The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3129 threat reports
Page 256 of 261
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 3061–3072 / 3129 reports
SonicWall Cloud Backup Breach: Firewall Configurations Compromised, Credential Resets Urged
Computer/Network Security9 months ago

SonicWall Cloud Backup Breach: Firewall Configurations Compromised, Credential Resets Urged

In September 2025, SonicWall disclosed a cloud security incident that exposed firewall configuration backup files tied to less than 5% of MySonicWall accounts, prompting a company-wide advisory to reset credentials for impacted users. The breach involved unauthorized access to backup firewall preference files hosted in SonicWall’s cloud backup service, which could potentially allow attackers insight into sensitive network policies and infrastructure details. Upon detection, SonicWall revoked affected credentials, reset authentication tokens, and notified regulatory authorities and end-users. The incident underscores operational risks associated with cloud-based configuration repositories and the downstream consequences for enterprise security posture. This breach highlights ongoing attacker focus on cloud storage services and device configuration files, which are increasingly targeted for initial access or lateral movement. As regulatory scrutiny grows and advanced threats seek out persistent footholds, organizations face mounting urgency to harden cloud storage, segment sensitive data, and enforce continuous credential hygiene.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
CountLoader: The Russian Ransomware Loader Redefining Post-Exploitation in 2025
Financial Services9 months ago

CountLoader: The Russian Ransomware Loader Redefining Post-Exploitation in 2025

In September 2025, cybersecurity researchers uncovered a major campaign involving CountLoader, a newly identified malware loader leveraged by Russian ransomware gangs. CountLoader has been deployed to infiltrate organizations by delivering post-exploitation tools such as Cobalt Strike, AdaptixC2, and the PureHVNC RAT via sophisticated phishing and initial access broker (IAB) operations. Notably, the loader is associated with affiliates of the LockBit ransomware group and is suspected to support both initial access sales and direct ransomware attacks. The campaign enabled attackers to establish stealthy persistence and remote control over compromised environments, amplifying threats of data theft, lateral movement, and disruptive encryption attacks. This incident highlights the growing adoption of multi-stage loader malware by established ransomware actors, blending traditional and cutting-edge post-exploitation tools for maximum impact. The tactics seen here illustrate the evolving, service-based ransomware ecosystem—one where payload delivery, access brokering, and command-and-control capabilities are modular and rapidly evolving in response to network defenses.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
GhostRedirector Backdoors Windows Servers with Malicious IIS Modules
Information Technology/IT9 months ago

GhostRedirector Backdoors Windows Servers with Malicious IIS Modules

In early 2024, ESET researchers uncovered a sophisticated cyber campaign known as GhostRedirector targeting Windows servers worldwide. The attacker employed a passive C++ backdoor and a malicious Microsoft IIS module, granting remote control and enabling the manipulation of Google search results. By compromising internet-facing IIS web servers, the threat actor covertly redirected visitors to malicious domains while maintaining persistent access through undetected, stealthy backdoors. The attack had the potential to facilitate broad influence operations, data exfiltration, and further deployment of malware on compromised networks. This incident highlights the growing risk of advanced web server threats utilizing legitimate application modules for stealthy persistence. Such tactics reflect a wider trend of attackers exploiting trusted infrastructure and automated SEO poisoning, challenging organizations to strengthen threat detection, zero trust controls, and incident response.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
HybridPetya Ransomware: UEFI Secure Boot Under Attack in 2024
Banking/Mortgage9 months ago

HybridPetya Ransomware: UEFI Secure Boot Under Attack in 2024

In June 2024, ESET researchers discovered a ransomware variant dubbed HybridPetya, modeled after the infamous Petya/NotPetya malware, with a significant escalation in its capabilities. HybridPetya leverages the CVE-2024-7344 vulnerability to compromise UEFI-based systems, effectively bypassing Secure Boot protections on outdated hardware. Although not known to be active in broad campaigns, this bootkit joins a small group of malware capable of undermining the fundamental trust mechanisms securing modern machines, representing a sophisticated evolution in ransomware delivery and persistence techniques. HybridPetya’s emergence highlights the rapid adaptation of cybercriminals to harden malware against defensive controls. UEFI bootkit methods—once advanced nation-state territory—are now appearing in ransomware. Organizations must urgently review endpoint protections, hardware patching, and secure boot configurations to lower exposure to these new attack paths.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
HybridPetya Ransomware: UEFI Secure Boot Bypass Proof-of-Concept Shakes Firmware Security
Health Care / Life Sciences9 months ago

HybridPetya Ransomware: UEFI Secure Boot Bypass Proof-of-Concept Shakes Firmware Security

In July 2025, ESET Research uncovered HybridPetya, a proof-of-concept ransomware closely mimicking the destructive Petya and NotPetya malware. HybridPetya features a novel UEFI bootkit component, capable of targeting both legacy and modern UEFI-based systems by exploiting CVE-2024-7344 to bypass Secure Boot protections. The malware operates by encrypting the Master File Table on NTFS partitions, leveraging advanced techniques such as malicious EFI application deployment and fake CHKDSK screens to evade detection. To date, ESET’s telemetry has found no evidence of HybridPetya in active attacks, and its development suggests an evolving threat landscape for ransomware targeting core system components. HybridPetya’s public discovery underscores an alarming trend: sophisticated ransomware is expanding its reach to firmware and boot processes, previously considered resilient to commodity malware. The rise of UEFI-targeting threats and Secure Boot bypass exploits highlights the urgent need for rigorous patch management and endpoint visibility, especially as new vulnerabilities (like CVE-2024-7344) become weaponized.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
SonicWall 2024 Breach: Cloud Portal Attack Exposes Firewall Configurations
Financial Services9 months ago

SonicWall 2024 Breach: Cloud Portal Attack Exposes Firewall Configurations

In June 2024, SonicWall confirmed a security incident impacting its MySonicWall.com portal, where threat actors gained unauthorized access to backup firewall configuration files belonging to fewer than 5% of their customers. The attackers employed targeted brute-force attacks to access encrypted preference files stored in the cloud, potentially exposing sensitive network architecture and policy information. While SonicWall promptly disabled the affected backup feature, notified law enforcement and affected customers, and engaged incident response specialists, the exposure raises substantial risk of follow-on attacks and exploitation due to the detailed nature of the data compromised. This incident highlights a growing concern with threats targeting cloud-managed administrative platforms, especially those operated by key infrastructure vendors. As attackers pivot from device exploits to systemic attacks on cloud portals, organizations must scrutinize cloud data storage and vendor security practices more rigorously to mitigate downstream and supply chain risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft Seizes RaccoonO365: 2024’s Largest Phishing-as-a-Service Credential Theft Takedown
Health Care / Life Sciences9 months ago

Microsoft Seizes RaccoonO365: 2024’s Largest Phishing-as-a-Service Credential Theft Takedown

In July 2024, Microsoft’s Digital Crimes Unit, in collaboration with law enforcement and cybersecurity partners, led a takedown of RaccoonO365—a subscription-based phishing-as-a-service platform operated by the threat group Storm-2246. Over 338 domains linked to RaccoonO365 were seized after being used to steal more than 5,000 Microsoft credentials across 94 countries since July 2024. The group’s kits, leveraging sophisticated evasion techniques and authentic-looking Microsoft branding, enabled cybercriminals to mount tax-themed and healthcare-targeted phishing campaigns, with sessions often bypassing multifactor authentication to harvest both passwords and session cookies. The breadth and pace of RaccoonO365’s operations highlight the commoditization and professionalization of cybercrime. This incident signals a shift towards scalable, as-a-service attack tools, increasing risks to organizations globally. Security teams must rapidly adapt to evolving TTPs and plug new identity-driven attack pathways, especially as phishing toolkits grow in accessibility and sophistication.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CHILLYHELL and ZynorRAT: Cross-Platform RATs Evade Detection, Threaten Enterprise Environments (2025)
Financial Services9 months ago

CHILLYHELL and ZynorRAT: Cross-Platform RATs Evade Detection, Threaten Enterprise Environments (2025)

In September 2025, security researchers from Jamf Threat Labs uncovered two sophisticated malware strains: CHILLYHELL, a modular backdoor targeting macOS systems, and ZynorRAT, a Go-based remote access trojan spreading across Windows and Linux environments. CHILLYHELL, written in C++ for Intel macOS architectures, enables persistent remote access and exfiltrates sensitive data, while ZynorRAT facilitates cross-platform attacks and lateral movement. Both threats leverage encrypted communications and modular payloads to evade detection and expand their reach, highlighting attackers’ increasing investment in multi-OS toolkits. The campaign impacted diverse sectors by undermining endpoint trust and exposing organizations to data breaches, extortion, and operational disruption. This incident reflects an ongoing surge in cross-platform malware development, with adversaries targeting heterogeneous enterprise environments using advanced, modular code. The discovery underscores heightened regulatory scrutiny around endpoint security, zero trust enforcement, and incident response as ransomware and espionage risks escalate.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Chinese APT Bypasses Philippine Military Defenses with EggStreme Fileless Malware (2025)
Defense/Space9 months ago

Chinese APT Bypasses Philippine Military Defenses with EggStreme Fileless Malware (2025)

In September 2025, a Chinese advanced persistent threat (APT) group breached a Philippines-based military company using a sophisticated multi-stage attack leveraging the novel fileless malware framework, EggStreme. According to Bitdefender, the attackers achieved persistence and stealth by injecting their malicious code directly into memory and utilizing DLL sideloading to execute payloads without writing files to disk. This allowed them to maintain an undetected presence, conduct espionage, and potentially exfiltrate sensitive military and government data. The breach underscores ongoing risks to national security organizations from highly resourced nation-state actors employing advanced techniques. This incident highlights the emergence of more evasive, memory-resident malware frameworks targeting defense and critical infrastructure. Fileless attack methods such as those used by EggStreme are increasingly common and harder to detect, urging organizations to adopt advanced threat detection, improved segmentation, and robust incident response capabilities.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Akira Ransomware Exploits SonicWall SSL VPN Flaw in 2025 – What You Need to Know
Financial Services9 months ago

Akira Ransomware Exploits SonicWall SSL VPN Flaw in 2025 – What You Need to Know

In late July 2025, threat actors affiliated with the Akira ransomware group launched a wave of attacks by exploiting a vulnerability and misconfigurations in SonicWall SSL VPN appliances. Cybersecurity firm Rapid7 reported a notable surge in intrusions targeting these devices, leveraging unsecured remote access pathways for initial compromise. Once inside, attackers escalated privileges, moved laterally, and deployed ransomware to encrypt critical data, causing extensive operational disruptions for affected organizations. The attacks highlighted gaps in east-west traffic monitoring, segmentation, and visibility, leaving many networks vulnerable to rapid malware spread and data loss. This breach underscores ongoing ransomware innovation and the persistent targeting of networking appliances as low-hanging fruit for initial access. It also reveals the increasing urgency for organizations to enforce zero trust network segmentation, proactively patch perimeter devices, and continuously monitor for anomalous access to defend against evolving ransomware threats and regulatory scrutiny.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
HybridPetya: Ransomware That Bypasses UEFI Secure Boot with CVE-2024-7344
Banking/Mortgage9 months ago

HybridPetya: Ransomware That Bypasses UEFI Secure Boot with CVE-2024-7344

In September 2025, researchers at ESET identified a new ransomware variant named HybridPetya that combines destructive Petya/NotPetya traits with advanced UEFI attack capabilities. Leveraging the CVE-2024-7344 vulnerability, attackers were able to bypass UEFI Secure Boot, allowing the malware to execute at a privileged level prior to OS load. Initial infection vectors appear to include phishing emails and software supply-chain compromises, leading to widespread disruption of targeted organizations’ endpoints, encrypted data, and in some instances, bricked devices. The attack highlights a disturbing escalation in ransomware sophistication and targeting, with significant operational downtime and financial losses reported in affected sectors. HybridPetya represents an evolution in ransomware, merging firmware exploitation with traditional payload delivery to maximize impact. This incident underscores the expanding threat landscape as adversaries weaponize newly discovered vulnerabilities and aim higher up the trust chain, intensifying pressure on organizations to harden their endpoints and update defenses in real time.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Apple Warns French Users of Fourth Major Spyware Campaign in 2025
Government Administration9 months ago

Apple Warns French Users of Fourth Major Spyware Campaign in 2025

In September 2025, Apple issued alerts to French users after identifying a sophisticated spyware campaign targeting their devices, marking the fourth such warning within the year. According to CERT-FR, the attack exploited vulnerabilities in Apple’s ecosystem—potentially via malicious links or zero-day exploits linked to iCloud accounts—allowing unauthorized surveillance and data exfiltration. The incident highlights persistent targeting of high-profile users in France, including journalists, activists, and officials, by advanced threat actors suspected to have nation-state-level capabilities. Impact includes compromised device privacy, risk of sensitive information leaks, and possible reputational harm to affected organizations. This incident underscores a worrying trend of recurrent, targeted campaigns using advanced spyware in Western Europe. The persistence of these attacks illustrates evolving threat actor sophistication and growing urgency for companies to strengthen device and network-level security, particularly as regulatory and public scrutiny intensifies.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports