Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3246 threat reports
Page 209 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 2497–2508 / 3246 reports
CISA Orders Feds to Patch Active GeoServer XXE Vulnerability Exploitation
Government Administration10 months ago

CISA Orders Feds to Patch Active GeoServer XXE Vulnerability Exploitation

In June 2024, U.S. federal agencies were ordered by CISA to immediately patch a critical vulnerability in GeoServer, an open-source geospatial server widely deployed across government networks. Threat actors were observed actively exploiting an XML External Entity (XXE) injection flaw that allows attackers to access sensitive files, exfiltrate data, and potentially pivot within federal environments. The exploitation, which was discovered in the wild, underscores how quickly attackers can weaponize unpatched vulnerabilities to compromise mission-critical public sector infrastructure, putting sensitive government information at risk. This incident highlights a recent spike in the exploitation of internet-facing open-source software by both cybercriminal and nation-state groups. With regulatory pressure mounting around software supply chain risks and zero-day response times, such vulnerabilities remain a primary vehicle for initial access in sophisticated cyberattacks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Mesa County's 2021 Election System Data Breach: The Insider Threat Exposed
Government Administration10 months ago

Mesa County's 2021 Election System Data Breach: The Insider Threat Exposed

In 2021, Mesa County, Colorado experienced a significant breach of its election system data, orchestrated by then-county election clerk Tina Peters. Unauthorized copies of sensitive voting-system hard drives were made following the 2020 U.S. Presidential election and leaked to the public, purportedly to expose alleged voter fraud. The breach, which did not reveal any evidence of fraud, exposed highly confidential election infrastructure information, leading to criminal charges against Peters. The incident is widely recognized as one of the most impactful attacks on U.S. election security in recent years and undermined trust within the local community and beyond. This case highlights the ongoing risks to election system integrity posed by insider threats and emphasizes the importance of robust access controls, encryption, and segmentation. It is particularly relevant today as the U.S. prepares for upcoming elections amid heightened scrutiny of both technical and human vulnerabilities in election infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Critical Windows RasMan Zero-Day (2024) Disrupts Remote Access—What You Need To Know
Financial Services10 months ago

Critical Windows RasMan Zero-Day (2024) Disrupts Remote Access—What You Need To Know

In mid-2024, a new zero-day vulnerability was discovered in the Windows Remote Access Connection Manager (RasMan) service, allowing attackers to crash the service and potentially disrupt VPN and remote networking capabilities. Security researchers published unofficial patches after Microsoft had yet to release an official fix. The flaw enables a local attacker or malware to exploit the service, leading to denial-of-service (DoS) and potential impact on enterprise connectivity and productivity. Organizations relying on Windows-based remote access are particularly affected as attackers can target unpatched systems. This incident underscores the increasing trend of zero-day vulnerabilities targeting critical Windows services and highlights the need for rapid patch cycles and improved anomaly detection in IT environments. With unofficial fixes circulating before vendor patches, organizations face new risks in securing remote workforce infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CISA Flags Critical GeoServer XXE Vulnerability Exploited in the Wild
Government Administration10 months ago

CISA Flags Critical GeoServer XXE Vulnerability Exploited in the Wild

In December 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a critical XML External Entity (XXE) vulnerability, CVE-2025-58360, affecting OSGeo GeoServer to its Known Exploited Vulnerabilities catalog. This flaw impacts versions up to 2.25.5 and select subsequent releases, enabling unauthenticated attackers to exploit the /geoserver/wms GetMap endpoint. Successful exploitation may lead to unauthorized file access, Server-Side Request Forgery (SSRF), or denial-of-service attacks. The discovery, reported by vulnerability platform XBOW, has prompted warnings from both CISA and the Canadian Centre for Cyber Security, emphasizing risks to organizations using GeoServer in production environments. This incident underscores the persistent targeting of widely-used open-source tools by threat actors, particularly through unauthenticated exploit paths. Amid increased regulatory focus and real-world exploitation evidence, organizations face mounting pressure to patch vulnerable infrastructure and strengthen detective controls to mitigate post-exploitation impacts.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Apple’s 2024 Zero-Day Exploits: Sophisticated Attacks Trigger Emergency Patches
Computer Software/Engineering10 months ago

Apple’s 2024 Zero-Day Exploits: Sophisticated Attacks Trigger Emergency Patches

In June 2024, Apple disclosed and swiftly patched two actively exploited zero-day vulnerabilities affecting multiple devices, including iPhones, iPads, and Macs. These flaws—CVE-2024-23296 (Kernel) and CVE-2024-23225 (RTKit)—were leveraged in a highly sophisticated attack that targeted select individuals, likely as part of a nation-state or advanced persistent threat campaign. The attackers bypassed security protections to achieve elevated privileges and potentially execute arbitrary code, underscoring the level of technical prowess and intent to compromise high-value targets. Apple released emergency updates to mitigate ongoing exploitation, emphasizing the urgency of immediate patching. This incident highlights the growing trend of advanced, targeted zero-day attacks aimed at high-profile platforms and users. Security teams should expect continued adversary innovation, accelerated zero-day discovery, and a heightened need for organizations to quickly adopt vendor-released mitigations to safeguard sensitive data and operations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
React2Shell Exploitation: Global RCE Wave Sparks Emergency Security Response
Information Technology/IT10 months ago

React2Shell Exploitation: Global RCE Wave Sparks Emergency Security Response

In December 2025, the React2Shell vulnerability (CVE-2025-55182) emerged as a critical remote code execution flaw impacting React Server Components and several key frameworks such as Next.js, Vite, and RedwoodSDK. Threat actors rapidly exploited the unauthenticated deserialization bug, enabling arbitrary privileged JavaScript execution with a single HTTP request. Within days of public disclosure, multiple malicious campaigns leveraged the flaw to deploy malware, compromise sensitive systems—including government, critical infrastructure and technology entities—and conduct mass internet-wide scans. Over 137,200 exposed endpoints were tracked globally, prompting CISA to issue an accelerated mitigation deadline and security vendors to warn of global supply chain risks. React2Shell’s exploitation highlights the growing trend of mass-scale, opportunistic attacks leveraging zero-day vulnerabilities in widely-used cloud-native frameworks. With parallels drawn to systemic exploits like Log4Shell, organizations face rising regulatory and supply chain scrutiny to strengthen cloud security and incident response practices.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Phishing in 2025: How Stolen Data Hits Telegram and the Dark Web Faster Than Ever
Financial Services10 months ago

Phishing in 2025: How Stolen Data Hits Telegram and the Dark Web Faster Than Ever

In early-to-mid 2025, a broad wave of phishing campaigns leveraged sophisticated data harvesting tools—including Telegram bots and automated admin panels—to exfiltrate user credentials and personal data from victims worldwide. Attackers collected credentials through fraudulent pages, relayed them instantly over secure messaging apps or specialized dashboards, and then swiftly funneled the stolen information into darknet marketplaces. Stolen data ranged from email logins and banking details to scans of personal documents, which were sorted, validated, and commoditized for direct fraud, resale, or subsequent targeted attacks on individuals and organizations. This incident highlights the acceleration of phishing-as-a-service ecosystems driven by real-time, evasive data exfiltration via commodity tools. The commodification of personal and corporate credentials intensifies regulatory and reputational risks, as stolen data is increasingly recycled for follow-on attacks—including identity theft and business email compromise—months or years after the initial breach.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds Google Chromium CVE-2025-14174 to Exploited Vulnerabilities List
Government Administration10 months ago

CISA Adds Google Chromium CVE-2025-14174 to Exploited Vulnerabilities List

In December 2025, CISA added CVE-2025-14174—a Google Chromium out-of-bounds memory access vulnerability—to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. This vulnerability enables threat actors to execute arbitrary code or potentially escalate privileges via unauthorized memory access within affected Chromium browser instances. Attackers exploited this flaw as an entry vector for malware and credential theft, increasing risks for both federal agencies and organizations relying on Chromium-based browsers. Federal Civilian Executive Branch agencies were directed, under BOD 22-01, to remediate this vulnerability by a strict deadline to mitigate ongoing risks. The rapid inclusion of CVE-2025-14174 in the KEV Catalog highlights persistent challenges posed by zero-day and n-day browser vulnerabilities. Recent increases in browser-based exploitation and strict regulatory mandates underscore the growing urgency to address software supply chain threats and prioritize swift vulnerability management across all industry sectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Fake OSINT and GPT GitHub Repos Used to Spread PyStoreRAT in Supply Chain Attack
Computer Software/Engineering10 months ago

Fake OSINT and GPT GitHub Repos Used to Spread PyStoreRAT in Supply Chain Attack

In late 2025, cybersecurity researchers uncovered a supply chain attack involving malicious repositories on GitHub impersonating open-source Python utilities themed around OSINT and GPT automation. These repos covertly delivered a previously unseen JavaScript-based Remote Access Trojan dubbed PyStoreRAT, using minimal code to retrieve and execute a remote HTA file. Unsuspecting developers and security professionals, lured by the project's legitimate appearance, risked compromise when cloning or running the code, resulting in unauthorized remote access and potential data exfiltration. The campaign highlights the growing sophistication of attacks abusing trusted developer platforms and open-source supply chains. This incident underscores the urgent need for organizations to audit third-party code sources, bolster code supply chain security, and monitor for emerging malware targeting developer ecosystems. The tactic reflects broader trends in social engineering, weaponized open-source projects, and the exploitation of generative AI themes by threat actors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
FBI Delivers 630 Million Compromised Passwords to HIBP: 2024 Credential Exposure
Financial Services10 months ago

FBI Delivers 630 Million Compromised Passwords to HIBP: 2024 Credential Exposure

In June 2024, the FBI provided Have I Been Pwned (HIBP) with approximately 630 million compromised passwords uncovered during multiple cybercrime investigations. The credentials were amassed from seized devices linked to a criminal suspect and sourced from the open web, Tor-based marketplaces, Telegram channels, and infostealer malware logs. Notably, about 46 million of these passwords were new to HIBP's repository, enabling organizations and individuals to proactively block use of these widely circulated credentials and bolster account security. The addition further expands the scale and utility of accessible credential hygiene tools worldwide. This incident underscores the ongoing and massive prevalence of credential compromise in the cybercrime landscape, as password data continually proliferates across threat actors and dark markets. It highlights the urgent need for organizations to adopt robust password exposure monitoring and zero trust authentication policies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Hamas Espionage Malware Hits Middle East Diplomats: 2024 Breach Analysis
Government Administration10 months ago

Hamas Espionage Malware Hits Middle East Diplomats: 2024 Breach Analysis

In early 2024, state-sponsored threat actors linked to Hamas intensified cyber-espionage campaigns targeting Middle Eastern diplomatic entities. Attackers leveraged tailored malware and advanced phishing schemes to infiltrate networks, harvest intelligence, and gain persistent access to government communications. The campaign utilized unpatched vulnerabilities, abused encrypted and lateral east-west traffic, and bypassed conventional perimeter defenses. These intrusions aimed to gather political intelligence and undermine regional security, impacting the operational confidentiality of affected governments and creating heightened diplomatic tensions. This incident reflects a broader escalation in politically motivated cyber-espionage across the region, as Hamas and allied groups continue to innovate with more sophisticated tooling and tactics. The evolving threat landscape underscores the urgency for robust east-west segmentation, encrypted traffic controls, and real-time threat detection among critical infrastructure and state agencies.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How Salt Typhoon Infiltrated US Telecoms: Lessons from the 2024 Nation-State Attack
Telecommunications10 months ago

How Salt Typhoon Infiltrated US Telecoms: Lessons from the 2024 Nation-State Attack

In early 2024, multiple major US telecommunications providers were targeted in a sophisticated nation-state attack attributed to Salt Typhoon, a Chinese-affiliated APT group. The attackers exploited unencrypted and east-west traffic flows within provider networks, bypassing conventional perimeter defenses to gain persistent access to sensitive infrastructure and intercept data in transit. Salt Typhoon leveraged advanced lateral movement and covert exfiltration techniques, enabling them to collect confidential communications and network architecture details. The incident led to significant operational risks, regulatory scrutiny, and concern within the telecom and national security sectors. This breach highlights a surge in highly targeted attacks on critical infrastructure, as nation-state actors exploit unencrypted traffic and insufficient internal segmentation. Current attacks reflect a broader strategic trend, with organizations facing pressure to modernize controls to address evolving threat vectors and international cyber-risk dynamics.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports