Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
UNC5174 Exploits VMware Zero-Day in Cloud Foundation: 2024 Breach Analysis
In October 2024, China-linked threat actor UNC5174 actively exploited an undisclosed zero-day vulnerability (CVE-2025-41244) in Broadcom VMware Tools and VMware Aria Operations, primarily impacting VMware Cloud Foundation 4.x and 5.x. This local privilege escalation flaw allowed attackers to gain elevated access on affected systems, facilitating potential lateral movement across enterprise networks. The exploitation campaign remained undetected for several months until NVISO Labs and security researchers documented the sophisticated tactics, techniques, and persistence of UNC5174. This incident highlights the growing risks associated with zero-day vulnerabilities in widely deployed virtualization platforms, especially as advanced persistent threats increasingly target cloud and hybrid infrastructure. The attack underscores the urgent need for robust patch management and east-west security controls amid a surge in sophisticated nation-state cyber activity.
8 months ago
Kill Chain
Phantom Taurus: Stealth China-Linked APT Breaches Global Governments in 2025
Between early 2023 and mid-2025, government and telecommunications agencies spanning Africa, the Middle East, and Asia became the targets of a previously undocumented China-linked nation-state threat group, dubbed Phantom Taurus. The group leveraged stealthy, custom malware and encrypted command-and-control channels to infiltrate ministries of foreign affairs, embassies, and military operations, maintaining persistent access to sensitive networks for extended periods. Attackers employed advanced lateral movement and living-off-the-land techniques, hindering detection and enabling covert intelligence collection. Exfiltrated data included diplomatic communications and potentially classified material, posing severe geopolitical and operational risks to the affected organizations. This incident underscores a rising trend of sophisticated China-aligned APT campaigns exploiting stealth malware, encrypted traffic, and advanced cloud evasion to breach strategic targets. As state-sponsored espionage continues to escalate, organizations must strengthen zero trust controls, real-time traffic inspection, and segmented multicloud defenses to counter evolving nation-state tactics.
8 months ago
Kill Chain
Palo Alto GlobalProtect VPN Vulnerability (CVE-2024-3400): Global Exploitation in 2024
In September 2024, cybersecurity observers detected a surge in malicious internet scans targeting Palo Alto Networks GlobalProtect gateways vulnerable to CVE-2024-3400. Threat actors exploited an authentication validation flaw, enabling unauthenticated attackers to manipulate session IDs and upload arbitrary files to the server. Initial activity was observed from IP 141.98.82.26, executing file upload and retrieval attempts against honeypots. While early-stage attacks focused on validating exploitability, successful exploitation of this flaw could lead to remote code execution, exposing enterprise networks protected by GlobalProtect to compromise, lateral movement, and potential data breaches. This incident is significant as CVE-2024-3400 rapidly attracted widespread exploitation attempts, with proof-of-concept code and automated scanning observed in the wild. The event underscores the criticality of timely appliance patching and the inherent risk posed by remotely accessible VPN infrastructure in enterprise environments.
8 months ago
Kill Chain
IoT Devices in the Crosshairs: The 2024 Admin Cookie Exploitation Wave
In September 2024, widespread exploitation of IoT devices was observed, leveraging insecure session cookies and weak access control. Attackers were able to escalate privileges or bypass authentication entirely by modifying HTTP cookies such as 'user=admin', 'uid=1', or similar session tokens on devices including TBK DVRs, LB-LINK routers, Tenda access points, and biometric access systems. The method often enabled the execution of OS commands or remote code, with threat actors targeting default credentials and under-protected web interfaces for persistence and lateral movement. Impact included unauthorized system changes, potential data exfiltration, and compromise across IoT and networking infrastructure in both consumer and enterprise environments. This incident highlights an ongoing trend: attackers increasingly exploit weak authentication and session management in IoT devices, which often lack robust patching and monitoring. With regulatory frameworks tightening and IoT expanding into critical sectors, such low-effort but high-impact vulnerabilities are becoming a major concern for organizations seeking to secure their operational technology.
8 months ago
Kill Chain
Akira Ransomware Launches Mass Attack on SonicWall VPNs in 2025
In mid-2025, Akira ransomware operators launched a widespread campaign targeting organizations using SonicWall VPN appliances, exploiting a critical vulnerability (CVE-2024-40766) in SonicOS firmware. Attackers achieved initial access through malicious SSL VPN logins, sometimes even bypassing one-time password (OTP) multi-factor authentication controls. Following a successful breach, the attackers conducted rapid port scanning and lateral movement via Impacket SMB activity before deploying Akira ransomware, impacting organizations across various sectors. Despite firmware updates and password resets, compromised credentials persisted, leaving several devices exposed, and the campaign has continued to escalate into late September 2025. This incident illustrates the ongoing evolution and sophistication of ransomware campaigns exploiting network infrastructure vulnerabilities and underscores the urgency of proactive credential management, privileged access monitoring, and swift patch adoption. It exemplifies growing attacks abusing VPNs and MFA, requiring organizations to revisit zero trust and layered defense measures.
8 months ago
Kill Chain
Phantom Taurus: Inside the 2025 Chinese APT NET-STAR Espionage Breach
In early 2025, security researchers uncovered a sophisticated espionage campaign attributed to a newly recognized Chinese nation-state actor, Phantom Taurus. Operating since at least late 2022, the group prioritized stealth and advanced tactics, primarily targeting government and telecommunications entities across Africa, the Middle East, and Asia. Attackers leveraged a novel, highly covert malware suite—NET-STAR—capable of remaining fileless within IIS web servers and facilitating persistent, encrypted exfiltration of sensitive diplomatic, military, and geopolitical data. The operation exploited custom-developed tools to move from email theft to direct database compromise, employing in-memory web backdoors and evasion techniques like timestomping and security mechanism bypasses to avoid detection and maintain long-term access. The exposure of Phantom Taurus and the NET-STAR suite highlights an escalating trend of targeted, stealthy cyber espionage campaigns against critical infrastructure by advanced persistent threat (APT) actors. This incident underscores the urgent need for organizations to strengthen east-west security visibility, enforce zero trust principles, and regularly review controls against constantly evolving attacker tradecraft.
8 months ago
Kill Chain
Jaguar Land Rover’s 2025 Ransomware Crisis: Lessons on Supply Chain and Zero Trust Resilience
In September 2025, Jaguar Land Rover (JLR) was forced to halt production across multiple plants after suffering a catastrophic ransomware attack. The incident resulted in severe IT system disruption, suspended manufacturing operations, and subsequent data theft. A cybercrime group calling itself 'Scattered Lapsus$ Hunters' – reportedly linked to Scattered Spider and ShinyHunters – claimed responsibility, providing evidence of internal SAP system access. The attack’s impact exposed JLR’s business continuity vulnerabilities, prompted supply chain paralysis, and led the UK government to back a significant £1.5 billion loan guarantee to stabilize operations and prevent wider economic fallout. The breach highlights how ransomware actors are increasingly targeting critical manufacturing and supply chains for greater leverage. With mounting regulatory pressure and evolving attack tactics, strengthening enterprise resilience, zero trust architectures, and segmentation is more urgent than ever.
8 months ago
Kill Chain
Microsoft Warns: AI-Powered SVG Phishing Campaign Evades Email Security
In September 2025, Microsoft disclosed a sophisticated phishing campaign targeting US-based organizations that leveraged large language models (LLMs) to craft highly obfuscated SVG file payloads. Attackers used these LLM-generated SVG attachments to evade traditional email security filters, employing convincing business terminology and synthetic code structures to deliver malicious links or steal credentials. The campaign demonstrates a notable escalation in phishing tactics, exploiting advancements in AI to automate and disguise attack vectors, with the operational impact ranging from compromised accounts to potential supply chain breaches. This incident exemplifies a new era of phishing attacks empowered by generative AI, underlining the growing urgency for advanced detection capabilities and stricter email security policies. The trend highlights a pivot toward more adaptive, machine-generated threats that traditional tools may be ill-equipped to address.
8 months ago
Kill Chain
Ukrainian Police Spoofed: SVG Fileless Phishing Delivers Amatera Stealer in Kyiv
In early 2024, cybercriminals conducted a sophisticated phishing campaign targeting organizations and individuals in Kyiv, Ukraine, by spoofing the National Police of Ukraine. The attackers distributed malicious emails containing Scalable Vector Graphics (SVG) files, which enabled fileless delivery of info-stealing malware such as Amatera Stealer and the cryptocurrency miner PureMiner. By leveraging social engineering and trusted police branding, they bypassed common security defenses, leading to the theft of sensitive credentials, system compromise, and potential financial losses. The breach highlights attackers’ growing reliance on fileless techniques and deceptive lures to infiltrate victims’ environments with minimal detection. This incident underlines a shift toward advanced, stealthy phishing tactics that weaponize graphics files and trusted institutional identities. The approach signifies an escalating trend in cybercrime, where threat actors continue to innovate to evade legacy controls and exploit user trust amid ongoing geopolitical unrest.
8 months ago
Kill Chain
2025’s Cyber Tsunami: Cisco 0-Day, Record DDoS & Multi-Vector Threats Unleashed
In September 2025, the global cybersecurity landscape faced a convergence of high-profile threats, including a critical Cisco 0-day vulnerability, record-breaking distributed denial-of-service (DDoS) attacks, an emergent LockBit 5.0 ransomware variant, multiple vulnerabilities targeting baseboard management controllers (BMC), and rapid expansion of the ShadowV2 botnet. Adversaries exploited the Cisco 0-day to gain privileged access, launched multi-vector DDoS assaults disrupting online services, compromised server hardware via BMC flaws, and weaponized the new LockBit variant for data extortion and ransomware. The combination of these attacks resulted in widespread operational instability, data breaches, and heightened risk exposure across cloud and on-premises environments. These incidents underscore the rapidly evolving threat landscape, marked by increasingly sophisticated and diverse attack vectors that target infrastructure, software, hardware, and supply chains simultaneously. The convergence of ransomware, DDoS, and zero-day exploitation—often driven by organized cybercriminal groups—signals an urgent need for organizations to adopt layered, zero trust security strategies and accelerate detection and response.
8 months ago
Kill Chain
CISA Expiration: The Looming Risk to U.S. Cyber Threat Intelligence Collaboration
In June 2024, the Cybersecurity Information Sharing Act (CISA) is poised to expire, potentially removing crucial liability protections that allow private and public entities to exchange cyber threat intelligence without fear of legal repercussions. If congressional reauthorization is not enacted, organizations may retreat from collaborative defense, risking increased exposure to sophisticated cyber threats like AI-driven attacks, ransomware, and advanced nation-state intrusions such as the recent Salt Typhoon telecommunications incidents. The expiration signals a return to pre-2015 conditions, where fear of litigation fostered information silos and hindered a unified defensive posture. This situation is particularly urgent given today’s rapidly evolving threat landscape, marked by automated attacks, cloud-scale lateral movement, and the surge of machine-driven identities. The outcome will shape both regulatory priorities and operational risk management for sectors relying on timely, actionable intelligence sharing.
8 months ago
Kill Chain
Akira Ransomware: MFA-Protected SonicWall VPNs Breached in 2024
In early 2024, the Akira ransomware group escalated its campaign by successfully breaching organizations through SonicWall SSL VPN appliances, even when multi-factor authentication (MFA) was enabled. Security researchers determined that Akira actors appeared to bypass one-time password (OTP) protections, potentially by leveraging previously obtained OTP seed information or exploiting weaknesses in authentication management. Following the VPN compromise, attackers moved laterally, exfiltrated data, and encrypted systems to demand substantial ransom payments. This attack vector enabled access to privileged internal resources, resulting in business disruption, data exposure, and financial losses for affected organizations. The incident underscores how ransomware operators are adapting to bypass commonly deployed defenses, specifically targeting VPN and MFA solutions. Such tactics highlight the urgent need for organizations to reassess remote access controls, authentication infrastructure, and visibility gaps, as similar techniques are increasingly observed in the wild.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports