The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3129 threat reports
Page 246 of 261
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 2941–2952 / 3129 reports
Oracle EBS Exploited in Clop Ransomware Extortion Campaign (2025)
Financial Services9 months ago

Oracle EBS Exploited in Clop Ransomware Extortion Campaign (2025)

In September 2025, Oracle confirmed that customers running E-Business Suite (EBS) were targeted by extortion emails attributed to the Clop ransomware gang, following exploitation of security vulnerabilities addressed in the July 2025 Critical Patch Update. Multiple executives at affected companies received emails demanding ransom, with Clop claiming to have exfiltrated confidential data from unpatched Oracle EBS instances. While Oracle has not formally verified the data theft, the vulnerabilities—three of which were remotely exploitable without authentication—enabled attackers to potentially access sensitive business documents and threaten public disclosure if ransoms were not paid. This incident highlights a continued and escalating trend of ransomware groups leveraging zero-day and freshly patched vulnerabilities to target critical enterprise software. Organizations dependent on ERP and business process applications are increasingly at risk, underscoring the urgent need for rapid patching and advanced network-layer security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Signal Launches SPQR: A Quantum-Safe Encryption Upgrade for 2025
Telecommunications9 months ago

Signal Launches SPQR: A Quantum-Safe Encryption Upgrade for 2025

In October 2025, Signal introduced a major upgrade to its encryption suite by deploying the Sparse Post-Quantum Ratchet (SPQR), designed to secure user communications against present and future quantum computing threats. Developed in collaboration with leading academic and industry partners, SPQR brings a 'triple ratchet' protocol leveraging hybrid cryptography based on both traditional and quantum-resistant key exchange mechanisms. This system provides continual key rotation, forward secrecy, and robust post-compromise security, ensuring that even if current keys are compromised, future messages remain protected. The rollout will be gradual and backward-compatible, affecting Signal’s 100 million global users without requiring manual intervention. The launch of SPQR is a landmark response to the rise of quantum computing, which threatens conventional encryption schemes. Its introduction reflects mounting industry urgency to adopt advanced cryptographic standards and maintain trust in privacy-critical communications platforms amid rapid shifts in the threat landscape.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Cavalry Werewolf APT Hits Russian Agencies with FoalShell and StallionRAT in 2025
Government Administration9 months ago

Cavalry Werewolf APT Hits Russian Agencies with FoalShell and StallionRAT in 2025

In October 2025, a sophisticated threat actor known as Cavalry Werewolf, believed to share links with the YoroTrooper group, orchestrated targeted cyber attacks against Russian public sector agencies. Utilizing custom malware families FoalShell and StallionRAT, the attackers infiltrated key government systems, establishing covert access for potential espionage and data theft. Security firm BI.ZONE detected the activity, noting operational overlaps with other known clusters such as SturgeonPhisher and Comrade Saiga. The cyber-espionage campaign leveraged a mix of spear-phishing, credential theft, and advanced persistence techniques to evade detection and conduct lateral movement within critical infrastructure environments. This incident highlights a continuing trend of state-aligned espionage campaigns that exploit zero trust gaps, advanced malware, and blended tactics to compromise sensitive government data. The increasing frequency and sophistication of such attacks elevate the urgency for robust segmentation and monitoring strategies within public sector networks.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
SORVEPOTEL: New WhatsApp-Driven Malware Campaign Hits Brazil
Financial Services9 months ago

SORVEPOTEL: New WhatsApp-Driven Malware Campaign Hits Brazil

In late 2025, cybersecurity researchers identified a rapid outbreak of a self-spreading malware targeting Brazilian Windows users through WhatsApp, labeled SORVEPOTEL and tracked as the Water Saci campaign. The malware leverages the inherent trust and widespread popularity of WhatsApp by delivering malicious payloads via chat messages, which entice users to download infected files. Once inside a system, SORVEPOTEL propagates by messaging victims’ contacts, enabling swift lateral movement and widespread distribution. Notably, the campaign appears engineered for rapid proliferation rather than for data theft or ransomware deployment, showcasing evolving malware propagation tactics. This incident highlights the increasing sophistication and speed of messaging app-based malware and reflects a broader trend of social engineering campaigns capitalizing on trusted digital platforms. Organizations should re-examine endpoint protections and user awareness in light of emerging threats exploiting popular communications channels.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Detour Dog Exposes DNS-Powered Stealer Risk: A 2025 Campaign Analysis
Financial Services9 months ago

Detour Dog Exposes DNS-Powered Stealer Risk: A 2025 Campaign Analysis

In October 2025, threat intelligence researchers revealed that the actor known as Detour Dog orchestrated wide-scale campaigns to deliver the Strela Stealer information stealer using DNS-powered malware infrastructure. Detour Dog’s operation involved maintaining control over a network of malicious domains, enabling initial delivery of a backdoor named StarFish, which then facilitated deployment of Strela Stealer. This campaign leveraged covert DNS traffic and evasion techniques, making threat detection and containment difficult for enterprise defenders. Victimized organizations faced increased risk of credential theft, data exfiltration, and operational disruption as a result. This incident highlights the rising trend of weaponizing benign protocols like DNS for malware delivery and lateral movement, as well as the emergence of advanced information stealers targeting enterprise networks and cloud environments. Organizations must adapt controls and detection strategies to defend against increasingly sophisticated, protocol-abusing threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Rhadamanthys Stealer 2025: Device Fingerprinting, Steganography, and the New Face of Data Theft
Financial Services9 months ago

Rhadamanthys Stealer 2025: Device Fingerprinting, Steganography, and the New Face of Data Theft

In October 2025, cybersecurity researchers uncovered significant new capabilities in the Rhadamanthys Stealer malware, including advanced device fingerprinting and the use of PNG steganography to distribute malicious payloads. Initially spread via cybercrime forums, the malware author has expanded its ecosystem with additional tools like Elysium Proxy Bot and Crypt Service, targeting organizations worldwide. Threat actors leveraged these upgrades to collect detailed browser and system data while evading detection, resulting in an uptick of credential, financial, and sensitive data thefts across enterprise environments. The evolution of Rhadamanthys Stealer highlights a broader trend of information stealer malware using novel evasion tactics and multi-tool ecosystems. Its modularity and innovative payload delivery have driven increased attention from security teams and regulators, as businesses seek to defend against ever-more-sophisticated data exfiltration methods.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Clop Ransomware Targets Oracle E-Business Suite Customers in 2025 Extortion Campaign
Information Technology/IT9 months ago

Clop Ransomware Targets Oracle E-Business Suite Customers in 2025 Extortion Campaign

In late September 2025, the Clop ransomware group launched a targeted extortion campaign against Oracle E-Business Suite customers. Using compromised third-party email accounts, attackers sent personalized emails to executives, claiming to have exfiltrated sensitive corporate data via known vulnerabilities in Oracle's ERP software. The emails provided 'proof' offers, imposed a payment deadline, and threatened public exposure or resale of stolen data if demands were not met. Oracle acknowledged the incident, referencing vulnerabilities patched in the July 2025 update, but did not confirm direct data exfiltration or specify the flaws under exploitation. This incident highlights the evolution of ransomware-as-a-service models that blend data theft, psychological pressure, and supply-chain targeting. It underscores urgent enterprise risk around unpatched ERP systems, the danger of credential compromise, and the increasing sophistication of financially motivated threat actors such as Clop.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Android Spyware Masquerades as Messaging Apps in UAE: ESET Uncovers 2024 Mobile Threats
Telecommunications9 months ago

Android Spyware Masquerades as Messaging Apps in UAE: ESET Uncovers 2024 Mobile Threats

In June 2024, ESET researchers uncovered two Android spyware campaigns—ProSpy and ToSpy—masquerading as popular messaging apps Signal and ToTok, specifically targeting residents in the United Arab Emirates. The malware was distributed via third-party websites impersonating legitimate app stores, such as the Samsung Galaxy Store, and required users to manually install them. Upon installation, the spyware requested extensive permissions, gaining access to contacts, messages, stored files, audio, images, and more, enabling extensive data exfiltration. The campaigns utilized regional delivery tactics to focus on UAE users, exploiting trusted local app brands. These findings highlight a persistent threat trend: attackers disguising malware as legitimate communication apps to bypass official channels and exploit regional trust. With increased scrutiny on privacy and secure messaging, such campaigns pose heightened operational and compliance risks for organizations and individuals alike, underscoring the urgent need for enhanced mobile security measures and user awareness.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Clop Ransomware Claims Oracle E-Business Suite Data Breach in 2025 Extortion Wave
Financial Services9 months ago

Clop Ransomware Claims Oracle E-Business Suite Data Breach in 2025 Extortion Wave

In late September 2025, a widespread extortion campaign was detected targeting companies using Oracle E-Business Suite, with the Clop ransomware group (also tracked as FIN11) claiming to have exfiltrated sensitive data. Attackers used hundreds of compromised email accounts to send extortion messages to executives, demanding payment to prevent data leaks on Clop's darknet site. While links to previous Clop activity were identified through reused email accounts and familiar tactics, as of early October, no definitive evidence of a successful Oracle E-Business Suite breach has been confirmed by investigators (Mandiant, Google Cloud, and GTIG). As a result, organizations remain on alert as the situation develops, and incident response efforts continue. This attack underscores a continuing trend of cyber extortion groups leveraging data theft and email-based threats rather than traditional encryption. The campaign's timing and targeting highlight rapidly evolving attacker sophistication and the ongoing vulnerability of enterprise applications, emphasizing the importance of robust lateral movement controls and proactive monitoring in the face of persistent ransomware and extortion campaigns.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Android Spyware Campaigns Target Signal and ToTok Users in Sophisticated 2025 Attack
Telecommunications9 months ago

Android Spyware Campaigns Target Signal and ToTok Users in Sophisticated 2025 Attack

In June 2025, cybersecurity firm ESET uncovered targeted Android spyware campaigns, dubbed ProSpy and ToSpy, which impersonated upgrades and plugins for the popular messaging apps Signal and ToTok. Threat actors distributed malicious APK files via websites masquerading as official app sites and third-party stores, luring users primarily in the United Arab Emirates. Once installed, these spyware variants harvested sensitive data including device information, contacts, SMS, files, and backups, using sophisticated persistence mechanisms and disguising themselves as legitimate apps. Data exfiltration was conducted using encrypted channels to evade detection. This incident underscores the increasing threat of mobile malware leveraging convincing social engineering tactics and fake branding. It highlights a macro trend of attackers exploiting trust in widely used apps to infiltrate user devices, reflecting rising complexity in mobile threat landscapes and growing regulatory pressure on app distributors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Service Desk Social Engineering Attack Exposes Enterprise Vulnerabilities in 2025
Financial Services9 months ago

Service Desk Social Engineering Attack Exposes Enterprise Vulnerabilities in 2025

In October 2025, organizations witnessed a sharp rise in successful social engineering attacks targeting enterprise service desks. Threat actors such as Scattered Spider exploited help desk processes by impersonating employees and manipulating support staff into resetting credentials or granting privileged access. These attacks bypassed traditional technical defenses by leveraging persuasive phone or chat conversations, resulting in significant business disruptions, data exposure, and potential operational outages. Notable events, such as those at MGM Resorts and Clorox, demonstrated the devastating financial and reputational impact of a single compromised support interaction, with recovery efforts spanning weeks and incurring nine-figure damages. This trend highlights the evolving threat landscape where the human element is now the primary entry vector. The urgency to adopt robust, workflow-driven identity verification, bypassing agent discretion, is underscored by regulatory scrutiny and mounting pressure to align with NIST and similar frameworks. Organizations must shift from relying on staff intuition to standardized, audited processes to mitigate these high-impact risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
U.A.E. Android Spyware Alert 2025: ProSpy & ToSpy Impersonate Secure Messaging Apps
Government Administration9 months ago

U.A.E. Android Spyware Alert 2025: ProSpy & ToSpy Impersonate Secure Messaging Apps

In October 2025, cybersecurity researchers at ESET identified two sophisticated Android spyware campaigns, ProSpy and ToSpy, actively targeting users in the United Arab Emirates by masquerading as legitimate apps such as Signal Encryption Plugin and ToTok Pro. The spyware was disseminated through fake websites leveraging social engineering techniques, deceiving users into downloading malicious apps. Once installed, the malware secretly exfiltrated device data, tracked user communications, and introduced significant privacy and data security risks for both individuals and organizations. The campaigns indicate a growing trend of targeted mobile espionage in the region, significantly undermining user trust and operational safety. This incident underscores the escalating threat from mobile spyware distributed via convincing social engineering and fake app storefronts. As more users move critical communications to mobile platforms, adversaries are rapidly advancing their techniques, prompting urgent calls for enhanced mobile threat detection, robust user education, and strict compliance with data protection frameworks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports