Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 16 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 181–192 / 3243 reports
CISA Issues Emergency Alert for Actively Exploited Ivanti Connect Secure Zero-Day
CISA Issues Emergency Alert for Actively Exploited Ivanti Connect Secure Zero-Day
Financial Services3 weeks ago

CISA Issues Emergency Alert for Actively Exploited Ivanti Connect Secure Zero-Day

In October 2026, CISA disclosed active exploitation of CVE-2026-104935, a zero-day authentication bypass vulnerability in Ivanti Connect Secure VPN appliances affecting versions 25.1.1.1 and prior. Cyber threat actors exploited this remote code execution vulnerability to conduct credential theft and data exfiltration operations, executing commands directly in memory to evade detection by Ivanti's Integrity Checker Tool. The vulnerability allows unauthenticated attackers to execute arbitrary commands on affected systems, representing a critical threat to organizations relying on these widely-deployed enterprise VPN solutions. This incident highlights the continuing trend of VPN infrastructure targeting by sophisticated threat actors, following similar campaigns against Pulse Secure, Fortinet, and other remote access solutions. With hybrid work models making VPN security critical, organizations face mounting pressure to implement comprehensive monitoring and rapid patch management for internet-facing infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Ivanti VPN Flaw Under Active Attack: What CISOs Need to Know About CVE-2026-104935
Critical Ivanti VPN Flaw Under Active Attack: What CISOs Need to Know About CVE-2026-104935
Government Administration3 weeks ago

Critical Ivanti VPN Flaw Under Active Attack: What CISOs Need to Know About CVE-2026-104935

In October 2026, CISA issued urgent warnings after threat actors actively exploited CVE-2026-104935, a critical authentication bypass vulnerability in Ivanti Connect Secure VPN appliances. The zero-day flaw allowed remote attackers to execute arbitrary commands without authentication, leading to credential theft and data exfiltration. Security researchers documented over 105 exploitation attempts from coordinated attackers, with the criminal group UTA0576 conducting sophisticated post-exploitation activities including Active Directory metadata theft, Kerberos attacks, and BitLocker recovery key harvesting while evading detection through selective log tampering. This incident highlights the accelerating trend of VPN infrastructure targeting by cybercriminals who are increasingly focusing on legitimate remote access solutions as primary attack vectors, exploiting the expanded attack surface created by hybrid work environments and the critical trust boundaries that VPN appliances represent in modern enterprise networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
curl's Critical HTTP/2 Vulnerability: When Clients Become Targets
curl's Critical HTTP/2 Vulnerability: When Clients Become Targets
Computer Software/Engineering3 weeks ago

curl's Critical HTTP/2 Vulnerability: When Clients Become Targets

A critical use-after-free vulnerability (CVE-2026-92392) in curl versions 8.12.0 through 8.22.0 allows malicious servers to corrupt client memory during HTTP/2 file uploads, potentially leading to remote code execution. The flaw occurs when a malicious server stalls an upload, resets the stream while keeping the connection open, causing curl to mishandle memory references during retry operations. While exploitation requires precise knowledge of the client's build and memory layout, making successful attacks unlikely, the vulnerability affects both the curl command-line tool and libcurl library used by numerous applications. The curl project expedited their release cycle to ship version 8.23.0 with a fix on October 14, 2026. This vulnerability represents a significant escalation in client-side attack vectors, demonstrating how AI-powered vulnerability research is uncovering complex memory corruption flaws in widely-deployed networking libraries. With HTTP/2 becoming the default protocol for most applications, such vulnerabilities pose substantial risks to enterprise software supply chains and require immediate attention from security teams.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Inside Storm-3119: How a Chinese Cybercriminal Marketplace Weaponized Cloud Infrastructure for Global Phishing
Inside Storm-3119: How a Chinese Cybercriminal Marketplace Weaponized Cloud Infrastructure for Global Phishing
Financial Services3 weeks ago

Inside Storm-3119: How a Chinese Cybercriminal Marketplace Weaponized Cloud Infrastructure for Global Phishing

Microsoft uncovered a sophisticated Chinese-language cybercriminal ecosystem centered around YAM Store (Storm-3119), an initial access broker selling fraudulently obtained Microsoft 365 and Google cloud environments to phishing kit operators. The operation, tracked as Storm-2990, includes three major phishing kits (CoGUI, Haozi, and Iron Man System) that have facilitated over one billion phishing emails and SMS messages targeting 75,000 organizations worldwide since January 2026. The threat actors primarily targeted healthcare, financial services, wholesale distribution, and IT sectors across Japan, the United States, Australia, and India, using sophisticated evasion techniques including geofencing, anti-detection configurations, and real-time victim interaction through Telegram bots. This incident highlights the evolving threat landscape where cybercriminal infrastructure has become commoditized through phishing-as-a-service platforms, significantly lowering barriers to entry for less skilled attackers. The discovery comes amid increased regulatory scrutiny on cloud security and the growing sophistication of social engineering attacks targeting multi-factor authentication bypass techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
UTA0576 Exploits Ivanti Connect Secure Zero-Day for Credential Theft Campaign
UTA0576 Exploits Ivanti Connect Secure Zero-Day for Credential Theft Campaign
Financial Services3 weeks ago

UTA0576 Exploits Ivanti Connect Secure Zero-Day for Credential Theft Campaign

In October 2024, threat actor UTA0576 exploited a zero-day vulnerability chain (CVE-2026-104935) in Ivanti Connect Secure VPN appliances, achieving authentication bypass and remote code execution. The attackers focused on credential theft, Active Directory metadata extraction, and network reconnaissance across a limited number of customer environments. Ivanti had discovered portions of the vulnerability during internal security checks in June but delayed patching until the regular release cycle, allowing attackers to weaponize the flaw before remediation. This incident highlights the persistent targeting of VPN and edge devices as initial compromise vectors, with CISA adding 36 Ivanti vulnerabilities to its Known Exploited Vulnerabilities catalog since 2021. The attack demonstrates the critical importance of timely security updates for internet-facing infrastructure and the need for robust monitoring of edge device compromise indicators.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
UTA0576 Chains Three Ivanti Connect Secure Zero-Days for Complete System Compromise
UTA0576 Chains Three Ivanti Connect Secure Zero-Days for Complete System Compromise
Government Administration3 weeks ago

UTA0576 Chains Three Ivanti Connect Secure Zero-Days for Complete System Compromise

In October 2026, threat actor UTA0576 exploited a chain of three zero-day vulnerabilities in Ivanti Connect Secure VPN appliances to achieve unauthenticated root access. The attack targeted fully patched systems running version 22.8R2.4, combining authentication bypass and remote code execution flaws (CVE-2026-104935) with an unpatched privilege escalation vulnerability. The attacker stole LDAP credentials, performed Active Directory reconnaissance, and executed password-spraying attacks while evading detection through memory-only modifications and configuration restoration techniques. This incident highlights the continued targeting of VPN infrastructure by sophisticated threat actors, reflecting the ongoing trend of chaining zero-day exploits against critical network access points. With only two of the three vulnerabilities patched and active exploitation confirmed by CISA, organizations face immediate risk to their remote access infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
The Gentlemen Ransomware Gang Industrialized EDR Evasion Into a Service Economy
The Gentlemen Ransomware Gang Industrialized EDR Evasion Into a Service Economy
Financial Services3 weeks ago

The Gentlemen Ransomware Gang Industrialized EDR Evasion Into a Service Economy

The Gentlemen ransomware-as-a-service operation emerged in late 2025 and rapidly ascended to become a top-five ransomware gang by Q1 2026 through their innovative EDR killer framework. The crew developed an industrialized approach to endpoint detection and response evasion, creating eight or more variants of their GentleKiller tool that targets over 400 security processes across 48 different security products. By offering affiliates a generous 90% revenue share compared to the industry standard of 80%, Gentlemen scaled their operation through volume rather than per-incident margins, transforming EDR evasion from a technical skill barrier into a commodity service available to low-skill threat actors. This incident represents the maturation of the bring-your-own-vulnerable-driver (BYOVD) attack technique from isolated tactics into a full-scale economy with pricing tiers, product roadmaps, and customer support models, fundamentally changing the threat landscape defenders face.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
SonicWall SMA Under Fire: CVE-2026-102255 Exploitation Reveals SSL-VPN Risks
SonicWall SMA Under Fire: CVE-2026-102255 Exploitation Reveals SSL-VPN Risks
Financial Services3 weeks ago

SonicWall SMA Under Fire: CVE-2026-102255 Exploitation Reveals SSL-VPN Risks

In October 2026, threat actors began actively exploiting CVE-2026-102255, a maximum-severity SSRF vulnerability in SonicWall SMA 1000 appliances. The flaw allows remote unauthenticated attackers to abuse the WorkPlace interface, directing appliances to issue internal requests and perform unauthorized operations. Cybersecurity firms Previdian and Defused detected exploitation attempts on their honeypot devices within days of SonicWall's advisory, despite the vendor initially reporting no evidence of active exploitation. This incident highlights the ongoing targeting of SSL-VPN and edge devices by cybercriminals, following previous zero-day attacks on SonicWall products by the Inc ransomware gang in July 2026. The vulnerability's trivial exploitation combined with SMA devices' position between public internet and corporate resources creates significant risk for organizations relying on legacy SSL-VPN solutions.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Trusted Cybersecurity Executive Turned Alleged Extortionist: The Edward Dubrovsky Case
Trusted Cybersecurity Executive Turned Alleged Extortionist: The Edward Dubrovsky Case
Computer/Network Security3 weeks ago

Trusted Cybersecurity Executive Turned Alleged Extortionist: The Edward Dubrovsky Case

Edward Dubrovsky, a prominent 54-year-old cybersecurity executive and ransomware negotiator, was arrested in Pennsylvania in October 2026 on federal extortion charges under the Computer Fraud and Abuse Act. The Canadian-based security professional, who previously served as an executive at incident response firm Cypfer and authored strategic guides on cyber-extortion response, is suspected of involvement with the ShinyHunters cybercrime collective. FBI investigations suggest connections to the group's recent breach of FBIjobs.gov, where attackers claimed to have stolen data from nearly every FBI employee and job applicant. This case represents a significant insider threat scenario where a trusted cybersecurity professional allegedly participated in the very criminal activities they were supposed to defend against. This incident highlights the growing concern of insider threats within the cybersecurity industry itself, as professionals with privileged access and deep knowledge of defensive strategies increasingly become targets for recruitment by cybercriminal organizations or choose to monetize their expertise through illegal means.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Critical MarkLogic Vulnerabilities Enable Persistent Admin Takeover
Critical MarkLogic Vulnerabilities Enable Persistent Admin Takeover
Financial Services3 weeks ago

Critical MarkLogic Vulnerabilities Enable Persistent Admin Takeover

Progress Software disclosed 31 security vulnerabilities in MarkLogic Server on October 12, 2026, with five rated critical. Two of the most severe flaws (CVE-2026-85947 and CVE-2026-85948) allow accounts with limited management privileges to escalate to persistent administrator control of the database server. CVE-2026-85947 enables forest-management accounts to create persistent admin accounts, while CVE-2026-85948 exploits an XQuery injection flaw in deprecated Management API paths. The vulnerabilities affect MarkLogic 11.x before 11.3.7 and 12.x before 12.1.0, with fixes available since September 10, 2026. The disclosure follows another batch of 10 critical flaws published in August 2026, indicating an ongoing pattern of privilege escalation vulnerabilities in enterprise database platforms that require immediate attention from organizations relying on MarkLogic for mission-critical data management.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
AvisLoader Malware Leverages Tox P2P Networks to Evade Takedowns
AvisLoader Malware Leverages Tox P2P Networks to Evade Takedowns
Financial Services3 weeks ago

AvisLoader Malware Leverages Tox P2P Networks to Evade Takedowns

AvisLoader is a sophisticated Windows malware loader discovered by Varonis Threat Labs in October 2024 that uses the encrypted Tox peer-to-peer messaging network for command and control communications. The malware is delivered through ClickFix social engineering lures disguised as DocuSign document verification requests, tricking users into executing PowerShell commands that download and install the loader. AvisLoader employs multiple evasion techniques including UAC bypass methods, process hiding capabilities, and shortcut persistence mechanisms while communicating through Tox P2P networks to avoid traditional domain-based takedowns. This incident highlights the growing sophistication of malware distribution campaigns that leverage legitimate cloud services and encrypted P2P networks to evade detection and maintain persistent command and control infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Yandex Drone Attacks Reveal New Era of Kinetic Cyber Warfare
Yandex Drone Attacks Reveal New Era of Kinetic Cyber Warfare
Information Technology/IT3 weeks ago

Yandex Drone Attacks Reveal New Era of Kinetic Cyber Warfare

In October 2026, Russian cloud services provider Yandex experienced massive service disruptions after Ukrainian drone attacks targeted three data centers in Sasovo, Kaluga, and Vladimir between October 8-11. The kinetic cyber attacks completely shut down two facilities and severely degraded operations at a third, causing widespread outages affecting cloud storage, databases, and business infrastructure services. Customers reported inability to access files, failed downloads, and system errors across Yandex's cloud platform, which serves as critical infrastructure for Russian government and private sector organizations. This incident represents the evolution of warfare into hybrid kinetic-cyber operations, demonstrating how physical attacks on data centers can achieve the same disruptive effects as traditional cyberattacks while being harder to defend against through conventional cybersecurity measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports