Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 163 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1945–1956 / 3243 reports
Poland's Nuclear Research Center Successfully Defends Against Cyberattack
Oil/Energy/Solar/Greentech8 months ago

Poland's Nuclear Research Center Successfully Defends Against Cyberattack

In March 2026, Poland's National Centre for Nuclear Research (NCBJ) successfully thwarted a cyberattack targeting its IT infrastructure. The institute's security systems and internal procedures detected the intrusion early, preventing any compromise to their systems. Notably, the MARIA reactor, Poland's sole nuclear reactor used for scientific research and medical isotope production, remained unaffected and continued to operate safely at full capacity. While the NCBJ did not attribute the attack to any specific entity, reports suggest potential involvement of Iranian actors, though investigators caution that these indicators may be deceptive. This incident underscores the escalating cyber threats faced by critical infrastructure globally, particularly in the nuclear sector. Organizations must remain vigilant, continuously enhancing their cybersecurity measures to detect and respond to such sophisticated attacks promptly.

Threat report

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CrackArmor: Critical Vulnerabilities in Linux AppArmor Demand Immediate Attention
Information Technology/IT8 months ago

CrackArmor: Critical Vulnerabilities in Linux AppArmor Demand Immediate Attention

In March 2026, cybersecurity researchers identified nine critical vulnerabilities, collectively named 'CrackArmor,' within the Linux kernel's AppArmor module. These flaws, present since 2017, allow unprivileged users to manipulate security profiles, bypass user-namespace restrictions, and execute arbitrary code within the kernel, leading to potential root privilege escalation and compromised container isolation. The vulnerabilities affect all Linux kernels since version 4.11 on distributions integrating AppArmor, including Ubuntu, Debian, and SUSE. Immediate kernel patching is strongly advised to mitigate these risks. The disclosure of CrackArmor underscores the persistent challenges in securing kernel-level modules and the importance of timely vulnerability management. Organizations relying on AppArmor for mandatory access control should prioritize updates and review their security configurations to prevent exploitation of these flaws.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CrashFix: Unveiling the Latest ClickFix Variant Deploying Python RATs
Financial Services8 months ago

CrashFix: Unveiling the Latest ClickFix Variant Deploying Python RATs

In January 2026, Microsoft Defender Experts identified a new evolution in the ongoing ClickFix campaign, dubbed 'CrashFix'. This variant begins with victims installing a malicious browser extension that impersonates legitimate ad blockers. Once installed, the extension deliberately crashes the browser and displays a fake security warning, instructing users to execute a command via the Windows Run dialog. This command abuses the legitimate Windows utility 'finger.exe' to download and execute a Python-based Remote Access Trojan (RAT), granting attackers persistent access to the compromised system. The RAT enables extensive reconnaissance, data exfiltration, and potential deployment of additional malware payloads. The 'CrashFix' variant represents a significant escalation in ClickFix tactics, combining user disruption with sophisticated social engineering to increase execution success while reducing reliance on traditional exploit techniques. This evolution underscores the growing trend of attackers leveraging trusted user actions and native OS utilities to bypass traditional defenses, highlighting the critical need for behavior-based detection and heightened user awareness.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
INTERPOL's Global Crackdown: 45,000 Malicious IPs Dismantled, 94 Arrested
Banking/Mortgage8 months ago

INTERPOL's Global Crackdown: 45,000 Malicious IPs Dismantled, 94 Arrested

Between July 18, 2025, and January 31, 2026, INTERPOL coordinated a global operation involving 72 countries, resulting in the dismantling of 45,000 malicious IP addresses and servers associated with phishing, malware, and ransomware activities. This effort led to the arrest of 94 individuals and the seizure of 212 electronic devices and servers. Notable actions included the arrest of 40 suspects in Bangladesh linked to various cybercrimes and the identification of over 33,000 fraudulent websites in Macau targeting critical infrastructure. This operation underscores the escalating threat of transnational cybercrime and the necessity for coordinated international responses. The increasing sophistication and scale of cybercriminal activities highlight the urgent need for enhanced cybersecurity measures and global cooperation to protect individuals and organizations from emerging digital threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Google Chrome Zero-Day Vulnerabilities Patched in March 2026
Financial Services8 months ago

Google Chrome Zero-Day Vulnerabilities Patched in March 2026

In March 2026, Google identified and patched two high-severity zero-day vulnerabilities in its Chrome browser: CVE-2026-3909, an out-of-bounds write in the Skia graphics library, and CVE-2026-3910, an inappropriate implementation in the V8 JavaScript engine. Both flaws allowed remote attackers to execute arbitrary code via crafted HTML pages and were actively exploited in the wild. Google released updates to address these issues, urging users to update their browsers promptly. This incident underscores the persistent threat posed by zero-day vulnerabilities and the importance of timely software updates. The rapid identification and patching of these flaws highlight the need for continuous vigilance and proactive security measures in the face of evolving cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Chinese Hackers Infiltrate Southeast Asian Militaries Using Advanced Malware
Military Industry8 months ago

Chinese Hackers Infiltrate Southeast Asian Militaries Using Advanced Malware

In March 2026, a China-based cyber espionage operation, identified as CL-STA-1087 by Palo Alto Networks Unit 42, targeted Southeast Asian military organizations. The attackers employed sophisticated malware tools, including AppleChris and MemFun backdoors, and a credential harvester named Getpass, to infiltrate systems and exfiltrate sensitive information related to military capabilities and collaborations with Western armed forces. The campaign demonstrated strategic patience, utilizing advanced techniques such as DLL hijacking and sandbox evasion to maintain prolonged unauthorized access. This incident underscores the persistent threat posed by state-sponsored cyber actors to national security infrastructures. The use of advanced malware and evasion tactics highlights the evolving sophistication of cyber espionage campaigns, necessitating enhanced vigilance and robust cybersecurity measures within military and governmental networks.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Iran MOIS's 2026 Cyber Collaboration with Criminal Groups
Health Care / Life Sciences8 months ago

Iran MOIS's 2026 Cyber Collaboration with Criminal Groups

In March 2026, Iran's Ministry of Intelligence and Security (MOIS) intensified its cyber operations by collaborating with cybercriminal groups to enhance the scale and effectiveness of its attacks. This partnership led to a series of sophisticated cyberattacks targeting critical infrastructure and private sector entities in the United States and Europe. The MOIS leveraged the expertise and tools of cybercriminals to conduct operations that included data breaches, ransomware attacks, and disruptive activities against government and corporate networks. ([forbes.com](https://www.forbes.com/sites/steveweisman/2026/03/03/irans-cyberwarfare-attacks-will-be-targeting-critical-infrastructure/?utm_source=openai)) This incident underscores a concerning trend where state-sponsored actors are increasingly partnering with cybercriminal organizations to achieve geopolitical objectives. Such collaborations blur the lines between nation-state and criminal cyber activities, complicating attribution and response efforts. Organizations must remain vigilant and adapt their cybersecurity strategies to address this evolving threat landscape.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ICE's 2025 Reactivation of Paragon Solutions Spyware Contract Raises Privacy Concerns
Government Administration8 months ago

ICE's 2025 Reactivation of Paragon Solutions Spyware Contract Raises Privacy Concerns

In September 2025, the U.S. Immigration and Customs Enforcement (ICE) reactivated a $2 million contract with Israeli spyware vendor Paragon Solutions, initially signed in 2024 but paused for compliance review under an executive order restricting the use of commercial spyware. The contract involves Paragon's Graphite spyware, capable of infiltrating mobile devices and accessing encrypted communications. This reactivation has raised significant concerns among civil rights organizations regarding potential overreach and misuse of surveillance technology. The decision to proceed with the contract underscores the ongoing debate over the balance between national security measures and individual privacy rights, especially in light of previous controversies surrounding the use of commercial spyware by government agencies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Stryker's 2026 Cyberattack: A Wake-Up Call for the Medical Tech Industry
Government Administration8 months ago

Stryker's 2026 Cyberattack: A Wake-Up Call for the Medical Tech Industry

In March 2026, Stryker Corporation, a leading U.S.-based medical technology company, suffered a significant cyberattack orchestrated by the Iran-linked group Handala Hack. The attackers infiltrated Stryker's network, deploying wiper malware that erased data from over 200,000 devices and exfiltrated more than 50 terabytes of sensitive information. This breach disrupted operations across 79 countries, affecting both corporate and personal devices connected through Stryker's mobile device management software. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/iran-hacking-group-claims-attack-on-med-tech-company-stryker-says-over-200-000-devices-have-been-wiped-clean-and-over-50tb-of-data-extracted?utm_source=openai)) This incident underscores the escalating threat of state-sponsored cyberattacks targeting critical infrastructure and private sector entities. The use of wiper malware by nation-state actors highlights the need for robust cybersecurity measures and proactive defense strategies to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Stryker's 2026 Cyberattack: A Wake-Up Call for Healthcare Cybersecurity
Health Care / Life Sciences8 months ago

Stryker's 2026 Cyberattack: A Wake-Up Call for Healthcare Cybersecurity

In March 2026, Stryker, a leading U.S. medical technology company, experienced a significant cyberattack attributed to the Iranian-linked hacking group Handala. The attackers claimed to have wiped over 200,000 systems and extracted 50 terabytes of critical data, leading to widespread operational disruptions across Stryker's global network. The attack was reportedly in retaliation for U.S. military actions in Iran. ([techradar.com](https://www.techradar.com/pro/security/an-unprecedented-blow-us-medtech-giant-stryker-suffers-global-outage-after-apparent-iranian-cyberattack?utm_source=openai)) This incident underscores the escalating cyber threats targeting critical healthcare infrastructure, highlighting the need for robust cybersecurity measures to protect sensitive data and ensure operational continuity in the face of nation-state-sponsored cyberattacks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Salt Typhoon 2024: A Wake-Up Call for Telecom Cybersecurity
Telecommunications8 months ago

Salt Typhoon 2024: A Wake-Up Call for Telecom Cybersecurity

In 2024, the Chinese state-sponsored hacking group known as Salt Typhoon infiltrated the networks of at least nine major U.S. telecommunications companies, including AT&T, Verizon, and Lumen. The attackers exploited vulnerabilities in Cisco routers to gain access to sensitive metadata, such as call records and text message details, affecting millions of users. This breach enabled the hackers to monitor communications of high-profile individuals, including government officials and political figures, posing significant national security concerns. The Salt Typhoon campaign underscores the escalating threat of nation-state cyber espionage targeting critical infrastructure. Despite subsequent U.S. sanctions and regulatory efforts, the persistence of such sophisticated attacks highlights the urgent need for enhanced cybersecurity measures and international cooperation to safeguard sensitive communications and data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Apple 2026: Coruna Exploit Kit Targets iOS Devices
Financial Services8 months ago

Apple 2026: Coruna Exploit Kit Targets iOS Devices

In early 2025, the Coruna exploit kit emerged as a sophisticated tool targeting Apple iOS devices, leveraging 23 vulnerabilities across five exploit chains to compromise devices running iOS versions 13.0 through 17.2.1. Initially utilized by a surveillance vendor's client, it was later deployed by Russian state-backed group UNC6353 in mid-2025 and by Chinese financially motivated actor UNC6691 by late 2025, leading to significant data breaches and financial losses. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/spyware-grade-coruna-ios-exploit-kit-now-used-in-crypto-theft-attacks/?utm_source=openai)) The Coruna exploit kit's evolution underscores the escalating sophistication of cyber threats targeting mobile devices, highlighting the critical need for timely security updates and robust defense mechanisms to protect sensitive user data and maintain device integrity.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports