Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Malicious Chrome Extensions Steal Credentials in 2024 Supply-Chain Attack
In June 2024, security researchers discovered two malicious Chrome extensions, 'Phantom Shuttle,' available in the official Web Store, that masqueraded as proxy service plugins but instead hijacked users’ browser sessions. Once installed, these extensions intercepted sensitive user data—including login credentials—by redirecting and manipulating network traffic. By deploying the extensions within the Chrome browser ecosystem, threat actors leveraged a trusted supply-chain vector to reach a broad user base without raising immediate suspicion, resulting in widespread data theft before the plugins were reported and removed. This incident highlights the persistent risks associated with supply-chain compromise in browser extension ecosystems. Attackers increasingly exploit official platforms like Chrome’s Web Store to distribute malicious tools, circumvent traditional network defenses, and exfiltrate credentials, underscoring the need for robust extension vetting, user education, and advanced detection capabilities.
8 months ago
Kill Chain
INTERPOL’s Landmark Crackdown: 574 Cybercrime Arrests across Africa in Operation Sentinel
In November 2025, INTERPOL coordinated Operation Sentinel across 19 African nations, resulting in the arrest of 574 suspected cybercriminals and recovery of $3 million. The operation targeted major cybercrime networks involved in business email compromise (BEC), digital extortion, and related ransomware campaigns. Notably, a Ukrainian national associated with ransomware operations pled guilty, highlighting the global breadth of these criminal networks. The operation uncovered sophisticated use of encrypted communication and lateral movement tactics to evade detection, impacting financial institutions and businesses across the continent. The crackdown underscores the evolving nature of cybercrime, with attackers leveraging advanced techniques and international collaboration among law enforcement agencies rising in response. Increased BEC and ransomware threats have pressed organizations in Africa and globally to evaluate existing cybersecurity and compliance controls.
8 months ago
Kill Chain
Amazon Thwarts Massive North Korean IT Job Scam: Lessons in Zero Trust and Insider Defense
In 2024, Amazon confronted a surge of over 1,800 suspected North Korean state-sponsored IT job scammers who attempted to infiltrate the company’s workforce through fraudulent job applications. The attackers used sophisticated social engineering and impersonation tactics to pose as legitimate IT professionals, seeking remote work to gain internal access or sensitive data. Amazon’s security and HR teams collaborated to detect anomalies, verify identities, and block the hiring process for the fraudulent profiles, successfully preventing insider threats and potential exploitation of corporate assets. The operation underscores the increasing complexity and scale of employment-based attack vectors. This incident is particularly relevant as cybercriminals and nation-state actors are increasingly leveraging remote work trends and IT labor shortages to execute social engineering intrusions. It highlights the need for enhanced workforce vetting, robust anomaly detection, and proactive segmentation to protect organizations from evolving insider and supply chain threats.
8 months ago
Kill Chain
Threat Actors Exploit Zero-Day Vulnerability in WatchGuard Firebox Devices
In early 2024, cybercriminals exploited a previously unknown zero-day vulnerability in WatchGuard Firebox firewall devices, enabling unauthorized remote access and control over affected appliances. Attackers leveraged this flaw to bypass authentication, deploy malware, and establish persistent footholds within targeted organizational networks. The campaign resulted in potential data breaches, service disruptions, and exposure of sensitive internal traffic due to compromised network perimeters. WatchGuard has since released urgent patches and guidance, while security teams raced to detect and remediate compromised devices. This incident highlights the persistent targeting of edge security appliances by advanced threat actors and the speed at which zero-day exploits are weaponized. As remote work and hybrid cloud adoption surge, organizations must prioritize rapid patching and enhanced detection to mitigate risks posed by critical perimeter vulnerabilities.
8 months ago
Kill Chain
Remote Code Execution Risk in Windows Imaging Component: Deep Dive into CVE-2025-50165
In November 2025, researchers exposed a critical vulnerability (CVE-2025-50165) in the Windows Imaging Component, specifically affecting WindowsCodecs.dll. The flaw arises from the mishandling of 12-bit and 16-bit JPG image encoding, where uninitialized function pointers could lead to a remote code execution (RCE) scenario. Attackers could theoretically trigger the vulnerability when a vulnerable application (such as Microsoft Photos or other image-processing tools) attempts to (re-)encode specially crafted JPG files. However, exploitation is complex and requires precise conditions—such as address leaks and heap control—making real-world attacks unlikely. Microsoft and library maintainers released patches to address the flaw by initializing pointers and adding error checks. This case highlights persistent risks in legacy image-processing libraries and the importance of timely patching. With software supply chains increasingly relying on third-party components, vulnerabilities in popular libraries can have broad implications, especially as adversaries probe for new entry points through common file formats.
8 months ago
Kill Chain
How Russian State-Sponsored Cyberattacks Targeted Denmark’s Critical Infrastructure and Elections in 2024
In December 2025, Danish authorities attributed two major cyberattacks in 2024 to Russian-backed groups. The first attack targeted a Danish water utility, causing significant operational disruption, and was attributed to Z-Pentest, a pro-Russian threat actor. The second involved a series of distributed denial-of-service (DDoS) attacks against Danish municipal and regional council websites on the eve of critical elections, orchestrated by NoName057(16), another threat group with ties to Russia. These incidents highlighted the vulnerabilities of critical infrastructure and democratic processes to foreign state-sponsored actors. The fallout from these attacks underscores a broader pattern of rising state-sponsored cyber operations targeting essential services and democratic institutions across Europe. Heightened geopolitical tensions and the growing sophistication of threat actors are driving urgent calls for improved cyber defenses and regulatory responses.
8 months ago
Kill Chain
Ascension 2024 Breach: How RC4’s Legacy Left Millions Exposed
In May 2024, healthcare giant Ascension suffered a major data breach after threat actors exploited legacy support for the outdated RC4 encryption algorithm in Microsoft Windows environments. Attackers leveraged the well-known 'Kerberoasting' attack technique, enabled by RC4’s weak cryptography, to compromise credentials and move laterally between systems. This breach led to significant operational disruption across 140 hospitals, putting 5.6 million patient records at risk and critically impacting healthcare delivery. The incident highlighted the dangers of legacy cryptography persisting in critical infrastructure. The breach has brought renewed urgency to deprecate outdated cryptographic standards and accelerate upgrades within regulated industries. Regulatory scrutiny and increased attacker focus on cryptographic weaknesses make retiring end-of-life encryption technologies a top priority for all enterprises.
8 months ago
Kill Chain
WatchGuard 2025 RCE Breach Exposes 115,000+ Firebox Firewalls Globally
In December 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-14733, was disclosed impacting over 115,000 WatchGuard Firebox firewalls running Fireware OS. The flaw, residing in the OS iked process, allowed unauthenticated attackers to execute arbitrary code over the network when IKEv2 VPN was enabled. Actively exploited in the wild, the vulnerability placed thousands of organizations worldwide at risk of compromise. Shadowserver reported over 117,000 unpatched instances exposed online days after patches were released. U.S. federal agencies were ordered to patch affected firewalls within one week, with WatchGuard providing indicators of compromise, urgent mitigation steps, and guidance for customers unable to patch immediately. This incident underscores the persistent risk of edge device vulnerabilities and rapid attacker exploitation cycles. With federal mandates, ongoing zero-day disclosures, and increasingly sophisticated attack vectors targeting VPN and firewall infrastructure, organizations must prioritize timely patching and layered defenses to reduce exposure.
8 months ago
Kill Chain
Ransomware Attack Hits Romanian Water Authority: A 2024 Critical Infrastructure Wake-Up Call
In June 2024, Romania’s National Water Administration (Administrația Națională Apele Române) suffered a ransomware attack that disrupted key systems and operational processes. The attack, identified over the weekend of June 8–9, targeted core IT infrastructure, encrypting file servers and temporarily interrupting the administrative management of the country’s water resources. While water supply to the public reportedly remained unaffected, the incident led to delays in critical public and environmental services and highlighted gaps in incident response capabilities and network segmentation. Early indications suggest the attackers used a known ransomware variant, gaining access via a vulnerable remote service. This breach comes amid a surge in ransomware attacks on public utilities across Europe, emphasizing the increasing threat to operational technology and critical infrastructure. Heightened regulatory scrutiny and an evolving threat landscape put additional pressure on agencies to improve cyber resilience and visibility.
8 months ago
Kill Chain
INTERPOL Sparks Major 2024 Ransomware Takedown in Operation Sentinel
In May 2024, INTERPOL led a sweeping global cybercrime crackdown titled Operation Sentinel, targeting ransomware crews, business email compromise (BEC) groups, and extortion gangs. The coordinated action resulted in the arrest of 574 individuals across multiple countries. Six major ransomware strains were decrypted, and authorities seized over $3 million in illicit funds, effectively disrupting expansive international crime networks. Attackers leveraged a mix of phishing, malware, and lateral movement to infiltrate corporate and public-sector environments, lock critical data, and demand ransom payments. The impact was both substantial and international, affecting hundreds of organizations and drawing heavy collaboration among law enforcement agencies across continents. This case underscores the rise of global, cross-border law enforcement cooperation in tackling ransomware and financially motivated cybercrime. As threat actors become ever more sophisticated and resilient, multinational efforts and advanced decryption capabilities are now essential for effective disruption and victim support.
8 months ago
Kill Chain
How Multi-Vector Attacks in 2025 Exposed Firewall and Internal Security Gaps
In December 2025, several global organizations faced a coordinated multi-vector cyber campaign in which threat actors leveraged recent vulnerabilities across enterprise firewalls, browser plugins, and connected devices. Attackers stealthily exploited zero-day flaws in network perimeter devices to access east-west traffic, deploy lateral movement, and exfiltrate sensitive data using encrypted channels. Both commercial and open-source threat detection struggled to identify activity quickly, resulting in significant operational disruptions, regulatory notification requirements, and data privacy liabilities affecting numerous sectors worldwide. This incident is indicative of a new threat paradigm in which attackers favor multi-tool, insider-style techniques, combining supply chain vulnerabilities with stealthy movements inside trusted IT environments. Security and compliance teams must now contend with adversaries who bypass traditional controls and exploit overlooked components, highlighting urgent needs for zero trust segmentation, improved traffic visibility, and robust egress monitoring.
8 months ago
Kill Chain
Uzbekistan Telegram Users Hit by Sophisticated Android SMS-Stealer Campaign in 2024
In early 2024, Android users in Uzbekistan experienced a surge of targeted attacks as cybercriminals deployed SMS-stealer malware through phishing campaigns delivered via Telegram. The attackers leveraged fake and malicious applications purpose-built to intercept and exfiltrate SMS messages, enabling unauthorized access to multi-factor authentication codes and banking credentials. Threat actors demonstrated increasing sophistication and adaptability by iterating on malware variants, incorporating obfuscation tactics, and exploiting the popularity of Telegram as a distribution channel. This resulted in significant risks of financial theft and compromised user privacy across a large segment of Uzbek Android device users. This incident highlights the evolving landscape of mobile infostealer attacks in Central Asia, with a marked uptick in the use of instant messaging platforms as malware delivery vectors. The swift adaptation of criminal tactics underscores the necessity for organizations and individuals to strengthen mobile endpoint security and remain vigilant against increasingly convincing phishing and sideloading threats.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports