Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Operation ForumTroll 2025: Memento Labs Revives APT Espionage with Chrome 0-day
In March 2025, Kaspersky uncovered Operation ForumTroll, a sophisticated espionage campaign targeting Russian government agencies, critical institutions, and media organizations. The threat actors employed personalized spear-phishing emails carrying unique, short-lived links; merely visiting these sites using Chrome or Chromium-based browsers enabled a zero-day exploit (CVE-2025-2783) to escape the browser sandbox. The attackers established system persistence via COM hijacking, then operated stealthy malware—LeetAgent and the commercial Dante spyware, attributed to Memento Labs (formerly Hacking Team)—to exfiltrate sensitive files and credentials, while leveraging cloud infrastructure for their C2 communications and tool delivery. This campaign exemplifies a new wave of highly targeted, sophisticated APT activity leveraging commercial spyware and advanced zero-day exploitation. As browser vulnerabilities and commercial surveillance tools increasingly intersect, organizations must urgently review security for endpoints, threat detection, and privileged access to counter fast-evolving espionage operations.
8 months ago
Kill Chain
LockBit 5.0 Resurgence: How WSUS and F5 Vulnerabilities Fueled 2025's Biggest Ransomware Wave
In October 2025, a coordinated wave of cyberattacks struck major enterprise environments worldwide. Attackers exploited Windows Server Update Services (WSUS) flaws and vulnerabilities in F5 infrastructure, deploying the new LockBit 5.0 ransomware variant. Using phishing, unauthorized RDP access, and advanced persistence techniques, LockBit affiliates moved laterally across networks, encrypting critical data and disrupting cloud-hosted workloads. Compromised systems experienced operational downtime, data theft, and subsequent ransom demands, while threat actor activity on underground forums confirmed an aggressive resurgence and evolving TTPs. This incident underscores the heightened pace and sophistication of ransomware operations, with threat actors exploiting both zero-day vulnerabilities and supply chain channels. As enterprise defenses adapt to increasingly hybrid and distributed infrastructure, recent attacks have spotlighted urgent needs for segmentation, real-time visibility, and policy enforcement to counter proactive adversary tactics.
8 months ago
Kill Chain
Qilin Ransomware Surge (2025): Hybrid Linux Attacks and BYOVD Tactics Challenge Defenses
In early to mid-2025, the notorious Qilin ransomware group (also known as Agenda/Gold Feather/Water Galura) executed a wave of aggressive hybrid cyberattacks, combining Linux-targeting ransomware payloads with a sophisticated BYOVD (Bring Your Own Vulnerable Driver) exploit. The attacks leveraged unpatched vulnerabilities to gain initial access, followed by lateral movement across multi-cloud and on-premises environments. Once inside, Qilin deployed encryption routines across both Windows and Linux servers, exfiltrated sensitive business data, and posted victim details on its dark web leak site, with attack volumes peaking at over 100 cases in June 2025. Organizations across healthcare, finance, and manufacturing were among those affected, experiencing significant operational disruptions, data exposure risks, and costly recovery processes. The rise of cross-platform ransomware with BYOVD techniques demonstrates attackers' growing technical sophistication and ability to evade traditional defenses. As ransomware-as-a-service (RaaS) operations like Qilin accelerate, organizations face increasing regulatory scrutiny and must enhance cloud, endpoint, and network segmentation strategies to defend against such adaptive threats.
8 months ago
Kill Chain
Qilin Ransomware Breach: Linux-Based Attack Targets Windows Hosts in 2024
In early 2024, the Qilin ransomware-as-a-service (RaaS) group executed a sophisticated attack leveraging a Linux-based payload to compromise Windows hosts. This cross-platform ransomware evaded many traditional security solutions, enabling the threat actors to gain access through targeted phishing and lateral movement techniques. The attackers rapidly encrypted critical data, demanding ransom payments, and causing business disruption across affected organizations. Qilin's attack uniquely circumvented endpoint protection measures designed for a single operating system, highlighting a significant challenge for heterogeneous IT environments. This incident underscores a rising trend of cross-platform ransomware operations, where attackers tailor malware to exploit gaps in multi-OS networks. Security teams are urged to reassess their detection capabilities in light of these evolving threat vectors and intensifying RaaS activity.
8 months ago
Kill Chain
First Wap's SS7 Exploit: How Altamides Changed Global Surveillance in 2025
In 2025, surveillance-technology firm First Wap, based in Jakarta, was revealed to have quietly built and operated the 'Altamides' system, a covert platform leveraging SS7 telecom vulnerabilities for global phone tracking. Unlike conventional spyware, Altamides enabled real-time location tracking of mobile devices across regions—from the Vatican to Silicon Valley—without requiring user interaction, installation, or leaving traces on targeted phones. The technology exploited legacy telecom protocols to access cell tower information, bypassing most modern mobile security defenses. As a result, sensitive locations and communications were exposed to persistent surveillance risk, with broad geopolitical and privacy implications. This incident underscores a worrying rise in the commercial proliferation of offensive surveillance tools exploiting underprotected telecom infrastructure. It highlights the urgent need for stronger regulatory action and zero trust defenses, as targeted espionage techniques move further away from traditional malware and towards systemic protocol abuse.
8 months ago
Kill Chain
CoPhish 2024: How Microsoft Copilot Studio Became a Vector for OAuth Phishing
In early June 2024, security researchers discovered a sophisticated phishing campaign dubbed 'CoPhish' exploiting Microsoft Copilot Studio agents to deliver fraudulent OAuth consent requests. By leveraging legitimate Microsoft domains and trusted Copilot workflows, attackers deceived enterprise users into granting malicious apps access to their Microsoft 365 accounts, thereby stealing OAuth tokens and enabling unauthorized access to sensitive emails, files, and collaborative workspaces. The attack chain bypassed traditional email security controls due to its reliance on trusted infrastructure and social engineering, putting multiple organizations at risk of data compromise and account takeover. This incident underscores the growing trend of threat actors abusing trusted cloud and AI-powered collaboration platforms, capitalizing on user trust and shadow IT. It highlights urgent security concerns around identity-driven attacks, modern authentication abuse, and the need for enhanced vigilance in managing third-party OAuth authorizations.
8 months ago
Kill Chain
Synthient Data Breach 2024: 2 Billion Exposed Credentials Spark Global Risk
In early 2024, a new breach known as the 'Synthient Threat Data Collection' surfaced, encompassing a staggering two billion unique email addresses tied to credential stuffing operations. This data was amassed from large-scale compromise campaigns and open sources, then processed and analyzed for integrity and novelty on high-capacity infrastructure. The breach reflects the increasing industrialization of credential harvesting by attackers, raising significant privacy and security concerns for individuals and organizations across sectors, as many of these records had never before been reported in regular breach repositories. The exposure demonstrates a dramatic uptick in both credential reuse attacks and the volume of personal data accessible to cybercriminals. As data brokers and threat actors accelerate their harvesting and aggregation campaigns, organizations must bolster detection, consumer alerts, and incident response to meet new regulatory and operational risks.
8 months ago
Kill Chain
Microsoft Issues Emergency Patch for Critical WSUS Vulnerability (CVE-2025-59287)
In October 2025, Microsoft disclosed and initially patched a critical vulnerability, tracked as CVE-2025-59287, in its Windows Server Update Services (WSUS) platform. The flaw, actively exploited in the wild, allowed attackers to compromise the WSUS update mechanism, potentially enabling malicious code injection during trusted Windows Server updates. Rapid exploitation following the Patch Tuesday release prompted Microsoft to issue an emergency out-of-band security update in response to ongoing attacks, underscoring the vulnerability's urgency and the risk of widespread operational impact for enterprises reliant on WSUS. This incident highlights the escalating frequency of supply chain and update-platform attacks as adversaries increasingly target patch distribution mechanisms. The rise in vulnerability exploitation, particularly against trusted infrastructure components, is driving regulatory attention and motivating organizations to reassess their zero trust models and patch management processes.
8 months ago
Kill Chain
Critical WSUS RCE Exploit in Windows Server: Immediate Patching Required
In June 2024, Microsoft urgently released out-of-band security patches to address a critical vulnerability (CVE-2024-30080) in Windows Server Update Services (WSUS). Security researchers publicly disclosed a proof-of-concept exploit that bypassed authentication and enabled remote code execution (RCE) on WSUS servers, exposing connected enterprise environments to attacker control. Threat actors could exploit this flaw to gain high-level privileges, push malicious updates to endpoints, or pivot deeper into corporate networks, presenting significant risk to organizations depending on WSUS for patch management. Microsoft advised immediate patching and provided guidance for mitigating exposed servers. This incident underscores a recent escalation in supply-chain and patch management vulnerabilities targeted by threat actors. Public exploit availability heightens the urgency for rapid remediation, as adversaries increasingly weaponize new vulnerabilities before standard patch cycles can address them.
8 months ago
Kill Chain
WSUS Windows Server Vulnerability Exploited: What Organizations Need to Know in 2024
In June 2024, attackers began actively exploiting a critical-severity vulnerability in Microsoft’s Windows Server Update Services (WSUS), allowing unauthenticated remote code execution on unpatched Windows Server instances. Public proof-of-concept exploit code enabled threat actors to target organizations’ update infrastructure, potentially granting attackers elevated privileges and control over networked endpoints. The attack vector leverages unencrypted or weakly secured WSUS communication endpoints, risking malware delivery or the propagation of malicious updates across enterprise environments. Immediate business impacts can include system compromise, lateral movement, and potential data exfiltration. This exploitation reflects a recent trend where attackers leverage highly impactful remote code execution bugs in widely deployed software with public exploits, underscoring the need for rapid patch management and improved east-west traffic visibility. Organizations using legacy or unpatched WSUS deployments are most at risk as targeted attacks continue to rise.
8 months ago
Kill Chain
APT36 Exploits Golang-Based Malware to Compromise Indian Government in 2025
In August and September 2025, the state-sponsored hacking group APT36 (also known as Transparent Tribe) launched a spear-phishing campaign targeting Indian government entities. The campaign delivered a new variant of a Golang-based remote access trojan, DeskRAT, which allowed attackers to gain persistent access, conduct reconnaissance, and exfiltrate sensitive information. The phishing emails, likely crafted to impersonate trusted sources, succeeded in infecting victim networks, enabling APT36 to conduct espionage activities against high-profile targets, further compromising Indian national security interests. This incident underscores the persistent risk posed by well-resourced, nation-state threat actors using continuously evolving malware families and novel programming languages like Golang. The rise of such campaigns highlights an urgent need for improved east-west traffic monitoring, zero trust network segmentation, and advanced user awareness against targeted phishing techniques.
8 months ago
Kill Chain
Microsoft WSUS 2025: Critical RCE Vulnerability Exploited in the Wild
In October 2025, Microsoft disclosed and urgently patched a critical remote code execution vulnerability (CVE-2025-59287) impacting the Windows Server Update Services (WSUS) framework. Following the public release of a proof-of-concept exploit, threat actors began actively targeting vulnerable WSUS deployments to execute malicious code, gain unauthorized access, and potentially compromise large segments of enterprise environments. The flaw, assigned a CVSS score of 9.8, allowed unauthenticated attackers to leverage exposed update services, posing significant risk to organizations’ patch management infrastructures before the emergency fix was implemented. This incident highlights the continuing trend of sophisticated adversaries exploiting zero-day and n-day vulnerabilities in widely used systems with available PoCs. It also underscores growing urgency for proactive patch management, real-time anomaly detection, and adoption of Zero Trust models to protect against rapidly weaponized threats.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports