Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Kimwolf Botnet: How Residential Proxy Infections Fueled a 2025 IoT Crisis
In late 2025, the Kimwolf botnet rapidly infected over 2 million IoT devices—primarily unofficial Android TV streaming boxes—by exploiting insecure residential proxy networks, notably those operated by IPIDEA. Kimwolf used these proxies to scan and compromise additional devices on local networks, enabling attackers to conscript them for distributed denial-of-service (DDoS) attacks and other forms of malicious activity, such as ad fraud and data scraping. Investigations by Infoblox and other security firms found Kimwolf infections active across diverse industry sectors worldwide, including healthcare, finance, utilities, and notably, dozens of sensitive government networks. The Kimwolf incident highlights persistent weaknesses in IoT device security, the risks of unmanaged devices on enterprise networks, and the danger posed by residential proxy services abused for malicious purposes. As threat actors increasingly exploit lateral movement via proxy endpoints, organizations in all industries must strengthen segmentation, east-west traffic monitoring, and endpoint visibility to mitigate future outbreaks.
8 months ago
Kill Chain
Johnson Controls iSTAR ICU Tool Faces Critical Stack Buffer Overflow Vulnerability
In January 2026, Johnson Controls Inc. disclosed a significant vulnerability (CVE-2025-26386) affecting its iSTAR Configuration Utility (ICU) tool, versions up to 6.9.7. The issue, a stack-based buffer overflow, could be exploited by a remote attacker, potentially causing a failure in the operating system hosting the ICU tool. Although there have been no reported cases of active exploitation as of the disclosure, the vulnerability poses a risk to critical infrastructure sectors—including commercial facilities, energy, and government services—where the affected product is widely deployed. Security researchers at Tenable responsibly reported the flaw to CISA, who published the advisory. This incident rolls out against the backdrop of increasing attention to the cybersecurity of operational technology (OT) in industrial and critical infrastructure, with regulators and operators emphasizing timely patching and network segmentation practices to prevent lateral movement and operational disruption.
8 months ago
Kill Chain
Fortinet Firewalls Compromised: 2024 Malicious Configuration Attack Exposes Networks
In early 2024, threat actors exploited unpatched and even fully patched Fortinet FortiGate firewalls, deploying malicious automation to illicitly access and exfiltrate firewall configuration files. Attackers leveraged vulnerabilities or misconfigurations to automate the compromise of a significant number of devices globally, granting them access to sensitive internal network details, VPN credentials, and administrative information. The targeted manipulation of device configurations allowed for persistent access and posed a risk of lateral movement deeper into enterprise environments. Impacted organizations faced potential exposure of encrypted traffic configurations and gateway policies, undermining both security posture and compliance. This incident is especially relevant as network infrastructure compromises grow more frequent and sophisticated, with attackers rapidly shifting tactics to automate attacks and bypass traditional perimeter defenses. The breach highlights the ongoing challenges organizations face in protecting network infrastructure against highly motivated and well-resourced threat actors.
8 months ago
Kill Chain
AI Agents Breach Simulated Enterprise via Open-Source Tools: Claude Sonnet 4.5 Equifax-Style Attack
In January 2026, researchers demonstrated that the latest Anthropic Claude Sonnet 4.5 AI model could autonomously breach simulated enterprise networks using only standard, open-source tools without custom malware or frameworks. During testing, the AI model rapidly identified and exploited an unpatched, publicized vulnerability to exfiltrate sensitive (simulated) personal data, mimicking tactics similar to the original Equifax breach. This exercise revealed how advanced AI agents now lower the technical barriers for rapid, multistage cyberattacks, enabling them to recognize and exploit vulnerabilities far faster than manual attackers. This incident underscores the accelerating risk posed by AI-powered offensive cyber capabilities. The proliferation of autonomous cyber agents marks a turning point, driving urgent regulatory, corporate, and operational focus on timely patch management, zero trust architectures, and advanced detection to stay ahead of next-generation threats.
8 months ago
Kill Chain
Jordan Government’s Use of Cellebrite Forensics Tools Targets Activists in 2024
Between late 2023 and mid-2024, Jordanian authorities used Cellebrite’s digital forensic technology to access and extract data from the mobile phones of local activists and human rights defenders. According to an investigation by Citizen Lab and OCCRP, authorities seized activists’ devices—three iPhones and one Android—and subjected them to Cellebrite’s phone-cracking tools, often in connection with political protests. Court records and forensic analysis confirmed the use of Cellebrite products to nonconsensually access information, shaking victims’ trust and prompting self-censorship. This incident underscores the growing risks of commercial digital forensics tools being repurposed for surveillance beyond criminal cases. Amnesty International and other watchdogs report a broader trend of such technologies being leveraged against civil society, signaling a need for stronger governance, vendor accountability, and compliance oversight globally.
8 months ago
Kill Chain
Fortinet 2026 Breach: Authentication Bypass Leads to Firewall Configuration Theft
In January 2026, Fortinet FortiGate devices became the target of a coordinated cyberattack exploiting an authentication bypass vulnerability (CVE-2025-59718) associated with the FortiCloud SSO feature. Attackers accessed vulnerable firewalls, created rogue administrative accounts, and swiftly exfiltrated firewall configuration data using automated tools, demonstrating significant threat actor sophistication. Reports indicated the campaign began on January 15, 2026, and quickly escalated as even patched devices were compromised—suggesting a patch bypass or incomplete remediation. Affected organizations faced exposure of sensitive security configurations and heightened risk of follow-on breaches or lateral movement within their networks. This incident spotlights the urgent challenges posed by cloud-exposed assets and incomplete vulnerability remediation. It emphasizes the criticality of rapid patch cycles, zero trust principles, and robust monitoring amid a trend of identity and configuration–focused attacks targeting enterprise infrastructure platforms.
8 months ago
Kill Chain
Zendesk Ticket Systems Hijacked: 2026 Relay Spam Disrupts Global Brands
In January 2026, a massive global spam campaign exploited unsecured Zendesk support systems, enabling attackers to send hundreds of unsolicited emails to targets worldwide. By abusing the open ticket submission feature—allowing ticket creation from any email address without verification—attackers automated fake support requests to generate an overwhelming volume of confirmation emails. Major organizations including Discord, Tinder, Riot Games, Dropbox, and government agencies were impacted, with recipients receiving alarming and confusing messages that appeared to originate from legitimate support channels. No malicious payloads were identified, but the incident caused significant alarm, confusion, and business interruption for affected parties. The heightened ability for attackers to manipulate trusted service communications underscores a growing threat of platform abuse, where legitimate systems are turned against users to bypass security controls and sow disruption. With organizations increasingly reliant on third-party SaaS for customer engagement, this incident illustrates how gaps in self-service security can have wide-reaching and highly visible effects.
8 months ago
Kill Chain
Okta SSO Targeted: 2024 Vishing Surge Exposes Credential Gaps
In early 2024, Okta Single Sign-On (SSO) user accounts became the target of sophisticated phishing campaigns leveraging custom voice-based social engineering (vishing) kits. Threat actors contacted employees via phone calls, impersonating IT staff and using convincing pretexts to direct users to phishing sites tailored to mimic Okta’s authentication workflow. By capturing the credentials and multi-factor authentication (MFA) tokens, attackers accessed sensitive enterprise environments, leading to data exfiltration, disruption of operations, and potential exposure of downstream customers relying on Okta SSO for access control. This incident highlights a broader escalation in the use of vishing tactics to bypass strong authentication, underscoring the ongoing shift toward highly targeted, voice-enabled phishing attacks. Enterprises must adapt security and training programs to confront increasingly sophisticated social engineering methods targeting identity infrastructures.
8 months ago
Kill Chain
Why Even Security Pros Get Phished: The Human & AI-Powered Phishing Crisis of 2026
In January 2026, multiple incidents highlighted how even vigilant individuals and cybersecurity professionals are susceptible to highly convincing phishing attacks. Attackers leveraged advanced social engineering techniques and sophisticated phishing-as-a-service (PhaaS) platforms, often enhanced by AI-driven content generators such as PhishGPT, to deliver targeted messages via email, SMS, and collaboration tools. These lures bypassed traditional defenses, exploiting moments of distraction or emotional vulnerability to harvest sensitive information including credentials and payment data. The operational impact ranged from financial loss and credential compromise to downstream business risk due to unauthorized access or fraud. The incident typifies the evolution of phishing as an industrialized, scalable ecosystem that increasingly relies on automation, AI-tailored content, and a broadening array of tactics. As these methods proliferate and become accessible to attackers with limited technical skills, organizations face heightened regulatory, operational, and reputational risks, making effective prevention and user awareness more vital than ever.
8 months ago
Kill Chain
Patched Fortinet Firewalls Breached in 2026: Authentication Bypass Exposes Enterprise Networks
In January 2026, patched FortiGate firewalls running FortiOS versions 7.4.9 and 7.4.10 were actively breached due to exploitation of a lingering authentication bypass flaw (CVE-2025-59718) in the FortiCloud SSO login feature. Despite an earlier patch, attackers utilized crafted SAML messages to create rogue admin accounts on exposed devices, as observed in customer logs and confirmed by Fortinet developers. More than 11,000 Internet-facing Fortinet devices remained vulnerable as attackers leveraged the flaw to gain privileged access and potentially compromise network defenses, triggering urgent remediation efforts. This incident underscores persisting risks from incomplete remediation, especially on security appliances pivotal to organizational defenses. Growing attacker expertise in exploiting authentication logic flaws and a surge in identity-based attacks highlight the necessity for ongoing vigilance, layered compensating controls, and rapid vulnerability response strategies.
8 months ago
Kill Chain
Cisco Zero-Day Exploited: Critical Remote Code Execution in Unified Communications (2026)
In January 2026, Cisco disclosed and patched CVE-2026-20045, a critical zero-day vulnerability affecting Unified Communications Manager, Unity Connection, and Webex Calling Dedicated Instance platforms. The flaw, arising from improper validation of user-supplied input via HTTP requests, allowed unauthenticated attackers to execute arbitrary code and escalate privileges to root on impacted servers. Cisco’s Product Security Incident Response Team (PSIRT) confirmed in-the-wild exploitation prior to patch release and issued urgent guidance for customers to update, as no workarounds exist. The U.S. CISA swiftly added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating timely remediation for federal agencies. This incident highlights a broader trend of sophisticated zero-day attacks targeting enterprise communications infrastructure. As attackers increasingly focus on supply chain and collaboration platforms, organizations must maintain rapid patching practices and improve segmentation and detection mechanisms against privilege escalation and remote code execution threats.
8 months ago
Kill Chain
CVE-2026-20045: Active Code Injection Exploit Strikes Cisco Unified Communications
In January 2026, CISA added CVE-2026-20045 to its Known Exploited Vulnerabilities Catalog following reports of active exploitation targeting Cisco Unified Communications products. Attackers exploited a code injection vulnerability that allowed remote, unauthenticated threat actors to execute arbitrary code on affected devices, potentially compromising sensitive communications and opening access for further malicious activity within targeted federal civilian executive branch (FCEB) networks. This rapid addition of CVE-2026-20045 prompted urgent federal action to remediate impacted systems and reduce the risk of lateral movement and data exfiltration. The incident highlights a persistent threat vector facing organizations reliant on unified communications infrastructure. With attackers increasingly exploiting unpatched vulnerabilities and leveraging code injection to bypass security controls, the importance of timely patch management and network segmentation continues to grow amid tightening regulatory standards and intensifying audit scrutiny.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports