Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Clop Ransomware Hits Barts Health NHS via Oracle Zero-Day
In early 2024, Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite. The attackers gained unauthorized access to internal systems, exfiltrated sensitive files from a key database, and threatened further leaks. The attack leveraged unpatched software flaws as the entry vector, allowing for rapid lateral movement and data theft before being detected. The incident disrupted operations and triggered regulatory notifications due to the sensitive nature of patient and operational information. This breach highlights the ongoing risks posed by sophisticated ransomware groups exploiting zero-day vulnerabilities in widely used enterprise software. Attacks of this kind are increasingly common, especially in the healthcare sector, which remains a high-value target for ransomware due to legacy systems and critical service mandates.
8 months ago
Kill Chain
CISA Discloses PRC Hackers Using BRICKSTORM Backdoor for Stealthy U.S. System Access
In June 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that state-sponsored hackers affiliated with the People's Republic of China (PRC) utilized a newly identified backdoor dubbed BRICKSTORM to infiltrate and maintain long-term access within VMware vSphere and Windows environments of U.S. critical infrastructure entities. The campaign started months prior, leveraging advanced persistent threat (APT) tactics such as lateral movement, encrypted C2 channels, and sophisticated evasion techniques to bypass network defenses and persist undetected. This led to extensive exfiltration of sensitive data and raised major concerns about the resilience of core U.S. operational systems. The BRICKSTORM attack signals a rising tide of highly targeted intrusions on virtualization platforms, as nation-state actors adopt increasingly stealthy and persistent approaches. Organizations must now contend with the growing complexity and scale of APT operations, which often elude legacy tools and monitoring strategies.
8 months ago
Kill Chain
Active Command Injection Attacks Hit Array AG Series Gateways in 2025
In mid-2025, JPCERT/CC reported that a command injection vulnerability in Array Networks AG Series secure access gateways had been actively exploited in the wild since at least August of that year. The flaw, residing in the DesktopDirect remote desktop access feature, allowed unauthenticated attackers to execute arbitrary commands on targeted devices. The vulnerability, lacking a CVE at the time of disclosure, was patched by Array Networks in May 2025, but unpatched systems remained exposed to attacks that could lead to further compromise and unauthorized network access. This incident underscores the persistent risks of unpatched infrastructure and weak segmentation in network environments. The rise of zero-day exploits targeting remote access solutions combined with increased regulatory scrutiny makes rapid detection, patching, and least privilege policy enforcement more critical than ever.
8 months ago
Kill Chain
Supply-Chain Emergency: Critical XXE Bug (CVE-2025-66516) in Apache Tika Imperils Enterprises
In December 2025, a critical XML External Entity (XXE) vulnerability, CVE-2025-66516, with a maximum CVSS score of 10.0, was discovered in multiple core Apache Tika modules. This flaw enables unauthenticated attackers to exploit XXE processing to remotely access sensitive files, exfiltrate data, and launch further attacks through maliciously crafted XML payloads. Because Apache Tika is widely employed in data extraction and content analysis across enterprise, cloud, and supply-chain systems, the exposure has immediate downstream risk for any organizations leveraging impacted Tika libraries. The incident highlights a significant supply-chain security challenge, reinforcing the urgency for immediate patching and improved review of third-party open-source components. Increasingly, threat actors are exploiting foundational software dependencies to bypass traditional security perimeters, making software supply-chain vigilance a key priority for 2025 and beyond.
8 months ago
Kill Chain
Holiday Season Phishing Surge: Fake Rewards, Tax Refunds, and Retail Scams Hit US Consumers
In late 2025, a surge of SMS phishing campaigns originating from China-based threat actors targeted US consumers, leveraging fake rewards, tax refund lures, and convincing e-commerce storefronts. Attackers registered thousands of new phishing domains, deploying convincing T-Mobile and AT&T spoof sites promoted via iMessage and RCS. Victims, enticed to enter payment card data and one-time codes, unknowingly enabled attackers to enroll their cards into Apple or Google mobile wallets under fraudster control, facilitating rapid monetization of stolen credentials. These operations exploited seasonal shopping urgency and sophisticated phishing kits to evade detection, causing widespread financial fraud, identity theft, and downstream losses for individuals and financial institutions. The incident highlights a global shift in phishing techniques, with threat actors now employing advanced, rapidly deployable kits and mobile wallet fraud vectors. The proliferation of fake e-commerce and tax-refund scams demonstrates increased operational agility and a focus on bypassing traditional browser-based defenses, raising urgent concerns for both consumer security and enterprise payment protection.
8 months ago
Kill Chain
CISA Issues Stark Warning on Ongoing Brickstorm Backdoor Attacks
In early 2024, the Cybersecurity and Infrastructure Security Agency (CISA) issued a warning regarding sustained state-sponsored attacks targeting VMware vSphere environments, attributed to China-linked advanced persistent threat (APT) groups. These actors deployed the 'Brickstorm' backdoor to compromise government and technology sector organizations, exploiting vulnerabilities to achieve persistence and lateral movement within affected networks. The intrusion enabled attackers to bypass security controls, maintain privileged access, and exfiltrate sensitive information, highlighting a persistent threat targeting virtualization infrastructure. This incident is notable as it reflects a concerning evolution in attacker tactics, specifically the abuse of virtualization platforms as an entry vector for espionage. The ongoing campaign underscores the urgent need for enhanced detection, segmentation, and defense against stealthy operations in hybrid and cloud environments.
8 months ago
Kill Chain
AutoIT3 Compiled Script Malware: 2024 Infostealer Surge Targets Windows Users
In December 2024, researchers identified a fresh malware campaign abusing compiled AutoIT3 scripts to deliver infostealers and remote access trojans to Windows systems. Attackers distributed malicious executables packaged in ZIP archives, which, upon execution, leveraged AutoIT3’s FileInstall() function to embed and unpack additional payloads, including obfuscated shellcode. Once unpacked, these scripts decoded and executed shellcode in memory, deploying threats such as Quasar RAT and Phantom Stealer, thereby enabling credential theft and system compromise for victim organizations. This campaign highlights a growing trend where attackers utilize low-profile development tools, like AutoIT, to evade traditional defenses and deliver sophisticated payloads. The resurgence of compiled script-based malware demonstrates ongoing innovation in attack vectors, requiring defenders to expand their monitoring to scripting environments and unpacked resource analysis.
8 months ago
Kill Chain
Meta React Server Components 2025: Critical RCE Vulnerability Added to CISA KEV
In December 2025, a critical remote code execution (RCE) vulnerability (CVE-2025-55182) was discovered and actively exploited in Meta's React Server Components framework. Threat actors leveraged this flaw in internet-exposed REACT instances, enabling them to execute arbitrary code remotely and potentially gain unauthorized access to internal systems. This vulnerability was significant enough to be added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, prompting urgent remediation efforts across public and private organizations. Federal agencies were mandated to act by Binding Operational Directive 22-01, while industry peers were strongly advised to prioritize patching to limit exposure and prevent compromise. The exploit highlights an ongoing trend of attackers targeting widely adopted development frameworks like React, demonstrating how software supply chain and third-party vulnerabilities remain a high-risk vector. Its addition to the KEV Catalog underlines the persistent challenge organizations face in quickly identifying and mitigating critical threats across their infrastructure.
8 months ago
Kill Chain
Intellexa Exposed: Predator Spyware Vendor’s Secret Remote Access Unveiled (2024)
In 2024, investigative reporting revealed that Intellexa, a vendor of the Predator spyware, retained the ability to remotely access systems belonging to its own customers. Leaked training videos and multiple research publications uncovered that Intellexa could view customer surveillance logs, potentially monitoring surveillance operations and data on targeted individuals. Additional findings exposed that Intellexa exploited malicious mobile advertisements (notably the 'Aladdin' vector) to infect targets, and utilized domains imitating legitimate news sites, implicating Predator in surveillance of high-profile activists, journalists, and lawyers across Kazakhstan, Egypt, Greece, Iraq, and Pakistan. This raised serious concerns regarding human rights oversight and corporate accountability. This incident is particularly alarming due to the vendor’s persistent development of new zero-day exploits and its direct operational involvement in customer deployments. Such practices highlight significant shifts in spyware vendor behavior and raise urgent questions about regulatory readiness, digital rights, and the security of organizations relying on third-party surveillance tools.
8 months ago
Kill Chain
China’s Brickstorm Malware Campaign: The New Face of State-Level US Espionage in 2024
In 2024, U.S. and Canadian cybersecurity authorities, together with threat analysts from Google and CrowdStrike, disclosed an extensive, ongoing cyber-espionage campaign attributed to China-linked state actors known as Warp Panda and UNC5221. Utilizing the advanced Brickstorm malware, attackers achieved undetected persistence within critical infrastructure and government agency networks for an average of over a year, beginning as early as 2022. Brickstorm, targeting VMware vSphere and Windows environments, enabled stealthy lateral movement, automated reinfection, and the theft of sensitive identity and configuration data. The campaign exploited cloud misconfigurations, edge device vulnerabilities, and under-monitored zones, impacting dozens of U.S. organizations and associated downstream victims. This incident reflects the continued evolution of state-sponsored Chinese cyber-operations. Its strategic targeting, tradecraft sophistication, and stealth tactics represent persistent threats for both government and private sector organizations managing hybrid or multi-cloud environments.
8 months ago
Kill Chain
Predator Spyware 2024: Zero-Click Ad Delivery Redefines Stealth Attacks
Between late 2023 and early 2024, the Predator spyware—developed by surveillance tech company Intellexa—was deployed via a novel zero-click attack vector known as "Aladdin." This technique exploited malicious ads to automatically compromise targeted devices as soon as they displayed the booby-trapped advertisement, without requiring any user interaction. Elite threat actors leveraged this method to implant sophisticated spyware capable of exfiltrating sensitive data and monitoring victim activity. The campaign’s covert nature enabled infections to go undetected, raising the risk for organizations and individuals exposed to this advanced surveillance toolset. This incident highlights the rapid evolution of zero-click infection strategies, especially those exploiting web advertising ecosystems. Security teams must double down on threat detection, anomaly response, and zero trust frameworks to counter increasingly stealthy surveillance tools used by both commercial operators and nation-state clients.
8 months ago
Kill Chain
ArrayOS AG VPN Vulnerability Exploited: Threat Actors Plant Webshells via Command Injection (2024)
In early June 2024, threat actors began actively exploiting a command injection vulnerability in Array Networks AG Series VPN devices, targeting organizations and critical infrastructure globally. Attackers leveraged the flaw to plant malicious webshells and create rogue administrative users, gaining persistent access to internal networks. The observed attacks allowed adversaries to bypass normal authentication and move laterally, posing significant operational risks by exposing sensitive internal systems and enabling further exploitation. The breach heightened concerns about the security of perimeter VPN appliances and the need for urgent patching. This incident is especially significant as attackers rapidly weaponize new vulnerabilities in edge infrastructure, reflecting a persistent trend of chaining VPN flaws to compromise enterprise environments. Heightened regulatory scrutiny and rising sophistication in attacks on remote access solutions underscore the urgent need for enhanced security controls and vigilant vulnerability management.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports