Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
NHS Flags PoC Exploit for 7-Zip Symlink RCE Vulnerability (CVE-2025-11001)
In November 2025, NHS England Digital issued an advisory regarding a significant vulnerability (CVE-2025-11001) in the popular 7-Zip compression software. While no active in-the-wild exploitation was detected, a publicly available proof-of-concept (PoC) exploit for a symbolic link–based remote code execution (RCE) flaw raised concerns of imminent risk. The flaw, if exploited, could allow attackers to execute arbitrary code on systems using 7-Zip, threatening the confidentiality, integrity, and availability of healthcare data critical to NHS operations. Security teams were urged to prioritize patching and closely monitor for suspicious activity. This incident highlights a broader industry trend: attackers are rapidly weaponizing PoC exploits for newly disclosed vulnerabilities, targeting widely used utilities to enable lateral movement and privilege escalation. The urgency of patching and proactive threat detection has never been greater, especially for organizations in regulated sectors like healthcare.
8 months ago
Kill Chain
CISA Flags New Chromium Browser Exploit: CVE-2025-13223 in Active Use
On November 19, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2025-13223—an actively exploited type confusion vulnerability in the Google Chromium V8 JavaScript engine—to its Known Exploited Vulnerabilities (KEV) Catalog. This flaw allows remote attackers to execute arbitrary code via a crafted web page, exploiting weaknesses in Chromium-based browsers used by federal and commercial entities. Threat actors have been leveraging this vulnerability to deliver malware and potentially gain unauthorized access to systems, heightening risk across government and enterprise environments. This incident is highly relevant as attackers continue to target zero-day and rapidly weaponized browser flaws, reflecting a broader trend of exploiting client-side vulnerabilities to bypass traditional network defenses. Regulatory and industry pressure for rapid patch management and strong endpoint protection is intensifying as attackers' tactics evolve.
8 months ago
Kill Chain
Iran-Nexus UNC1549 Targets Aerospace: 2024 Cyberattack Details
In early 2024, the Iranian-aligned threat actor group identified as UNC1549 orchestrated targeted cyberattacks against aerospace and defense organizations across the US, Israel, UAE, Qatar, Spain, and Saudi Arabia. Researchers discovered that the group leveraged sophisticated spear-phishing campaigns and custom malware implants to infiltrate sensitive networks, focusing primarily on exfiltrating confidential intellectual property and operational data. The campaign showcased advanced persistence techniques and bypassed standard security controls, leading to operational disruption and heightened espionage risk for impacted organizations. These attacks highlight a broader trend of nation-state threat actors increasingly focusing on strategic sectors with evolving tools and tactics. The targeting of multiple geographies underscores the global nature of aerospace security risks and pressing regulatory and compliance expectations.
8 months ago
Kill Chain
Critical Vulnerabilities in Railway Braking Systems Expose OT Security Gaps
In June 2024, security researchers discovered multiple vulnerabilities in the braking systems of modern trains, revealing that low-cost, readily available hardware could be used to exploit weaknesses in operational technology (OT) environments. Attackers demonstrated that by using items such as recycled cans and basic electronics sourced online, they could manipulate communication between the train conductor's controls and the braking systems. The lack of encrypted traffic and segmentation allowed malicious actors to reroute or interrupt braking commands, posing severe safety and operational risks to critical railway infrastructure. This incident underscores a broader trend of cyber-physical risk in OT systems, where traditional safety assumptions are being undermined by the exposure of legacy protocols and weak internal controls. As rail operators increasingly digitize and connect systems, adversaries have more opportunities to exploit gaps in lateral defenses and traffic security.
8 months ago
Kill Chain
Anatomy of an Akira Ransomware Attack: 42 Days Hidden After a Fake CAPTCHA
In early 2024, a sophisticated cyberattack attributed to the Akira ransomware group exploited a fake CAPTCHA page to infiltrate an organization's environment. Attackers used this social engineering technique as an entry point, deploying malware that enabled persistent access and undetected movement across internal systems for 42 days. During this period, lateral movement and privilege escalation allowed the attackers to exfiltrate data and ultimately deploy ransomware, encrypting vital business assets and causing significant operational disruption. The incident illustrates how modern ransomware actors leverage stealth, deception, and extended dwell times to maximize their impact. This case underscores an escalating trend of increasingly complex and targeted ransomware attacks that blend technical exploitation with effective social engineering. Organizations are being challenged to enhance east-west traffic security, real-time threat detection, and zero trust segmentation to counter these evolving threats.
8 months ago
Kill Chain
CISA 2025 Issues Guidance to Mitigate Bulletproof Hosting Provider Risks
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA), together with the NSA, FBI, Department of Defense Cyber Crime Center, and international partners, released comprehensive guidance to combat risks posed by Bulletproof Hosting Providers (BPHs). BPHs are infrastructure providers that knowingly lease servers and networking resources to cybercriminals, enabling ransomware, phishing, malware distribution, and denial-of-service attacks at scale. The guidance urges Internet Service Providers and network operators to apply blocklists, traffic analysis, intelligence sharing, and stronger vetting to prevent malicious actors from exploiting BPH resources, aiming to bolster the digital resilience of critical infrastructure sectors globally. The ongoing proliferation of cyberattacks leveraging BPH infrastructure underscores the urgency of these recommendations. With threat actors increasingly turning to anonymized, resilient hosting to evade law enforcement and detection, proactive mitigation by ISPs is crucial to limiting damage and strengthening industry-wide cybersecurity defense.
8 months ago
Kill Chain
Fortinet FortiWeb Zero-Day Abuse: 2024 Attack Highlights Security Device Risks
In June 2024, Fortinet disclosed a critical zero-day vulnerability in its FortiWeb web application firewall that was being actively exploited in the wild. Threat actors leveraged the unknown flaw to gain unauthorized access to targeted organizations, bypassing authentication and potentially altering application configurations or exfiltrating sensitive data. Fortinet responded promptly by releasing security patches and urging customers to update affected devices, while security researchers warned this campaign was already impacting several organizations before public disclosure. This incident is part of a growing trend of sophisticated attacks targeting network and security appliances through undisclosed vulnerabilities. Organizations face heightened risk as attackers weaponize zero-days more quickly, making swift patch management and layered controls essential to defending digital infrastructure.
8 months ago
Kill Chain
Google Chrome 2024 Zero-Day Exploited in the Wild: What You Need to Know
In June 2024, Google disclosed and patched a critical zero-day vulnerability in the Chrome web browser (CVE-2024-5274) that had actively been exploited in the wild. Attackers leveraged a type confusion flaw in Chrome’s V8 JavaScript engine to execute arbitrary code on victim devices, enabling full compromise of targeted systems. Google's rapid response—releasing an emergency security update—helped mitigate exploitation risks. The vulnerability represented the seventh zero-day affecting Chrome this year, underscoring persistent targeting of popular browsers for initial access into corporate and consumer environments. This incident illustrates the sustained threat posed by browser zero-days and the increasing velocity with which attackers are weaponizing new flaws. As web browsers remain a ubiquitous endpoint attack vector, organizations must ensure rapid patch cycles and layered security controls to limit exposure.
8 months ago
Kill Chain
Tycoon 2FA: How Phishing-as-a-Service Broke Legacy MFA at Scale in 2024
In 2024, cybercriminals leveraged the Tycoon Phishing-as-a-Service (PaaS) platform to orchestrate over 64,000 successful real-time attacks bypassing legacy multi-factor authentication (MFA) with relay-based phishing toolkits. Tycoon allowed even low-skilled attackers to automate the interception and relay of users’ MFA tokens, defeating common one-time passcodes and push-based authentication. This Phishing-as-a-Service campaign targeted a wide array of industries and organizations, exposing user credentials and compromising sensitive systems at scale. The incident underscores the urgent collapse of legacy MFA methods under modern, scalable phishing threats. The widespread exposure from Tycoon demonstrates how phishing-resistant authentication (such as FIDO2 hardware tokens and biometrics) are now critical. Regulatory agencies and security experts have since elevated calls for organizations to rapidly phase out vulnerable MFA in favor of hardware-backed solutions, as attackers weaponize automated, scalable PaaS infrastructure.
8 months ago
Kill Chain
Pajemploi Data Breach Exposes 1.2 Million French Citizens: What Went Wrong?
In June 2024, French public agency Pajemploi, responsible for social security management for parents and home childcare providers, suffered a large-scale data breach. Attackers exploited a flaw in the agency's online system that enabled them to access personal data belonging to approximately 1.2 million individuals, including names, addresses, social security numbers, bank details, and tax identification data. The breach was discovered after abnormal activity was detected, and Pajemploi acted swiftly to close the vulnerability, notify affected users, and inform regulatory authorities, including France's data privacy regulator CNIL. The incident temporarily restricted access to certain online services for impacted users. This breach highlights the ongoing targeting of government and public-sector databases holding sensitive citizen data. With regulatory requirements such as GDPR placing heavy penalties on agencies that fail proper controls, the Pajemploi incident underscores the urgency of robust data protection, zero trust segmentation, and advanced anomaly detection across Europe’s digital public services.
8 months ago
Kill Chain
Google Chrome’s 2025 V8 Zero-Day: What Organizations Must Do After the Latest Exploit
In June 2025, Google disclosed an actively exploited zero-day vulnerability (CVE-2025-13223) in the V8 JavaScript and WebAssembly engine powering Chrome. Attackers leveraged this type confusion flaw to execute arbitrary code or trigger program crashes, enabling them to compromise vulnerable browsers. Google promptly released patches to address the flaw after receiving reports of in-the-wild exploitation. At-risk users included anyone running unpatched Chrome versions across platforms, with attackers potentially able to hijack sessions, install malware, or steal sensitive data simply by enticing users to visit a malicious web page. This incident highlights the persistent risks posed by emerging browser vulnerabilities, as both sophisticated threat actors and opportunistic cybercriminals increasingly exploit zero-day flaws for rapid compromise. Security teams face mounting urgency to prioritize browser patching cycles to counter fast-moving, exploitation-ready threats.
8 months ago
Kill Chain
Microsoft Thwarts Record-Breaking 15.72 Tbps DDoS Attack Orchestrated by AISURU Botnet
In November 2025, Microsoft successfully detected and mitigated an unprecedented Distributed Denial-of-Service (DDoS) attack that peaked at 15.72 Tbps, targeting a cloud endpoint in Australia. The attack, orchestrated by the AISURU botnet leveraging TurboMirai-class malware, generated nearly 3.64 billion packets per second. Advanced protections within Microsoft's Azure platform automatically neutralized the threat before it could affect customer availability or data. Microsoft attributed the attack to highly automated botnets leveraging compromised IoT devices and observed a rapid, multi-vector assault designed to test cloud resilience and incident response. This record-breaking event highlights the escalating scale and sophistication of DDoS activity targeting foundational cloud infrastructure. As attackers exploit larger IoT botnets and novel malware strains, defenders face mounting pressure to evolve detection and mitigation at cloud-scale. Organizations must increasingly invest in robust DDoS protection and continuously monitor for emerging threats.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports