Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Smishing Triad: Inside 2024's Massive Chinese-Run SMS Phishing Surge
In 2024, security researchers tracked a surge in activity from a sophisticated smishing (SMS phishing) group known as Smishing Triad, a decentralized operation managed in Chinese, leveraging a network of over 195,000 malicious domains to steal sensitive information globally. Domains impersonated critical sectors—including U.S. postal services, financial firms, healthcare, e-commerce, and government agencies—with the majority hosted in the U.S., China, and Singapore. Cross-functional threat actors orchestrated attacks via mobile messaging and Telegram forums, evolving tactics to avoid detection; most domains were short-lived, amplifying evasion and operational scale. This incident stands out for its scale, rapid infrastructure cycling, and global targeting, highlighting rising threats from organized smishing groups. The continued proliferation of phishing-as-a-service operations, increasing attacker collaboration, and adoption of short-lived domain infrastructures demonstrate the urgent need for improved east-west security controls, rapid detection, and stronger identity-based segmentation.
8 months ago
Kill Chain
China-Linked ToolShell SharePoint Attacks Hit Four Continents in 2025
In 2025, a coordinated cyber-espionage campaign attributed to Chinese-state actors targeted organizations across government, academic, telecommunications, and finance sectors by exploiting the ToolShell vulnerability (CVE-2025-53770) in Microsoft SharePoint. Attackers gained initial access through unpatched SharePoint deployments, enabling lateral movement, exfiltration of sensitive data, and persistent covert access. Victims spanned four continents, highlighting the campaign's scale and impact on critical information flows and business operations. The attackers' use of encrypted communications and sophisticated toolsets complicated detection and eradication efforts, leading to material operational and reputational risks for affected entities. This incident underscores a broader trend of supply chain and platform vulnerabilities being weaponized by advanced, nation-state groups. With the rapid disclosure of exploits and a proliferation of similar techniques, patch management and visibility into east-west traffic remain urgent enterprise priorities.
8 months ago
Kill Chain
PhantomCaptcha Spearphishing Attack Targets Ukraine War Relief Orgs
On June 22, 2024, a coordinated spearphishing campaign dubbed 'PhantomCaptcha ClickFix' targeted Ukrainian regional government entities and major international humanitarian organizations, such as the International Committee of the Red Cross and UNICEF. The attackers used convincing phishing emails distributing malicious links intended to compromise users through browser exploits and credential harvesting, aiming to disrupt relief efforts amid ongoing conflict. Although the operation was short-lived, lasting just one day, it exposed staff to significant risk of account takeover and disruption of war relief operations. This incident spotlights the expanding use of highly targeted, short-duration spearphishing campaigns against NGOs and governmental organizations, reflecting the broader trend of cyber-enabled disruption in geopolitical conflict zones. Attacks exploiting human trust and exploiting organizational urgency are on the rise, demanding renewed vigilance.
8 months ago
Kill Chain
Over 100 Government Agencies Breached by Iranian MuddyWater APT with Phoenix Backdoor
In early 2024, the Iranian state-sponsored threat group MuddyWater executed widespread attacks leveraging the Phoenix backdoor (version 4), successfully targeting over 100 government entities worldwide. The campaign exploited spear-phishing and malicious document attachments to deliver the backdoor, enabling persistent access, lateral movement, and data exfiltration from compromised systems. This sophisticated intrusion allowed the attackers to maintain a long-term foothold within highly sensitive government networks, posing significant operational and intelligence risks across multiple regions. This incident underscores a sharp escalation in advanced persistent threat (APT) tactics targeting public sector organizations. It highlights both the evolving sophistication and relentless nature of nation-state cyber operations, amplifying regulatory and operational pressure on government organizations to strengthen east-west traffic security, anomaly detection, and Zero Trust segmentation strategies.
8 months ago
Kill Chain
Pwn2Own Ireland 2025: 56 Zero-Day Vulnerabilities Exposed in One Day
In May 2025, security researchers at the Pwn2Own Ireland contest successfully exploited 56 previously unknown zero-day vulnerabilities across a broad range of consumer and enterprise devices—including the latest Samsung Galaxy S25 smartphone—over the course of a single day, earning nearly $793,000 in rewards. Participants used advanced exploitation chains targeting device software, firmware, and novel attack surfaces to gain remote code execution and bypass layered security controls. The demonstration of these critical flaws underlined the sophistication of contemporary offensive security techniques and the persistent risk posed by undiscovered vulnerabilities in modern technology stacks. Vendors were immediately notified, but the affected products are widely used globally. This incident exemplifies the accelerating pace and scale at which new vulnerabilities are uncovered, often by highly skilled researchers using techniques similar to those seen in active threat landscapes. Organizations are facing increased regulatory pressure to address zero-day risks and are urged to respond rapidly to vendor advisories and emerging disclosures.
8 months ago
Kill Chain
PassiveNeuron APT: 2024 Cyber Espionage Targets Asia, Africa & LatAm with Neursite Malware
In late 2024, cybersecurity researchers identified a sophisticated cyber espionage campaign targeting government, financial, and industrial organizations across Asia, Africa, and Latin America. Dubbed "PassiveNeuron," the operation leveraged custom malware strains, Neursite and NeuralExecutor, deployed by an advanced persistent threat (APT) group to infiltrate networks, maintain persistence, and exfiltrate sensitive data over several months. The entry vector appears to involve highly targeted spear-phishing and exploitation of vulnerable internet-facing assets, allowing attackers to bypass perimeter defenses and conduct stealthy lateral movement. The attack resulted in significant exposure of confidential communications and potentially state or financial secrets, raising concerns among affected sectors and governments. This incident exemplifies ongoing evolution in state-sponsored cyber attacks, with advanced malware leveraging encrypted traffic and zero trust evasion techniques. Given the increasingly global scope of APT operations and regulatory pressure on critical sectors, organizations must reexamine east-west security, policy enforcement, and anomaly detection capabilities to mitigate rising espionage risks.
8 months ago
Kill Chain
MuddyWater's 2025 Global Espionage Campaign Targets 100+ Organizations
In late 2025, the Iranian nation-state threat group known as MuddyWater launched a sophisticated espionage campaign targeting over 100 organizations across the Middle East and North Africa (MENA) region. Leveraging a compromised email account as an entry point, the attackers distributed a custom backdoor named Phoenix to high-value government entities, enabling covert infiltration and sustained intelligence gathering. The operation involved methods designed to evade detection and facilitate ongoing access to sensitive data, underscoring the persistent risk posed by nation-state actors. This campaign highlights a continued escalation in advanced cyberespionage activities targeting governmental and critical infrastructure sectors. With threat actors increasingly exploiting social engineering and custom malware, organizations face intensified pressure to strengthen defenses and adhere to evolving security frameworks.
8 months ago
Kill Chain
Chinese APT Group Rapidly Exploits SharePoint Vulnerability in Major 2025 Telecom Breach
In July 2025, Chinese state-affiliated threat actors exploited the recently patched ToolShell vulnerability in Microsoft SharePoint to breach a major telecommunications company in the Middle East. This advanced persistent threat (APT) group swiftly leveraged the disclosed flaw to gain unauthorized access, rapidly launching attacks just weeks after the patch was released. Their campaign extended to government bodies in Africa and South America, as well as academic and technology institutions in the US, highlighting a rapid weaponization of public vulnerabilities. The attackers used sophisticated techniques for lateral movement, data exfiltration, and persistence within the affected networks, likely resulting in compromise of sensitive communications, operational disruption, and potential regulatory exposure for the victims. This incident demonstrates how APT actors quickly adapt to disclosed vulnerabilities and underscores the urgency for organizations to accelerate patching cycles and bolster east-west security controls. The event marks an increasing trend of state-sponsored groups targeting hybrid cloud environments and critical infrastructure via freshly disclosed exploits.
8 months ago
Kill Chain
PhantomCaptcha: How Ukraine Aid Groups Were Targeted with Spear-Phishing PDFs in 2025
On October 8, 2025, a sophisticated spear-phishing campaign, dubbed PhantomCaptcha, targeted Ukraine war relief organizations, including members of the International Red Cross and Norwegian Refugee Council. Attackers sent counterfeit Zoom invitations and weaponized PDF attachments designed to lure aid workers into executing a remote access trojan (RAT). Leveraging WebSockets for covert command-and-control, the threat actors gained unauthorized access, potentially jeopardizing sensitive wartime humanitarian data and operations. The campaign showcased precise targeting, the use of specially crafted lures reflecting victims’ work environments, and advanced C2 techniques to evade detection. This incident underscores the increasing cyber threats facing humanitarian sectors amid ongoing geopolitical conflicts. As military and civilian support organizations become more digitalized and visible, spear-phishing and RAT-based compromises are on the rise, necessitating urgent security enhancements and compliance vigilance.
8 months ago
Kill Chain
WhatsApp Bans NSO Group: Landmark Legal Win Over Spyware Surveillance (2024)
In June 2024, WhatsApp achieved a legal victory against NSO Group following a six-year battle over the use of commercial spyware targeting WhatsApp users. NSO Group had exploited zero-day vulnerabilities to deploy its Pegasus spyware, surreptitiously compromising user devices for surveillance. As a result of the court decision, NSO Group is permanently banned from accessing or reverse-engineering WhatsApp and must pay $4 million in damages. The court's judgement underscores the broader risks posed by commercial surveillance tools, impacting end-user privacy and digital trust on a global scale. This incident comes amidst intensifying global scrutiny over spyware vendors and increasing pressure for technology companies to safeguard user data. The legal ruling sets a precedent for software platforms defending against targeted surveillance campaigns, emphasizing the role of legal strategy alongside technical security countermeasures.
8 months ago
Kill Chain
Canada Fines Cryptomus $176M Over Cybercrime Payment Networks
In October 2024, the Financial Transactions and Reports Analysis Center of Canada (FINTRAC) levied a record $176 million fine against Cryptomus, a digital payments platform, for violating Canada's anti-money laundering laws. Investigations uncovered that Cryptomus helped facilitate transactions for dozens of Russian cryptocurrency exchanges and cybercrime-related services without submitting suspicious transaction reports. Infractions were linked to money laundering for child sexual abuse material, fraud, ransomware, and sanctions evasion. The business used a Vancouver address also tied to numerous other questionable entities, none of which had any physical presence at the location. This enforcement action highlights intensifying global scrutiny on cryptocurrency payment processors and money service businesses (MSBs) operating as shadow facilitators for cybercriminals, particularly in regions facing heightened sanctions. As regulators ramp up pressure, organizations relying on cryptographic payment tools, or with exposure to digital currency ecosystems, must reassess their compliance, monitoring, and due diligence procedures in light of evolving financial crime threats.
8 months ago
Kill Chain
China-Nexus Threat Actors Weaponize 'Nezha' RAT for Stealthy Campaigns in 2024
In early 2024, cybersecurity researchers uncovered a new campaign by China-nexus threat actors leveraging the open source "Nezha" remote access tool (RAT) to facilitate covert network access and persistence. Unlike traditional RMM (Remote Monitoring and Management) abuse, the adversaries deployed Nezha across multiple victim environments to enable encrypted traffic tunneling, conduct command-and-control operations, and bypass security controls. Targeting enterprises in various sectors, the attackers exploited weak access controls and east-west network traffic to establish lateral movement pathways, with the operation resulting in significant risks to sensitive data and business continuity. This incident highlights an accelerating trend in the use of open source, commodity tools by nation-state-aligned actors to evade detection and complicate attribution. The campaign reflects shifting threat dynamics, as attackers weaponize cloud-native techniques and legitimate tools to target organizations seeking to modernize security controls and comply with frameworks such as NIST and PCI DSS.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports