Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 154 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1837–1848 / 3243 reports
Critical Vulnerability in Citrix NetScaler: CVE-2026-3055 Memory Overread
Financial Services7 months ago

Critical Vulnerability in Citrix NetScaler: CVE-2026-3055 Memory Overread

In March 2026, Citrix disclosed a critical vulnerability (CVE-2026-3055) in its NetScaler ADC and NetScaler Gateway products. This out-of-bounds read flaw allows unauthenticated remote attackers to access sensitive information from the appliance's memory when configured as a SAML Identity Provider (IdP). Affected versions include NetScaler ADC and Gateway 14.1 before 14.1-66.59, and 13.1 before 13.1-62.23. Citrix has released patches to address this issue, and organizations are urged to update their systems promptly to mitigate potential risks. ([censys.com](https://censys.com/advisory/cve-2026-3055/?utm_source=openai)) The disclosure of CVE-2026-3055 underscores the ongoing threat posed by vulnerabilities in widely used network appliances. Similar past vulnerabilities, such as CVE-2023-4966 ("CitrixBleed"), have been rapidly exploited in the wild, highlighting the importance of timely patching and vigilant system configuration reviews to prevent unauthorized access and data breaches. ([cycognito.com](https://www.cycognito.com/blog/citrix-netscaler-adc-and-gateway-vulnerabilities-cve-2026-3055-cve-2026-4368/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Bypassing Application Control: A New Data Exfiltration Technique Unveiled
Financial Services7 months ago

Bypassing Application Control: A New Data Exfiltration Technique Unveiled

In March 2026, a security assessment revealed that data exfiltration could bypass application control mechanisms in next-generation firewalls. The assessment demonstrated that by transmitting data in small chunks (approximately 3KB each), an attacker could evade detection thresholds, allowing unauthorized data transfer without triggering security alerts. This method exploits the time and data volume required by firewalls to accurately classify and block malicious traffic. This incident underscores the evolving tactics of cyber adversaries who continuously adapt to circumvent security measures. Organizations must recognize that traditional firewall configurations may be insufficient against such sophisticated exfiltration techniques, necessitating enhanced monitoring and adaptive security strategies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Understanding CVE-2025-33073: NTLM Reflection Vulnerability in Windows SMB Client
Financial Services7 months ago

Understanding CVE-2025-33073: NTLM Reflection Vulnerability in Windows SMB Client

In June 2025, Microsoft disclosed CVE-2025-33073, a critical vulnerability in the Windows SMB client that allows attackers to perform NTLM reflection attacks, leading to privilege escalation to SYSTEM level on affected systems. This flaw enables authenticated attackers to coerce a Windows host into authenticating to a malicious SMB server, which then reflects the authentication back to the victim, granting elevated privileges. The vulnerability affects Windows systems where SMB signing is not enforced, including various versions of Windows 10, 11, and Windows Server. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2025/10/21/cisa-warns-of-windows-smb-flaw-under-active-exploitation-cve-2025-33073/?utm_source=openai)) The exploitation of CVE-2025-33073 underscores the persistent risks associated with NTLM relay attacks and the importance of enforcing SMB signing across all systems. Organizations are urged to apply the security updates released by Microsoft in June 2025 and to review their network configurations to mitigate potential exploitation paths. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2025/10/21/cisa-warns-of-windows-smb-flaw-under-active-exploitation-cve-2025-33073/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Vulnerability in strongSwan: Integer Underflow Leads to Denial of Service
Computer/Network Security7 months ago

Critical Vulnerability in strongSwan: Integer Underflow Leads to Denial of Service

In March 2026, a critical integer underflow vulnerability (CVE-2026-25075) was identified in strongSwan versions 4.5.0 through 6.0.4, specifically within the EAP-TTLS AVP parser. This flaw allows unauthenticated remote attackers to crash the charon IKE daemon by sending crafted AVP data with invalid length fields during IKEv2 authentication, leading to a denial of service. The vulnerability arises from improper validation of AVP length fields, resulting in excessive memory allocation or NULL pointer dereference. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-25075?utm_source=openai)) The discovery of this vulnerability underscores the importance of rigorous input validation in security protocols. Organizations utilizing affected versions of strongSwan are urged to upgrade to version 6.0.5 or later to mitigate potential service disruptions. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-25075?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
DeepLoad 2026: Unveiling the AI-Powered Credential Stealer
Financial Services7 months ago

DeepLoad 2026: Unveiling the AI-Powered Credential Stealer

In March 2026, a sophisticated malware campaign named 'DeepLoad' was identified, targeting enterprise IT environments to steal user credentials. Delivered through deceptive 'QuickFix' social engineering tactics, such as fake browser prompts, DeepLoad employs AI-generated code to evade detection at multiple stages. The malware obfuscates its payload with extensive junk code, executes behind overlooked Windows processes, and spreads via connected USB drives, ensuring persistence and complicating remediation efforts. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/ai-powered-deepload-steals-credentials-evades-detection/?utm_source=openai)) This incident underscores a growing trend where cybercriminals leverage artificial intelligence to enhance malware capabilities, making traditional static detection methods less effective. Organizations must adapt by implementing behavioral and runtime detection strategies to counteract these evolving threats. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/ai-powered-deepload-steals-credentials-evades-detection/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
European Commission's 2026 Data Breach: A Wake-Up Call for Cloud Security
Government Administration7 months ago

European Commission's 2026 Data Breach: A Wake-Up Call for Cloud Security

In March 2026, the European Commission confirmed a significant data breach following a cyberattack on its Europa.eu web platform, attributed to the ShinyHunters extortion gang. The attackers reportedly accessed at least one of the Commission's Amazon Web Services (AWS) accounts, exfiltrating over 350 GB of data, including multiple databases and confidential documents. While the attack did not disrupt the functionality of Europa websites, the Commission is actively investigating the full impact and has notified affected Union entities. This incident underscores the escalating threat posed by cyber extortion groups like ShinyHunters, who have been increasingly targeting high-profile organizations through sophisticated attacks on cloud infrastructures. The breach highlights the critical need for robust cloud security measures and proactive threat detection to safeguard sensitive governmental data against such evolving cyber threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Fortinet FortiClientEMS Vulnerability Exploited in the Wild
Computer/Network Security7 months ago

Critical Fortinet FortiClientEMS Vulnerability Exploited in the Wild

In February 2026, a critical SQL injection vulnerability, CVE-2026-21643, was identified in Fortinet's FortiClientEMS version 7.4.4. This flaw allows unauthenticated attackers to execute arbitrary code via specially crafted HTTP requests, potentially leading to full system compromise. Fortinet released a patch in version 7.4.5 to address this issue. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-21643/?utm_source=openai)) As of March 2026, reports indicate active exploitation of this vulnerability in the wild, underscoring the urgency for organizations to apply the available patch promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical F5 BIG-IP RCE Vulnerability Discovered in 2026
Financial Services7 months ago

Critical F5 BIG-IP RCE Vulnerability Discovered in 2026

In March 2026, F5 Networks reclassified a previously identified denial-of-service (DoS) vulnerability in its BIG-IP Access Policy Manager (APM) as a critical remote code execution (RCE) flaw, designated CVE-2025-53521. This vulnerability allows unauthenticated attackers to execute arbitrary code on systems with specific configurations, leading to potential deployment of webshells and unauthorized access. The flaw affects BIG-IP APM systems with access policies configured on virtual servers. The reclassification underscores the evolving nature of cybersecurity threats, where initial assessments may underestimate the severity of vulnerabilities. Organizations relying on BIG-IP APM for access management are urged to apply the latest patches promptly to mitigate the risk of exploitation.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Citrix NetScaler CVE-2026-3055: Critical Vulnerability Exploited in the Wild
Financial Services7 months ago

Citrix NetScaler CVE-2026-3055: Critical Vulnerability Exploited in the Wild

In March 2026, a critical vulnerability identified as CVE-2026-3055 was discovered in Citrix NetScaler ADC and NetScaler Gateway appliances configured as SAML Identity Providers (IDP). This out-of-bounds read flaw allows unauthenticated attackers to extract sensitive information, including administrative session IDs, from the appliance's memory. Exploitation of this vulnerability can lead to unauthorized access and potential full takeover of affected systems. Citrix released security updates on March 23, 2026, addressing this issue, urging administrators to apply patches immediately to mitigate the risk. The exploitation of CVE-2026-3055 underscores a recurring pattern of critical vulnerabilities in Citrix NetScaler products, reminiscent of previous incidents like 'CitrixBleed' and 'CitrixBleed2' from 2023 and 2025, respectively. This trend highlights the importance of proactive vulnerability management and timely patching to safeguard against emerging threats targeting widely-used enterprise solutions. ([csoonline.com](https://www.csoonline.com/article/4150224/new-critical-citrix-netscaler-hole-of-similar-severity-to-citrixbleed2-says-expert.html?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding RoadK1ll: A New Threat to Network Security
Financial Services7 months ago

Understanding RoadK1ll: A New Threat to Network Security

In March 2026, cybersecurity researchers identified a new malicious implant named RoadK1ll, designed to facilitate lateral movement within compromised networks. This Node.js-based malware establishes outbound WebSocket connections to attacker-controlled infrastructure, enabling threat actors to pivot from an initially breached host to other internal systems. By leveraging this technique, attackers can bypass traditional perimeter defenses and maintain persistent access to sensitive network segments. The discovery of RoadK1ll underscores the evolving sophistication of cyber threats, particularly in the realm of covert communication channels. Organizations are urged to enhance their network monitoring capabilities and implement robust segmentation strategies to detect and mitigate such advanced intrusion methods.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
GitGuardian's 2026 Report Highlights Alarming Surge in AI Service Leaks and Hardcoded Secrets
Computer Software/Engineering7 months ago

GitGuardian's 2026 Report Highlights Alarming Surge in AI Service Leaks and Hardcoded Secrets

In 2025, GitGuardian's 'State of Secrets Sprawl' report identified a 34% year-over-year increase in hardcoded secrets exposed on public GitHub repositories, totaling approximately 29 million. This surge is largely attributed to the rapid adoption of AI-assisted coding tools, which have accelerated software development but also increased the frequency of security vulnerabilities. Notably, AI service credentials leaks rose by 81%, with tools like Claude Code exhibiting a 3.2% secret leak rate, double the GitHub-wide baseline. Additionally, internal repositories were found to be six times more likely to contain hardcoded secrets compared to public ones, and 28% of leaks originated from collaboration and productivity tools. The report underscores the urgent need for robust secrets management and governance to mitigate these escalating risks. ([blog.gitguardian.com](https://blog.gitguardian.com/the-state-of-secrets-sprawl-2026/?utm_source=openai)) The current relevance of this incident lies in the expanding attack surface introduced by AI technologies and the persistent challenge of secrets sprawl. As organizations increasingly integrate AI into their development processes, the potential for inadvertent exposure of sensitive information grows, necessitating immediate attention to secrets management practices to prevent security breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Russian CTRL Toolkit Exploits LNK Files and RDP via FRP Tunnels
Financial Services7 months ago

Russian CTRL Toolkit Exploits LNK Files and RDP via FRP Tunnels

In March 2026, cybersecurity researchers identified a sophisticated malware campaign involving a Russian-origin remote access toolkit named 'CTRL.' This toolkit is distributed through malicious Windows shortcut (LNK) files disguised as private key folders. Once executed, the LNK files deploy the CTRL toolkit, which is custom-built using .NET and includes various executables designed to facilitate credential phishing, keylogging, Remote Desktop Protocol (RDP) hijacking, and reverse tunneling. The attackers leverage Fast Reverse Proxy (FRP) tunnels to hijack RDP sessions, enabling unauthorized remote access to compromised systems. This method allows threat actors to bypass traditional security measures and maintain persistent access within targeted networks. The campaign underscores the evolving tactics of Russian state-sponsored cyber actors in exploiting legitimate Windows features and protocols to achieve their objectives. Organizations are advised to implement robust security measures, including user education on phishing tactics, monitoring for unusual RDP activity, and deploying advanced threat detection systems to mitigate such sophisticated attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports