Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 2 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 13–24 / 3243 reports
Zyxel GS1900 Zero-Day: How a Faulty Patch Left 996 Switches Open to Root Takeover by Red Heron
Zyxel GS1900 Zero-Day: How a Faulty Patch Left 996 Switches Open to Root Takeover by Red Heron
Government Administration3 days ago

Zyxel GS1900 Zero-Day: How a Faulty Patch Left 996 Switches Open to Root Takeover by Red Heron

In August 2026, a Chinese-speaking threat actor tracked as Red Heron exploited an unauthenticated remote code execution vulnerability in Zyxel GS1900-series managed switches to harvest configuration data, hashed root credentials, and network topology details from 996 devices. The attackers leveraged an out-of-bounds write flaw (CVE-2026-107441) in the switch's web management handler—a flaw that Zyxel's earlier Patch 2 firmware (CVE-2026-7273) failed to fully remediate because the size check was applied after the malicious parameter had already been copied into memory. Commands executed with root privileges. Zyxel released Patch 3 firmware across ten GS1900 models on October 23, 2026, providing the authoritative fix. This incident exposes a persistent and dangerous pattern: vendor patches that address a symptom while leaving the underlying memory-safety defect exploitable. With CISA's KEV catalog still not listing CVE-2026-107441 as of early November 2026, organizations that believed they were protected by Patch 2 remain silently exposed—underscoring the risk of trusting patch compliance alone without runtime network controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
SlippyNunchucks and the Sogou Trap: How a Chinese IME's HTTP Gap Became a Nation-State Espionage Vector
SlippyNunchucks and the Sogou Trap: How a Chinese IME's HTTP Gap Became a Nation-State Espionage Vector
Gambling/Casinos3 days ago

SlippyNunchucks and the Sogou Trap: How a Chinese IME's HTTP Gap Became a Nation-State Espionage Vector

Beginning July 1, 2026, the China-aligned APT group SlippyNunchucks exploited an unencrypted HTTP endpoint within Sogou Input Method's brand promotion mechanism to deliver the DarkVigil espionage implant (also tracked as FDMTP) to victims across Hong Kong, Thailand, Japan, Vietnam, Oman, and Sri Lanka. By hijacking DNS resolution of config.pinyin.sogou[.]com and redirecting traffic to attacker-controlled staging servers, SlippyNunchucks served a malicious AES-256-CBC encrypted configuration that instructed the legitimate SGTool.exe component to download and side-load the DarkVigil implant via DLL hijacking. The group had previously abused the QuickFox supply chain before pivoting to this DNS hijacking technique. Tencent released a patched version (16.10) on October 30, 2026, migrating the affected requests to HTTPS with certificate pinning. This incident highlights a growing trend among China-aligned APT actors of weaponizing trusted, widely installed software used by Chinese-speaking diaspora communities to conduct persistent surveillance. The abuse of legitimate application update and configuration mechanisms—rather than zero-day exploits—underscores the difficulty of detecting such campaigns and the critical importance of enforcing encrypted transit for all application communications.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
You've Got (Graph) Mail: How Attackers Are Silently Exfiltrating Microsoft 365 Data via Graph API Webhooks
You've Got (Graph) Mail: How Attackers Are Silently Exfiltrating Microsoft 365 Data via Graph API Webhooks
Financial Services3 days ago

You've Got (Graph) Mail: How Attackers Are Silently Exfiltrating Microsoft 365 Data via Graph API Webhooks

In November 2026, NetSPI disclosed a post-exploitation data exfiltration technique leveraging Microsoft Graph API Change Notifications (Rich Notifications) to silently siphon Outlook emails and Microsoft Teams messages from compromised Microsoft 365 tenants. By registering attacker-controlled webhook subscriptions using pre-consented delegated permissions from Microsoft first-party apps such as Microsoft Office, adversaries can redirect live message content—including email previews and full Teams chat bodies—to external endpoints entirely through Microsoft's own infrastructure. No direct access to mailboxes or Teams channels is required after initial token compromise, and no dedicated Entra Admin portal blade exists to surface active subscriptions, making detection extremely difficult without specific KQL queries against Graph Activity Logs. This technique highlights a broader pattern of living-off-the-land cloud attacks where adversaries abuse legitimate platform features—API subscriptions, OAuth tokens, and pre-consented app scopes—to exfiltrate sensitive data while evading traditional DLP and network-based controls. As Microsoft 365 adoption deepens across regulated industries, identity-centric and API-layer attack techniques are rapidly becoming the dominant post-compromise exfiltration vector.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
APT29's Zero-Click Mobile Campaign: How Russian Hackers Silently Stole Credentials from iOS and Android Devices
APT29's Zero-Click Mobile Campaign: How Russian Hackers Silently Stole Credentials from iOS and Android Devices
Government Administration4 days ago

APT29's Zero-Click Mobile Campaign: How Russian Hackers Silently Stole Credentials from iOS and Android Devices

In late 2026, APT29 (Midnight Blizzard), a Russian state-sponsored threat group, executed a large-scale watering hole campaign targeting iOS and Android users across the U.S., Ukraine, Czech Republic, and Bulgaria. Attackers compromised legitimate high-profile websites and created lookalike domains to deliver JavaScript profiling payloads that fingerprinted visitor devices and browser versions. Based on device type, a tailored n-day exploit chain was silently deployed—requiring zero user interaction—to harvest Safari cookies, WhatsApp and Telegram databases, Keychain credentials, location data, photos, and Chrome login data. The campaign also subverted the Plerdy Ukrainian web analytics tracker, briefly exposing thousands of downstream sites. This campaign underscores a critical shift in nation-state tradecraft: supply chain compromise of analytics scripts combined with zero-click mobile exploitation eliminates traditional phishing dependencies entirely. As mobile devices become primary endpoints for sensitive communications, credential theft via browser-level n-day exploits represents a rapidly escalating threat vector that bypasses conventional endpoint defenses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds WordPress RCE CVE-2026-119977 to KEV Catalog: What Security Teams Must Do Now
CISA Adds WordPress RCE CVE-2026-119977 to KEV Catalog: What Security Teams Must Do Now
Government Administration4 days ago

CISA Adds WordPress RCE CVE-2026-119977 to KEV Catalog: What Security Teams Must Do Now

In late October 2026, the WordPress security team patched a high-severity remote code execution vulnerability (CVE-2026-119977) rooted in a Time-of-Check Time-of-Use race condition within WordPress Core's upgrade process. Attackers can exploit predictable, web-accessible staging paths during full-package core upgrades to execute arbitrary code on unpatched servers without requiring authentication privileges. CISA confirmed active exploitation on November 3, 2026, adding the flaw to its Known Exploited Vulnerabilities catalog and ordering FCEB agencies to patch by November 7. WordPress security firm Wordfence reported blocking over 13,000 attacks targeting this vulnerability within a single 24-hour window, underscoring rapid and widespread threat actor adoption. This incident follows a pattern of accelerating WordPress Core exploitation in 2026, including the wp2shell chain (CVE-2026-63030, CVE-2026-60137) weaponized by Chinese-speaking threat actors to exfiltrate data from over 18,500 records across government and small business databases. The convergence of unauthenticated RCE, short patch-to-exploit timelines, and nation-state interest in WordPress infrastructure signals a sustained and escalating threat to web-facing organizations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
SonicWall GMS End-of-Life: Two Unpatched CVEs with No Fix—What Your Security Team Must Do Now
SonicWall GMS End-of-Life: Two Unpatched CVEs with No Fix—What Your Security Team Must Do Now
Government Administration4 days ago

SonicWall GMS End-of-Life: Two Unpatched CVEs with No Fix—What Your Security Team Must Do Now

In November 2026, SonicWall disclosed two unpatched vulnerabilities—CVE-2026-109593 and CVE-2026-109594—affecting its end-of-life Global Management System (GMS) versions 9.5.2 and earlier. CVE-2026-109593 allows unauthenticated attackers with network access to read internal files and exfiltrate sensitive information, while CVE-2026-109594 enables high-privilege adversaries to perform SQL injection attacks against the GMS database. Because GMS has reached end-of-life status, SonicWall confirmed no patches will be issued, urging all customers to migrate immediately to the Network Security Manager (NSM) platform. Organizations delaying migration face unremediated, permanent exposure across a management plane that oversees thousands of security appliances simultaneously. This disclosure is part of a sustained pattern of SonicWall vulnerability exploitation in 2026, with CISA cataloguing 19 SonicWall flaws over four years—13 tied to active ransomware campaigns. The convergence of EOL software, unpatched critical CVEs, and a historically targeted vendor creates compounding risk that defenders must treat as an active threat, not a future upgrade consideration.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Zyxel Zero-Day CVE-2026-107441: How Kapibala Bypassed a Patch to Compromise 1,000 Network Switches
Zyxel Zero-Day CVE-2026-107441: How Kapibala Bypassed a Patch to Compromise 1,000 Network Switches
Government Administration4 days ago

Zyxel Zero-Day CVE-2026-107441: How Kapibala Bypassed a Patch to Compromise 1,000 Network Switches

In mid-2026, a suspected Chinese-speaking threat actor tracked as Kapibala exploited a zero-day vulnerability (CVE-2026-107441) in Zyxel GS1900 series network switches, compromising nearly 1,000 devices across 48 countries. Initial attribution pointed to a previously patched flaw (CVE-2026-7273), but firmware security firm Binarly discovered the attackers had developed an exploit that bypassed the June 2026 patch entirely by corrupting a parameter counter before validation. The attackers executed unauthenticated remote commands, downloaded scripts to harvest device configurations, hashed root credentials, and network topology data. Zyxel released remediation firmware on October 22, 2026, after confirming the new vulnerability on October 11. This incident is part of a broader pattern of state-linked actors targeting network edge infrastructure to establish persistent footholds and harvest credentials. The Kapibala group's linkage to the Red Heron campaign—which also deployed the JITTERLY backdoor and SIXZUT rootkit—signals a maturing, multi-vector threat posture that specifically targets unpatched or recently patched network devices as entry points into enterprise and government environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Root-Level Takeover via APT: How CVE-2026-109518 Turns a Package Retry into a Supply-Chain Weapon
Root-Level Takeover via APT: How CVE-2026-109518 Turns a Package Retry into a Supply-Chain Weapon
Information Technology/IT4 days ago

Root-Level Takeover via APT: How CVE-2026-109518 Turns a Package Retry into a Supply-Chain Weapon

On November 4, 2026, Debian, Ubuntu, and APT developers disclosed CVE-2026-109518, a critical vulnerability in the APT package manager affecting Debian 12+ and Ubuntu 22.04+. An attacker positioned as a man-in-the-middle — such as a malicious mirror, rogue proxy, or network interceptor — can exploit APT's default retry behavior (Acquire::Retries) to substitute a verified package with a malicious one during download, triggering arbitrary code execution as root at install time. The flaw carries a CVSS 4.0 score of 7.7 and affects all distributions built on Debian and Ubuntu. Patched APT versions were released the same day for Ubuntu 22.04 through 26.10 and Debian 11+, though Debian's testing branch remained on the vulnerable version hours after disclosure. This incident underscores the growing threat of supply-chain attacks targeting open-source package infrastructure. As enterprise Linux deployments proliferate across hybrid and multi-cloud environments, unencrypted or insufficiently monitored package-update traffic becomes a viable attack surface, making network-layer controls and transit encryption essential complements to patch management.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ARTEX Agentic AI Turns ConnectWise Into a Supply Chain Weapon: What the October 2026 Attack Reveals About AI-Driven Cloud Threats
ARTEX Agentic AI Turns ConnectWise Into a Supply Chain Weapon: What the October 2026 Attack Reveals About AI-Driven Cloud Threats
Financial Services4 days ago

ARTEX Agentic AI Turns ConnectWise Into a Supply Chain Weapon: What the October 2026 Attack Reveals About AI-Driven Cloud Threats

Between October 10–15, 2026, a suspected Chinese state-aligned threat actor deployed ARTEX, a Go-based multi-agent LLM penetration-testing framework, to execute an automated supply chain attack against ConnectWise Cloud Backup, compromising hundreds of global organizations across aerospace, defense, energy, financial services, government, and technology sectors. The attackers generated over 151,000 failed logon events via AI-driven password spraying, then abused pre-granted OAuth permissions to authenticate into downstream Microsoft 365 tenants without interactive logins. AI agents ran Microsoft Graph operations to perform directory reconnaissance, escalate privileges, and implant persistent OAuth backdoors—reducing time-to-privileged-access to under three hours per environment. This incident marks a watershed moment in offensive AI adoption: nation-state actors are now operationalizing autonomous agentic frameworks to compress attack timelines from days to hours, pivot across multi-tenant cloud architectures at machine speed, and leave persistent backdoors that survive primary remediation efforts. The convergence of AI-augmented intrusion and supply chain compromise demands immediate reassessment of cloud identity governance, OAuth application controls, and east-west segmentation strategies.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Black October 2026: How Chained Exploits Rooted Government Firewalls and What Cloud Network Security Teams Must Do Now
Black October 2026: How Chained Exploits Rooted Government Firewalls and What Cloud Network Security Teams Must Do Now
Government Administration4 days ago

Black October 2026: How Chained Exploits Rooted Government Firewalls and What Cloud Network Security Teams Must Do Now

In late October 2026, a coordinated cluster of critical vulnerabilities collectively branded 'Black October' rocked enterprise security teams worldwide. Threat actors actively chained PHP2SHELL — a heap-memory RCE flaw affecting roughly 70% of web servers — with Fragnesia (CVE-2026-46300), a Linux kernel privilege-escalation bug in the XFRM ESP-in-TCP subsystem, to achieve unauthenticated root access on 25 PAN-OS firewall and management servers across the United States, Japan, Taiwan, and South Korea, including three U.S. government-affiliated systems. Simultaneously, a critical memory-corruption flaw in the Brotli decoder (CVE-2026-111497, CVSS 9.2), dubbed Node2Shell, surfaced after a silent upstream fix went unannounced for eight months, exposing Node.js, Python, and .NET runtimes to remote code execution. CISA issued KEV mandates for all three CVEs, requiring federal agencies to patch within tight deadlines. These chained exploit campaigns signal a maturing attacker playbook in which no single patch is sufficient: closing the web-shell entry point leaves the kernel escalation path open, and proxy-level filtering cannot protect against library-level decompression flaws. Security teams must adopt layered network enforcement — inline inspection, east-west segmentation, and egress control — alongside aggressive patching to contain blast radius.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
69GB in 24 Minutes: How Attackers Drained Philippine Migrant Worker Records from an Unguarded Government Server
69GB in 24 Minutes: How Attackers Drained Philippine Migrant Worker Records from an Unguarded Government Server
Government Administration4 days ago

69GB in 24 Minutes: How Attackers Drained Philippine Migrant Worker Records from an Unguarded Government Server

In late October 2026, an unidentified threat actor breached the Philippine Overseas Employment Administration (POEA), exfiltrating approximately 69GB of sensitive data across 27 SQL Server backup databases in under 25 minutes. The attacker leveraged privilege escalation tools GodPotato and SeImpersonate alongside the Impacket Python library to move data to an open staging server hosted on UpCloud infrastructure in Singapore. Stolen records encompassed overseas-employment case management, accreditation files, contracts, and financial records including LandBank data. Threat intelligence firm Hunt.io discovered the breach by identifying an exposed open directory containing attack tools and transfer logs, though attribution remains unconfirmed. This incident underscores a troubling pattern of under-secured government portals in Southeast Asia being targeted for high-value diaspora PII. The combination of overprivileged service accounts, exposed management ports (SMB 445, WinRM 5985/47001), and the absence of egress controls enabled a rapid, high-volume exfiltration that mirrors tactics increasingly observed against public-sector entities across the Asia-Pacific region.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-58868: Google's Critical Android RCE Flaw Needs No Click — What Enterprises Must Do Now
CVE-2026-58868: Google's Critical Android RCE Flaw Needs No Click — What Enterprises Must Do Now
Telecommunications4 days ago

CVE-2026-58868: Google's Critical Android RCE Flaw Needs No Click — What Enterprises Must Do Now

In November 2026, Google disclosed CVE-2026-58868, a critical remote code execution vulnerability affecting Android versions 14 through 17, rooted in a heap buffer overflow within the FrameDecoder.cpp onOutputReceived function. The flaw requires no user interaction, enabling a remote attacker to execute arbitrary code silently on unpatched devices. Google's November 2026 security bulletin catalogued 216 vulnerabilities, 23 rated Critical, including a second zero-interaction flaw, CVE-2026-58882, capable of crashing emergency calls via a malformed WAP Push SMS. Patches were assigned to the 2026-11-01 and 2026-11-05 security patch levels, with distribution dependent on individual OEM and carrier schedules. Zero-interaction RCE vulnerabilities in mobile operating systems represent an escalating threat class, as they require no phishing lure or social engineering. With public proof-of-concept code already circulating for the related SMS denial-of-service flaw, the window between disclosure and active exploitation continues to narrow, increasing enterprise risk for unmanaged or BYOD Android endpoints.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports