Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 152 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1813–1824 / 3243 reports
Google Chrome's Dawn WebGPU Zero-Day Vulnerability in 2026
Banking/Mortgage7 months ago

Google Chrome's Dawn WebGPU Zero-Day Vulnerability in 2026

In March 2026, Google identified and patched a critical zero-day vulnerability (CVE-2026-5281) in its Chrome browser, marking the fourth such exploit addressed that year. This flaw resided in Dawn, Chrome's implementation of the WebGPU standard, and was actively exploited in the wild. Attackers leveraged this use-after-free vulnerability to cause browser crashes, data corruption, and potentially execute arbitrary code by enticing users to visit maliciously crafted web content. Google promptly released emergency updates for Windows, macOS, and Linux platforms to mitigate the risk. The recurrence of multiple zero-day vulnerabilities within a short timeframe underscores the persistent targeting of widely-used browsers by threat actors. Organizations and individual users are urged to maintain vigilance by promptly applying security updates and adopting robust cybersecurity practices to mitigate the risks associated with such exploits.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Operation TrueChaos: Exploiting Trust in Software Updates
Government Administration7 months ago

Operation TrueChaos: Exploiting Trust in Software Updates

In early 2026, a sophisticated cyber espionage campaign, dubbed 'Operation TrueChaos,' exploited a zero-day vulnerability (CVE-2026-3502) in the TrueConf video conferencing software. This flaw allowed attackers to manipulate the software's update mechanism, distributing malicious updates to all connected clients without proper integrity checks. The campaign primarily targeted government entities in Southeast Asia, enabling the execution of arbitrary code across multiple agencies simultaneously. The attackers leveraged this vulnerability to deploy the Havoc command-and-control framework, facilitating reconnaissance, privilege escalation, and persistent access within the compromised networks. The operation is attributed with moderate confidence to a Chinese-nexus threat actor, based on observed tactics, techniques, and infrastructure choices. This incident underscores the critical need for organizations to implement robust validation mechanisms for software updates and to monitor internal systems for signs of compromise, even within trusted environments. The exploitation of trusted update mechanisms highlights a growing trend where attackers target internal trust relationships to achieve widespread access and control.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
NoVoice Malware: A Wake-Up Call for Android Security
Banking/Mortgage7 months ago

NoVoice Malware: A Wake-Up Call for Android Security

In early 2026, a sophisticated Android malware campaign named 'NoVoice' infiltrated over 50 applications on Google Play, amassing at least 2.3 million downloads. Disguised as legitimate utilities like cleaners, games, and image galleries, these apps functioned as advertised, concealing their malicious intent. Upon installation, the malware exploited known Android vulnerabilities to gain root access, enabling it to inject code into other applications and exfiltrate sensitive data, notably targeting WhatsApp sessions. The malware's persistence mechanisms allowed it to survive standard factory resets, posing a significant threat to user privacy and device integrity. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/novoice-android-malware-on-google-play-infected-23-million-devices/?utm_source=openai)) This incident underscores the evolving sophistication of mobile malware and the critical importance of maintaining up-to-date device security. It highlights the necessity for users to exercise caution when downloading apps, even from trusted sources like Google Play, and for developers to adhere to stringent security practices to prevent such infiltrations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Blackpoint Cyber's 2026 Report: Credential Abuse and RMM Tool Exploitation
Financial Services7 months ago

Blackpoint Cyber's 2026 Report: Credential Abuse and RMM Tool Exploitation

In 2026, Blackpoint Cyber's annual threat report highlighted a significant shift in cyberattack methodologies, with a notable increase in the exploitation of legitimate access methods over traditional vulnerability exploits. The report revealed that 32.8% of incidents involved SSL VPN abuse, where attackers utilized valid but compromised credentials to establish seemingly legitimate sessions, facilitating rapid lateral movement within networks. Additionally, 30.3% of incidents featured the misuse of Remote Monitoring and Management (RMM) tools, particularly ScreenConnect, which was present in over 70% of rogue RMM cases. This trend underscores the evolving tactics of threat actors who are leveraging trusted IT tools to gain and maintain unauthorized access, thereby evading conventional security measures. The current relevance of this incident lies in the growing prevalence of identity-driven attacks and the strategic use of legitimate tools for malicious purposes. Organizations must recognize that traditional security controls may be insufficient against such tactics, necessitating enhanced monitoring of credential usage and the implementation of stringent access controls. The rise in these sophisticated methods highlights the urgent need for adaptive security strategies to effectively counteract the evolving threat landscape.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Volt Typhoon 2024: A Case Study in Living Off the Land Cyber Attacks
Financial Services7 months ago

Volt Typhoon 2024: A Case Study in Living Off the Land Cyber Attacks

In 2024, the Chinese state-sponsored hacker group known as Volt Typhoon executed a sophisticated Living Off the Land (LOTL) attack targeting critical infrastructure in the United States. By exploiting legitimate system tools and processes, they infiltrated networks without deploying traditional malware, thereby evading standard detection mechanisms. This approach allowed them to conduct prolonged surveillance and data exfiltration, significantly compromising national security and operational integrity. ([nsa.gov](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/3669159/combatting-cyber-threat-actors-perpetrating-living-off-the-land-intrusions/?utm_source=openai)) The incident underscores a growing trend among nation-state actors to utilize LOTL techniques, which leverage trusted system utilities to carry out malicious activities. This method not only complicates detection but also challenges traditional cybersecurity defenses, necessitating a shift towards behavior-based monitoring and advanced threat detection strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Casbaneiro Phishing Campaign Targets Latin America and Europe
Banking/Mortgage7 months ago

Casbaneiro Phishing Campaign Targets Latin America and Europe

In March 2026, a sophisticated phishing campaign orchestrated by the Brazilian cybercrime group Augmented Marauder targeted Spanish-speaking users across Latin America and Europe. The attackers distributed emails with court summons-themed messages containing password-protected PDF attachments. These PDFs directed recipients to malicious links, initiating a multi-stage infection chain that deployed the Horabot malware, which subsequently delivered the Casbaneiro banking trojan. This campaign leveraged dynamic PDF generation and exploited both email and WhatsApp platforms to propagate the malware, resulting in significant financial and data losses for affected organizations. This incident underscores the evolving tactics of cybercriminals who are increasingly using multi-pronged attack vectors and dynamic content to bypass traditional security measures. The use of legitimate communication channels like WhatsApp for malware distribution highlights the need for organizations to implement comprehensive security strategies that address both email and messaging platforms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Chrome 2026 Dawn Use-After-Free Vulnerability
Banking/Mortgage7 months ago

Chrome 2026 Dawn Use-After-Free Vulnerability

In April 2026, Google identified and patched a high-severity zero-day vulnerability, CVE-2026-5281, in its Chrome browser. This use-after-free flaw in Dawn, Chrome's implementation of the WebGPU standard, allowed remote attackers to execute arbitrary code via crafted HTML pages. The vulnerability was actively exploited in the wild, prompting Google to release an emergency update to versions 146.0.7680.177/178 for Windows and macOS, and 146.0.7680.177 for Linux. ([thehackernews.com](https://thehackernews.com/2026/04/new-chrome-zero-day-cve-2026-5281-under.html?utm_source=openai)) This incident underscores the increasing frequency of zero-day vulnerabilities targeting widely used software. It highlights the critical need for organizations to maintain up-to-date systems and implement robust security measures to mitigate the risks associated with such exploits.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass
Financial Services7 months ago

Microsoft Warns of WhatsApp-Delivered VBS Malware Hijacking Windows via UAC Bypass

In late February 2026, Microsoft identified a sophisticated malware campaign leveraging WhatsApp messages to distribute malicious Visual Basic Script (VBS) files. Upon execution, these scripts initiate a multi-stage infection chain, utilizing renamed Windows utilities to download additional payloads from trusted cloud services like AWS, Tencent Cloud, and Backblaze B2. The malware employs User Account Control (UAC) bypass techniques to escalate privileges, establish persistence, and deploy tools such as AnyDesk for remote access, enabling attackers to exfiltrate data or deploy further malware. This campaign underscores the evolving tactics of threat actors who exploit legitimate tools and platforms to evade detection and maintain control over compromised systems. Organizations must remain vigilant against such social engineering attacks and implement robust security measures to mitigate these threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
CERT-UA Impersonation Campaign: UAC-0255's AGEWHEEZE Malware Attack
Government Administration7 months ago

CERT-UA Impersonation Campaign: UAC-0255's AGEWHEEZE Malware Attack

In late March 2026, the threat actor group UAC-0255 launched a phishing campaign impersonating the Computer Emergency Response Team of Ukraine (CERT-UA). The attackers sent emails on March 26 and 27, 2026, posing as CERT-UA to distribute a password-protected ZIP archive hosted on Files.fm, urging recipients to install the 'specialized software.' The ZIP file ('CERT_UA_protection_tool.zip') is designed to download malware packaged as security software from the agency. The targets of the campaign included state organizations, medical centers, security companies, educational institutions, financial institutions, and software development companies. Some of the emails were sent from the email address 'incidents@cert-ua[.]tech.'

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Critical XSS and GhostScript RCE Vulnerabilities in Enterprise Document Processing Platform
Financial Services7 months ago

Critical XSS and GhostScript RCE Vulnerabilities in Enterprise Document Processing Platform

In 2026, a critical security assessment of an enterprise document processing platform revealed two severe vulnerabilities: an unauthenticated cross-site scripting (XSS) flaw and a GhostScript parameter injection leading to remote code execution (RCE). The XSS vulnerability allowed attackers to execute malicious scripts, bypassing HttpOnly cookie protections by exploiting an internal service endpoint that reflected session cookies in its response. This enabled full administrative access. Additionally, the GhostScript flaw permitted arbitrary command execution on the server by injecting parameters that disabled security features, leading to potential system compromise. ([praetorian.com](https://www.praetorian.com/blog/httponly-cookie-bypass-xss-ghostscript-rce/?utm_source=openai)) This incident underscores the persistent risks associated with XSS and RCE vulnerabilities, especially in applications handling sensitive data. It highlights the necessity for comprehensive security measures, including proper input validation, strict access controls, and regular security assessments to identify and mitigate such critical flaws.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Surge in Cyberattacks Targets Latin American Governments in 2026
Government Administration7 months ago

Surge in Cyberattacks Targets Latin American Governments in 2026

In early 2026, Latin American governments faced a significant surge in cyberattacks targeting critical infrastructure and sensitive data. Notably, Colombia's health ministry reported over 23 million cyberattacks and probes in March, while Mexico's government agencies suffered breaches compromising millions of identities and tax records. Puerto Rico's Department of Transportation also experienced disruptions due to cyber incidents. These attacks were primarily driven by financially motivated cybercriminals, with a notable increase in nation-state espionage and politically motivated hacktivism. The region's rapid digitalization, coupled with legacy systems and a shortage of cybersecurity professionals, has exacerbated vulnerabilities, making government networks prime targets for cyber adversaries. ([darkreading.com](https://www.darkreading.com/cyber-risk/latin-american-confidence-cyber-defenses-skills?utm_source=openai)) This escalation underscores the urgent need for Latin American governments to bolster their cybersecurity defenses. The convergence of AI acceleration, geopolitical fragmentation, and cyber-enabled fraud is reshaping the global risk landscape, necessitating enhanced threat intelligence, public-private cooperation, and investment in cybersecurity infrastructure to mitigate the growing threats. ([weforum.org](https://www.weforum.org/stories/2026/01/geopolitics-ai-fraud-global-cyber-cybersecurity-2026/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Navigating the Surge of AI-Driven Cyberattacks in 2025
Financial Services7 months ago

Navigating the Surge of AI-Driven Cyberattacks in 2025

In 2025, the cybersecurity landscape witnessed a significant surge in AI-driven offensive operations. Threat actors leveraged generative AI to automate and enhance attack vectors, including sophisticated phishing campaigns, deepfake-based social engineering, and rapid malware development. Notably, the average breakout time for cyberattacks decreased to just 29 minutes, a 65% acceleration from the previous year, underscoring the efficiency gains achieved through AI integration. ([itpro.com](https://www.itpro.com/security/crowdstrike-says-ai-is-officially-supercharging-cyber-attacks-average-breakout-times-hit-just-29-minutes-in-2025-65-percent-faster-than-in-2024-and-some-attacks-take-just-seconds?utm_source=openai)) This escalation in AI-powered threats has compelled organizations to reevaluate their defensive strategies. Traditional security measures are increasingly inadequate against the speed and complexity of AI-enhanced attacks. Consequently, there is a pressing need for adaptive, AI-driven defense mechanisms capable of real-time threat detection and response to mitigate the evolving risks posed by adversaries employing artificial intelligence. ([venturebeat.com](https://venturebeat.com/ai/outsmarting-ai-powered-cyber-attacks-endpoint-defense-2025?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports