Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
China-Linked APT Exploits Windows Shortcut Flaw in 2025 to Breach EU Diplomats
In late 2025, the China-linked threat group UNC6384 orchestrated a targeted cyber espionage campaign against European diplomatic and government institutions. Utilizing a previously unpatched Windows shortcut (LNK) vulnerability, attackers delivered malicious payloads to compromise systems in Hungary, Belgium, Italy, the Netherlands, and Serbia. The group specialized in stealthy lateral movement, data collection, and command-and-control operations while evading standard defenses. As a result, sensitive government data and communications were potentially exposed, undermining national security and international collaboration efforts. This incident underscores the growing sophistication of state-sponsored cyberattacks, intensified by the exploitation of zero-day vulnerabilities and advanced lateral movement techniques. The frequent targeting of government and diplomatic organizations shows a continued evolution in APT tactics and a rising threat to global critical infrastructure.
8 months ago
Kill Chain
2025 Lanscope Zero-Day: Tick APT’s Attack on Corporate Systems
In October 2025, the cyber espionage group Tick (also known as Bronze Butler), believed to be linked to China, exploited CVE-2025-61932—a critical zero-day vulnerability (CVSS 9.3) affecting Motex Lanscope Endpoint Manager. The attackers gained remote SYSTEM-level access to targeted on-premise environments, allowing them to hijack corporate systems and exfiltrate sensitive data. The attack chain involved leveraging the flaw for command execution, facilitating lateral movement and persistence within victim organizations, primarily impacting Japanese and East Asian enterprises. Authorities issued advisory alerts urging immediate remediation to prevent data loss and further intrusions. This incident underscores the growing operational risk posed by nation-state actors exploiting enterprise endpoint vulnerabilities. It highlights an escalation in zero-day weaponization and reinforces the need for robust segmentation, endpoint monitoring, and proactive patch management amid intensifying APT activity and regulatory scrutiny.
8 months ago
Kill Chain
Airstalk Malware: 2025 Nation-State Supply Chain Attack Hits Mobile Device Ecosystems
In October 2025, a suspected nation-state threat actor, tracked as CL-STA-1009, orchestrated a sophisticated supply chain attack involving the novel 'Airstalk' malware. Investigations by Palo Alto Networks Unit 42 revealed that Airstalk exploited the AirWatch mobile device management (MDM) API to gain unauthorized access to victim organizations' internal networks. This enabled adversaries to compromise large numbers of mobile devices, bypass network controls, and pivot laterally within affected systems, causing operational disruption and data loss. The primary targets were organizations with complex supply chains, where the attackers injected malicious code via trusted software providers, highlighting the vulnerabilities inherent in interconnected IT ecosystems. This incident is especially relevant as supply chain attacks become increasingly prevalent, with attackers leveraging trusted third-party relationships to bypass traditional network defenses. Nation-state actors' use of advanced evasion techniques and MDM abuse underscores the need for enhanced visibility, segmentation, and threat detection across distributed and hybrid IT environments.
8 months ago
Kill Chain
2024 Smart Building Zero-Day: Global Infrastructure Exposed
In early 2024, cybersecurity researcher Gjoko Krstic uncovered hundreds of zero-day vulnerabilities within legacy building automation systems still widely deployed in hospitals, schools, and commercial facilities globally. The investigation, codenamed "Project Brainfog," revealed that outdated codebases, some as old as 18 years, exposed critical physical infrastructure to remote compromise by unauthenticated attackers. Exploitable weaknesses in authentication, encryption, and access controls allowed for the manipulation of HVAC, security, and energy systems, putting sensitive environments such as medical and educational facilities at operational risk, and making them potential targets for ransomware and espionage. This incident highlights the growing threat of unpatched operational technology in critical sectors, as attackers increasingly target IoT and building control systems for both sabotage and lateral movement. As digital-physical convergence accelerates, organizations must rapidly modernize and secure these legacy environments to mitigate cascading risks.
8 months ago
Kill Chain
Insider at L3Harris Sells Cyber Exploits to Russian Broker in 2024 Breach
In early 2024, Peter Williams, a former executive at L3Harris Trenchant, a U.S. defense contractor, pleaded guilty to stealing and illicitly selling confidential cyber exploit information to a Russian broker. The insider utilized privileged access to exfiltrate sensitive data on cybersecurity vulnerabilities and offensive research, subsequently marketing this intelligence to foreign entities, including actors associated with the Russian cyber underground. The breach exposed L3Harris Trenchant's internal detection gaps, ultimately triggering a federal investigation and leading to Williams' prosecution in U.S. District Court. This incident underscores the growing threat posed by insider actors within critical infrastructure and defense sectors. It highlights the need for advanced detection, segmentation, and strict policy enforcement to counter the insider risk—especially as nation-state and organized crime demand for zero-day vulnerabilities and advanced cyber tools continues to escalate.
8 months ago
Kill Chain
CISA & NSA Issue 2024 Guidance to Harden Microsoft Exchange Servers
In June 2024, the Cybersecurity and Infrastructure Security Agency (CISA) and the National Security Agency (NSA) issued joint guidance targeting administrators of Microsoft Exchange servers. This proactive measure follows a history of critical vulnerabilities in Exchange, which have enabled advanced threat actors and ransomware groups to access sensitive organizational email systems, often through unpatched servers and weak configurations. By outlining best practices for hardening Exchange, the agencies aim to help organizations mitigate risks from exploitation, data theft, and business disruption associated with increasingly sophisticated attack vectors seen throughout 2023 and 2024. This guidance reflects the heightened urgency around securing ubiquitous enterprise communications tools following high-profile breaches exploiting on-premise infrastructure. With persistent evolution in offensive capabilities and regulatory scrutiny increasing, consistently applying infrastructure hardening and Zero Trust controls is now critical for organizations of all sizes.
8 months ago
Kill Chain
Conduent’s 2024 Data Breach: Over 10 Million Records Stolen in Major BPO Attack
In June 2024, business process outsourcing giant Conduent confirmed a major data breach after attackers gained unauthorized access to its systems, exposing sensitive information of approximately 10.5 million individuals across the United States. The breach came to light following regulatory disclosures and was attributed to exploitation of a third-party vulnerability, allowing attackers to access personal data used in Conduent's healthcare and government services contracts. Impacted data reportedly includes names, social security numbers, addresses, and related identifiers tied to outsourced processing for public sector and healthcare organizations. This breach underscores persistent risks faced by organizations managing data at scale for critical sectors, with attackers increasingly targeting supply chain or third-party gaps. Growing regulatory scrutiny and rising consumer awareness are amplifying the urgency for improved data protection, robust access controls, and ongoing monitoring against sophisticated threat behaviors.
8 months ago
Kill Chain
CISA Orders Urgent Patch of VMware Tools Flaw Exploited by Chinese Hackers
In October 2024, Chinese state-sponsored hackers exploited a high-severity vulnerability in Broadcom’s VMware Aria Operations and VMware Tools software, targeting U.S. federal agencies through a software supply-chain attack. The attackers leveraged the unpatched flaw to gain unauthorized access, move laterally within networks, and potentially exfiltrate sensitive data. The Cybersecurity and Infrastructure Security Agency (CISA) responded by issuing an emergency directive, mandating all federal agencies to immediately patch the affected systems amid evidence of ongoing compromise. This incident underscores the persistent risks of vulnerable supply-chain components and the growing sophistication of state-sponsored adversaries. In light of increased regulatory scrutiny and rising exploitation of critical infrastructure platforms, organizations must prioritize rapid vulnerability management and layered defense strategies.
8 months ago
Kill Chain
Multi-Vector Attacks Surge: DNS Poisoning, Supply-Chain Compromise, and Rust Malware in 2025
In October 2025, a major multi-vector cyberattack was uncovered leveraging DNS poisoning, a sophisticated software supply-chain compromise, and the deployment of a new strain of Rust-based malware capable of evading traditional detection mechanisms. The attackers exploited vulnerabilities in third-party supplier code to infiltrate enterprise networks, enabling lateral movement via compromised DNS servers. Shortly thereafter, remote access trojans (RATs) and other post-exploitation tools were deployed, resulting in significant data exfiltration and disruption across multiple sectors. Incident response teams collaborated internationally to isolate affected systems and assess the operational damage. This event highlights a tightening attacker focus on high-value targets and critical infrastructure, driven by advances in malware tooling, zero-day exploitation, and the mainstream use of modern programming languages like Rust for stealthy payloads. The breach exemplifies how defenders must adapt to increasingly layered threats that combine classic attack vectors with contemporary tactics.
8 months ago
Kill Chain
New 'Brash' Chromium Exploit Exposes Enterprise Browser Risks in 2025
In October 2025, a severe vulnerability affecting Chromium-based browsers was publicly disclosed by security researcher Jose Pino. Nicknamed "Brash," this exploit targets the Blink rendering engine by manipulating specific DOM operations, allowing any attacker to crash a victim's browser with a single specially crafted URL. The vulnerability impacted Chrome, Edge, Brave, and other browsers using Chromium, raising concerns about both service disruption and potential for more severe follow-on attacks. The flaw could be triggered in as little as 15–60 seconds, posing a high risk for denial-of-service campaigns and widespread user impact until an emergency patch was released. The Brash exploit underscores increasing risks from 'zero-click' browser attacks. As reliance on web-based applications rises, threat actors increasingly target foundational browser components. This incident highlights the need for continuous monitoring and rapid browser patching in enterprise environments to counter such fast-moving threats.
8 months ago
Kill Chain
Russian Ransomware Leverages AdaptixC2: 2025's Open-Source Attack Surge
In mid-2025, threat intelligence sources reported that Russian ransomware groups had begun leveraging the open-source AdaptixC2 framework to orchestrate highly targeted, advanced ransomware campaigns. AdaptixC2, originally designed for penetration testing, was weaponized to facilitate command-and-control communications, enable lateral movement, and automate deployment of ransomware binaries across hybrid cloud and enterprise environments. The attackers exploited weak internal segmentation and monitoring deficiencies, achieving extensive encryption of critical systems, data exfiltration, and ransom demands that disrupted multiple sectors, including finance and healthcare. This incident reflects a broader trend: threat actors are rapidly operationalizing legitimate open-source red team tools for malicious purposes. Organizations must respond to this evolution in attacker strategies, as post-exploitation frameworks become increasingly prevalent in real-world breaches, complicating detection and increasing regulatory and operational risk.
8 months ago
Kill Chain
CISA Alerts on Five New Actively Exploited Vulnerabilities in Critical Platforms (2025)
On October 20, 2025, the Cybersecurity and Infrastructure Security Agency (CISA) updated its Known Exploited Vulnerabilities (KEV) Catalog, adding five actively exploited vulnerabilities across products from Apple, Kentico, Microsoft, and Oracle. These critical flaws—ranging from authentication bypasses in Kentico Xperience to a server-side request forgery in Oracle E-Business Suite and improper SMB access control in Microsoft Windows—are being leveraged by threat actors to gain unauthorized access, escalate privileges, or exfiltrate data. The directive mandates federal agencies to urgently remediate these risks to safeguard the federal enterprise and critical infrastructure from rapidly evolving threats. The continued expansion of the KEV Catalog highlights the persistent challenge organizations face in tracking and rapidly remediating high-impact vulnerabilities, especially as exploit techniques become more sophisticated and widely disseminated. The urgency is underscored by both regulatory pressure and the increase in observed exploitation campaigns targeting these vulnerabilities across public and private sectors.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports