Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Fortra GoAnywhere MFT 2025: CVE-2025-10035 Exposed Critical Enterprise File Transfers
In September 2025, Fortra disclosed a critical security vulnerability (CVE-2025-10035) in its GoAnywhere Managed File Transfer (MFT) platform. The flaw, a deserialization weakness in the License Servlet, enabled remote attackers to execute arbitrary commands if they could submit a forged license request. Malicious activity leveraging this zero-day allowed threat actors to gain unauthorized access to sensitive file transfers, escalate privileges, and potentially exfiltrate confidential information before a patch was issued. The vulnerability received a maximum CVSS score of 10.0, emphasizing its severe risk and widespread exploitability. This incident highlights the ongoing surge in weaponization of zero-day vulnerabilities affecting popular enterprise software. Threat actors are increasingly exploiting deserialization bugs to bypass security controls and facilitate ransomware operations, putting organizations and their supply chains at heightened risk unless immediate mitigations are applied.
8 months ago
Kill Chain
UNC1549: Iranian Cyber Espionage Breaches 11 European Telecoms Using LinkedIn Lures
In mid-2025, an Iran-affiliated cyber espionage group tracked as UNC1549 executed a coordinated attack targeting 11 European telecommunications firms. Using LinkedIn job recruitment lures and the custom MINIBIKE malware, the attackers successfully infiltrated 34 devices within these organizations, gaining persistent access to sensitive internal systems. The campaign, discovered by Swiss cybersecurity company PRODAFT, leveraged sophisticated social engineering alongside stealthy lateral movement, indicating considerable operational capability and intent to harvest confidential information potentially valuable for nation-state interests. This incident underscores a rising trend of strategic supply chain and telecom attacks using spear phishing and novel malware, highlighting the importance of strong east-west traffic controls and threat detection. It also reflects growing geopolitical tensions fueling state-sponsored cyber campaigns against critical infrastructure in Europe.
8 months ago
Kill Chain
AdaptixC2 in Real-World Attacks: Open-Source C2 Framework Alters the Threat Landscape
In early 2024, security researchers discovered that AdaptixC2, a newly released open-source command and control (C2) framework, was actively leveraged by threat actors in real-world intrusion campaigns. The attackers employed AdaptixC2 for post-exploitation activities, enabling covert command execution, lateral movement, and persistent access within targeted enterprise networks. The framework’s encrypted traffic and modular architecture allowed actors to evade traditional security controls, complicating detection and response efforts and increasing business risk. The widespread adoption of open-source C2 frameworks like AdaptixC2 underscores a shift where commodity offensive tools rapidly enter the arsenal of both sophisticated and opportunistic threat actors. This trend increases attack surface for organizations and challenges defenders to implement advanced incident detection, with regulatory bodies stressing the importance of proactive east-west and anomaly monitoring.
8 months ago
Kill Chain
Scattered Spider Exposed: 2024 Ransomware Hits Critical Infrastructure and Healthcare
In September 2024, UK authorities arrested two teenagers, Thalha Jubair and Owen Flowers, for their significant roles in numerous cyberattacks attributed to the Scattered Spider gang—a notorious offshoot of The Com collective. Operating since at least May 2022, the pair leveraged social engineering techniques to infiltrate a range of organizations, including Transport for London, U.S. critical infrastructure, healthcare providers, and the federal court system. They stole and encrypted sensitive data, then demanded ransom payments, netting at least $115 million from 47 U.S. victims alone. Cryptocurrency wallets tied to the suspects were seized, totaling over $36 million, and both face serious charges on both sides of the Atlantic. This incident illustrates the growing threat from young, highly skilled ransomware groups utilizing sophisticated extortion tactics. As extortion and identity-driven ransomware evolve, organizations—especially those in critical industries—face increasing pressure to bolster defenses against lateral movement and social engineering-based breaches.
8 months ago
Kill Chain
SonicWall 2024 Breach: Firewall Backup Data Compromised in MySonicWall Attack
In June 2024, SonicWall confirmed that threat actors breached its MySonicWall portal and gained unauthorized access to a set of firewall backup configuration files. The attackers were able to obtain configuration data belonging to less than 5% of customers through this service, which could potentially reveal sensitive network information such as network structures, credentials, and policy configurations. SonicWall indicated that the breach was swiftly detected, affected accounts were notified, and the scope was limited, but details regarding the initial attack vector or threat actor remain undisclosed. This incident comes at a time of heightened targeting of network infrastructure management portals and supply chain entry points. As attackers increasingly look to exploit enterprise-grade device management platforms, organizations must reinforce segmentation, monitor lateral movements in east-west traffic, and continually validate zero trust architectures across all privileged network and cloud control panels.
8 months ago
Kill Chain
Critical Azure Entra ID Flaw Reveals Cloud IAM Security Gaps
In mid-2024, a critical cloud misconfiguration vulnerability was discovered in Microsoft Azure Entra ID, exposing severe weaknesses in the cloud provider’s identity and access management (IAM) infrastructure. The flaw allowed attackers, had it been exploited, to escalate privileges and potentially gain unauthorized access to sensitive assets across tenant environments. The vulnerability was quietly remediated by Microsoft prior to public disclosure, but security researchers noted it could have resulted in catastrophic, widespread attacks on enterprise data and operations if abused by malicious actors. This incident underscores growing concerns over cloud platform security and identity-centric attack vectors, coinciding with a broader surge in high-impact IAM misconfigurations. Organizations are increasingly urged to review cloud IAM policies and controls, as regulatory pressure intensifies and attackers shift focus to exploiting identity weaknesses within as-a-service environments.
8 months ago
Kill Chain
SonicWall MySonicWall Breach Puts Firewall Backups and Credentials at Risk
In September 2025, SonicWall disclosed a security incident impacting its MySonicWall cloud platform, where firewall configuration backup files were accessed by threat actors following a series of brute-force attacks. The breach, affecting less than 5% of SonicWall firewalls, exposed configuration data that included encrypted passwords and sensitive information, potentially easing future exploitation of affected devices. SonicWall responded by disabling unauthorized access, notifying affected customers, and issuing urgent guidance to reset credentials, keys, and secrets for all related accounts and services. The vendor also coordinated with cybersecurity and law enforcement agencies as part of its investigation. This incident highlights a rising trend of attackers targeting cloud-based administrative services and configuration backups, exploiting brute-force methods and known vulnerabilities such as CVE-2024-40766. Organizations face increased pressure to secure not only device firmware but also backup repositories and credentials, underscoring the persistent threat of credential-based and configuration compromise attacks.
8 months ago
Kill Chain
Google Chrome Hit by Sixth Zero-Day Exploit in 2025—Emergency Patch Released
In September 2025, Google disclosed and urgently patched a high-severity zero-day vulnerability (CVE-2025-10585) in its Chrome browser, the sixth such flaw exploited in the wild this year. The vulnerability stemmed from a type confusion issue within the V8 JavaScript engine and was reportedly leveraged by threat actors—likely government-sponsored—primarily in targeted campaigns against high-risk individuals such as journalists, activists, and political dissidents. Google’s Threat Analysis Group discovered the flaw, leading to an accelerated patch rollout for Windows, Mac, and Linux platforms to mitigate potential compromise and data theft. This incident underscores the continued escalation in zero-day exploitation, particularly against ubiquitous software. As browser-based attacks become more sophisticated and frequent, organizations face mounting pressure to adopt rapid patching cycles and proactive threat mitigation strategies to defend against emergent threats.
8 months ago
Kill Chain
Critical WatchGuard Firebox VPN Flaw Exposes Businesses to Remote Attacks in 2025
In September 2025, WatchGuard revealed a critical remote code execution vulnerability (CVE-2025-9242) affecting its Firebox firewalls running Fireware OS 11.x, 12.x, and 2025.1. The flaw, caused by an out-of-bounds write in the iked process, could let unauthenticated attackers remotely execute code by exploiting VPN configurations utilizing IKEv2, even after vulnerable settings are removed if static gateway peers remain. While no active exploitation has been observed to date, the vulnerability exposes potentially 250,000 small and mid-sized business networks globally. This incident underscores the ongoing risks faced by organizations from appliance-level vulnerabilities in edge security devices, especially as attackers increasingly target VPN and firewall platforms in their campaigns. Recent ransomware activity and mandates from regulators have heightened industry awareness around patching and vigilance for these critical network components.
8 months ago
Kill Chain
Scattered Spider Strikes: 2024 Ransomware Attack on Transport for London Exposes Critical Gaps
In August 2024, Transport for London (TfL), a critical national infrastructure operator in the UK, suffered a significant ransomware attack attributed to the 'Scattered Spider' cybercrime collective. Law enforcement arrested two UK-based teenagers, believed to be key members of the group, after evidence tied them to not just the TfL breach but also a string of attacks targeting US healthcare and federal systems. The ransomware event caused extensive disruption to TfL’s internal and online systems, delayed refund processing, and ultimately led to a breach of customer data, including names, contact details, and addresses. Financial losses for TfL ran into the millions. This incident highlights both the growing capability and brazenness of young, English-speaking cybercriminals, as well as the expanding impact of ransomware on critical infrastructure and global enterprises. The subsequent law enforcement operation illustrates the increased regulatory scrutiny and international cooperation aimed at dismantling hacker collectives operating ransomware and extortion campaigns.
8 months ago
Kill Chain
RaccoonO365: Microsoft & Cloudflare Take Down Major Phishing-as-a-Service Network in 2024
In July 2024, Microsoft, in collaboration with Cloudflare and law enforcement, disrupted the RaccoonO365 Phishing-as-a-Service (PhaaS) operation, which enabled cybercriminals to launch large-scale phishing campaigns mimicking Microsoft 365 and other trusted brands. The service, run by Storm-2246 and attributed to Joshua Ogundipe, offered subscription-based kits that automated credential-theft campaigns targeting over 2,300 US organizations and at least 20 healthcare entities. The takedown involved seizing 338 domains, mapping the attack infrastructure, and revealing financial flows in cryptocurrency, shutting down an operation responsible for stealing at least 5,000 sets of credentials from 94 countries. This incident underscores the industrialization of phishing through subscription-based platforms and highlights how low-skill attackers are being enabled at scale. As phishing-as-a-service proliferates and leverages brand impersonation, organizations face escalating risks of credential theft and downstream ransomware or malware attacks.
8 months ago
Kill Chain
Microsoft's September 2025 Patch: Critical Azure & SMB Vulnerabilities Fixed
In September 2025, Microsoft released a critical security update addressing 80 vulnerabilities across its product suite, with particular focus on an SMB privilege escalation flaw and an Azure vulnerability rated CVSS 10.0. While eight of these vulnerabilities were classified as Critical and the rest as Important, none are reported to have been exploited in the wild at release. The patch release comes after public disclosures made some flaws widely known, elevating risk of exploitation. Microsoft urged organizations to immediately apply updates, highlighting the dangers posed by both privilege escalation and remote code execution vectors that could severely impact enterprise security. This incident underscores the continued rise in attacks targeting software supply chains and cloud platforms. With a surge in public disclosures and exploit tool availability, patch management has become both more challenging and more essential—particularly as attackers increasingly exploit unpatched vulnerabilities for lateral movement and privilege escalation.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports