Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3246 threat reports
Page 198 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 2365–2376 / 3246 reports
Critical RCE Flaw in Hitachi Energy Asset Suite: Jasper Report Vulnerability Exposes Critical Infrastructure (2025)
Utilities10 months ago

Critical RCE Flaw in Hitachi Energy Asset Suite: Jasper Report Vulnerability Exposes Critical Infrastructure (2025)

In December 2025, Hitachi Energy disclosed a critical remote code execution (RCE) vulnerability (CVE-2025-10492) affecting its Asset Suite product versions 9.7 and prior. The flaw, found in the Jasper Report third-party component, arises from improper deserialization of untrusted data, allowing attackers to remotely execute arbitrary code on affected systems. The vulnerability particularly impacts organizations using Asset Suite in critical infrastructure sectors, such as energy, potentially exposing operational networks to severe risks of compromise, data breach, or service disruption. This incident underscores the persistent threat posed by supply chain vulnerabilities in industrial control software. As threat actors increasingly target critical infrastructure through third-party and open-source components, organizations face heightened regulatory scrutiny and an urgent need for robust patch and mitigation strategies to close compliance and security gaps.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
D-Link Router Zero-Day Exploited in 2024: A Network Infrastructure Wake-Up Call
Telecommunications10 months ago

D-Link Router Zero-Day Exploited in 2024: A Network Infrastructure Wake-Up Call

In early 2024, security researchers identified active exploitation of a zero-day vulnerability affecting end-of-life D-Link DSL routers. Attackers leveraged the unpatched flaw to execute arbitrary code remotely, enabling them to gain full control over susceptible devices. The campaign targets legacy router models no longer supported with firmware updates, resulting in thousands of home and small-office networks being exposed to malware infection, data interception, and lateral movement within internal networks. Public disclosure led to warnings from multiple security vendors, though permanent remediation is unavailable due to the unsupported status of affected models. This incident highlights the ongoing risks posed by obsolete network infrastructure and the trend of threat actors exploiting unmaintained IoT and edge hardware. As organizations depend on interconnected devices, lack of timely decommissioning and patch management creates persistent attack surfaces for cybercriminals.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Veeam Patches Critical Operator RCE Vulnerability in Backup Software
Information Technology/IT10 months ago

Veeam Patches Critical Operator RCE Vulnerability in Backup Software

In early June 2025, Veeam identified and patched a critical security flaw (CVE-2025-59470) in its Backup & Replication v13 software. The vulnerability allows users with the privileged 'Backup Operator' or 'Tape Operator' roles to gain remote code execution capabilities by sending crafted interval or order settings, ultimately permitting execution of commands as the service's database user. While the flaw was discovered through internal testing and no exploitation in the wild has been reported, organizations running affected software faced serious operational and data security risks until patched. This incident underscores the trend of attackers targeting privileged IT roles and backup platforms to gain persistent, high-impact access. As regulatory pressure to secure sensitive data intensifies and threats against backup infrastructure become more sophisticated, timely patching and principle of least privilege are more critical than ever.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Veeam 2026 RCE Vulnerability: Ransomware’s Direct Path into Enterprise Backups
Information Technology/IT10 months ago

Veeam 2026 RCE Vulnerability: Ransomware’s Direct Path into Enterprise Backups

In January 2026, Veeam disclosed several critical vulnerabilities affecting its popular Backup & Replication software platform, including CVE-2025-59470—a remote code execution (RCE) flaw that allowed highly privileged Backup or Tape Operators to execute arbitrary code as the postgres user by manipulating input parameters. While the vulnerability required high privileges, threat actors have a history of targeting Veeam's backup systems to gain lateral access, destroy backups, and enable ransomware attacks, especially given the software's widespread deployment across large enterprises. Notably, historic ransomware operations such as Cuba, FIN7, Akira, and Frag have exploited Veeam flaws to undermine business continuity, infect victim networks, and erase recovery options. This incident underscores the ongoing threat of ransomware actors prioritizing backup infrastructure as a major attack vector, leveraging RCE flaws to cripple organizations’ resilience. The rapid evolution and regular targeting of backup systems show a critical need for enforced least privilege, defense-in-depth for privileged roles, and prompt patch deployments, particularly as backup environments remain frequent targets for sophisticated attackers seeking maximal impact.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Misconfigured Email Routing Enables Sophisticated Internal Domain Phishing Attacks
Financial Services10 months ago

Misconfigured Email Routing Enables Sophisticated Internal Domain Phishing Attacks

In early 2026, Microsoft disclosed that threat actors exploited misconfigured email routing and insufficient spoof protections to impersonate internal organizational domains. Attackers leveraged these configuration flaws to bypass domain authentication controls, distributing phishing emails that appeared to originate from trusted internal addresses. Tactics included the use of phishing-as-a-service (PhaaS) platforms like Tycoon 2FA, resulting in credential theft and increased risk of lateral movement within affected organizations. The incident underscored systemic weaknesses in email routing setups and the importance of enforcing secure communication protocols. This attack highlights a growing trend of adversaries abusing overlooked, internal cloud and email infrastructure weaknesses to evade legacy defenses. The prevalence of PhaaS platforms has lowered the barrier for conducting sophisticated phishing campaigns, emphasizing the urgency for organizations to audit and remediate their email and domain configurations against evolving social engineering tactics.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
D-Link Legacy Routers Under Siege: CVE-2026-0625 RCE Flaw Exploited in Active Campaigns
Telecommunications10 months ago

D-Link Legacy Routers Under Siege: CVE-2026-0625 RCE Flaw Exploited in Active Campaigns

In late 2025 and early 2026, a critical security vulnerability (CVE-2026-0625, CVSS 9.3) in legacy D-Link DSL routers was actively exploited, enabling unauthenticated remote code execution. The flaw arises from insufficient input sanitization on the dnscfg.cgi endpoint, allowing attackers to inject arbitrary shell commands and modify DNS settings remotely. As reported by VulnCheck and observed by the Shadowserver Foundation, exploitation affected end-of-life models including DSL-2740R, DSL-2640B, DSL-2780B, and DSL-526B, leading to large-scale DNS hijacking, persistent traffic redirection, and compromised user privacy and security for any device behind these routers. This incident highlights the ongoing risk posed by end-of-life and unsupported network hardware, which remains prevalent in many organizations. The swift weaponization of unauthenticated RCE vulnerabilities in edge devices—especially those lacking patch support—underscores the need for proactive infrastructure lifecycle management, supply chain visibility, and robust segmentation to defend against fast-evolving infrastructure-targeted threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Veeam Backup & Replication 2026: Critical RCE Flaws and Enterprise Risk
Information Technology/IT10 months ago

Veeam Backup & Replication 2026: Critical RCE Flaws and Enterprise Risk

In January 2026, Veeam disclosed and patched four critical vulnerabilities in its Backup & Replication software, with the most severe (CVE-2025-59470, CVSS 9.0) enabling remote code execution as the postgres user by authorized Backup or Tape Operators. Additional flaws allowed for RCE as root and arbitrary file writes, impacting Veeam Backup & Replication 13.0.1.180 and prior. While exploitation requires highly privileged roles, prior incidents have shown that threat actors rapidly exploit vulnerable backup platforms, risking backup integrity, ransomware proliferation, and data exfiltration. Immediate patching is essential to prevent lateral movement and data loss, per Veeam's and industry guidance. The incident underscores the ongoing risk of privilege abuse and the critical importance of timely vulnerability management in backup infrastructures, especially as threat actors increasingly target backup systems to disable recovery and amplify ransomware impacts.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Black Cat SEO Poisoning Campaign Unleashes Mass Infostealer Outbreak Across China
Computer Software/Engineering10 months ago

Black Cat SEO Poisoning Campaign Unleashes Mass Infostealer Outbreak Across China

Between December 7 and 20, 2025, the cybercrime gang Black Cat orchestrated a large-scale SEO poisoning campaign targeting Chinese users searching for popular software via Microsoft Bing and similar engines. By pushing fraudulent lookalike websites (e.g., mimicking Notepad++, Google Chrome, QQ International, iTools) to the top of search results, Black Cat tricked users into downloading compromised installers. When executed, these installers side-loaded backdoor trojans that exfiltrated sensitive information, such as browser data, keystrokes, and clipboard contents, back to attacker-controlled infrastructure. At least 277,800 hosts were infected in less than two weeks, with daily compromise rates peaking above 62,000 machines. This campaign marks a significant escalation in the use of SEO poisoning for initial malware access, reflecting a trend in highly targeted, financially motivated infostealer operations. As search engines become the go-to for software discovery, this incident strongly highlights the risks of relying on unverified download sources and demonstrates attackers' growing sophistication in exploiting user trust.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
GRU’s BlueDelta Targets Energy and Research: Advanced Credential Phishing in 2025
Oil/Energy/Solar/Greentech10 months ago

GRU’s BlueDelta Targets Energy and Research: Advanced Credential Phishing in 2025

Between February and September 2025, the Russian state-sponsored threat group BlueDelta (APT28/GRU) conducted a series of targeted credential-harvesting attacks, focusing on organizations in Türkiye, Europe, North Macedonia, and Uzbekistan. The attackers deployed sophisticated phishing lures themed as Microsoft Outlook Web Access, Google, and Sophos VPN portals, abusing free hosting and tunneling services such as Webhook.site and ngrok to capture credentials and exfiltrate data. Victims were redirected through multi-stage phishing chains, and legitimate PDF documents were used to enhance believability and evade detection, ultimately supporting Russian intelligence collection. This incident underlines the evolution of state-sponsored phishing techniques, including automation for credential exfiltration and the increasing abuse of legitimate internet infrastructure. The campaign’s focus on energy and defense sectors reflects heightened geopolitical interest and reinforces the urgent need for robust email and identity security practices across sensitive organizations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Flags New Code Injection Threats in 2026: HPE OneView & Microsoft Office Under Attack
Government Administration10 months ago

CISA Flags New Code Injection Threats in 2026: HPE OneView & Microsoft Office Under Attack

On January 7, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) Catalog after confirming active exploitation of two critical code injection vulnerabilities: CVE-2009-0556 in Microsoft Office PowerPoint and CVE-2025-37164 affecting HPE OneView. Attackers leveraged these vulnerabilities to gain unauthorized code execution, potentially enabling lateral movement and data compromise within federal and enterprise environments. The exploitation highlighted weaknesses in outdated software and emphasized the urgency for immediate remediation to safeguard sensitive systems and data across government agencies and broader sectors. The rapid addition of these vulnerabilities to CISA's KEV Catalog reflects a broader industry trend of threat actors targeting lingering, unpatched software with advanced code injection techniques. Increasing regulatory pressure and new threat intelligence underscore the need for timely vulnerability management as attackers adapt to bypass existing defenses.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
How NoName057(16) Used DDoSia to Drive Hacktivist DDoS Attacks in 2024
Government Administration10 months ago

How NoName057(16) Used DDoSia to Drive Hacktivist DDoS Attacks in 2024

In early 2024, the pro-Russian hacktivist group NoName057(16) leveraged their custom DDoS tool, DDoSia, to orchestrate large-scale distributed denial-of-service attacks targeting government, media, and institutional websites in Ukraine and Western countries. By mobilizing a network of volunteer participants through its affiliate model, NoName057(16) was able to coordinate and intensify attacks, resulting in substantial website downtime and service disruptions for organizations with links to Ukraine and the West. The campaign highlighted the effectiveness of modern hacktivist crowd-sourcing tactics and the increasing difficulty of defending against well-organized, politically motivated DDoS operations. This incident is particularly relevant in 2024 as DDoS-as-a-service tools and volunteer-driven hacktivist campaigns are on the rise, blurring the lines between state-driven threats and amateur activism. Organizations should review their DDoS mitigation and incident response defenses amid heightened geopolitical tensions and expanding threat capabilities among hacktivist collectives.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How the 2020 Venezuelan Power Grid Cyberattack Set a New Precedent for Nation-State Warfare
Utilities10 months ago

How the 2020 Venezuelan Power Grid Cyberattack Set a New Precedent for Nation-State Warfare

In May 2020, Venezuela experienced a significant power grid disruption that coincided with an alleged US-backed military incursion. Intelligence sources and public statements, including hints from President Trump, suggested that nation-state cyber actors played a role in disabling critical infrastructure, likely by targeting unencrypted or poorly segmented network traffic in Caracas. The incident demonstrated the attackers’ use of advanced cyber capabilities to disrupt the nation's power supply, contributing to confusion and vulnerability during a period of political unrest. While the precise techniques remain classified, the attack highlighted significant weaknesses in Venezuela’s critical industrial control systems and network segmentation. The relevance of this event endures as cyber operations against power grids and critical infrastructure grow more sophisticated and frequent globally. Recent years have seen a surge in state-sponsored attacks leveraging both advanced persistent threats and rapid lateral movement, making robust east-west security, zero trust practices, and encrypted traffic defenses urgent imperatives for organizations.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports