Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
2025 Ransomware Attack Disrupts Venezuela’s State Oil Giant PDVSA
In December 2025, Petróleos de Venezuela (PDVSA), Venezuela’s national oil and gas company, experienced a significant ransomware attack that targeted its administrative systems. While official company communications downplayed the incident and attributed blame to international adversaries, media reports indicated substantial disruption: the attack resulted in major outages, took down vital IT systems, impacted cargo deliveries, and forced network disconnections. Efforts to remediate using antivirus software exacerbated downtime, and export activities, including loading instructions, were suspended. The incident highlighted operational fragility due to reliance on legacy infrastructure and a lack of segmentation between administrative and critical operational technologies. This breach spotlights the ongoing wave of ransomware attacks targeting energy and critical infrastructure sectors worldwide. It underscores how geopolitically charged environments, and legacy technologies without zero trust segmentation, remain especially vulnerable. The incident serves as a stark warning for the urgent adoption of robust east-west traffic controls and resilient response playbooks to mitigate emerging ransomware TTPs.
8 months ago
Kill Chain
AI Deepfake Geospatial Maps Incident Exposes New Security Frontier (2025)
In December 2025, a high-profile security research initiative revealed significant risks in the unchecked proliferation of AI-generated deepfake satellite maps. Sparked by the personal experience of a deepfake attack, a 17-year-old cybersecurity researcher demonstrated how adversaries could blend or fabricate satellite imagery using advanced GANs and diffusion models. These manipulations, undetectable to the naked eye, could mislead governments and emergency responders, mask critical infrastructure weaknesses, or facilitate large-scale misinformation campaigns with potentially catastrophic consequences on national security and public trust. The incident highlights a rising threat: geospatial deepfakes are evolving rapidly, outpacing current detection solutions and exposing new vulnerabilities in organizations' data and decision pipelines. Growing reliance on AI-generated imagery and the lack of robust verification frameworks make this an urgent issue for security leaders and risk managers in both public and private sectors.
8 months ago
Kill Chain
AWS IAM Credential Theft Drives Massive Cloud Cryptomining in 2024
In early 2024, threat actors exploited stolen Amazon Web Services (AWS) Identity and Access Management (IAM) credentials to launch an extensive cryptomining campaign. Attackers gained unauthorized access to multiple customer environments, leveraging compromised IAM keys to provision and operate Amazon EC2 instances at scale. This unauthorized infrastructure was then used to mine cryptocurrency, resulting in significant financial losses, increased resource utilization, and additional operational overhead for affected organizations. The incident exposed critical gaps in cloud credential management and highlighted the attackers’ agility in abusing cloud-native services for illicit profit. This attack underscores a growing trend where cybercriminals are rapidly pivoting to cloud environments, exploiting mismanaged or stolen credentials. As more businesses migrate workloads to multi-cloud platforms, identity-driven threats and cryptojacking incidents are rising, urging organizations to reexamine their cloud security postures and access controls.
8 months ago
Kill Chain
ESET H2 2025 Report: Multi-Vector Cyberattacks Disrupt Enterprise Defenses
In the second half of 2025, ESET’s telemetry detected a significant uptick in multi-vector cyberattacks targeting enterprises across cloud, hybrid, and on-premises environments. Adversaries leveraged sophisticated tactics such as encrypted traffic evasion, lateral movement through east-west traffic, and exploitation of cloud misconfigurations to bypass traditional security controls and exfiltrate sensitive data. These campaigns combined advanced persistent threat (APT) techniques, ransomware deployment, and the abuse of shadow AI tools, often resulting in business disruption, regulatory exposure, and reputational harm for affected organizations. This incident reflects an intensifying trend: cyber actors are increasingly combining multiple techniques to evade detection, overwhelm defenses, and exploit both legacy and cloud-native infrastructure. With regulatory scrutiny mounting and a surge in identity-driven and AI-enabled threats, proactive segmentation and real-time threat detection are now vital for enterprise resilience.
8 months ago
Kill Chain
How RansomHouse's 2025 Encryption Upgrade Disrupted Critical Sectors
In December 2025, the RansomHouse ransomware-as-a-service (RaaS) group, operated by the Jolly Scorpius threat actor, was observed deploying a significantly upgraded encryption process against high-value victims. Attackers exploited compromised credentials and ESXi server vulnerabilities to infiltrate enterprise environments, moving laterally and using tools like MrAgent to disable firewalls and maintain persistent access. Once established, they deployed the enhanced Mario encryptor, which used multi-layered, two-stage file encryption and selective chunk processing to maximize data disruption. This double extortion campaign resulted in data theft, operational outages, and public leaks for at least 123 organizations across healthcare, finance, government, and transportation sectors. This incident highlights both the increasing technical sophistication of ransomware operations and the rapid evolution of RaaS offerings. The shift to more complex encryption makes detection, containment, and recovery far more challenging, calling for organizations to adopt dynamic, layered security controls and anticipate future trends in ransomware capabilities.
8 months ago
Kill Chain
European Authorities Dismantle Major Call Center Fraud Ring in Ukraine (2024)
In mid-2024, European law enforcement agencies succeeded in dismantling a major organized fraud ring operating out of Ukraine. This network used illicit call centers to impersonate financial institutions, manipulating victims across Europe—especially in Germany—into divulging sensitive information or making fraudulent investments. Through sophisticated social engineering techniques and well-structured scripts, the group defrauded thousands of individuals of over 10 million euros. The operation also seized electronic equipment and led to at least five arrests. This incident highlights the ongoing evolution of transnational cybercrime syndicates that exploit human vulnerability through social engineering. Call center fraud, often leveraging modern technologies and cross-border coordination, continues to surge even as regulatory and enforcement actions intensify across Europe.
8 months ago
Kill Chain
Hypervisors Under Fire: 2024 Ransomware Blitz Hits Virtualization Core
In early 2024, organizations across multiple sectors faced a wave of targeted ransomware attacks exploiting vulnerabilities in virtualization platforms' hypervisors. Threat actors used stolen administrative credentials and leveraged known and zero-day flaws in hypervisor management interfaces to bypass segmentation controls, moving laterally from corporate networks onto host environments. Once inside, attackers deployed ransomware payloads at the hypervisor level, simultaneously encrypting dozens of virtual machines and crippling key business operations for days or weeks. The impact included downtime cascading across critical workloads, increased ransom demands due to concentrated disruption, and challenges in restoring services due to the interlocked nature of virtualized systems. This incident spotlights the growing trend of ransomware groups shifting attacks from endpoint devices to virtualization infrastructure, exploiting weak visibility and east-west segmentation at the hypervisor layer. As businesses accelerate cloud and virtual adoption, the threat landscape is rapidly evolving, making hypervisor security an urgent priority for IT and security leaders.
8 months ago
Kill Chain
Fortinet 2024 Auth Bypass Exploited: Urgent Actions for Network Security
In early June 2024, threat actors actively exploited newly disclosed authentication bypass vulnerabilities in multiple Fortinet products, including FortiOS and FortiProxy. Attackers leveraged these flaws (notably CVE-2024-21762 and CVE-2024-23113) shortly after Fortinet's patch release, gaining unauthorized admin-level access to vulnerable devices. The intruders then extracted system configuration files, risking exposure of sensitive network data and credentials. Several organizations reported compromises and system disruptions, prompting urgent advisories from Fortinet and government agencies to patch immediately and review system integrity. This incident underscores a dangerous trend: rapid mass exploitation of zero-day vulnerabilities in network security devices. The high-profile breach highlights mounting risks to organizations that delay critical patching and demonstrates the persistent targeting of edge appliances by sophisticated attackers.
8 months ago
Kill Chain
Venezuelan Oil Giant PDVSA Hit by Cyberattack—Exports Disrupted in 2024 Incident
In June 2024, Petróleos de Venezuela S.A. (PDVSA), Venezuela’s state-owned oil giant, suffered a major cyberattack that disrupted its oil export operations. Attackers reportedly targeted IT infrastructure critical to the export scheduling and operational logistics of PDVSA, forcing the company to revert to manual processes while systems were restored. Although the precise entry vector and threat actor remain unconfirmed, preliminary indications suggest ransomware or disruptive malware may have played a role, leading to significant business interruption and delayed global shipments. This incident underscores the persistent risks facing critical infrastructure sectors worldwide, with cyberattacks increasingly targeting essential energy supply chains. With ransomware and nation-state threats evolving in sophistication, organizations must urgently prioritize segmentation, threat detection, and resilient network architectures.
8 months ago
Kill Chain
Amazon Stops Russian GRU Hackers Targeting Cloud Edge Devices in 2025
In December 2025, Amazon's Threat Intelligence team thwarted a sophisticated cyber-espionage campaign attributed to the Russian GRU, which actively targeted Western critical infrastructure via AWS cloud environments. Beginning in 2021 and intensifying through 2025, the threat actors transitioned from exploiting known and zero-day vulnerabilities to targeting misconfigured customer-managed edge devices such as VPN gateways and network appliances hosted on EC2. This allowed them to gain persistent access, harvest credentials, and move laterally within networks, yet there was no compromise of AWS's own infrastructure. Amazon responded rapidly by securing affected instances, notifying customers, and sharing threat intelligence with partners. This incident highlights the growing trend of state-sponsored groups shifting from vulnerability exploitation to leveraging customer misconfigurations. The persistent focus on edge devices underscores the importance of robust configuration and monitoring practices, especially as critical infrastructure organizations move sensitive operations into the cloud.
8 months ago
Kill Chain
Active Attack: Fortinet FortiGate SAML SSO Authentication Bypass Exposes Networks
In December 2025, threat actors began exploiting two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719, both CVSS 9.8) in Fortinet FortiGate appliances. By targeting the FortiCloud SSO feature—enabled during FortiCare registration—they leveraged crafted SAML messages to gain unauthorized access to admin accounts. Once inside, attackers exported device configuration files, risking credential compromise and broader network infiltration. The U.S. CISA quickly classified the flaws as Known Exploited Vulnerabilities, urging immediate patching. This incident demonstrates the evolving risk of identity-driven network attacks and rapid exploitation following vulnerability disclosure. With opportunistic threat actors targeting edge infrastructure, similar authentication-based attacks are likely to increase, further incentivized by regulatory and industry pressure for swift vulnerability management.
8 months ago
Kill Chain
Turkey Hit by Advancing Android Banking Trojan: Inside the Frogblight Campaign
In August 2025, researchers identified a sophisticated Android banking Trojan dubbed "Frogblight" targeting users in Turkey. Distributed primarily through smishing campaigns and phishing sites masquerading as official government portals, Frogblight lured victims by posing as legitimate court case or Chrome browser apps. Once installed, it harvested banking credentials, SMS, contact lists, call logs, and device data, while providing remote device control and persistence mechanisms for operators. The malware communicated via REST API and later WebSockets to exfiltrate stolen data to attacker-controlled C2 servers and was frequently updated with new spyware features, indicating ongoing development and potential adoption as Malware-as-a-Service (MaaS). Frogblight exemplifies the rapid evolution and increasing capabilities of mobile banking malware. The campaign underscores the rising threat to mobile users—particularly in markets where banks and government digital services are trusted attack vectors—and reflects a broader trend toward commoditized MaaS offerings and advanced evasion techniques. Effective mobile security controls and user awareness remain critical as adversaries refine their payloads.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports