Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Fortinet FortiSIEM Zero-Day: Exploitation Surge Exposes SIEM Risks in 2024
In June 2024, attackers began actively exploiting a critical vulnerability (CVE-2024-XXXX) in Fortinet FortiSIEM, a widely deployed security event management solution. The flaw, which allows remote code execution via specially crafted API requests, was leveraged soon after public proof-of-concept exploit code emerged. Threat actors targeted unpatched FortiSIEM instances to gain privileged access, deploy malware, and establish persistence within enterprise environments, impacting security visibility and putting sensitive data at risk. Public advisories highlighted patch urgency, as exploitation was observed globally in both private and government sectors. This incident underscores sharp escalation in exploitation of high-impact vulnerabilities immediately following public disclosure and POC release. The attack illustrates the need for rapid patching, robust segmentation, and comprehensive monitoring, as threat actors increasingly automate targeting of critical management infrastructure.
8 months ago
Kill Chain
Sitecore 2025: China-Linked APT UAT-8837’s Zero-Day Attack Reveals Modern Espionage Tactics
In early September 2025, an advanced persistent threat group known as UAT-8837, believed to be linked to China, exploited a zero-day vulnerability (CVE-2025-53690) in Sitecore products to gain initial access to critical infrastructure targets in North America. The attackers obtained credentials and leveraged living-off-the-land tools, open-source utilities, and custom backdoors—including 'WeepSteel'—to conduct deep reconnaissance, move laterally, and collect sensitive data such as credentials and Active Directory configurations. Post-exploitation activity also included disabling security controls and exfiltrating internal DLLs, which could be leveraged for future supply chain attacks. This incident spotlights a surge in targeted espionage exploiting both zero-day and known software vulnerabilities, with an emphasis on credential compromise and lateral movement. Growing overlap in TTPs among China-nexus actors and continued attack innovation reinforce the importance of modernizing defenses against sophisticated identity- and supply-chain-driven attacks.
8 months ago
Kill Chain
China-Linked APT Exploits Cisco Secure Email Gateway Zero-Day (2025)
In late 2025, Cisco disclosed a critical zero-day vulnerability (CVE-2025-20393, CVSS 10.0) within AsyncOS Software powering its Secure Email Gateway and Secure Email and Web Manager appliances. Exploited by China-linked advanced persistent threat group UAT-9686, the flaw—residing in insufficient HTTP request validation by the Spam Quarantine feature—allowed attackers to remotely execute commands as root, install tunneling and persistence tools, and drop a Python backdoor ("AquaShell"). The threat actor’s campaign saw exploitation in the wild ahead of Cisco’s January 2026 patch release, impacting organizations exposing affected appliances to the internet with the vulnerable feature enabled. This incident highlights the increasing sophistication and operational tempo of state-backed APTs exploiting zero-day vulnerabilities in enterprise infrastructure. The case underscores the urgency for rigorous patch management, network segmentation, and rapid detection as attackers target critical security appliances that serve as organizational communication lifelines.
8 months ago
Kill Chain
LOTUSLITE Backdoor: How Mustang Panda Targeted U.S. Policy Organizations in 2026
In January 2026, researchers revealed a spear phishing campaign targeting US government and policy organizations utilizing geopolitical lures themed around US intervention in Venezuela. Attackers distributed a malicious ZIP archive containing a DLL file using side-loading techniques to deploy the LOTUSLITE backdoor. The campaign, attributed to the Chinese state-linked Mustang Panda group, leveraged reliable execution flows such as DLL sideloading, beaconed over WinHTTP APIs, enabled remote command execution, and exfiltrated data. While the exact scope of any successful compromise remains unclear, the operation demonstrates a focused cyber espionage effort using proven tactics for initial access and persistence. This campaign highlights the ongoing trend where threat actors employ familiar, effective tradecraft combined with timely or provocative lures. It underscores the continued risk posed to policy organizations from geopolitical-themed spear phishing as attackers adapt their delivery but rely on consistent, operationally sound techniques.
8 months ago
Kill Chain
GootLoader’s Malformed ZIP Attack: 2026 Lessons for Enterprise Security
In January 2026, security researchers uncovered a sophisticated GootLoader malware campaign leveraging malformed, hashbusting ZIP archives containing JavaScript payloads. These ZIP files, crafted by concatenating 500–1,000 archives and manipulating ZIP header fields, evaded analysis from most extraction tools except Windows' default unarchiver. Distributed via SEO poisoning and malvertising targeting legal template seekers, the attack delivered unique archives to each victim, successfully bypassing many detection workflows. Once executed, the JavaScript payload established persistence and launched additional scripts to gather system info and await remote instructions—potentially leading to further infections, including ransomware. This incident underscores the rising technical sophistication in malware delivery tactics, with adversaries rapidly adapting to security controls by exploiting common utilities and unique, randomized delivery artifacts. The campaign highlights the need for proactive endpoint controls and continuous monitoring, as many legacy detection and response tools may miss such creative evasion methods.
8 months ago
Kill Chain
China-Linked APT Leverages Sitecore Zero-Day to Target Critical Infrastructure (2025)
In late 2025, a China-nexus advanced persistent threat group tracked as UAT-8837 exploited a critical Sitecore zero-day vulnerability (CVE-2025-53690, CVSS 9.0) to compromise multiple critical infrastructure organizations in North America. Following initial access through vulnerable servers or compromised credentials, the threat actor leveraged open-source post-exploitation tools to steal sensitive credentials, manipulate Active Directory, and establish multiple persistent access channels. Attackers disabled security features like RestrictedAdmin for RDP and exfiltrated confidential assets, including proprietary DLL libraries, potentially setting the stage for future supply chain attacks or further reverse engineering efforts. This incident reflects a broader trend of sophisticated, state-linked attackers increasingly targeting operational technology environments and critical infrastructure, exploiting unpatched vulnerabilities and adopting living-off-the-land techniques. The ongoing relevance is underscored by heightened governmental warnings and the urgent need for robust vulnerability management, segmentation, and monitoring in high-value environments.
8 months ago
Kill Chain
Predator Spyware: Inside Intellexa’s Vendor-Controlled C2 Attack Tactics (2024)
In early 2024, cybersecurity researchers uncovered evidence of Predator, a commercial spyware platform developed by Intellexa, leveraging a vendor-controlled command-and-control (C2) infrastructure to improve attack precision. Failed and thwarted infection attempts were systematically analyzed by the vendor to refine future attack methods, highlighting a professionalized feedback loop in commercial spyware campaigns. The attack vectors included advanced mobile device exploits, with malicious payloads deployed on targeted mobile devices through phishing or exploit links. The incident underscores how commercial spyware vendors adapt rapidly by learning from failed compromises, posing significant operational risk to both individuals and organizations globally. The exposure of Predator's vendor-controlled C2 approach signals a broader industry shift toward more dynamic, resilient spyware operations, complicating detection and defense for enterprises. This incident exemplifies the rise of highly adaptive, commercially-driven attack infrastructure, intensifying regulatory, technical, and reputational challenges for security leaders and organizations handling sensitive data.
8 months ago
Kill Chain
DoS Flaw in Palo Alto Networks PAN-OS 2026: Firewall Shutdowns Expose New Risks
In January 2026, Palo Alto Networks disclosed and patched a high-severity Denial of Service (DoS) vulnerability—CVE-2026-0227—in its next-generation firewalls running PAN-OS 10.1 or later, as well as in Prisma Access configurations with the GlobalProtect gateway or portal enabled. The flaw allowed unauthenticated attackers to remotely disable firewall services, causing the devices to enter maintenance mode and disrupt protections. While there was no evidence of active exploitation at disclosure, the vulnerability posed significant risks to business continuity and network security, particularly for organizations relying on always-on perimeter defense. This incident is of particular concern given the recent uptick in attacks targeting network security and VPN appliances, regulatory focus on rapid patching, and the extensive use of Palo Alto hardware by Fortune 10 enterprises, critical infrastructure, and government agencies. The evolving threat landscape underscores the urgent need for timely vulnerability management and layered security controls.
8 months ago
Kill Chain
Critical Google Fast Pair Bluetooth Flaw Lets Hackers Track & Eavesdrop (2024)
In early June 2024, a critical vulnerability was disclosed in Google's Fast Pair Bluetooth protocol, used widely in Android devices, headphones, and earbuds. Security researchers revealed that attackers could exploit this flaw to hijack Bluetooth audio accessories, track device owners' physical movements, and potentially eavesdrop on private conversations—all without user interaction. The Fast Pair protocol failed to adequately authenticate and encrypt initial device pairing traffic, allowing threat actors within radio range to intercept or manipulate connections. The business impact extends to privacy exposures and reputational risk for both individuals and organizations relying on wireless audio devices for sensitive conversations. This incident is particularly relevant as Bluetooth and wireless accessories proliferate in enterprises, with remote and on-the-go professionals depending on them daily. The flaw highlights an urgent need for stronger encryption and authentication in edge protocols, especially as threat actors shift to exploiting overlooked supply chain and device-layer risks.
8 months ago
Kill Chain
Gootloader’s Stealth Upgrade: 1,000-Part ZIP Exploit Bypasses Detection in 2026
In January 2026, the Gootloader malware loader resurfaced with advanced evasion techniques, deploying highly obfuscated, malformed ZIP archives containing JScript payloads. By concatenating up to 1,000 archive parts and leveraging ZIP format irregularities, attackers successfully bypassed many security tools, causing them to crash or miss the threat. These ZIPs are unpackable by Windows' default utility but break common tools like 7-Zip and WinRAR. Once delivered via a decoded, XOR-encoded blob, the JScript establishes persistence through .LNK shortcuts and triggers PowerShell-based execution chains, facilitating initial access for ransomware and other malware campaigns. This incident highlights a shift toward highly customized, anti-analysis delivery methods and demonstrates how common file formats can be manipulated to evade detection. With Gootloader back in circulation, organizations face renewed threats from sophisticated malware loaders that exploit endpoint tool weaknesses and static signature limitations.
8 months ago
Kill Chain
Palo Alto Networks GlobalProtect DoS Flaw in 2026: What CISOs Need to Know
In January 2026, Palo Alto Networks disclosed a high-severity vulnerability (CVE-2026-0227, CVSS 7.7) in its GlobalProtect Gateway and Portal services for PAN-OS, exposing organizations to unauthenticated denial-of-service (DoS) attacks. The flaw, an improper handling of exceptional conditions, enables remote attackers to crash affected firewalls and force them into maintenance mode, disrupting business-critical network operations. Vulnerable PAN-OS versions include 12.1, 11.2, 11.1, 10.2, and 10.1, as well as Prisma Access 10.2/11.2 with GlobalProtect enabled. No workarounds are available, and Palo Alto released urgent patches following responsible disclosure by an external researcher. While exploitation in the wild wasn't confirmed at disclosure, ongoing threat actor scanning against GlobalProtect instances was reported in prior months. This vulnerability reinforces the ongoing risk to critical network infrastructure posed by service exposure and unauthenticated access paths. The incident follows a trend of increased attacks targeting VPN and remote access solutions as part of broader DoS and ransomware campaigns, placing heightened pressure on organizations to patch exposed perimeter devices rapidly.
8 months ago
Kill Chain
Lumma Stealer 2026: Persistent Infostealer Escalates C2 Traffic Through Scheduled Tasks
In January 2026, an ongoing wave of Lumma Stealer infections demonstrated a distinctive post-infection pattern on Windows hosts. After initial data exfiltration, compromised machines retrieved a malicious PowerShell payload from Pastebin, which led to repeated execution of mshta commands against a .cc command and control (C2) domain—fileless-market[.]cc. The malware automatically created dozens of scheduled tasks, each triggering outbound HTTPS connections to the C2 infrastructure over many hours, elevating the risk of persistent infiltration and extended data leakage. This approach resulted in a marked increase in C2 traffic and operational risk for affected organizations. This case is relevant now as it highlights a trend of increasingly persistent infostealer operations leveraging fileless persistence, public paste sites, and escalated task creation for resilience. Security teams must be alert to novel automation and scripting techniques that facilitate stealthy C2 traffic and recurring infections, especially as infostealers like Lumma gain popularity in the cybercriminal ecosystem.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports