Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
ClickFix Attackers Get Creative: Finger Protocol Exploitation in Ongoing Social Engineering Campaigns (2025)
In December 2025, ongoing ClickFix social engineering campaigns, notably KongTuke and SmartApeSG, exploited the legacy finger protocol to deliver malicious payloads to Windows hosts. Attackers enticed users to interact with fake CAPTCHA pages, triggering finger.exe commands that retrieved further instructions—such as encoded PowerShell commands or direct downloads of malware—from attacker-controlled servers over TCP port 79. These techniques allowed adversaries to bypass conventional detection and deliver remote access tools or additional scripts, posing operational threats to unprotected enterprise environments. This campaign highlights the resurgence of creative use of legacy or overlooked network protocols in modern attack chains. The persistence of ClickFix-driven social engineering and the reuse of finger.exe underline the importance for organizations to reassess traffic filtering strategies, as attackers are diversifying their initial access and payload delivery vectors.
8 months ago
Kill Chain
Ransomware Gets Hacked: CyberVolk’s VolkLocker Crumbles Under Weak Crypto
In June 2024, the pro-Russia hacktivist group CyberVolk introduced its VolkLocker ransomware-as-a-service (RaaS) platform, targeting organizations with file-encrypting malware. However, security researchers quickly discovered significant cryptographic vulnerabilities in its implementation, allowing many victims to recover encrypted files without paying the ransom. The flawed encryption methods meant attackers’ efforts to monetize were largely ineffective, reducing financial impact for most affected organizations but still causing temporary operational disruption and alarm. This incident highlights the persistent evolution of ransomware delivery via RaaS models, even by newly emerging threat actors with insufficient technical sophistication. As ransomware groups proliferate and adapt, businesses face the dual challenges of staying current on new threats and maintaining fundamental security practices, including robust encryption and incident response readiness.
8 months ago
Kill Chain
MITRE 2025: The Top 25 Most Dangerous Software Weaknesses Revealed
In June 2025, MITRE released its annually curated list of the Top 25 Most Dangerous Software Weaknesses, compiling exploit data from 39,000 security vulnerabilities reported between June 2024 and June 2025. This report is used globally by software vendors, security teams, and regulators to target systemic issues—such as improper input validation, use-after-free errors, and insufficient authentication—that are consistently abused by cybercriminals and advanced threat actors. The publication aims to increase awareness and prioritize remediation actions, reducing exposure to the most common and severe attack vectors across both enterprise and critical infrastructure sectors. MITRE's 2025 CWE Top 25 is particularly relevant as organizations respond to a continuing rise in supply chain attacks and software-targeted ransomware campaigns. Regulatory frameworks increasingly demand proactive vulnerability management and prioritization based on real-world exploitability—making this list a critical resource for compliance, risk reduction, and secure software development initiatives.
8 months ago
Kill Chain
Apple 2025 WebKit Zero-Day Breach: What Security Teams Must Know
In June 2025, Apple issued urgent security updates across iOS, iPadOS, macOS, tvOS, watchOS, visionOS, and Safari in response to two actively exploited zero-day vulnerabilities in the WebKit browser engine. One notable vulnerability, CVE-2025-43529, was a use-after-free flaw that could allow maliciously crafted web content to execute arbitrary code on affected devices. The flaws were discovered being exploited in the wild, with attackers leveraging compromised web traffic to bypass built-in device protections, raising concerns for the billions of global Apple device users. This event underscores the growing prevalence and severity of zero-day exploits against popular consumer platforms, highlighting attacker agility and cross-app targeting. With the rapid pace of vulnerability discovery and exploitation, it accentuates the pressing need for real-time patching, proactive threat detection, and segmentation strategy for organizations leveraging Apple devices.
8 months ago
Kill Chain
CISA Orders Feds to Patch Active GeoServer XXE Vulnerability Exploitation
In June 2024, U.S. federal agencies were ordered by CISA to immediately patch a critical vulnerability in GeoServer, an open-source geospatial server widely deployed across government networks. Threat actors were observed actively exploiting an XML External Entity (XXE) injection flaw that allows attackers to access sensitive files, exfiltrate data, and potentially pivot within federal environments. The exploitation, which was discovered in the wild, underscores how quickly attackers can weaponize unpatched vulnerabilities to compromise mission-critical public sector infrastructure, putting sensitive government information at risk. This incident highlights a recent spike in the exploitation of internet-facing open-source software by both cybercriminal and nation-state groups. With regulatory pressure mounting around software supply chain risks and zero-day response times, such vulnerabilities remain a primary vehicle for initial access in sophisticated cyberattacks.
8 months ago
Kill Chain
Mesa County's 2021 Election System Data Breach: The Insider Threat Exposed
In 2021, Mesa County, Colorado experienced a significant breach of its election system data, orchestrated by then-county election clerk Tina Peters. Unauthorized copies of sensitive voting-system hard drives were made following the 2020 U.S. Presidential election and leaked to the public, purportedly to expose alleged voter fraud. The breach, which did not reveal any evidence of fraud, exposed highly confidential election infrastructure information, leading to criminal charges against Peters. The incident is widely recognized as one of the most impactful attacks on U.S. election security in recent years and undermined trust within the local community and beyond. This case highlights the ongoing risks to election system integrity posed by insider threats and emphasizes the importance of robust access controls, encryption, and segmentation. It is particularly relevant today as the U.S. prepares for upcoming elections amid heightened scrutiny of both technical and human vulnerabilities in election infrastructure.
8 months ago
Kill Chain
Critical Windows RasMan Zero-Day (2024) Disrupts Remote Access—What You Need To Know
In mid-2024, a new zero-day vulnerability was discovered in the Windows Remote Access Connection Manager (RasMan) service, allowing attackers to crash the service and potentially disrupt VPN and remote networking capabilities. Security researchers published unofficial patches after Microsoft had yet to release an official fix. The flaw enables a local attacker or malware to exploit the service, leading to denial-of-service (DoS) and potential impact on enterprise connectivity and productivity. Organizations relying on Windows-based remote access are particularly affected as attackers can target unpatched systems. This incident underscores the increasing trend of zero-day vulnerabilities targeting critical Windows services and highlights the need for rapid patch cycles and improved anomaly detection in IT environments. With unofficial fixes circulating before vendor patches, organizations face new risks in securing remote workforce infrastructure.
8 months ago
Kill Chain
CISA Flags Critical GeoServer XXE Vulnerability Exploited in the Wild
In December 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical XML External Entity (XXE) vulnerability, CVE-2025-58360, affecting OSGeo GeoServer to its Known Exploited Vulnerabilities catalog. This flaw impacts versions up to 2.25.5 and select subsequent releases, enabling unauthenticated attackers to exploit the /geoserver/wms GetMap endpoint. Successful exploitation may lead to unauthorized file access, Server-Side Request Forgery (SSRF), or denial-of-service attacks. The discovery, reported by vulnerability platform XBOW, has prompted warnings from both CISA and the Canadian Centre for Cyber Security, emphasizing risks to organizations using GeoServer in production environments. This incident underscores the persistent targeting of widely-used open-source tools by threat actors, particularly through unauthenticated exploit paths. Amid increased regulatory focus and real-world exploitation evidence, organizations face mounting pressure to patch vulnerable infrastructure and strengthen detective controls to mitigate post-exploitation impacts.
8 months ago
Kill Chain
Apple’s 2024 Zero-Day Exploits: Sophisticated Attacks Trigger Emergency Patches
In June 2024, Apple disclosed and swiftly patched two actively exploited zero-day vulnerabilities affecting multiple devices, including iPhones, iPads, and Macs. These flaws—CVE-2024-23296 (Kernel) and CVE-2024-23225 (RTKit)—were leveraged in a highly sophisticated attack that targeted select individuals, likely as part of a nation-state or advanced persistent threat campaign. The attackers bypassed security protections to achieve elevated privileges and potentially execute arbitrary code, underscoring the level of technical prowess and intent to compromise high-value targets. Apple released emergency updates to mitigate ongoing exploitation, emphasizing the urgency of immediate patching. This incident highlights the growing trend of advanced, targeted zero-day attacks aimed at high-profile platforms and users. Security teams should expect continued adversary innovation, accelerated zero-day discovery, and a heightened need for organizations to quickly adopt vendor-released mitigations to safeguard sensitive data and operations.
8 months ago
Kill Chain
React2Shell Exploitation: Global RCE Wave Sparks Emergency Security Response
In December 2025, the React2Shell vulnerability (CVE-2025-55182) emerged as a critical remote code execution flaw impacting React Server Components and several key frameworks such as Next.js, Vite, and RedwoodSDK. Threat actors rapidly exploited the unauthenticated deserialization bug, enabling arbitrary privileged JavaScript execution with a single HTTP request. Within days of public disclosure, multiple malicious campaigns leveraged the flaw to deploy malware, compromise sensitive systems—including government, critical infrastructure and technology entities—and conduct mass internet-wide scans. Over 137,200 exposed endpoints were tracked globally, prompting CISA to issue an accelerated mitigation deadline and security vendors to warn of global supply chain risks. React2Shell’s exploitation highlights the growing trend of mass-scale, opportunistic attacks leveraging zero-day vulnerabilities in widely-used cloud-native frameworks. With parallels drawn to systemic exploits like Log4Shell, organizations face rising regulatory and supply chain scrutiny to strengthen cloud security and incident response practices.
8 months ago
Kill Chain
Phishing in 2025: How Stolen Data Hits Telegram and the Dark Web Faster Than Ever
In early-to-mid 2025, a broad wave of phishing campaigns leveraged sophisticated data harvesting tools—including Telegram bots and automated admin panels—to exfiltrate user credentials and personal data from victims worldwide. Attackers collected credentials through fraudulent pages, relayed them instantly over secure messaging apps or specialized dashboards, and then swiftly funneled the stolen information into darknet marketplaces. Stolen data ranged from email logins and banking details to scans of personal documents, which were sorted, validated, and commoditized for direct fraud, resale, or subsequent targeted attacks on individuals and organizations. This incident highlights the acceleration of phishing-as-a-service ecosystems driven by real-time, evasive data exfiltration via commodity tools. The commodification of personal and corporate credentials intensifies regulatory and reputational risks, as stolen data is increasingly recycled for follow-on attacks—including identity theft and business email compromise—months or years after the initial breach.
8 months ago
Kill Chain
CISA Adds Google Chromium CVE-2025-14174 to Exploited Vulnerabilities List
In December 2025, CISA added CVE-2025-14174—a Google Chromium out-of-bounds memory access vulnerability—to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. This vulnerability enables threat actors to execute arbitrary code or potentially escalate privileges via unauthorized memory access within affected Chromium browser instances. Attackers exploited this flaw as an entry vector for malware and credential theft, increasing risks for both federal agencies and organizations relying on Chromium-based browsers. Federal Civilian Executive Branch agencies were directed, under BOD 22-01, to remediate this vulnerability by a strict deadline to mitigate ongoing risks. The rapid inclusion of CVE-2025-14174 in the KEV Catalog highlights persistent challenges posed by zero-day and n-day browser vulnerabilities. Recent increases in browser-based exploitation and strict regulatory mandates underscore the growing urgency to address software supply chain threats and prioritize swift vulnerability management across all industry sectors.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports