The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3129 threat reports
Page 244 of 261
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 2917–2928 / 3129 reports
Phishing and RMM Tool Abuse Drive Multi-Vector Attacks – September 2025 Wrap-Up
Financial Services9 months ago

Phishing and RMM Tool Abuse Drive Multi-Vector Attacks – September 2025 Wrap-Up

In September 2025, organizations faced a surge of multi-vector cyber campaigns targeting enterprises through sophisticated phishing attacks and compromised WordPress sites. Attackers used phishing emails as entry points, tricking employees into installing remote monitoring and management (RMM) tools such as AnyDesk and Atera, thereby gaining unauthorized access to internal networks. Simultaneously, threat actors leveraged vulnerable or hijacked WordPress websites to distribute malware payloads, facilitating both initial compromise and lateral movement across organizations' internal networks. The impact included credential theft, unauthorized remote control, and data exfiltration, as well as disruption to normal business activities. This incident highlights a rapidly evolving threat landscape where attackers combine social engineering, legitimate RMM tools, and supply-chain exploits to evade traditional security defenses. It underscores increased regulatory attention on monitoring east-west traffic, policy enforcement, and anomaly detection across hybrid cloud environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
FileFix's 2024 Cache Smuggling Attack: What CISOs Need to Know
Financial Services9 months ago

FileFix's 2024 Cache Smuggling Attack: What CISOs Need to Know

In June 2024, a new variant of the FileFix social engineering attack was identified leveraging cache smuggling to bypass endpoint security and deliver a malicious ZIP archive onto victims' systems. Attackers enticed users with phishing emails or deceptive social engineering content, prompting them to click download links. These links abused proxy and cache server behaviors to insert a malware payload into responses that security tools would otherwise block, enabling stealthy malware infection and potential data exfiltration. The attack method proved effective at evading security controls such as endpoint protection, web proxies, and firewalls, increasing the risk to business operations and sensitive data. This incident underscores the sophisticated evolution of social engineering attacks, now boosted by technical exploits like cache smuggling. Attackers are increasingly combining human and infrastructure weaknesses to evade even advanced security defenses, making traditional filtering and sandboxing less reliable. Security operations should urgently revisit email, web proxy, and endpoint controls for these new attack chains.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
2025 Fortra GoAnywhere Breach: Medusa Ransomware Leverages Zero-Day and Key Compromise
Financial Services9 months ago

2025 Fortra GoAnywhere Breach: Medusa Ransomware Leverages Zero-Day and Key Compromise

In early 2025, Medusa ransomware operators—tracked as Storm-1175—successfully exploited a critical vulnerability (CVE-2025-10035) in the Fortra GoAnywhere Managed File Transfer (MFT) platform. The attack required access to a private key, indicating either an advanced intrusion or insider compromise. Once inside, the threat actors moved laterally to deploy ransomware payloads, seizing sensitive business data and disrupting managed file transfers for impacted organizations. Multiple enterprises suffered data theft, business downtime, and reputational damage as a result. This incident underscores an ongoing trend of targeting supply chain platforms and MFT products with ransomware via sophisticated access methods. As ransomware groups become more resourceful in exploiting zero-days and leveraging stolen keys, organizations must prioritize proactive threat detection, timely patching, and tighter access controls to counter these evolving tactics.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Clop Ransomware Strikes Oracle: 2024 Zero-Day Breakdown
Financial Services9 months ago

Clop Ransomware Strikes Oracle: 2024 Zero-Day Breakdown

In early 2024, the Clop ransomware group leveraged a previously unknown zero-day vulnerability in Oracle E-Business Suite to infiltrate the networks of multiple Oracle customers. Exploiting this zero-day, Clop operators gained unauthorized access to critical enterprise systems by bypassing conventional security controls, moving laterally within organization environments, and ultimately deploying ransomware to encrypt sensitive business data. The attack’s vector allowed rapid compromise across industries reliant on Oracle systems, resulting in operational disruptions, potential data exposure, and ransom demands for decryption keys. Security teams across affected organizations were forced into emergency response and containment procedures. This incident highlights a disturbing trend of ransomware gangs exploiting supply-chain vulnerabilities and zero-day flaws in widely used enterprise applications. With attackers aggressively targeting business-critical platforms, the urgency for patch management, network segmentation, and advanced threat monitoring has never been higher, especially as regulatory scrutiny and financial impacts intensify.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Brazilian Military Breach: Zimbra Zero-Day Exploited via Libyan Navy Impersonation
Defense/Space9 months ago

Brazilian Military Breach: Zimbra Zero-Day Exploited via Libyan Navy Impersonation

In early 2024, cyber attackers posing as representatives of the Libyan Navy’s Office of Protocol targeted the Brazilian military using a sophisticated spear-phishing campaign. By leveraging a previously unknown zero-day vulnerability in Zimbra Collaboration Suite and delivering malicious emails through compromised inter-country secure communications channels (ICS), the threat actors successfully bypassed traditional perimeter defenses. The attackers' advanced persistent techniques enabled them to gain unauthorized access, exploit sensitive data, and risk critical communications infrastructure for the Brazilian defense sector, with potential exposure of mission-critical information. This incident highlights the escalating risks posed by zero-day vulnerabilities and state-linked or impersonation-driven threat actors, particularly against government and defense organizations. The unusual attack vector via ICS demonstrates evolving tactics beyond routine phishing, reinforcing the necessity for layered security, real-time threat detection, and robust segmentation controls.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
FreePBX VoIP Vulnerability Exploited: CVE-2025-57819 Enables Code Execution
Telecommunications9 months ago

FreePBX VoIP Vulnerability Exploited: CVE-2025-57819 Enables Code Execution

In August 2025, a critical SQL injection vulnerability (CVE-2025-57819) was disclosed in FreePBX, a popular open-source VoIP telephony platform. The flaw, found in the system's web-based admin interface, allowed unauthenticated attackers to inject malicious SQL queries via a vulnerable 'brand' parameter, enabling arbitrary modification of the backend database. Attackers have already been observed using this vulnerability to gain remote code execution by inserting persistent cron jobs that continuously recreate a web shell on the target server, providing full access for data exfiltration or fraudulent activities. Organizations using unpatched versions may be exposed to call fraud, impersonation, lateral movement, or further compromise of VoIP infrastructure. This breach highlights a persistent trend of attackers exploiting critical web application vulnerabilities shortly after public disclosure, underscoring the importance of proactive patching and real-time threat detection. It also illustrates attackers’ growing focus on embedded and telecom systems as entry points for broader enterprise compromise.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Oracle Zero-Day Breach: Clop Ransomware Group Orchestrates Global Data Theft in 2024
Financial Services9 months ago

Oracle Zero-Day Breach: Clop Ransomware Group Orchestrates Global Data Theft in 2024

In mid-2024, the Clop ransomware gang exploited a critical zero-day vulnerability (CVE-2025-61882) in Oracle E-Business Suite, executing a sophisticated chain of exploits for unauthorized, pre-authenticated remote code execution. Attackers infiltrated multiple enterprise and public-sector environments, stealing significant volumes of data before issuing high-dollar extortion demands—some as high as $50 million. The breaches went undetected for weeks, with Oracle disclosing the flaw only after victims began receiving ransom emails and the U.S. CISA catalogued the vulnerability as actively exploited. This incident underscores the rapid weaponization of newly discovered vulnerabilities by well-resourced threat actors. As enterprises increase reliance on complex ERP systems, threats leveraging zero-day exploits and multi-bug chains have become a pressing concern, signaling the need for enhanced threat detection, segmentation, and zero-trust controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Clop Ransomware Exploits Oracle EBS Zero-Day for Massive Data Theft in 2025
Financial Services9 months ago

Clop Ransomware Exploits Oracle EBS Zero-Day for Massive Data Theft in 2025

In October 2025, Oracle urgently patched a critical zero-day vulnerability (CVE-2025-61882) affecting Oracle E-Business Suite (EBS) after widespread exploitation by the Clop ransomware gang. The flaw enabled unauthenticated remote code execution via the Concurrent Processing component’s BI Publisher integration, letting attackers gain unauthorized access and exfiltrate data. Threat actors, including Clop and possibly affiliated groups, used public proof-of-concept exploits—some leaked by other cybercriminals—to breach multiple organizations’ Oracle EBS servers. Victims were extorted via email, with stolen data leveraged for ransom, highlighting material operational and reputational risks. This incident underscores the persistent targeting of enterprise software zero-days by organized ransomware groups. The increased speed of exploit weaponization and the public sharing of exploit code amplify the urgency for organizations to apply patches swiftly, harden business-critical systems, and enhance detection capabilities for lateral movement and data exfiltration.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
XWorm RAT Re-emerges in 2025: Ransomware & Plugins Drive Global Malware Campaigns
Financial Services9 months ago

XWorm RAT Re-emerges in 2025: Ransomware & Plugins Drive Global Malware Campaigns

In mid-2025, security researchers observed the resurgence of XWorm, a modular remote access trojan (RAT) that now features extensive plugin support and an integrated ransomware module. Originally developed by XCoder and abandoned in 2024, the latest XWorm variants (v6.0–6.5) have been widely adopted by multiple threat actors and distributed via phishing campaigns using malicious scripts and document attachments. Capable of data theft, remote desktop takeover, and file encryption, XWorm leverages over 35 plugins, including modules for browser data harvesting, keystroke logging, shell access, and ransomware deployment. The malware's rapid proliferation has led to thousands of infections globally, with major activity detected in Russia, the US, India, Ukraine, and Turkey. The reappearance of XWorm, now available on dark web forums and grouped with capabilities like AI-themed lures and social engineering, demonstrates an alarming trend: readily available commodity malware is increasingly sophisticated and multifaceted. This case underscores rising risks from plug-and-play cybercrime kits and reinforces the critical need for continuous defense, layered security, and advanced threat monitoring.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft 2025: Storm-1175 Exploits GoAnywhere Zero-Day for Devastating Ransomware Attacks
Financial Services9 months ago

Microsoft 2025: Storm-1175 Exploits GoAnywhere Zero-Day for Devastating Ransomware Attacks

In September 2025, a cybercrime group tracked as Storm-1175 exploited a critical zero-day deserialization vulnerability (CVE-2025-10035) in Fortra's GoAnywhere Managed File Transfer (MFT) solution. The attackers gained initial access by remotely targeting vulnerable MFT instances and leveraged remote monitoring tools (SimpleHelp, MeshAgent) for persistence. Subsequently, they conducted network reconnaissance with Netscan, moved laterally using Microsoft RDP, exfiltrated sensitive data with Rclone, and ultimately deployed Medusa ransomware payloads to encrypt files. This campaign affected multiple organizations, exposing unpatched systems to significant operational risk and data loss. The incident highlights a continued surge in ransomware operations leveraging zero-day vulnerabilities in widely used enterprise software. Attackers are increasingly exploiting supply chain and infrastructure components to maximize impact, driving regulatory scrutiny and accelerating the need for robust patch management and segmentation practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How Kaspersky’s 2025 ML Models Raised the Bar for DLL Hijacking Detection
Financial Services9 months ago

How Kaspersky’s 2025 ML Models Raised the Bar for DLL Hijacking Detection

In 2025, Kaspersky advanced their detection capabilities against DLL hijacking attacks by developing and deploying machine learning (ML) models. DLL hijacking, used by both organized malware developers (such as those behind Lumma stealer) and advanced persistent threat (APT) groups, involves loading malicious DLLs in place of genuine libraries. Attackers exploited trusted processes to evade detection and complicate incident response. Kaspersky’s internal telemetry revealed a sharp uptick in these attacks across diverse regions and sectors, prompting an iterative ML-driven approach. By refining training datasets, extracting relevant behavioral features, and evolving their models through analyst feedback, Kaspersky achieved higher true positive rates and reduced false positives, integrating the solution into SIEM and MDR offerings to surface live threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Kaspersky SIEM Uncovers ToddyCat DLL Hijacking Attacks in 2024
Financial Services9 months ago

Kaspersky SIEM Uncovers ToddyCat DLL Hijacking Attacks in 2024

In early 2024, Kaspersky detected several advanced persistent threat (APT) incidents during pilot testing of their machine-learning-based DLL-hijacking detection module within their SIEM platform. Notably, the ToddyCat APT group exploited a SharePoint vulnerability (CVE-2021-27076) to gain initial access, then leveraged DLL sideloading to execute Cobalt Strike implants using masqueraded Windows system libraries. Other real-world incidents uncovered included infostealer malware posing as a policy manager, and a malicious loader activated through a USB drive, all utilizing DLL hijacking for code execution and persistence. Kaspersky’s detection tool enabled rapid identification and response, preventing further compromise and data exfiltration. This case highlights the growing sophistication of DLL hijacking techniques in APT operations and the increasing use of AI-driven security products to detect lateral movement and stealthy intrusion behaviors. The incidents underscore the need for robust behavioral analytics and real-time anomaly detection as threat actors increasingly target supply chains and trusted binaries to bypass traditional security defenses.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports