign exposed critical vulnerabilities in the digital advertising ecosystem, prompting Google and IAB Europe to remove Discover-Tech from their vendor registries. This incident highlights the growing sophistication of surveillance-for-hire operations exploiting legitimate advertising infrastructure to conduct mass surveillance operations against media organizations, government agencies, and civil society targets worldwide.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery
Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery
Information Technology/IT3 weeks ago

Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery

In October 2026, Microsoft released a record-breaking Patch Tuesday update containing 1,413 vulnerabilities across its enterprise products and services, surpassing the previous annual record of 1,261 CVEs set in 2020. Among these vulnerabilities was one actively exploited zero-day, CVE-2026-96951, affecting Windows Shell that allows attackers to bypass security features. The massive volume of vulnerabilities was attributed to AI-accelerated discovery processes, though experts noted that exploitation rates have not increased proportionally. Microsoft introduced "risk cohorts" to help customers prioritize patching efforts amid the overwhelming number of monthly security updates. This incident highlights the growing challenge organizations face in vulnerability management as AI tools dramatically accelerate both vulnerability discovery and the security patching burden, fundamentally changing how enterprises must approach cybersecurity risk assessment and remediation prioritization.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack
CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack
Government Administration3 weeks ago

CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) being actively exploited as a zero-day since October 1st, 2026. The vulnerability allows remote attackers to execute arbitrary commands without authentication on targeted ICS systems. Threat actor UTA0576 has been chaining this flaw with two other vulnerabilities to achieve unauthenticated root-level code execution, targeting Active Directory credentials, LAPS passwords, and BitLocker recovery keys. This incident highlights the persistent targeting of VPN infrastructure by sophisticated threat actors, continuing a pattern of Ivanti Connect Secure exploitation that has plagued organizations for years. With over 5,600 Internet-exposed ICS hosts identified and federal agencies ordered to patch by Friday, this represents another critical supply chain risk affecting enterprise remote access security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack
Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack
Financial Services3 weeks ago

Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack

In October 2026, Cisco disclosed and patched CVE-2026-76519, an actively exploited zero-day vulnerability in its Secure Email Gateway (SEG) that allows remote unauthenticated attackers to execute commands with root privileges. The flaw stems from a relative path traversal weakness in SEG's Advanced Malware Protection feature, exploitable through maliciously crafted email attachments. Cisco became aware of active exploitation in October 2026 and has deployed mitigations on cloud instances while providing indicators of compromise to help customers detect potential breaches. This represents the fourth critical SEG vulnerability exploited in the wild since November 2021, highlighting the persistent targeting of email security infrastructure by threat actors seeking initial access and lateral movement capabilities within enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications
Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications
Financial Services3 weeks ago

Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications

In October 2026, Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interfaces with a CVSS score of 8.6. The zero-day flaw affects PA-Series and VM-Series firewalls, as well as Panorama appliances, allowing authenticated attackers with network access to execute code as root. Limited exploitation has been observed targeting the management interface from three identified IP addresses, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with a federal mitigation deadline of October 17, 2026. This incident highlights the growing trend of sophisticated attackers targeting network infrastructure devices to establish persistent access and pivot into internal networks. As organizations increasingly rely on cloud-native architectures and zero-trust frameworks, vulnerabilities in critical security appliances represent high-value targets for threat actors seeking to bypass perimeter defenses and compromise enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation
Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation
Financial Services3 weeks ago

Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation

In October 2026, Microsoft led a coalition including Health-ISAC, Japan Cybercrime Control Center, and private sector partners to disrupt three major phishing-as-a-service (PhaaS) kits: CoGUI, Haozi, and Iron Man System. These Chinese-language cybercriminal operations, tracked as Storm-3119 and Storm-2990, facilitated over one billion phishing emails and SMS messages targeting 75,000 organizations across 150+ countries since January 2026. The threat actors leveraged compromised Microsoft and Google cloud environments purchased through the YAM Store marketplace, generating tens of millions in revenue while targeting healthcare, financial, and government sectors globally. This disruption highlights the evolving sophistication of phishing-as-a-service ecosystems that abuse legitimate cloud infrastructure at scale. As organizations increasingly adopt cloud-first strategies, attackers are weaponizing trusted platforms to bypass traditional security controls, making this incident particularly relevant for understanding modern credential theft and initial access broker tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Cisco Email Gateway Vulnerability Under Active Attack: CVE-2026-76519 Analysis
Critical Cisco Email Gateway Vulnerability Under Active Attack: CVE-2026-76519 Analysis
Financial Services3 weeks ago

Critical Cisco Email Gateway Vulnerability Under Active Attack: CVE-2026-76519 Analysis

In October 2026, Cisco disclosed CVE-2026-76519, a critical vulnerability in Cisco Secure Email Gateway with a CVSS score of 9.8, actively exploited by threat actors. The flaw allows unauthenticated attackers to write files to the appliance's operating system by sending crafted email attachments through the gateway, potentially achieving root-level command execution. Cisco discovered the vulnerability through internal security scanning and became aware of active exploitation in October 2026, affecting gateways with File Reputation service enabled and Content Scanner Tools versions older than 25.3.0.5525. This incident highlights the continuing trend of attackers targeting email security infrastructure as critical attack vectors, particularly as organizations increasingly rely on cloud-based email filtering solutions. The vulnerability represents part of a broader pattern of sophisticated attacks against enterprise security appliances that serve as chokepoints for organizational communications.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports