Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3246 threat reports
Page 199 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 2377–2388 / 3246 reports
State-Sponsored Cyberattack: US Targets Venezuelan Power Grid (2019)
Utilities10 months ago

State-Sponsored Cyberattack: US Targets Venezuelan Power Grid (2019)

In March 2019, a significant power outage crippled Venezuela’s capital, Caracas, and other major cities, reportedly as part of a broader campaign by the United States involving offensive cyber operations. Although official attribution remains classified, senior U.S. officials and President Trump openly hinted at the use of advanced cyberattacks to disrupt Venezuela’s electrical grid during a period of heightened political instability and efforts to capture President Nicolás Maduro. This unprecedented event marked a rare instance of publicized state-sponsored cyber warfare, raising concerns about the direct targeting of national critical infrastructure and its immediate social, political, and economic impact. This incident highlights a growing trend of nations turning to cyber operations as a tool for geopolitical leverage, targeting vital systems with the intent to destabilize adversaries. The weaponization of cyber capabilities against critical infrastructure sets a precedent for both escalation and regulatory scrutiny worldwide.

Medium impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
Generative AI Supercharges Active Directory Credential Attacks in 2026
Financial Services10 months ago

Generative AI Supercharges Active Directory Credential Attacks in 2026

In early 2026, organizations relying on Microsoft Active Directory experienced a significant increase in successful identity attacks fueled by generative AI technology. Threat actors leveraged AI-powered password cracking tools, such as PassGAN, capable of predicting and cracking user passwords with unprecedented speed, particularly by exploiting patterns present in common password creation habits. These attackers combined automated reconnaissance—scraping public data with large language models—to generate highly targeted guesses, accelerating credential compromise, and enabling lateral movement within corporate networks. Weak password policies, reliance on basic MFA, and the wide availability of cost-effective GPU resources contributed to the scale and efficiency of these breaches. This incident highlights the urgent need for organizations to address evolving attack methodologies, as generative AI lowers the technical barrier for credential-focused attacks and shortens breach timetables. The cybersecurity landscape is rapidly shifting towards identity-driven threats facilitated by AI, demanding stronger, adaptive protections to prevent widespread compromise.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Ransomware at Sedgwick Government Solutions: What the 2026 TridentLocker Breach Reveals
Government Administration10 months ago

Ransomware at Sedgwick Government Solutions: What the 2026 TridentLocker Breach Reveals

In January 2026, Sedgwick confirmed a security incident at its subsidiary, Sedgwick Government Solutions, a contractor serving over 20 U.S. federal agencies including CISA, DHS, and the U.S. Coast Guard. The breach was perpetrated by the TridentLocker ransomware group, which claimed to have stolen 3.39 GB of sensitive documents and subsequently leaked data on its Tor site. The attackers gained access via an isolated file transfer system; however, Sedgwick asserts no evidence of compromise to core claims servers or operational disruption. External cybersecurity experts and law enforcement were immediately engaged, and affected systems were properly segmented from the wider parent company network. This incident highlights the increased targeting of government contractors by ransomware operators and underscores the importance of network segmentation, prompt incident response, and continuous monitoring. The breach reflects growing regulatory and client demands for transparent reporting and robust data protection as ransomware groups escalate their tactics.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Tenfold Spike: Chinese State Cyberattacks on Taiwan’s Energy Sector in 2025
Oil/Energy/Solar/Greentech10 months ago

Tenfold Spike: Chinese State Cyberattacks on Taiwan’s Energy Sector in 2025

In 2025, Taiwan experienced a dramatic surge in cyberattacks against its energy sector, with incidents increasing tenfold compared to the previous year, as reported by the country's National Security Bureau. Chinese nation-state groups, such as BlackTech, Flax Typhoon, Mustang Panda, APT41, and UNC3886, orchestrated targeted campaigns that leveraged hardware and software vulnerabilities, DDoS, social engineering, and supply-chain tactics. These attacks predominantly focused on industrial control systems and aimed to implant malware during key software upgrade windows, affecting vital infrastructure in petroleum, electricity, and natural gas domains and raising geopolitical and operational security concerns. This incident highlights the persistent threat of coordinated nation-state cyber activity against critical infrastructure, especially during politically sensitive periods. The tactics and techniques observed reflect global trends in the exploitation of operational technology and underscore the increasing need for advanced defense and cross-border intelligence sharing.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Ransomware 2026: Inside the Surge of DDoS, Insiders, and Gig Worker Threats
Financial Services10 months ago

Ransomware 2026: Inside the Surge of DDoS, Insiders, and Gig Worker Threats

In early 2026, ransomware groups rapidly adapted their extortion playbooks following a revenue decline, marked by a 47% year-over-year surge in attacks but falling ransom payments. Threat actors broadened tactics—reviving DDoS-for-hire within the Ransomware-as-a-Service (RaaS) model, ramping up recruitment of insiders (including targeting trusted employees and gig workers), and executing data theft via both technical and social attack vectors. Notably, attackers expanded beyond traditional Russian operators, evidencing global proliferation. These methods bypassed conventional defenses, with incidents tracked across multiple sectors and frequently resulting in significant data breaches, operational disruption, and reputational harm. The evolution of ransomware in 2026 highlights a rising urgency for enterprises to harden insider defenses, revisit DDoS mitigation, and validate physical security and third-party access. With attackers exploiting workforce instability, gig economy platforms, and hybrid extortion, a modernized, multi-layered security posture is now critical across all industries.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Columbia Weather Systems MicroServer Critical Firmware Exploits Threaten US Critical Infrastructure
Utilities10 months ago

Columbia Weather Systems MicroServer Critical Firmware Exploits Threaten US Critical Infrastructure

In January 2026, multiple severe vulnerabilities were disclosed in the Columbia Weather Systems MicroServer, impacting critical infrastructure sectors in the United States. Attackers could exploit these flaws—improper restriction of communication channels (CVE-2025-61939), cleartext storage of credentials (CVE-2025-64305), and an exposed webshell with unrestricted shell access (CVE-2025-66620)—to redirect secure connections to malicious devices, gain admin-level web access, and establish persistent shell access with rights to modify or exfiltrate sensitive data. The affected firmware versions allowed attackers with network or admin privileges to perform high-impact actions, risking both operational continuity and data confidentiality for organizations relying on these devices. This incident underscores the growing challenge to secure Internet of Things (IoT) and Industrial Control Systems (ICS), especially as attackers increasingly target insecure firmware, lateral movement vectors, and privileged machine access. Regulatory attention and attacker focus on supply-chain and device firmware attacks continue to intensify, heightening the urgency for proactive remediation and layered ICS defenses.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Insider Threat Reality: US Cyber Pros Caught as BlackCat Ransomware Affiliates
Computer/Network Security10 months ago

Insider Threat Reality: US Cyber Pros Caught as BlackCat Ransomware Affiliates

In 2023, two U.S.-based cybersecurity professionals—formerly employed by major security firms—pleaded guilty to acting as affiliates for the ALPHV/BlackCat ransomware group. The individuals leveraged their insider knowledge and technical expertise to facilitate the deployment of the ransomware, compromising sensitive systems in targeted organizations. By exploiting weaknesses in internal security protocols and bypassing detection mechanisms, they assisted in the encryption of files and extortion of affected businesses, resulting in operational disruptions and significant reputational damage across multiple sectors. This incident highlights an escalating threat posed by insiders with privileged knowledge and skills, who collaborate with sophisticated ransomware groups like BlackCat. The convergence of advanced ransomware-as-a-service operations and trusted industry insiders signals a dangerous shift, amplifying calls for more robust zero trust strategies, stricter network segmentation, and improved insider threat monitoring.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Russia-Aligned Group UAC-0184 Breaches Ukrainian Government via Viber Attack
Government Administration10 months ago

Russia-Aligned Group UAC-0184 Breaches Ukrainian Government via Viber Attack

In early 2025, the Russia-aligned cyber-espionage group UAC-0184 undertook a targeted campaign against Ukrainian military and government organizations. Leveraging the popular Viber messaging platform, the threat actors distributed malicious ZIP archives to infiltrate sensitive networks. Security researchers from the 360 Threat Intelligence Center noted that these operations demonstrated continued intelligence-gathering efforts, employing social engineering tactics and the abuse of trusted communication channels. The attack resulted in the unauthorized access and potential exposure of confidential government and defense information, further escalating the cyber hostilities related to the conflict in Ukraine. This incident highlights a growing trend in the weaponization of encrypted messaging apps for cyber-espionage, as nation-state actors increasingly exploit trusted consumer platforms to bypass traditional enterprise security controls. The breach underscores the urgency for robust east-west traffic monitoring, zero trust segmentation, and advanced detection capabilities across critical sectors.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Mustang Panda’s 2025 Kernel Rootkit: How a Signed Driver Enabled Stealth Espionage in Asia
Government Administration10 months ago

Mustang Panda’s 2025 Kernel Rootkit: How a Signed Driver Enabled Stealth Espionage in Asia

In mid-2025, the Chinese cyber espionage group Mustang Panda deployed a previously undocumented, signed kernel-mode rootkit to secretly load a TONESHELL backdoor variant during targeted attacks against government organizations in Southeast and East Asia—mainly Myanmar and Thailand. Leveraging a stolen legacy digital certificate, the attackers installed a Windows minifilter driver to inject TONESHELL into system processes, evade security controls, and shield their malware and associated files from detection. The backdoor enabled ongoing remote control, data exfiltration, and further malware deployments via encrypted channels, establishing persistent clandestine access. This incident is notable for its innovative use of signed kernel drivers to enhance stealth, resilience, and anti-forensic measures. It reflects a broader trend among sophisticated threat actors who increasingly leverage advanced rootkit technology and certificate abuse to bypass endpoint protections and remain undetected for extended periods.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
US Treasury Lifts Sanctions on Key Intellexa Predator Spyware Figures
Government Administration10 months ago

US Treasury Lifts Sanctions on Key Intellexa Predator Spyware Figures

In December 2025, the U.S. Department of the Treasury’s Office of Foreign Assets Control (OFAC) removed three individuals previously sanctioned for their involvement with Intellexa and its Predator commercial spyware from the Specially Designated Nationals (SDN) list. The individuals—Merom Harpaz, Andrea Nicola Constantino Hermes Gambazzi, and Sara Aleksandra Fayssal Hamou—were linked to leadership and distribution roles within the Intellexa Consortium. Their removal followed a petition and OFAC’s evaluation that they had separated themselves from the Intellexa ecosystem, but no underlying details or independent confirmation were disclosed. The original sanctions stemmed from their roles in developing, distributing, and enabling Predator software, a tool implicated in high-profile surveillance of civil society figures, including journalists and activists, through stealth zero-day and social engineering attacks. This case underscores the continued risks posed by commercial spyware vendors and associated compliance exposures. Ongoing public reporting highlights Predator’s persistent activity despite regulatory efforts, as well as geopolitical pressures that drive international balkanization and new attack trends targeting sensitive sectors. With regulatory frameworks evolving and threat actors shifting tactics, the risk of spyware misuse for human rights abuses and espionage remains acute.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Over 10,000 Fortinet Firewalls Still Exposed to 2FA Bypass Attack in 2026
Financial Services10 months ago

Over 10,000 Fortinet Firewalls Still Exposed to 2FA Bypass Attack in 2026

In early January 2026, it was revealed that over 10,000 Fortinet FortiGate firewalls remain exposed to a critical authentication bypass vulnerability (CVE-2020-12812) first patched by Fortinet in July 2020. Attackers exploit this flaw by manipulating username case sensitivity to bypass two-factor authentication (2FA) on SSL VPNs—allowing unauthorized access to devices with unpatched software and certain LDAP configurations. Despite years of vendor and government warnings, more than 1,300 vulnerable systems in the United States alone are still online, placing organizations at ongoing risk of compromise. The persistence of this five-year-old flaw’s exploitation highlights chronic issues in vulnerability management and patch adoption within network infrastructure. Active targeting by both cybercriminal and state-backed actors, combined with evidence of ransomware deployment, underscores the need for continuous configuration hardening, zero trust adoption, and rapid remediation of exposed security controls.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Phishing Goes Cloud-Native: Google Cloud Application Integration Abused in 2026 Attack
Financial Services10 months ago

Phishing Goes Cloud-Native: Google Cloud Application Integration Abused in 2026 Attack

In early 2026, a sophisticated phishing campaign was uncovered in which cybercriminals leveraged Google Cloud’s Application Integration service to send deceptive emails that mimicked legitimate Google communications. By exploiting the inherent trust in Google’s cloud infrastructure, attackers generated emails from authentic Google addresses, increasing the likelihood of victims engaging with malicious links or sharing sensitive information. According to Check Point researchers, this multi-stage approach enabled attackers to bypass traditional email security measures, posing significant risks to organizations that rely heavily on cloud-based productivity suites for daily operations. This campaign highlights an emerging trend in the abuse of trusted SaaS and cloud platforms for targeted phishing attacks. As adversaries shift toward cloud-native TTPs and social engineering techniques, organizations must enhance detection, improve user awareness, and adapt inline controls to mitigate risks tied to trusted service abuse.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports