Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 143 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1705–1716 / 3243 reports
Unpatched 'RedSun' Zero-Day in Microsoft Defender Poses Immediate Threat
Information Technology/IT6 months ago

Unpatched 'RedSun' Zero-Day in Microsoft Defender Poses Immediate Threat

In April 2026, security researcher Chaotic Eclipse publicly disclosed a zero-day vulnerability in Microsoft Defender, named 'RedSun.' This flaw allows local attackers to escalate privileges to SYSTEM level by exploiting a logic error in Defender's handling of specific file metadata. The vulnerability affects Windows 10, Windows 11, and Windows Server systems with Defender enabled. The researcher released a proof-of-concept (PoC) exploit on GitHub, demonstrating the ease of exploitation. Microsoft has not yet issued a patch for this vulnerability, leaving systems at risk. The public disclosure of 'RedSun' underscores the critical need for timely vulnerability management and the potential consequences of strained relationships between researchers and vendors. Organizations should monitor for updates and consider implementing additional security measures to mitigate the risk posed by this unpatched flaw.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
PowMix Botnet: A New Threat to Czech Organizations in 2025
Government Administration6 months ago

PowMix Botnet: A New Threat to Czech Organizations in 2025

In December 2025, Cisco Talos identified a new botnet named PowMix targeting the workforce in the Czech Republic. The attackers distributed malicious documents impersonating legitimate brands and regulatory frameworks to lure victims, particularly those in human resources, legal, and recruitment sectors. PowMix employs randomized command-and-control (C2) beaconing intervals and embeds encrypted heartbeat data into C2 URL paths that mimic legitimate REST API URLs, making detection challenging. Additionally, it can dynamically update its C2 domain within the botnet configuration file. Notably, PowMix shares tactical similarities with the earlier ZipLine campaign, including payload delivery mechanisms and misuse of cloud platforms like Heroku for C2 operations. ([blog.talosintelligence.com](https://blog.talosintelligence.com/powmix-botnet-targets-czech-workforce/?utm_source=openai)) This incident underscores the evolving sophistication of botnets, highlighting the need for organizations to enhance their cybersecurity measures. The use of randomized C2 intervals and legitimate-looking URLs indicates a trend towards more evasive malware, emphasizing the importance of advanced detection techniques and continuous monitoring to mitigate such threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
LummaC2 Infostealer's Impact on Latin America in 2025
Health Care / Life Sciences6 months ago

LummaC2 Infostealer's Impact on Latin America in 2025

In 2025, LummaC2, also known as Lumma Stealer, emerged as a significant cybersecurity threat in Latin America and the Caribbean. This malware-as-a-service (MaaS) infostealer targeted various industries by exfiltrating sensitive data from browsers and cryptocurrency wallets. Its distribution methods included phishing, malvertising, and abuse of trusted platforms, making it accessible to threat actors with minimal technical skills. The widespread use of LummaC2 led to substantial data breaches and financial losses across the region. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2025/05/21/lumma-stealer-breaking-down-the-delivery-techniques-and-capabilities-of-a-prolific-infostealer/?utm_source=openai)) The prominence of LummaC2 underscores the evolving cyber threat landscape in Latin America, highlighting the need for enhanced cybersecurity measures. The region's rapid digitalization, coupled with persistent gaps in resources and workforce development, continues to expose it to sophisticated cyber threats. ([publications.iadb.org](https://publications.iadb.org/en/2025-cybersecurity-report-vulnerability-and-maturity-challenges-bridging-gaps-latin-america-and?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
UAC-0247's AGINGFLY Malware Targets Ukrainian Healthcare and Government Sectors
Health Care / Life Sciences6 months ago

UAC-0247's AGINGFLY Malware Targets Ukrainian Healthcare and Government Sectors

Between March and April 2026, the Ukrainian Computer Emergency Response Team (CERT-UA) identified a surge in cyberattacks targeting healthcare institutions, emergency services, and local government bodies. The threat actor, designated as UAC-0247, employed phishing emails disguised as humanitarian aid offers to deliver malicious LNK files. These files exploited Windows utilities to execute remote code, leading to the deployment of multi-stage loaders and custom malware, notably the AGINGFLY backdoor. AGINGFLY facilitated persistent remote control, enabling attackers to steal credentials from Chromium-based browsers and WhatsApp, and to deploy additional tools like SILENTLOOP and RAVENSHELL for further exploitation. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-agingfly-malware-used-in-attacks-on-ukraine-govt-hospitals/?utm_source=openai)) This campaign underscores a concerning evolution in cyber threats, with attackers leveraging sophisticated social engineering tactics and dynamic malware to infiltrate critical infrastructure. The focus on healthcare and government sectors highlights the urgent need for enhanced cybersecurity measures to protect sensitive data and maintain operational integrity in essential services.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(low)
Read report
Critical SSO Vulnerability in Cisco Webex Services Exposes User Impersonation Risk
Information Technology/IT6 months ago

Critical SSO Vulnerability in Cisco Webex Services Exposes User Impersonation Risk

In April 2026, Cisco disclosed a critical vulnerability (CVE-2026-20184) in its Webex Services, specifically affecting the integration of single sign-on (SSO) with Control Hub. This flaw, due to improper certificate validation, allowed unauthenticated remote attackers to impersonate any user within the service by supplying a crafted token. Exploiting this vulnerability could grant unauthorized access to legitimate Cisco Webex services, posing significant security risks. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL?utm_source=openai)) Cisco has addressed this vulnerability in the Webex service. However, organizations using SSO integration must upload a new identity provider (IdP) SAML certificate to Control Hub to prevent service interruption. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-webex-cui-cert-8jSZYhWL?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Dahua DVRs Compromised: A 2026 Cybersecurity Wake-Up Call
Security/Investigations6 months ago

Dahua DVRs Compromised: A 2026 Cybersecurity Wake-Up Call

In April 2026, a significant cybersecurity incident was identified involving Dahua Digital Video Recorders (DVRs). Attackers exploited default credentials and unpatched vulnerabilities to gain unauthorized access to these devices. Once compromised, the DVRs were co-opted into botnets, facilitating further malicious activities such as distributed denial-of-service (DDoS) attacks and unauthorized surveillance. This breach underscores the critical need for device owners to change default passwords and regularly update firmware to mitigate such risks. This incident highlights a broader trend of cybercriminals targeting Internet of Things (IoT) devices with default settings and outdated software. As IoT adoption continues to rise, ensuring robust security practices for these devices becomes increasingly vital to prevent their exploitation in large-scale cyberattacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Unveiling the Hidden Threat: Shadow Admins in Active Directory
Financial Services6 months ago

Unveiling the Hidden Threat: Shadow Admins in Active Directory

In April 2026, security researchers highlighted the escalating threat of 'shadow admins' within Active Directory (AD) environments. These are user accounts that, while not members of traditional administrative groups, possess elevated privileges due to misconfigurations or oversight. Such accounts can be exploited by attackers to gain unauthorized access, leading to potential domain-wide compromises. The increasing complexity of IT infrastructures, including cloud integrations and virtualization, has amplified the prevalence and risk associated with shadow admins. The significance of this issue is underscored by the growing trend of attackers leveraging indirect privilege paths to infiltrate systems. Organizations are urged to conduct thorough audits of their AD configurations, implement the principle of least privilege, and employ continuous monitoring to detect and remediate shadow admin accounts promptly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Windows Task Host Vulnerability (CVE-2025-60710) Exploited in the Wild
Government Administration6 months ago

Critical Windows Task Host Vulnerability (CVE-2025-60710) Exploited in the Wild

In November 2025, Microsoft disclosed CVE-2025-60710, a privilege escalation vulnerability in the Windows Task Host component affecting Windows 11 and Windows Server 2025. This flaw allows local attackers with basic user permissions to gain SYSTEM privileges through low-complexity attacks, potentially leading to full control over compromised devices. The vulnerability arises from improper link resolution before file access, commonly referred to as 'link following'. On April 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-60710 to its Known Exploited Vulnerabilities catalog, indicating active exploitation in the wild. This inclusion underscores the critical need for organizations to apply the available patches promptly to mitigate potential security risks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Dragon Boss Solutions' 2026 Adware Supply Chain Attack: A Wake-Up Call for Cybersecurity
Higher Education/Acadamia6 months ago

Dragon Boss Solutions' 2026 Adware Supply Chain Attack: A Wake-Up Call for Cybersecurity

In March 2026, security researchers uncovered a sophisticated adware campaign orchestrated by Dragon Boss Solutions LLC, a company claiming to engage in 'search monetization research.' The campaign involved digitally signed software that, under the guise of legitimate applications, deployed payloads with SYSTEM privileges to disable antivirus protections across thousands of endpoints. This operation leveraged an unregistered update domain, allowing potential attackers to hijack the update mechanism and push malicious payloads to over 25,000 infected systems worldwide, including those within critical infrastructure sectors such as education, utilities, government, and healthcare. This incident underscores the evolving nature of adware threats, which are increasingly adopting advanced techniques to escalate privileges and disable security measures. The exploitation of unregistered domains in software update mechanisms highlights a significant supply chain vulnerability, emphasizing the need for organizations to scrutinize third-party software components and ensure the integrity of their update processes to prevent similar attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
AgingFly Malware: A New Threat to Critical Infrastructure
Government Administration6 months ago

AgingFly Malware: A New Threat to Critical Infrastructure

In March 2026, a sophisticated cyberattack targeted Ukrainian local governments and hospitals, deploying a new malware family named 'AgingFly.' The attack began with phishing emails offering humanitarian aid, leading recipients to compromised or fake websites. These sites delivered malicious files that, once executed, initiated a multi-stage infection process. The final payload, AgingFly, enabled attackers to steal authentication data from Chromium-based browsers and the WhatsApp messenger, and provided remote control capabilities over infected systems. CERT-UA attributed these attacks to the threat actor group UAC-0247. This incident underscores the evolving tactics of cyber adversaries, including the use of AI-generated content and advanced multi-stage malware delivery mechanisms. Organizations, especially those in critical sectors, must remain vigilant against such sophisticated social engineering attacks and enhance their cybersecurity defenses accordingly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft's April 2026 Patch Tuesday: Addressing Critical Vulnerabilities and Zero-Day Exploits
Information Technology/IT6 months ago

Microsoft's April 2026 Patch Tuesday: Addressing Critical Vulnerabilities and Zero-Day Exploits

In April 2026, Microsoft released a substantial Patch Tuesday update addressing 167 vulnerabilities across its product suite, marking it as the second-largest patch release in the company's history. This update included two zero-day vulnerabilities: CVE-2026-32201, a spoofing flaw in Microsoft SharePoint Server that was actively exploited in the wild, and CVE-2026-33825, an elevation of privilege issue in Microsoft Defender that had been publicly disclosed prior to patching. Additionally, eight critical vulnerabilities were addressed, affecting components such as Windows Internet Key Exchange (IKE) Service Extensions and Microsoft Word. The prevalence of elevation of privilege vulnerabilities, accounting for 57% of the patches, underscores the critical need for organizations to prioritize these updates to mitigate potential security risks. ([notebookcheck.net](https://www.notebookcheck.net/Microsoft-April-2026-Patch-Tuesday-fixes-167-vulnerabilities-and-two-zero-days.1274388.0.html?utm_source=openai)) The urgency of this update is heightened by the active exploitation of CVE-2026-32201 and the public disclosure of CVE-2026-33825, which could lead to increased targeting by threat actors. Organizations are advised to promptly apply these patches to protect their systems from potential attacks leveraging these vulnerabilities. ([notebookcheck.net](https://www.notebookcheck.net/Microsoft-April-2026-Patch-Tuesday-fixes-167-vulnerabilities-and-two-zero-days.1274388.0.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Strengthening Defenses Against the Rise of EDR Killers Utilizing BYOVD Techniques
Financial Services6 months ago

Strengthening Defenses Against the Rise of EDR Killers Utilizing BYOVD Techniques

In early 2026, security researchers observed a significant increase in the use of EDR (Endpoint Detection and Response) killers employing the Bring Your Own Vulnerable Driver (BYOVD) technique. This method involves attackers introducing legitimate, signed drivers with known vulnerabilities into target systems to disable security defenses. ESET's analysis identified nearly 90 unique EDR killer tools exploiting 35 vulnerable drivers, enabling ransomware groups to neutralize security measures before deploying their payloads. The proliferation of these tools, available through underground marketplaces and public proof-of-concept exploits, has heightened concerns among cybersecurity professionals. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/edr-killer-ecosystem-expansion-requires-stronger-byovd-defenses/?utm_source=openai)) The current relevance of this incident lies in the evolving threat landscape, where the commodification of EDR killers has made sophisticated attack techniques accessible to a broader range of cybercriminals. This trend underscores the urgent need for organizations to implement robust defenses against BYOVD attacks, including monitoring for unauthorized driver installations and enhancing endpoint security measures. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/edr-killer-ecosystem-expansion-requires-stronger-byovd-defenses/?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports