Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Kaspersky SIEM Uncovers ToddyCat DLL Hijacking Attacks in 2024
In early 2024, Kaspersky detected several advanced persistent threat (APT) incidents during pilot testing of their machine-learning-based DLL-hijacking detection module within their SIEM platform. Notably, the ToddyCat APT group exploited a SharePoint vulnerability (CVE-2021-27076) to gain initial access, then leveraged DLL sideloading to execute Cobalt Strike implants using masqueraded Windows system libraries. Other real-world incidents uncovered included infostealer malware posing as a policy manager, and a malicious loader activated through a USB drive, all utilizing DLL hijacking for code execution and persistence. Kaspersky’s detection tool enabled rapid identification and response, preventing further compromise and data exfiltration. This case highlights the growing sophistication of DLL hijacking techniques in APT operations and the increasing use of AI-driven security products to detect lateral movement and stealthy intrusion behaviors. The incidents underscore the need for robust behavioral analytics and real-time anomaly detection as threat actors increasingly target supply chains and trusted binaries to bypass traditional security defenses.
8 months ago
Kill Chain
How a Zimbra Zero-Day Breach Exposed the Brazilian Military: Lessons for Secure Collaboration
In early 2025, a zero-day vulnerability in Zimbra Collaboration (CVE-2025-27915), a widely used email and collaboration platform, was exploited to target the Brazilian military. Attackers used malicious ICS calendar files containing unsanitized HTML and JavaScript to trigger stored cross-site scripting (XSS) within Zimbra's Classic Web Client. This entry vector effectively bypassed standard security controls and provided attackers the ability to execute malicious code in users' browsers, potentially enabling credential theft, session hijacking, and further movement inside the organization before the vulnerability was patched. The campaign underscores how attackers are increasingly leveraging vulnerabilities in collaborative and communication tools to gain a foothold in targeted organizations and critical infrastructure. This breach is particularly relevant today given the ongoing surge in zero-day exploits against widely deployed business applications, especially in sectors such as government and defense. The rapid weaponization of collaboration-tool vulnerabilities highlights the need for timely patch management, robust segmentation, and vigilant threat detection to combat sophisticated phishing and XSS-based initial access.
8 months ago
Kill Chain
Chinese Cybercrime Group Exploits IIS Servers in Global SEO & Credential Theft Scheme
In October 2025, cybersecurity analysts uncovered a campaign orchestrated by a Chinese-speaking cybercrime group known as UAT-8099. The group exploited vulnerabilities in Microsoft Internet Information Services (IIS) servers, primarily targeting organizations across India and Thailand. Attackers deployed malicious scripts and leveraged the compromised servers for global search engine optimization (SEO) fraud while systematically stealing high-value credentials, configuration files, and certificate data. This sophisticated operation impacted business continuity, undermined trust, and exposed sensitive enterprise assets to further misuse. This breach exemplifies the growing threat from well-resourced cybercrime rings using server-side exploits to conduct financially motivated attacks. Similar credential theft and SEO manipulation TTPs are increasingly prevalent worldwide, highlighting an urgent need for enhanced internal server security, threat detection, and compliance with modern data protection standards.
8 months ago
Kill Chain
Oracle E-Business Suite Hit by Cl0p: CVE-2025-61882 Breach Exposes Enterprise Data
In October 2025, Oracle urgently released a security patch addressing CVE-2025-61882, a critical vulnerability in its E-Business Suite platform with a CVSS score of 9.8. The flaw, allowing unauthenticated remote attackers network access via HTTP, was actively exploited by the Cl0p ransomware gang in a series of data theft attacks. Threat actors leveraged the bug to gain control of impacted systems, enabling lateral movement and the exfiltration of sensitive business data. Oracle customers with exposed E-Business Suite deployments were specifically targeted, prompting a rapid, emergency response. This incident highlights the resurgence of large-scale supply chain ransomware attacks exploiting zero-day vulnerabilities in widely used enterprise software. Threat actors like Cl0p are increasingly automating exploitation campaigns, raising the bar for threat detection, patch management, and regulatory compliance requirements in digital enterprises.
8 months ago
Kill Chain
Oracle’s 2025 Mega Breach: 0-Day, BitLocker Bypass & VMScape Trigger Industry Wake-Up
In October 2025, Oracle faced a significant security incident that exposed critical new 0-day vulnerabilities, impacting key platforms via exploits including a BitLocker bypass, the 'VMScape' hypervisor escape, and a fast-spreading WhatsApp worm. Threat actors leveraged multiple sophisticated attack vectors, targeting both enterprise infrastructure and end-user devices. The campaign enabled unauthorized lateral movement, data exfiltration, and disruption of cloud workloads, with global enterprises and managed service providers feeling downstream impact as security researchers identified widespread exploitation across hybrid and multicloud environments. These multi-pronged intrusions forced urgent mitigation efforts, including rapid patching, segmentation, and new traffic visibility controls to stem active attacks. The incident underscores escalating attacker sophistication in blending 0-day exploitation, social engineering, and cloud platform abuse. As threat campaigns increasingly combine lateral spread mechanisms with supply chain risks and targeted ransomware, it highlights the necessity of modern Zero Trust frameworks, advanced detection, and continuous security governance for organizations operating at cloud scale.
8 months ago
Kill Chain
BIETA & CIII Unmasked: China’s MSS Deploys Espionage Through Research Firms in 2025
In October 2025, a detailed investigation revealed that Chinese research firms BIETA (Beijing Institute of Electronics Technology and Application) and CIII were directly implicated in cyber operations orchestrated by China’s Ministry of State Security (MSS). The report, based on personnel link analysis and institutional relationships, highlights how BIETA coordinated with MSS operatives and academic partners to conduct covert cyber-espionage campaigns targeting international entities. These campaigns leveraged advanced tactics, including exploitation of internal network flows and the use of encrypted traffic, to exfiltrate sensitive data undetected. The exposure underscores the persistent and sophisticated nature of state-sponsored cyber threats, as well as risks posed by non-traditional actors collaborating with government intelligence agencies. This incident reflects a broader escalation in state-driven cyber espionage, demonstrating that commercial and academic organizations may serve as active operational arms for nation-state threat actors. As attribution capabilities improve, organizations must reassess third-party relationships and reinforce east-west and encrypted traffic controls to mitigate lateral movement and exfiltration risks.
8 months ago
Kill Chain
How Chinese Front Organizations Exploited Western Research to Advance State Cyber Capabilities
In early 2024, coordinated investigations revealed that Chinese government-linked academic and research institutions were covertly collaborating with Western organizations and researchers. Operating under seemingly neutral fronts, these entities facilitated the transfer of advanced cyber technologies and expertise, ultimately benefitting the intelligence apparatus of the People’s Republic of China (PRC). The campaign included joint projects, academic exchanges, and technology partnerships that enabled the PRC to sidestep export controls and gain access to cutting-edge cyber defense and offensive capabilities. The outcome potentially undermines intellectual property protections and heightens risks to network and national security within targeted Western sectors. This incident underscores a marked escalation in supply chain and technology transfer tactics used by nation-state actors. As the global competition for cyber advantage intensifies, regulators and organizations must heighten vigilance around academic, research, and cross-border tech collaborations to mitigate risks of inadvertent technology leakage.
8 months ago
Kill Chain
Oracle E-Business Suite 2025: Critical SSRF Exploit Exposed and Analyzed
In October 2025, Oracle E-Business Suite was found to be vulnerable to an actively exploited server-side request forgery (SSRF) vulnerability, tracked as CVE-2025-61882. Threat actors leveraged a publicly available exploit script to manipulate the product’s servlet endpoints, extracting CSRF tokens and delivering a crafted payload capable of executing arbitrary commands via XSLT and Java reflection. The attack enabled remote code execution and potential lateral movement within affected enterprise environments, with indicators of compromise made public shortly after discovery. Oracle’s rapid response included a critical patch and threat intelligence advisory. This incident highlights an ongoing surge in advanced web exploitation techniques, particularly SSRF combined with deserialization and XSLT-based attacks. It underscores the urgent need for timely patching, defense-in-depth, and continuous anomaly detection, as well as the growing focus of attackers on business-critical ERP platforms.
8 months ago
Kill Chain
How Attackers Exploited a Zimbra Zero-Day via iCalendar Files in 2024
In early 2024, attackers exploited a previously unknown zero-day vulnerability in Zimbra Collaboration Suite (ZCS), targeting organizations via specially crafted .ICS (iCalendar) attachments. The vulnerability allowed threat actors to execute code by delivering malicious calendar files through email, bypassing traditional security filters. Incident responders observed attackers using this method for initial access, resulting in potential data theft, lateral movement, and disruption of email communications for affected businesses. The exploitation remained undetected for a significant period, amplifying operational and reputational risks for impacted entities. This incident highlights a growing trend of attackers leveraging supply chain and collaboration software vulnerabilities for sophisticated phishing and malware campaigns, often exploiting zero-days before vendors can respond. Organizations relying on common email and collaboration platforms face increased exposure to targeted file-type exploits and require improved visibility and rapid patching capabilities.
8 months ago
Kill Chain
Palo Alto Networks Faces Massive Surge in Login Portal Recon Scans
In early October 2025, cybersecurity firm GreyNoise detected a sharp 500% spike in reconnaissance scans targeting Palo Alto Networks GlobalProtect and PAN-OS login portals. Over 1,285 unique suspicious IP addresses, predominantly from the U.S., but also from the UK, Canada, the Netherlands, and Russia, launched automated probes against these authentication portals. The campaign appeared targeted, leveraging data from public scanning platforms like Shodan and Censys. No verified exploit or compromise has been confirmed, with Palo Alto Networks asserting their systems remain secure and attributing much of the observed activity to external fingerprinting, not internal breach. This incident highlights a broader escalation in focused reconnaissance tactics against major infrastructure platforms, often preceding attempts to weaponize new vulnerabilities. Organizations should remain vigilant about emerging threats, monitor authentication endpoints, and proactively patch known and zero-day-related risks.
8 months ago
Kill Chain
Palo Alto Networks Portals Targeted by 500% Surge in Reconnaissance Scanning
On October 3, 2025, cybersecurity researchers at GreyNoise detected an unprecedented 500% spike in scanning activity targeting Palo Alto Networks login portals, marking the highest volume observed over a three-month period. The scanning involved a surge of IP addresses systematically probing these portals, suggesting highly targeted reconnaissance efforts by unknown threat actors. While no direct exploitation or breach was reported, such coordinated scanning is often the precursor to exploitation attempts against potential vulnerabilities in security infrastructure, especially as targeted technologies are foundational for enterprise security postures. This incident exemplifies the growing trend of automated reconnaissance on high-value network assets as adversaries aim to map attack surfaces for later campaigns. Organizations relying on exposed management interfaces must bolster detection, segmentation, and access controls to address these evolving reconnaissance tactics.
8 months ago
Kill Chain
Dutch Teens Arrested for Wi-Fi Sniffer Recon in 2024 Russian Espionage Case
In June 2024, Dutch law enforcement arrested two 17-year-olds suspected of conducting cyber-espionage for Russian-backed threat actors. The teens reportedly canvassed high-profile locations in The Hague, including several embassies and European law enforcement headquarters, using a Wi-Fi sniffer to gather network intelligence. Authorities allege they were recruited via Telegram and that state-sponsored Russian actors utilized the pair for reconnaissance, leveraging youth engagement to mask attribution. The operation came to light after a tip-off from Dutch intelligence, resulting in swift arrests and raising significant policy concerns. This incident underscores a rising trend of nation-states outsourcing early reconnaissance to foreign youth via social media, reducing their risk of direct detection. The use of simple yet effective tools for physical/digital hybrid espionage highlights growing operational sophistication—and creates new urgency for organizations to shore up network perimeter and monitoring controls.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports