Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 144 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1717–1728 / 3243 reports
Microsoft's April 2026 Patch Tuesday: Addressing Critical SharePoint Vulnerabilities
Information Technology/IT6 months ago

Microsoft's April 2026 Patch Tuesday: Addressing Critical SharePoint Vulnerabilities

In April 2026, Microsoft released a significant Patch Tuesday update addressing 167 vulnerabilities across its product suite, including an actively exploited zero-day in SharePoint Server (CVE-2026-32201). This spoofing vulnerability allowed unauthorized attackers to perform cross-site scripting (XSS) attacks, potentially leading to data exfiltration and unauthorized access. The update also included fixes for another zero-day in Microsoft Defender and several critical remote code execution flaws. ([notebookcheck.net](https://www.notebookcheck.net/Microsoft-April-2026-Patch-Tuesday-fixes-167-vulnerabilities-and-two-zero-days.1274388.0.html?utm_source=openai)) The scale and severity of this update underscore the increasing sophistication and frequency of cyber threats targeting widely used enterprise platforms. Organizations are urged to prioritize patching to mitigate risks associated with these vulnerabilities, especially given the active exploitation of the SharePoint flaw. ([crowdstrike.com](https://www.crowdstrike.com/en-us/blog/patch-tuesday-analysis-april-2026/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
April 2026 Patch Tuesday: Addressing Critical Vulnerabilities Across Major Platforms
Financial Services6 months ago

April 2026 Patch Tuesday: Addressing Critical Vulnerabilities Across Major Platforms

In April 2026, multiple critical vulnerabilities were disclosed across major software vendors, including Microsoft, Adobe, SAP, and Fortinet. Notably, Microsoft addressed 167 security flaws, among them an actively exploited zero-day in SharePoint Server (CVE-2026-32201) allowing spoofing attacks, and a publicly disclosed privilege escalation vulnerability in Microsoft Defender (CVE-2026-33825). SAP patched a severe SQL injection vulnerability (CVE-2026-27681) in its Business Planning and Consolidation and Business Warehouse products, which could lead to arbitrary database command execution. Adobe released fixes for critical vulnerabilities in Acrobat Reader, including an actively exploited remote code execution flaw (CVE-2026-34621). Fortinet addressed critical issues in FortiSandbox, such as an authentication bypass (CVE-2026-39813) and an OS command injection vulnerability (CVE-2026-39808). These vulnerabilities, if exploited, could lead to unauthorized access, data exfiltration, and system compromise, underscoring the importance of timely patching and vigilant security practices. The current threat landscape is characterized by immediate, real-world exploitation of these vulnerabilities, highlighting the urgency for organizations to apply these patches promptly to mitigate potential risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft's April 2026 Patch Tuesday: A Critical Security Update
Information Technology/IT6 months ago

Microsoft's April 2026 Patch Tuesday: A Critical Security Update

In April 2026, Microsoft released a substantial Patch Tuesday update addressing 165 vulnerabilities across its product suite, marking the second-largest patch release in the company's history. Notably, this update included a zero-day vulnerability in Microsoft Office SharePoint (CVE-2026-32201) that was actively exploited, allowing unauthenticated attackers to perform spoofing over a network. Additionally, a high-severity vulnerability in Microsoft Defender (CVE-2026-33825) was publicly disclosed prior to patching, potentially enabling unauthorized privilege escalation. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-april-2026/?utm_source=openai)) The scale and severity of this update underscore the increasing complexity and volume of security threats facing organizations. The active exploitation of SharePoint and the public disclosure of the Defender vulnerability highlight the critical need for timely patch management and proactive security measures to mitigate potential breaches and data compromises.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Windows 11 April 2026 Security Update: Critical Fixes and Enhancements
Government Administration6 months ago

Windows 11 April 2026 Security Update: Critical Fixes and Enhancements

In April 2026, Microsoft released cumulative updates KB5083769 and KB5082052 for Windows 11 versions 25H2/24H2 and 23H2, respectively. These mandatory updates addressed 165 security vulnerabilities, including one actively exploited zero-day in Microsoft SharePoint Server (CVE-2026-32201) and one publicly disclosed zero-day in Microsoft Defender (CVE-2026-33825). The updates also introduced enhancements such as the ability to toggle Smart App Control without a clean install, improved Narrator features, and refined Settings app design. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/microsoft/windows-11-cumulative-updates-kb5083769-and-kb5082052-released/amp/?utm_source=openai)) The release underscores the critical importance of timely patch management, as threat actors increasingly exploit known vulnerabilities shortly after disclosure. Organizations are urged to apply these updates promptly to mitigate potential risks associated with these vulnerabilities. ([crowdstrike.com](https://www.crowdstrike.com/content/crowdstrike-www/locale-sites/us/en-us/blog/patch-tuesday-analysis-april-2026.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Bolsters RDP Security to Thwart Phishing Threats
Financial Services6 months ago

Microsoft Bolsters RDP Security to Thwart Phishing Threats

In April 2026, Microsoft released security updates for Windows 10 and Windows 11 to enhance protections against phishing attacks exploiting Remote Desktop Protocol (RDP) files. These updates introduce new security warnings and disable risky shared resources by default when opening RDP files, aiming to prevent unauthorized access and data theft facilitated through malicious RDP configurations. ([learn.microsoft.com](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/understanding-security-warnings?utm_source=openai)) This initiative addresses the increasing abuse of RDP files in phishing campaigns, where attackers use them to gain control over victims' systems and access sensitive information. By implementing these protections, Microsoft aims to mitigate the risks associated with such attacks and enhance overall system security. ([learn.microsoft.com](https://learn.microsoft.com/en-us/windows-server/remote/remote-desktop-services/remotepc/understanding-security-warnings?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
UNSW's 'Capture the Narrative' Wargame Reveals AI's Power in Social Media Manipulation
Government Administration6 months ago

UNSW's 'Capture the Narrative' Wargame Reveals AI's Power in Social Media Manipulation

In 2025, the University of New South Wales (UNSW) conducted 'Capture the Narrative,' a pioneering wargame where students developed AI-driven bots to influence a simulated election on a fictional social media platform. Over four weeks, participants generated over 7 million posts, with more than 60% of content produced by these bots. The exercise demonstrated how AI can be leveraged to manipulate public opinion, resulting in a 1.78% swing that altered the election outcome. This experiment underscores the growing threat of AI-powered influence operations in real-world scenarios. ([unsw.edu.au](https://www.unsw.edu.au/newsroom/news/2026/01/social-media-wargame-reveals-how-ai-bots-can-swing-election?utm_source=openai)) The relevance of this incident is heightened by the increasing use of AI in disinformation campaigns. For instance, Microsoft reported that China has begun employing generative AI to create realistic images supporting divisive U.S. political content, marking a significant evolution in influence operations. ([axios.com](https://www.axios.com/2023/09/08/china-ai-disinformation-microsoft?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Volt Typhoon 2023: Unveiling the Chinese Cyber Threat to U.S. Infrastructure
Utilities6 months ago

Volt Typhoon 2023: Unveiling the Chinese Cyber Threat to U.S. Infrastructure

In May 2023, Microsoft and U.S. intelligence agencies identified a Chinese state-sponsored cyber group, Volt Typhoon, infiltrating critical infrastructure sectors in the United States, including communications, manufacturing, utilities, and transportation. Active since mid-2021, Volt Typhoon employed 'living-off-the-land' techniques, utilizing legitimate system tools to evade detection, and targeted systems in Guam, a strategic U.S. military hub. The group's activities aimed to gather intelligence and potentially disrupt critical communications between the U.S. and Asia during future crises. ([techspot.com](https://www.techspot.com/news/98826-microsoft-global-intelligence-agencies-warn-chinese-hackers-infecting.html?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors to national security. The use of stealthy techniques by Volt Typhoon highlights the need for enhanced detection and response capabilities within critical infrastructure sectors to mitigate potential disruptions and safeguard sensitive information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Adobe Acrobat Reader Zero-Day Exploit CVE-2026-34621: What You Need to Know
Financial Services6 months ago

Adobe Acrobat Reader Zero-Day Exploit CVE-2026-34621: What You Need to Know

In April 2026, Adobe addressed a critical zero-day vulnerability (CVE-2026-34621) in Acrobat Reader, which had been actively exploited since at least December 2025. This flaw allowed attackers to execute arbitrary code on both Windows and macOS systems when users opened maliciously crafted PDF files. The vulnerability stemmed from a prototype pollution issue, enabling unauthorized code execution within the context of the current user. ([techcrunch.com](https://techcrunch.com/2026/04/14/adobe-fixes-pdf-zero-day-security-bug-that-hackers-have-exploited-for-months/?utm_source=openai)) The exploitation of this vulnerability highlights the persistent targeting of widely used software by threat actors. Organizations are urged to prioritize timely patching and to educate users on the risks associated with opening files from untrusted sources to mitigate similar threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Highlights Active Exploitation of Vulnerabilities in Fortinet, Microsoft, and Adobe Products
Financial Services6 months ago

CISA Highlights Active Exploitation of Vulnerabilities in Fortinet, Microsoft, and Adobe Products

On April 13, 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added six vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing evidence of active exploitation. These vulnerabilities affect Fortinet FortiClient EMS, Adobe Acrobat Reader, Microsoft Windows Common Log File System Driver, Microsoft Exchange Server, Host Process for Windows Tasks, and Microsoft Visual Basic for Applications. Notably, CVE-2026-21643, an SQL injection vulnerability in Fortinet FortiClient EMS, has been actively exploited since March 24, 2026. Additionally, Microsoft reports that threat actor Storm-1175 has been leveraging CVE-2023-21529 in Exchange Server to deliver Medusa ransomware. ([thehackernews.com](https://thehackernews.com/2026/04/cisa-adds-6-known-exploited-flaws-in.html?utm_source=openai)) The inclusion of these vulnerabilities underscores the persistent threat posed by both newly discovered and older security flaws. Organizations are urged to prioritize patching these vulnerabilities to mitigate potential risks, as unpatched systems remain prime targets for cyber adversaries. ([bytevanguard.com](https://bytevanguard.com/2026/04/14/cisa-kev-update-from-a-2012-bug-to-2026-flaws/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
Government Administration6 months ago

CISA Adds Seven Known Exploited Vulnerabilities to Catalog

On April 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding seven new vulnerabilities, including issues in Microsoft Visual Basic for Applications, Adobe Acrobat, Microsoft Exchange Server, and Fortinet products. These vulnerabilities have been actively exploited by malicious actors, posing significant risks to federal enterprises. CISA's Binding Operational Directive (BOD) 22-01 mandates that Federal Civilian Executive Branch (FCEB) agencies remediate these vulnerabilities by specified deadlines to protect against active threats. Although BOD 22-01 applies specifically to FCEB agencies, CISA strongly urges all organizations to prioritize timely remediation of KEV Catalog vulnerabilities as part of their vulnerability management practices. This proactive approach is essential to reduce exposure to cyberattacks and safeguard organizational networks against known exploited vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
AI-Driven Cybercrime Surge in 2026: A New Era of Threats
Financial Services6 months ago

AI-Driven Cybercrime Surge in 2026: A New Era of Threats

In 2026, the cybersecurity landscape witnessed a significant transformation with the emergence of AI-driven cybercrime. Threat actors leveraged artificial intelligence to automate and scale their attacks, resulting in a 1,500% surge in AI-enabled cyber incidents. These sophisticated attacks encompassed credential theft, ransomware, and identity-based intrusions, causing substantial harm to individuals and organizations worldwide. The rapid adoption of AI by cybercriminals enabled them to exploit vulnerabilities at unprecedented speeds, often within hours of disclosure, and to conduct large-scale, coordinated attacks with minimal human intervention. ([oecd.ai](https://oecd.ai/en/incidents/2026-03-11-3607?utm_source=openai)) This escalation underscores the urgent need for organizations to reassess their cybersecurity strategies. Traditional defense mechanisms are increasingly inadequate against AI-enhanced threats. The convergence of AI, automation, and cybercrime necessitates a proactive approach, emphasizing real-time threat intelligence, advanced detection systems, and robust incident response capabilities to mitigate the evolving risks posed by AI-driven cyberattacks. ([techradar.com](https://www.techradar.com/pro/security/in-2026-cybercrime-has-reached-a-point-of-total-convergence-new-research-claims-ai-attacks-are-taking-over-so-how-can-your-business-stay-safe?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Claude Mythos: A New Era of AI-Driven Cybersecurity Threats
Computer Software/Engineering6 months ago

Claude Mythos: A New Era of AI-Driven Cybersecurity Threats

In early 2026, Anthropic's AI model, Claude Mythos, demonstrated unprecedented capabilities in autonomously identifying and exploiting software vulnerabilities across major operating systems and web browsers. This advancement significantly reduces the time between vulnerability disclosure and exploitation, posing a substantial challenge to traditional cybersecurity defenses. ([tomshardware.com](https://www.tomshardware.com/tech-industry/artificial-intelligence/anthropics-latest-ai-model-identifies-thousands-of-zero-day-vulnerabilities-in-every-major-operating-system-and-every-major-web-browser-claude-mythos-preview-sparks-race-to-fix-critical-bugs-some-unpatched-for-decades?utm_source=openai)) The emergence of AI-driven tools like Claude Mythos signifies a paradigm shift in cyber threats, enabling attackers to automate complex exploits and outpace defenders. Organizations must urgently adapt their security strategies to address these rapidly evolving AI-enhanced threats. ([axios.com](https://www.axios.com/2026/04/10/anthropic-mythos-openai-cyber-threats?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports