Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3246 threat reports
Page 223 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 2665–2676 / 3246 reports
JustAskJacky 2025: AI/ML Exploitation Drives Major User Data Exposure
Financial Services10 months ago

JustAskJacky 2025: AI/ML Exploitation Drives Major User Data Exposure

In November 2025, the AI-driven platform JustAskJacky was compromised, exposing sensitive user prompts and data after adversaries exploited weaknesses in encrypted traffic controls and inadequate egress security. Attackers orchestrated lateral movements across internal AI/ML workloads, leveraging insufficient segmentation and lack of effective visibility to siphon proprietary inputs and outputs through encrypted but poorly-monitored channels. The breach remained undetected for weeks, putting affected businesses and consumers at risk of prompt leakage, IP loss, and possible regulatory infractions in industries reliant on AI automation. This incident underscores a surge in sophisticated AI/ML exploitation techniques and highlights systemic gaps in east-west traffic security, zero trust segmentation, and anomaly detection across multicloud and hybrid environments. As organizations accelerate their adoption of AI-powered platforms, the need for robust compliance and zero trust frameworks has reached critical urgency.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Matrix Push: How Browser Notifications Became a C2 Weapon in 2024
Banking/Mortgage10 months ago

Matrix Push: How Browser Notifications Became a C2 Weapon in 2024

In early 2024, cybersecurity researchers reported that a threat actor group leveraged a new Command and Control tool—dubbed 'Matrix Push'—to hijack web browser notifications as an innovative phishing and persistence mechanism. Attackers delivered malicious payloads through deceptive websites, tricking users into allowing browser notifications. These notifications were abused to send phishing lures and exfiltrate user information, evading traditional network monitoring tools by using trusted browser channels. The campaign allowed remote control and persistent access to compromised endpoints, highlighting a shift toward social engineering at the browser level. Organizations targeted included enterprises in technology, finance, and professional services sectors, resulting in elevated risks of credential theft and lateral movement. This incident is especially notable for exploiting a trusted browser feature in new ways, bypassing established email and endpoint filtering controls. As browser notification-based attacks surge, security teams face increased pressure to adapt controls. The tactics highlight the urgent need for enhanced user awareness and modern segmentation/visibility solutions that can identify and mitigate covert browser-based C2 channels.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Critical WebCTRL Server Flaws Threaten Building Automation Security in 2025
Construction10 months ago

Critical WebCTRL Server Flaws Threaten Building Automation Security in 2025

In November 2025, Automated Logic disclosed critical vulnerabilities impacting multiple legacy versions of its WebCTRL Premium Server and related Carrier i-Vu and SiteScan Web products. Reported by researchers Jaryl Low, Thuy D. Nguyen, and Cynthia E. Irvine, the flaws—CVE-2024-8527 (Open Redirect) and CVE-2024-8528 (Cross-site Scripting)—could allow remote attackers to deceive users into navigating to malicious sites or executing attacker-controlled scripts. These vulnerabilities affect industrial control solutions deployed globally within the Critical Manufacturing sector, potentially enabling credential theft, phishing, or unauthorized access to sensitive building automation environments. This incident underscores the urgent need for timely patching and secure software development in critical infrastructure industries. As web application attacks increase and threat actors target supply chain and operational technology, coordinated disclosures and swift remediation remain vital to reduce risk and comply with tightening regulatory frameworks.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Exposes Multi-Vendor ICS Vulnerabilities: 2025 Critical Infrastructure Security Alert
Utilities10 months ago

CISA Exposes Multi-Vendor ICS Vulnerabilities: 2025 Critical Infrastructure Security Alert

In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) issued six critical advisories revealing vulnerabilities across various Industrial Control Systems (ICS) devices, including those from Automated Logic, ICAM365, Opto 22, Festo, and Emerson. Attackers could exploit these flaws—ranging from weak authentication to remote code execution—potentially enabling unauthorized access, data exfiltration, or disruption of operational technology environments. ICS operators were urged to review technical details and partner with vendors for rapid mitigation to prevent lateral movement or credential compromise impacting essential infrastructure. This incident highlights the growing convergence of operational technology and IT risk, with threat actors increasingly targeting ICS environments. The regulatory and threat landscape is evolving, compelling organizations to strengthen segmentation, network monitoring, and zero trust security controls in light of rising attacks on critical infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical UPS Vulnerability: Emerson Appleton UPSMON-PRO Flaw Exposes ICS to Remote Attacks
Health Care / Life Sciences10 months ago

Critical UPS Vulnerability: Emerson Appleton UPSMON-PRO Flaw Exposes ICS to Remote Attacks

In November 2025, a critical vulnerability (CVE-2024-3871) was disclosed affecting Emerson's Appleton UPSMON-PRO, a monitoring solution widely deployed in critical infrastructure sectors including manufacturing and healthcare. Security researchers found that remotely sent, specially crafted UDP packets could trigger a stack-based buffer overflow, granting attackers SYSTEM-level privileges and permitting remote code execution on unpatched systems. The product, which reached End of Life status prior to disclosure, is still in use across several organizations, amplifying the impact of the vulnerability on global operational technology environments. This incident underscores a growing pattern of legacy ICS software vulnerabilities being targeted via low-complexity, remote attacks. Increased regulatory scrutiny and the advancing sophistication of attackers elevate the importance of updating unsupported systems and implementing defense-in-depth strategies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
iCam365 CCTV Camera Vulnerabilities Expose Video Streams and Configuration Data in 2025
Commercial Real Estate10 months ago

iCam365 CCTV Camera Vulnerabilities Expose Video Streams and Configuration Data in 2025

In November 2025, critical vulnerabilities were disclosed affecting iCam365 CCTV camera models P201 and QC021 (versions 43.4.0.0 and prior), allowing unauthorized access to video streams and configuration data via missing authentication controls. CVE-2025-64770 and CVE-2025-62674 enable attackers present on the same network segment to exploit unauthenticated access to ONVIF and RTSP services, potentially exposing sensitive surveillance footage and device configurations across commercial facilities globally. The vulnerabilities were reported by researcher Truong Nguyen Long and published by CISA after vendor non-responsiveness. This exposure highlights the persistent risk of IoT and security camera devices with weak or missing access controls, coinciding with broader trends of exploitation in internet-connected infrastructure. As remote surveillance soars and IoT devices proliferate, such lapses in device security increase the attack surface for organizations across industries.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
AI Agents: The New Attack Surface for Network Compromise in 2024
Financial Services10 months ago

AI Agents: The New Attack Surface for Network Compromise in 2024

In early 2024, cybersecurity researchers highlighted a critical weakness in agentic AI systems, demonstrating that malicious actors can subvert autonomous AI agents to alter behavior and compromise entire enterprise networks. By leveraging AI agent hijacking, attackers manipulated goal-seeking models and agent-to-agent communications to bypass security controls, escalate privileges, and move laterally within high-value environments. The incident revealed how the expanding AI/ML attack surface introduces new entry vectors tied to agent autonomy, cloud AI orchestration, and internal east-west traffic, posing operational risk to organizations deploying intelligent automation at scale. This incident underscores the urgent need for AI security frameworks and robust segmentation controls as enterprises accelerate agent and copilot deployments. With rapid adoption of agentic AI, attackers are increasingly exploiting flaws in agent autonomy and communication to orchestrate sophisticated attacks, raising the bar for zero trust and security visibility in multi-cloud environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
China-Backed PlushDaemon APT Leverages Network Devices for Advanced MitM Attacks (2024)
Telecommunications10 months ago

China-Backed PlushDaemon APT Leverages Network Devices for Advanced MitM Attacks (2024)

In 2024, ESET researchers uncovered a sustained campaign by the China-linked PlushDaemon APT that targeted edge and network devices in government, telecommunications, and technology sectors, enabling advanced adversary-in-the-middle (AitM) attacks. PlushDaemon deployed a sophisticated network implant capable of intercepting, modifying, and redirecting encrypted and unencrypted traffic, allowing the threat actor to facilitate credential theft and covert surveillance. The operation exploited weak segmentation and insufficient east-west controls, compromising business operations and exposing sensitive communications to persistent espionage. This incident is particularly relevant as APTs increasingly leverage traffic interception at the network device layer, bypassing traditional endpoint security and highlighting urgent gaps in zero trust, segmentation, and encrypted traffic monitoring solutions.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Fortinet Hit Again: WAF Zero-Day Exploitation Prompts Security Scrutiny
Financial Services10 months ago

Fortinet Hit Again: WAF Zero-Day Exploitation Prompts Security Scrutiny

In June 2024, Fortinet disclosed that a second zero-day vulnerability affecting its FortiWeb Web Application Firewall (WAF) products was actively exploited in the wild. Attackers leveraged the undisclosed flaw to bypass security controls and potentially gain unauthorized remote access to customer environments, raising major concerns about the rapidity and transparency of Fortinet's incident response. The breach followed an earlier 2024 WAF zero-day, indicating a worrying escalation in threat actor targeting and sophistication against network-edge defense systems. This incident underscores the increasing prevalence of zero-day attacks against security appliances themselves, a trend accelerated by sophisticated threat actors who seek to exploit both technical weaknesses and delayed vendor responses. Rapid incident disclosure and robust patching are now critical to safeguarding key infrastructure.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Amazon Warns: MuddyWater Cyberattack Bridges Digital and Kinetic Warfare
Defense/Space10 months ago

Amazon Warns: MuddyWater Cyberattack Bridges Digital and Kinetic Warfare

In June 2024, Amazon Threat Intelligence reported a sophisticated, nation-state cyberattack demonstrating the merging of cyber and kinetic warfare. The Iranian-backed MuddyWater group leveraged compromised CCTV infrastructure in Jerusalem to obtain real-time intelligence, directly enabling more precise missile strikes against physical targets. Attackers provisioned infrastructure and infiltrated CCTV feeds a month in advance, highlighting a deliberate and strategic approach to combining digital reconnaissance with physical attack vectors. Israeli authorities confirmed that this real-time data was used to adjust targeting during the incident, leading to heightened operational impact and escalating concerns for critical infrastructure operators. This incident underscores an alarming trend: cyber-espionage operations now increasingly serve as force multipliers for military actions. The blurred line between cyber and physical domains exemplifies an evolution in threat tactics, with nation-state actors exploiting enterprise networks as entry points for real-world impact. Security leaders must recognize this convergence and adapt defense and intelligence sharing accordingly.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Five Eyes Target Bulletproof Hosting: Sanctions Rock Media Land & Aeza Group in 2024
Financial Services10 months ago

Five Eyes Target Bulletproof Hosting: Sanctions Rock Media Land & Aeza Group in 2024

In June 2024, the Five Eyes intelligence alliance—comprising the US, UK, and Australia—executed coordinated sanctions against Russia-based bulletproof hosting provider Media Land, its executives, three subsidiaries, and entities supporting the previously sanctioned Aeza Group. These hosting providers were identified as key enablers for major ransomware groups (such as LockBit, BlackSuit, and Play), facilitating operations including malware delivery, phishing, and data extortion. Bulletproof hosting infrastructure aided threat actors by allowing them to mask malicious activity and evade law enforcement action, thereby supporting cybercrime at scale for nearly a decade. This incident highlights the increasing focus by global regulators and law enforcement on disrupting the infrastructure and services that underpin the cybercrime ecosystem, rather than targeting individual attackers. The coordinated international response signals a trend toward attacking the foundational services cybercriminals rely on, underscoring the evolving strategies required to address rising ransomware and data extortion threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
PlushDaemon Supply Chain Breach: How Integrity Controls Failed in the 2024 Update Hijack
Computer Software/Engineering10 months ago

PlushDaemon Supply Chain Breach: How Integrity Controls Failed in the 2024 Update Hijack

In early 2024, the China-aligned 'PlushDaemon' advanced persistent threat leveraged software update channels in supply-chain environments to deliver malicious payloads. Attackers infiltrated legitimate update infrastructure, intercepting and modifying update traffic destined for victim organizations across multiple sectors. The campaign enabled remote code execution, deployment of backdoors, and potential data exfiltration by masquerading malicious code as legitimate updates, significantly increasing evasion capabilities and operational impact. Victims discovered the compromise after anomalous network activity and unauthorized privilege escalations were observed within internal systems. This attack highlights a growing trend of sophisticated supply-chain compromises, demonstrating an escalation in targeting trusted dependencies to bypass traditional perimeter defenses. As threat actors expand their tactics and exploit trusted communications, organizations face heightened urgency to enforce software integrity, robust network segmentation, and end-to-end traffic inspection.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports