The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3129 threat reports
Page 240 of 261
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 2869–2880 / 3129 reports
F5 2025 Breach: Nation-State Attackers Target BIG-IP Source Code
Banking/Mortgage9 months ago

F5 2025 Breach: Nation-State Attackers Target BIG-IP Source Code

In August 2025, cybersecurity giant F5 detected a sophisticated breach by nation-state hackers who gained unauthorized access to its BIG-IP product development environment and engineering knowledge management platforms. Over an extended period, attackers exfiltrated undisclosed BIG-IP vulnerabilities, product source code, and select customer configuration information. F5 asserts no evidence that the attackers modified software, exploited the stolen vulnerabilities in active attacks, or that critical customer data was exposed. Response actions included credential rotations, hardening of development environments, enhanced threat detection, and external code audits by firms such as CrowdStrike, Mandiant, NCC Group, and IOActive. F5 also proactively issued security updates and guidance to impacted customers. This incident underscores the growing trend of sophisticated, supply-chain-oriented intrusions targeting technology providers with a wide enterprise customer base. It illustrates the strategic value of source code and zero-day exploits to well-resourced threat actors, and raises ongoing concerns about the security of key software infrastructure used widely across industries.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Microsoft Windows Server 2025 Update Breaks Active Directory Sync
Financial Services9 months ago

Microsoft Windows Server 2025 Update Breaks Active Directory Sync

In September 2025, Microsoft’s security updates for Windows Server 2025 triggered Active Directory (AD) Domain Services synchronization issues, specifically affecting environments with large AD security groups exceeding 10,000 members. The incident, stemming from update KB5065426, disrupted vital processes like Microsoft Entra Connect Sync, resulting in incomplete directory synchronization. Microsoft quickly acknowledged the bug, issued a temporary registry-based workaround, and warned that improper registry modifications carried significant risks. The root cause is connected to directory synchronization controls that do not yet officially support Windows Server 2025. This event highlights the increasing operational risk organizations face from software update regressions affecting core identity infrastructure. In an era of widespread cloud adoption and hybrid identity services, such failures can severely impact business continuity and compliance, amplifying the urgency for robust change management and pre-deployment validation.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
F5 2025 Supply Chain Breach: BIG-IP Vulnerabilities Exposed by State Hackers
Financial Services9 months ago

F5 2025 Supply Chain Breach: BIG-IP Vulnerabilities Exposed by State Hackers

In August 2025, cybersecurity company F5 detected a sophisticated supply chain attack resulting in the theft of source code and undisclosed vulnerabilities affecting its flagship BIG-IP products. The breach, attributed to state-sponsored hackers, did not lead to immediate exploitation but exposed potentially critical flaws. F5 responded by rapidly developing and releasing security patches for 44 vulnerabilities, proactively urging its global clientele—including many Fortune 500 companies and federal agencies—to update systems and implement enhanced monitoring. No evidence was found of modifications to the supply chain or active use of the stolen information as of disclosure. This incident highlights mounting concerns around supply chain security and zero-day vulnerability exposure, particularly within critical infrastructure and cloud environments. The breach also triggered regulatory intervention, with CISA issuing emergency directives for federal agencies, underscoring rising government attention to third-party risks and broader cybersecurity resilience in the face of advanced persistent threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Capita Hit by Black Basta Ransomware: 6.6 Million Impacted in 2023 Breach
Financial Services9 months ago

Capita Hit by Black Basta Ransomware: 6.6 Million Impacted in 2023 Breach

In March 2023, UK outsourcing giant Capita suffered a major data breach after an employee downloaded a malicious file, giving threat actors access to internal systems. The Black Basta ransomware gang exploited delayed response and weak access controls to maintain persistence for 58 hours, move laterally, and exfiltrate nearly a terabyte of sensitive data covering 6.6 million individuals, including customers of over 325 pension providers. The attackers deployed ransomware, resetting passwords and disrupting access, forcing Capita to take some systems offline and ultimately resulting in a £14 million regulatory fine after failing to meet key security requirements. This breach highlights the growing menace of ransomware operations targeting supply chain and service providers, with regulatory authorities emphasizing rapid response, robust access controls, and continuous security testing. Organizations face increased scrutiny to maintain strong cybersecurity baselines as attackers evolve tactics and exploit internal weaknesses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
PowerSchool 2024 Data Breach: College Student Sentenced for Massive Attack
Primary/Secondary Education9 months ago

PowerSchool 2024 Data Breach: College Student Sentenced for Massive Attack

In December 2024, PowerSchool, a major provider of cloud-based education technology, suffered a significant data breach orchestrated by 19-year-old college student Matthew D. Lane from Worcester, Massachusetts. Lane infiltrated PowerSchool’s systems by exploiting a combination of credential theft and vulnerabilities in internal access controls, enabling him to exfiltrate large volumes of sensitive student and faculty data over several weeks. Law enforcement investigation led to his arrest and subsequent sentencing to four years in prison, highlighting both the sophistication of modern attackers and the sensitivity of educational data targeted. The case is especially relevant as threat actors increasingly set their sights on critical SaaS platforms and education technology, exploiting gaps in zero trust implementation and east-west traffic visibility. The incident underscores a rising trend in data breaches against public sector organizations and the urgent need for robust controls in cloud and hybrid environments.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
2025 Mysterious Elephant Attack: Asia-Pacific Government Cyber-Espionage Exposed
Government Administration9 months ago

2025 Mysterious Elephant Attack: Asia-Pacific Government Cyber-Espionage Exposed

In early 2025, the Mysterious Elephant advanced persistent threat group launched a sophisticated campaign targeting government and foreign affairs entities across Pakistan, Bangladesh, Afghanistan, Nepal, and Sri Lanka. Utilizing spear phishing emails, exploit kits, and malicious documents as entry vectors, the group deployed custom and open-source malware—such as BabShell, MemLoader HidenDesk, and ChromeStealer—to gain persistent network access, move laterally, and exfiltrate sensitive data. Their tooling leveraged advanced evasion tactics and targeted WhatsApp data for exfiltration, compromising documents, images, and browser credentials. The operation demonstrates considerable code reuse and customized tooling, posing a significant disruption to national and diplomatic processes in the region. Mysterious Elephant’s shift to tailored malware, WhatsApp-specific exfiltration, and cloud-based infrastructure highlights a broader threat landscape trend: state-sponsored actors refining tactics for targeted governmental espionage. This underscores the importance of proactive monitoring and cross-border information sharing to address escalating nation-state risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft Patch Tuesday Ring-fences 172 Flaws and Ends Windows 10 Support
Government Administration9 months ago

Microsoft Patch Tuesday Ring-fences 172 Flaws and Ends Windows 10 Support

In October 2025, Microsoft’s Patch Tuesday delivered critical security updates addressing 172 vulnerabilities in Windows operating systems, including two zero-days actively exploited in the wild. The first, CVE-2025-24990, is a flaw in the long-bundled Agere Modem driver exploited by attackers and removed entirely by Microsoft. The second, CVE-2025-59230, impacted Windows Remote Access Connection Manager (RasMan), risking privilege escalation through compromised VPN and remote access services. Remote code execution bugs in Office Preview Pane and a critical risk to Windows Server Update Services (WSUS) put both endpoints and patching infrastructure at significant risk. This large wave of vulnerabilities coincided with the end of official support for Windows 10, Exchange Server 2016, and other Microsoft products. The combination of zero-day exploitation and the end-of-life for popular products highlights the urgent need for proactive vulnerability management and secure migration paths as cybercriminals increasingly exploit outdated software.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Microsoft’s October 2025 Patch Tuesday Highlights Critical Vulnerabilities and End-of-Support Urgency
Government Administration9 months ago

Microsoft’s October 2025 Patch Tuesday Highlights Critical Vulnerabilities and End-of-Support Urgency

In October 2025, Microsoft released security updates addressing 157 vulnerabilities across several on-premises products as part of its Patch Tuesday initiative. Eight vulnerabilities were rated critical, with impacted platforms including Windows 10, Office 2016/2019, Exchange Server 2016/2019, and various core components (e.g., Excel, Remote Desktop, SharePoint). While no active exploitation was reported at the time of disclosure, the sheer number and severity of these flaws—including several involving remote code execution and privilege escalation—pose significant risks for enterprises relying on legacy or end-of-support software. Organizations dependent on affected Microsoft software are urged to apply patches promptly and consider their exposure, particularly as support for key products ends and attackers often target unpatched environments. This Patch Tuesday is highly relevant as attackers consistently exploit newly disclosed vulnerabilities, especially in widely deployed systems, for lateral movement and data exfiltration. With mainstream support ending for core Microsoft products, the window of exposure and regulatory risk grows for companies slow to adopt updated versions or enhanced security controls.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Python Infostealer Exposes New Clipboard Image Attack Vector in 2024
Financial Services9 months ago

Python Infostealer Exposes New Clipboard Image Attack Vector in 2024

In October 2024, a new Python-based infostealer was discovered leveraging the clipboard’s picture functionality to stealthily exfiltrate screenshots and images from victim machines. The malware, observed in the wild using Telegram for command-and-control, exploits the common trust in clipboard features by targeting not only text but also graphical data such as screenshots often exchanged for reporting or documentation. Notably, the malware’s code contained Vietnamese-language comments, and a sample analyzed had a low detection score on VirusTotal, indicating low awareness and potential for widespread impact. This incident highlights the evolution of infostealer tactics as they expand data theft payloads beyond credentials and text, exploiting overlooked vectors like clipboard images. Such techniques present new challenges for organizations as attackers increasingly focus on fileless, cross-platform exfiltration and abuse of trusted collaboration workflows.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PhantomVAI Loader in 2024: Advanced Malware Delivery and Infostealer Risks
Financial Services9 months ago

PhantomVAI Loader in 2024: Advanced Malware Delivery and Infostealer Risks

In early 2024, cybersecurity researchers at Palo Alto Networks Unit 42 identified PhantomVAI, a new loader malware designed to deliver a variety of infostealers such as Lumma Stealer and LokiBot. The campaign uses advanced steganography and heavily obfuscated scripts to evade detection, enabling attackers to distribute payloads through malicious downloads and compromised websites. PhantomVAI’s modular design allows cybercriminals to easily switch the delivered malware, raising the risk for rapid adaptation against defense mechanisms. Affected organizations may experience credential compromise, data exfiltration, and exposure of sensitive information. This incident exemplifies the increasing sophistication of malware loaders and highlights a growing trend toward customizable, evasive attack tools targeting businesses worldwide. As attackers continue to automate and obfuscate their delivery methods, organizations must enhance their monitoring and threat detection to keep pace with evolving threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft Patch Tuesday: October 2025 Brings Critical Zero-Day Exploits
Government Administration9 months ago

Microsoft Patch Tuesday: October 2025 Brings Critical Zero-Day Exploits

In October 2025, Microsoft disclosed and patched 175 vulnerabilities affecting its major products, marking the year's largest vulnerability release from the company. Notably, two zero-day vulnerabilities (CVE-2025-24990 in the Agere Windows Modem Driver and CVE-2025-59230 in Windows Remote Access Connection Manager) were discovered to be actively exploited in the wild. Attackers leveraging these flaws could elevate privileges, potentially gaining administrative or system-level access across all supported Windows versions. Microsoft acted promptly, removing the vulnerable modem driver and providing fixes for the Remote Access Connection Manager, with the U.S. Cybersecurity and Infrastructure Security Agency adding both zero-days to its known exploited catalog. This incident underscores the persistent threat posed by zero-day exploits and highlights the increasing rate at which attackers are targeting system-level services and third-party drivers. The surge of high-severity vulnerabilities, along with rapid exploitation, demonstrates the need for organizations to strengthen vulnerability and privilege management programs to respond to modern attack trends.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Startling Satellite Breach: How $600 Unlocked a Global Data Leak in 2025
Telecommunications9 months ago

Startling Satellite Breach: How $600 Unlocked a Global Data Leak in 2025

In early 2025, researchers from the University of Maryland and UC San Diego revealed widespread leakage of sensitive and private data—including military and telecom communications—through unencrypted transmissions sent over geostationary (GEO) satellites. By using only $600 in commercially available equipment, the team passively intercepted vast amounts of plaintext data from major organizations, government entities, and telecom users around the globe. The incident highlighted fundamental lapses in network-layer encryption practices, allowing phone calls, SMS messages, internal application data, and even military vessel information to leak with no authentication or protection. The research further demonstrated that even technically unsophisticated actors could compromise critical satellite backhaul links using minimal resources. This event underscores the urgent need for end-to-end encryption and robust monitoring of satellite communications as reliance on these channels increases and barriers to interception continue to fall. Government and industry must now address the rapidly evolving risk landscape, especially as critical infrastructure becomes more dependent on satellite connectivity.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports