Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3246 threat reports
Page 207 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 2473–2484 / 3246 reports
How RansomHouse's 2025 Encryption Upgrade Disrupted Critical Sectors
Health Care / Life Sciences10 months ago

How RansomHouse's 2025 Encryption Upgrade Disrupted Critical Sectors

In December 2025, the RansomHouse ransomware-as-a-service (RaaS) group, operated by the Jolly Scorpius threat actor, was observed deploying a significantly upgraded encryption process against high-value victims. Attackers exploited compromised credentials and ESXi server vulnerabilities to infiltrate enterprise environments, moving laterally and using tools like MrAgent to disable firewalls and maintain persistent access. Once established, they deployed the enhanced Mario encryptor, which used multi-layered, two-stage file encryption and selective chunk processing to maximize data disruption. This double extortion campaign resulted in data theft, operational outages, and public leaks for at least 123 organizations across healthcare, finance, government, and transportation sectors. This incident highlights both the increasing technical sophistication of ransomware operations and the rapid evolution of RaaS offerings. The shift to more complex encryption makes detection, containment, and recovery far more challenging, calling for organizations to adopt dynamic, layered security controls and anticipate future trends in ransomware capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
European Authorities Dismantle Major Call Center Fraud Ring in Ukraine (2024)
Financial Services10 months ago

European Authorities Dismantle Major Call Center Fraud Ring in Ukraine (2024)

In mid-2024, European law enforcement agencies succeeded in dismantling a major organized fraud ring operating out of Ukraine. This network used illicit call centers to impersonate financial institutions, manipulating victims across Europe—especially in Germany—into divulging sensitive information or making fraudulent investments. Through sophisticated social engineering techniques and well-structured scripts, the group defrauded thousands of individuals of over 10 million euros. The operation also seized electronic equipment and led to at least five arrests. This incident highlights the ongoing evolution of transnational cybercrime syndicates that exploit human vulnerability through social engineering. Call center fraud, often leveraging modern technologies and cross-border coordination, continues to surge even as regulatory and enforcement actions intensify across Europe.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Hypervisors Under Fire: 2024 Ransomware Blitz Hits Virtualization Core
Information Technology/IT10 months ago

Hypervisors Under Fire: 2024 Ransomware Blitz Hits Virtualization Core

In early 2024, organizations across multiple sectors faced a wave of targeted ransomware attacks exploiting vulnerabilities in virtualization platforms' hypervisors. Threat actors used stolen administrative credentials and leveraged known and zero-day flaws in hypervisor management interfaces to bypass segmentation controls, moving laterally from corporate networks onto host environments. Once inside, attackers deployed ransomware payloads at the hypervisor level, simultaneously encrypting dozens of virtual machines and crippling key business operations for days or weeks. The impact included downtime cascading across critical workloads, increased ransom demands due to concentrated disruption, and challenges in restoring services due to the interlocked nature of virtualized systems. This incident spotlights the growing trend of ransomware groups shifting attacks from endpoint devices to virtualization infrastructure, exploiting weak visibility and east-west segmentation at the hypervisor layer. As businesses accelerate cloud and virtual adoption, the threat landscape is rapidly evolving, making hypervisor security an urgent priority for IT and security leaders.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Fortinet 2024 Auth Bypass Exploited: Urgent Actions for Network Security
Financial Services10 months ago

Fortinet 2024 Auth Bypass Exploited: Urgent Actions for Network Security

In early June 2024, threat actors actively exploited newly disclosed authentication bypass vulnerabilities in multiple Fortinet products, including FortiOS and FortiProxy. Attackers leveraged these flaws (notably CVE-2024-21762 and CVE-2024-23113) shortly after Fortinet's patch release, gaining unauthorized admin-level access to vulnerable devices. The intruders then extracted system configuration files, risking exposure of sensitive network data and credentials. Several organizations reported compromises and system disruptions, prompting urgent advisories from Fortinet and government agencies to patch immediately and review system integrity. This incident underscores a dangerous trend: rapid mass exploitation of zero-day vulnerabilities in network security devices. The high-profile breach highlights mounting risks to organizations that delay critical patching and demonstrates the persistent targeting of edge appliances by sophisticated attackers.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Venezuelan Oil Giant PDVSA Hit by Cyberattack—Exports Disrupted in 2024 Incident
Oil/Energy/Solar/Greentech10 months ago

Venezuelan Oil Giant PDVSA Hit by Cyberattack—Exports Disrupted in 2024 Incident

In June 2024, Petróleos de Venezuela S.A. (PDVSA), Venezuela’s state-owned oil giant, suffered a major cyberattack that disrupted its oil export operations. Attackers reportedly targeted IT infrastructure critical to the export scheduling and operational logistics of PDVSA, forcing the company to revert to manual processes while systems were restored. Although the precise entry vector and threat actor remain unconfirmed, preliminary indications suggest ransomware or disruptive malware may have played a role, leading to significant business interruption and delayed global shipments. This incident underscores the persistent risks facing critical infrastructure sectors worldwide, with cyberattacks increasingly targeting essential energy supply chains. With ransomware and nation-state threats evolving in sophistication, organizations must urgently prioritize segmentation, threat detection, and resilient network architectures.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Amazon Stops Russian GRU Hackers Targeting Cloud Edge Devices in 2025
Oil/Energy/Solar/Greentech10 months ago

Amazon Stops Russian GRU Hackers Targeting Cloud Edge Devices in 2025

In December 2025, Amazon's Threat Intelligence team thwarted a sophisticated cyber-espionage campaign attributed to the Russian GRU, which actively targeted Western critical infrastructure via AWS cloud environments. Beginning in 2021 and intensifying through 2025, the threat actors transitioned from exploiting known and zero-day vulnerabilities to targeting misconfigured customer-managed edge devices such as VPN gateways and network appliances hosted on EC2. This allowed them to gain persistent access, harvest credentials, and move laterally within networks, yet there was no compromise of AWS's own infrastructure. Amazon responded rapidly by securing affected instances, notifying customers, and sharing threat intelligence with partners. This incident highlights the growing trend of state-sponsored groups shifting from vulnerability exploitation to leveraging customer misconfigurations. The persistent focus on edge devices underscores the importance of robust configuration and monitoring practices, especially as critical infrastructure organizations move sensitive operations into the cloud.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Active Attack: Fortinet FortiGate SAML SSO Authentication Bypass Exposes Networks
Financial Services10 months ago

Active Attack: Fortinet FortiGate SAML SSO Authentication Bypass Exposes Networks

In December 2025, threat actors began exploiting two critical authentication bypass vulnerabilities (CVE-2025-59718 and CVE-2025-59719, both CVSS 9.8) in Fortinet FortiGate appliances. By targeting the FortiCloud SSO feature—enabled during FortiCare registration—they leveraged crafted SAML messages to gain unauthorized access to admin accounts. Once inside, attackers exported device configuration files, risking credential compromise and broader network infiltration. The U.S. CISA quickly classified the flaws as Known Exploited Vulnerabilities, urging immediate patching. This incident demonstrates the evolving risk of identity-driven network attacks and rapid exploitation following vulnerability disclosure. With opportunistic threat actors targeting edge infrastructure, similar authentication-based attacks are likely to increase, further incentivized by regulatory and industry pressure for swift vulnerability management.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Turkey Hit by Advancing Android Banking Trojan: Inside the Frogblight Campaign
Banking/Mortgage10 months ago

Turkey Hit by Advancing Android Banking Trojan: Inside the Frogblight Campaign

In August 2025, researchers identified a sophisticated Android banking Trojan dubbed "Frogblight" targeting users in Turkey. Distributed primarily through smishing campaigns and phishing sites masquerading as official government portals, Frogblight lured victims by posing as legitimate court case or Chrome browser apps. Once installed, it harvested banking credentials, SMS, contact lists, call logs, and device data, while providing remote device control and persistence mechanisms for operators. The malware communicated via REST API and later WebSockets to exfiltrate stolen data to attacker-controlled C2 servers and was frequently updated with new spyware features, indicating ongoing development and potential adoption as Malware-as-a-Service (MaaS). Frogblight exemplifies the rapid evolution and increasing capabilities of mobile banking malware. The campaign underscores the rising threat to mobile users—particularly in markets where banks and government digital services are trusted attack vectors—and reflects a broader trend toward commoditized MaaS offerings and advanced evasion techniques. Effective mobile security controls and user awareness remain critical as adversaries refine their payloads.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Flags Fortinet CVE-2025-59718: Improper Signature Verification Under Active Exploitation
Government Administration10 months ago

CISA Flags Fortinet CVE-2025-59718: Improper Signature Verification Under Active Exploitation

In December 2025, CISA added CVE-2025-59718 to its Known Exploited Vulnerabilities catalog, citing confirmed active exploitation targeting Fortinet's multiple products. This vulnerability involves improper verification of cryptographic signatures, allowing attackers to bypass security controls, execute unauthorized code, or escalate privileges on affected devices. Federal agencies, per BOD 22-01, must remediate this critical issue by the mandated deadline to protect their networks. The flaw’s exploitation risks device compromise and potential lateral movement by sophisticated threat actors, with broad implications for data integrity and operational continuity across affected organizations. This alert reflects the escalating trend of attackers rapidly weaponizing supply chain or cryptographic flaws in core network infrastructure. As organizations increasingly rely on complex integrations and encrypted communications, such vulnerabilities underscore persistent challenges in managing risk and ensuring trust in critical systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Parked Domains Weaponized: Inside the 2025 Typosquatting Malvertising Surge
Banking/Mortgage10 months ago

Parked Domains Weaponized: Inside the 2025 Typosquatting Malvertising Surge

In late 2025, security researchers uncovered that over 90% of parked domains—unused, expired, or misspelled web addresses—were actively redirecting visitors to malicious destinations, including scams, malware, and deceptive subscription offers. Utilizing techniques like device fingerprinting, IP geolocation, and chained redirects, threat actors profited by manipulating the domain parking ecosystem, turning innocuous navigation mistakes into vectors for malware delivery and fraud. The campaign targeted high-profile brands and government offices, often bypassing detection by profiling user access (e.g., residential IPs or VPN use), with some domains weaponized for business email compromise. This incident highlights an alarming shift: parked and typo domains are now a primary malvertising risk, not a minor threat. As domain registration and ad platform policies evolve, attackers rapidly adapt, exploiting weaknesses in digital trust and endpoint security. Organizations must broaden threat detection and policy enforcement to address direct navigation attacks and affiliate-driven malvertising.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical RADIUS MD5 Vulnerability Exposes Hitachi Energy Infrastructure — 2025 Analysis
Utilities10 months ago

Critical RADIUS MD5 Vulnerability Exposes Hitachi Energy Infrastructure — 2025 Analysis

In December 2025, Hitachi Energy disclosed a critical vulnerability (CVE-2024-3596) impacting their AFS, AFR, and AFF series infrastructure hardware, widely deployed in the global energy sector. The issue centers on improper enforcement of message integrity in RADIUS communications, allowing attackers in a local network to exploit a chosen-prefix collision attack against the MD5 response authenticator. This could let a malicious actor forge RADIUS authentication responses — potentially leading to unauthorized network access, disruption of critical systems, or exfiltration of sensitive data. The flaw carries a CVSS score of 9.0 (critical), but exploitation requires high attack complexity. This case highlights the continued risks posed by legacy authentication protocols and cryptographic weaknesses within operational technology environments. As adversaries increasingly target energy and critical infrastructure supply chains, prioritizing secure authentication and traffic integrity mechanisms is vital to maintaining resilience and regulatory compliance.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Güralp Systems 2025: Unauthenticated DoS Threat Hits Critical OT Devices
Oil/Energy/Solar/Greentech10 months ago

Güralp Systems 2025: Unauthenticated DoS Threat Hits Critical OT Devices

In December 2025, Güralp Systems disclosed a vulnerability affecting its Fortimus, Minimus, and Certimus Series devices, widely deployed in critical manufacturing and infrastructure sectors globally. The flaw (CVE-2025-14466) in the devices' web interface allows unauthenticated attackers on the network to send specially crafted HTTP requests, forcing the web service to restart and causing a temporary denial-of-service (DoS) condition. While the process automatically recovers, repeated exploitation could severely impact system availability for organizations relying on these seismic monitoring instruments. This type of DoS vulnerability is increasingly significant as threat actors increasingly target industrial control devices and operational technology (OT) with low-complexity attacks from unauthenticated vectors. Regulatory scrutiny of ICS network hygiene and cross-industry best practices is intensifying, pushing organizations to proactively address resource allocation and network exposure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports