Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3246 threat reports
Page 219 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 2617–2628 / 3246 reports
Inside the 2025 Digital Fraud Surge: How AI Supercharged Cybercrime
Financial Services10 months ago

Inside the 2025 Digital Fraud Surge: How AI Supercharged Cybercrime

In early 2025, a wave of advanced persistent fraud targeted multiple global organizations as cybercriminals leveraged generative AI and automated bots to launch large-scale digital fraud schemes. Attackers used sophisticated deepfake technology and high-quality counterfeit IDs to penetrate identity verification systems, bypass account controls, and hijack customer accounts across banking, healthcare, and e-commerce sectors. The attacks exploited gaps in east-west traffic security and leveraged encrypted channels to evade detection for months. Businesses suffered significant financial losses, reputational damage, and were forced to bolster their compliance efforts in the wake of the breach. This incident marked a turning point in the evolution of digital fraud, as attackers embraced highly scalable automation and AI for identity-driven campaigns. The surge in industrial-scale fraud highlighted gaps in visibility, zero-trust segmentation, and anomaly detection while placing new urgency on regulatory compliance and modern defense architectures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
ShinySP1D3R Ransomware Hits Hybrid Clouds During Holiday 2024
Financial Services10 months ago

ShinySP1D3R Ransomware Hits Hybrid Clouds During Holiday 2024

In December 2024, organizations worldwide were targeted by the ransomware group known as ShinySP1D3R, identified as an offshoot of the Scattered LAPSUS$ Hunters collective. Attackers exploited vulnerabilities in unencrypted east-west and egress traffic to gain network access, rapidly deploying ransomware across hybrid cloud environments during the busy holiday season. The incident resulted in substantial service outages, data encryption, and led to operational delays for affected enterprises, reinforcing the dangers of sophisticated lateral movement paired with insufficient segmentation controls. This incident highlights a rising trend of threat actors striking during holidays when staffing is limited and detection/response windows are higher. The campaign’s use of advanced TTPs—such as distributed command and control and abuse of hybrid connectivity—emphasizes why zero trust architectures and continuous threat monitoring are now business-critical.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Banks and Governments Exposed: Code Beautifiers Leak Credentials in 2024
Banking/Mortgage10 months ago

Banks and Governments Exposed: Code Beautifiers Leak Credentials in 2024

In early 2024, researchers discovered that thousands of sensitive credentials, API keys, and authentication tokens belonging to global banks, government agencies, and technology companies were inadvertently exposed through public submissions to online code formatting tools such as JSONFormatter and CodeBeautify. These web-based beautifier platforms, commonly used by developers to format or debug code, were found to be storing users’ uploads—including confidential configuration files—in publicly accessible repositories without adequate warning or access control. As a result, threat actors could easily discover and exploit these exposed secrets to compromise critical infrastructure or initiate supply chain attacks. This incident underscores the ongoing risks of third-party tool usage in secure development lifecycles. With data exposures driven by everyday tooling, organizations face mounting regulatory and operational scrutiny to audit developer practices, harden supply chain security, and implement broader controls for inadvertent credential leakage.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
How the OnSolve CodeRED Cyberattack Disrupted America’s Emergency Alert Infrastructure
Government Administration10 months ago

How the OnSolve CodeRED Cyberattack Disrupted America’s Emergency Alert Infrastructure

In June 2024, Crisis24 confirmed that its OnSolve CodeRED platform—used by state and local governments, police, and firefighting agencies—suffered a cyberattack disrupting emergency notification systems nationwide. Attackers gained unauthorized access to critical infrastructure, resulting in outages that hindered the timely dissemination of emergency alerts and public safety updates. While the investigation is ongoing, the breach demonstrates significant operational risks associated with service provider platforms in the public safety sector, impacting communities’ emergency preparedness and response effectiveness. This incident underscores growing threats targeting third-party vendors in critical sectors, where cyberattacks exploit platform dependencies to cause widespread and immediate disruption. With increasing regulatory scrutiny and a surge in ransomware and extortion campaigns against essential services, organizations must reassess supply chain, segmentation, and incident response controls to maintain operational and compliance resilience.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
CISA Uncovers 2025 Spyware Assaults on Signal and WhatsApp Users
Government Administration10 months ago

CISA Uncovers 2025 Spyware Assaults on Signal and WhatsApp Users

In June 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert regarding active espionage campaigns exploiting commercial spyware and remote access trojans (RATs) to compromise high-value users on secure messaging apps including Signal and WhatsApp. Attackers utilized sophisticated social engineering techniques—such as phishing and malicious links—to covertly deliver malware, enabling unauthorized access to users' encrypted chats, sensitive attachments, and even device controls. The victims ranged from executives and journalists to government officials, highlighting the background emergence of advanced social engineering paired with novel spyware kit deployment. The incident triggered heightened scrutiny of both messaging app security and endpoint defense controls. This event is emblematic of a growing surge in targeted surveillance operations against individuals using encrypted communication platforms. It raises concern over the effectiveness of endpoint security, user awareness, and the need for proactive threat intelligence, while highlighting an evolution in adversary tactics toward cloud-based and identity-driven infiltration.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
How Online Formatting Tools Exposed Thousands of Credentials: The JSONFormatter & CodeBeautify Leak
Government Administration10 months ago

How Online Formatting Tools Exposed Thousands of Credentials: The JSONFormatter & CodeBeautify Leak

In late 2025, researchers uncovered that thousands of sensitive credentials, including passwords and API keys from governments, telecoms, and critical infrastructure organizations, were exposed after being pasted into public web-based code formatting tools such as JSONFormatter and CodeBeautify. This inadvertent data exposure occurred over several years, as users leveraged these tools for convenience, unaware that information was being logged and stored without proper security. Security experts at watchTowr Labs discovered over 80,000 files containing this data, raising alarm over the significant risk posed to organizations relying on manual and unsecured workflows. This incident has highlighted the growing risks of shadow IT and insecure use of web utilities in enterprise environments. It mirrors a broader trend of misconfigured third-party tools creating substantial vulnerabilities, elevating concerns amid regulatory crackdowns and increased exploitation of exposed secrets by attackers.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
ToddyCat's 2025 Attack: How APTs Are Hijacking Microsoft 365 Email Tokens
Financial Services10 months ago

ToddyCat's 2025 Attack: How APTs Are Hijacking Microsoft 365 Email Tokens

In late 2025, the Advanced Persistent Threat (APT) group known as ToddyCat launched a sophisticated cyber espionage campaign targeting corporate environments across Europe and Asia. The attackers leveraged a new custom tool, TCSectorCopy, to steal Microsoft Outlook emails and Microsoft 365 OAuth 2.0 access tokens. By compromising user endpoints and abusing browser-based authentication flows, ToddyCat successfully exfiltrated sensitive email data and bypassed perimeter controls. The campaign, marked by its stealthy techniques, enabled attackers to maintain persistent access and move laterally within affected networks, significantly increasing the risk to sensitive enterprise communications and intellectual property. This incident highlights the growing reliance of threat actors on token theft and cloud-based attack vectors, posing new challenges for organizations with hybrid or cloud-first environments. It underscores the urgent need for advanced detection capabilities, Zero Trust network segmentation, and comprehensive identity protection strategies to counter emerging APT tactics.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Zenitel TCIV-3+ 2025: Critical ICS Vulnerabilities Enable Remote Attacks
Telecommunications10 months ago

Zenitel TCIV-3+ 2025: Critical ICS Vulnerabilities Enable Remote Attacks

In November 2025, Zenitel disclosed multiple critical vulnerabilities affecting its TCIV-3+ intercom systems, widely deployed in communications-critical infrastructure worldwide. Security researchers from Claroty Team82 identified three separate OS command injection flaws (CVE-2025-64126, -64127, -64128), as well as a severe out-of-bounds write and a reflected cross-site scripting vulnerability. These issues allowed threat actors to remotely execute arbitrary code or cause denial-of-service conditions without authentication, putting operational technology environments at significant risk of disruption or compromise. The vulnerabilities require only low-complexity attacks and no user interaction, amplifying their business impact. This incident highlights the ongoing critical importance of securing industrial control system components exposed to remote exploitation. With threat actors increasingly targeting IoT and OT devices in critical communications infrastructure, these types of vulnerabilities are seeing a dramatic rise globally, and patching urgency is at an all-time high.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
SiRcom Vulnerability Exposes Critical Siren Systems to Hijack (2025)
Government Administration10 months ago

SiRcom Vulnerability Exposes Critical Siren Systems to Hijack (2025)

In November 2025, a critical vulnerability (CVE-2025-13483) was disclosed in SiRcom SMART Alert (SiSA), a central emergency alert management system used globally in emergency services, government, and defense sectors. The flaw, due to missing authentication for critical API functions, enabled unauthenticated attackers to access restricted backend operations. Successful exploitation could allow remote manipulation and activation of emergency sirens, posing wide-reaching operational and safety risks to affected communities. The vulnerability, assigned a CVSS v4 score of 8.8, was initially reported by Microsec researcher Souvik Kandar. This incident highlights the persistent risks posed by missing authentication in critical infrastructure applications. With remote exploitation possible and attackers’ interest in manipulating physical environments on the rise, it underscores the urgent need for robust authentication, especially amid compliance and regulatory tightening in the critical infrastructure sector.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Opto 22 groov View: 2025 ICS Vulnerability Exposes API Keys & Credentials
Industrial Automation10 months ago

Opto 22 groov View: 2025 ICS Vulnerability Exposes API Keys & Credentials

In November 2025, Opto 22 disclosed a critical vulnerability (CVE-2025-13084) affecting its groov View industrial control platform, impacting versions of groov View Server for Windows and GRV-EPIC firmware. Security researchers from Meta identified that the API's users endpoint could inadvertently expose all user metadata, including API keys and credentials—even those for administrator accounts—when accessed by users with Editor privileges. Although exploitation requires already having Editor-level access, a successful attack could result in full privilege escalation, credential compromise, and unauthorized access across critical manufacturing environments worldwide. This incident highlights ongoing risks in industrial control systems (ICS) where sensitive data is exposed through insufficient API controls. The breach underscores the rising importance of strict segmentation, encrypted traffic management, and proactive patch management in ICS environments, especially as remote exploitation and metadata exposure attacks become more common.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Oracle 2025 Identity Manager Breach: CVE-2025-61757 Exploited in New Extortion Campaigns
Financial Services10 months ago

Oracle 2025 Identity Manager Breach: CVE-2025-61757 Exploited in New Extortion Campaigns

In 2025, Oracle’s Identity Manager platform was found to have a critical vulnerability, designated CVE-2025-61757, which was actively exploited by threat actors. Attackers leveraged this flaw to gain unauthorized access, escalate privileges, and potentially move laterally across enterprise environments leveraging Oracle's identity suite. This campaign followed earlier Oracle Cloud security incidents and a notable extortion trend targeting Oracle E-Business Suite customers, raising concerns about the security posture of widely-deployed identity management systems. This breach underscores an urgent industry shift: as digital identity becomes the new security perimeter, attackers increasingly target identity infrastructure. The incident’s exploit path highlights the need for robust segmentation, real-time threat detection, and compliance-driven control across cloud and enterprise platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
JackFix Attack: How Phishing Evolved to Outsmart ClickFix Defenses
Financial Services10 months ago

JackFix Attack: How Phishing Evolved to Outsmart ClickFix Defenses

In early June 2024, a new phishing campaign dubbed the 'JackFix' attack emerged, leveraging adaptations of the previously known ClickFix tactic to bypass recently implemented technical mitigations. Threat actors used sophisticated psychological manipulation and novel evasion techniques to bypass security controls and deceive end users into clicking malicious links. Once inside targeted environments, the attackers engaged in lateral movement and data exfiltration, exploiting inadequate segmentation and detection gaps. Organizations affected experienced compromised credentials, unauthorized access to sensitive systems, and increased risk of regulatory exposure due to the attack’s ability to blend with normal traffic. This incident underscores the rapid evolution of phishing methods in response to security improvements, highlighting the urgent need for layered defenses and zero trust segmentation. The JackFix attack is part of a wider trend of phishing campaigns that employ behavioral engineering and technical countermeasures, challenging legacy detection and policy frameworks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports