Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 26 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 301–312 / 3243 reports
Zimbra Email Servers Under Attack: CVE-2026-73570 Enables Web Shell Deployment and Credential Theft
Zimbra Email Servers Under Attack: CVE-2026-73570 Enables Web Shell Deployment and Credential Theft
Financial Services1 month ago

Zimbra Email Servers Under Attack: CVE-2026-73570 Enables Web Shell Deployment and Credential Theft

In July 2026, threat actors exploited CVE-2026-73570, an unauthenticated command injection vulnerability in Zimbra Collaboration Suite, to deploy web shells and harvest authentication secrets from internet-facing email servers. The critical flaw (CVSS 8.9) enabled attackers to execute remote code through specially crafted SMTP requests without authentication when SNMP notifications were enabled. Microsoft observed multi-stage attacks across multiple regions and industries between July 28 and August 7, 2026, where attackers deployed JSP web shells, established persistence mechanisms, escalated privileges, and exfiltrated mailbox data and authentication tokens including zimbraPreAuthKey and zimbraTwoFactorAuthSecret. This incident highlights the accelerating trend of targeting email infrastructure as attackers increasingly focus on business-critical communication systems and identity-related credentials that enable broader enterprise compromise and long-term persistence across hybrid cloud environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Russian State Hackers Deploy New RedFlick Technique in Automated Malware Campaigns
Russian State Hackers Deploy New RedFlick Technique in Automated Malware Campaigns
Government Administration1 month ago

Russian State Hackers Deploy New RedFlick Technique in Automated Malware Campaigns

In September 2026, Microsoft researchers identified a new malware delivery technique called 'RedFlick' being used by the Russian state-sponsored threat actor Star Blizzard (also known as COLDRIVER). This campaign represents a significant evolution in the group's tactics, streamlining their malware delivery process through automated scheduled tasks that deploy the CosmicPulse backdoor with minimal victim interaction. The attacks begin with phishing emails containing password-protected archives that house VHDX virtual disks with malicious LNK files disguised as PDFs. Microsoft observed at least 13 large-scale campaigns since early 2026, impacting over 100 organizations primarily in the US and UK, with particular focus on Ukrainian institutions and international organizations supporting Ukraine. This incident highlights the ongoing sophistication of state-sponsored cyber operations and the continuous evolution of attack methodologies. As geopolitical tensions remain high, organizations must prepare for increasingly automated and evasive attack chains that bypass traditional security controls through legitimate system utilities and scheduled task abuse.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Star Blizzard's RedFlick Evolution: How Russian APT Streamlined Phishing Attacks in 2026
Star Blizzard's RedFlick Evolution: How Russian APT Streamlined Phishing Attacks in 2026
Civic/Social Organization1 month ago

Star Blizzard's RedFlick Evolution: How Russian APT Streamlined Phishing Attacks in 2026

Russia's Star Blizzard APT group has evolved its phishing tactics in 2026, abandoning the multi-step ClickFix technique for a streamlined approach called RedFlick. Since January 2026, the FSB-linked threat actor has conducted 13 large-scale phishing campaigns targeting Ukrainian-linked NGOs, think tanks, and journalists worldwide. RedFlick reduces victim interaction to a single click while deploying the CosmicPulse backdoor through scheduled tasks and legitimate Windows utilities, significantly increasing the success rate of initial compromise attempts. This incident highlights the accelerating evolution of state-sponsored phishing operations, where APT groups are prioritizing operational efficiency over surgical precision. As geopolitical tensions persist, organizations supporting Ukraine or conducting Russia-related research face increasingly sophisticated and scalable attack vectors that require enhanced email security and user awareness programs.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Apple's CVE-2026-86950 Zero-Day Reveals Critical Enterprise Security Gaps
Apple's CVE-2026-86950 Zero-Day Reveals Critical Enterprise Security Gaps
Information Technology/IT1 month ago

Apple's CVE-2026-86950 Zero-Day Reveals Critical Enterprise Security Gaps

Apple disclosed CVE-2026-86950, a zero-day vulnerability in its CoreGraphics framework with a CVSS score of 8.8, actively exploited in highly sophisticated targeted attacks against specific individuals. The out-of-bounds write flaw affects a broad range of Apple devices including iPhones from iPhone 11 onward and multiple iPad generations, allowing attackers to execute arbitrary code through memory corruption. CISA immediately added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch within three days and conduct forensic triage by October 2, 2026. This incident highlights the growing trend of advanced persistent threat actors investing heavily in Apple device exploitation chains, moving beyond the traditional view of Apple products as inherently secure endpoints in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities
Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities
Airlines/Aviation1 month ago

Critical Infrastructure Under Siege: ATNS Ransomware Attack Exposes Aviation OT Vulnerabilities

In September 2026, South Africa's Air Traffic and Navigation Services (ATNS) discovered ransomware-linked malware in operational technology networks supporting weather services for air traffic control systems managing 10% of global airspace. The attack affected facilities at Port Elizabeth Airport and potentially East London Airport, with preliminary investigations revealing data exfiltration to external IP addresses located in China. While internal teams implemented containment measures and malware removal, ATNS issued a request for comprehensive cyber-forensic investigation services to determine the full extent of compromise and remaining risks. This incident highlights the accelerating threat landscape targeting critical aviation infrastructure, with ransomware attacks on the aviation sector surging sixfold in 2025. The targeting of air traffic control systems represents a concerning escalation in attacks against operational technology environments that directly impact public safety and global transportation networks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CVE-2026-88772: Critical Citrix NetScaler Vulnerability Under Active Exploitation
CVE-2026-88772: Critical Citrix NetScaler Vulnerability Under Active Exploitation
Financial Services1 month ago

CVE-2026-88772: Critical Citrix NetScaler Vulnerability Under Active Exploitation

Citrix NetScaler ADC and Gateway devices are under active exploitation through CVE-2026-88772, a critical memory overflow vulnerability in DTLS protocol handling that allows pre-authentication remote code execution. Attackers exploit parsing inconsistencies in the fragment_length field to craft malicious records that appear small but contain oversized data, causing buffer overflows that can be weaponized for arbitrary shellcode execution with root privileges. The vulnerability affects the NetScaler Packet Processing Engine and has been added to CISA's Known Exploited Vulnerabilities catalog due to confirmed active exploitation in the wild. This incident highlights the continued targeting of network infrastructure devices, particularly load balancers and VPN gateways that sit at critical network perimeters. With organizations increasingly dependent on hybrid connectivity and secure remote access, vulnerabilities in these edge devices represent high-value targets for threat actors seeking initial network compromise and lateral movement capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Apple CVE-2026-86950 Added to CISA KEV Catalog: Critical Out-of-Bounds Write Vulnerability Under Active Exploitation
Apple CVE-2026-86950 Added to CISA KEV Catalog: Critical Out-of-Bounds Write Vulnerability Under Active Exploitation
Government Administration1 month ago

Apple CVE-2026-86950 Added to CISA KEV Catalog: Critical Out-of-Bounds Write Vulnerability Under Active Exploitation

CISA has added CVE-2026-86950, an Apple Multiple Products Out-of-Bounds Write Vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. This critical vulnerability affects multiple Apple products and allows attackers to execute arbitrary code through out-of-bounds memory write operations. The vulnerability poses significant risks to federal enterprises and organizations using Apple devices, as successful exploitation can grant attackers total control of compromised systems. CISA's Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets. This incident highlights the ongoing trend of memory corruption vulnerabilities being actively exploited against Apple ecosystems, emphasizing the critical importance of timely patch management across enterprise device fleets as threat actors increasingly target platform-specific weaknesses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical NetScaler Exploitation Campaign Uses Advanced WHIPSHOT and SLAPSHOT Malware
Critical NetScaler Exploitation Campaign Uses Advanced WHIPSHOT and SLAPSHOT Malware
Government Administration1 month ago

Critical NetScaler Exploitation Campaign Uses Advanced WHIPSHOT and SLAPSHOT Malware

In September 2026, multiple threat actors exploited critical vulnerabilities CVE-2026-88772 and CVE-2026-88771 in Citrix NetScaler ADC and Gateway appliances to compromise dozens of organizations across North America and Europe. The attacks targeted government, financial services, technology, education, and legal sectors by bypassing authentication to establish root-level access through memory overflow bugs in the DTLS protocol handling. Attackers deployed sophisticated post-exploitation toolkits including WHIPSHOT web shells that disguise Base64-encoded commands within HTTP headers, and SLAPSHOT Python tunnelers for internal reconnaissance and credential theft, enabling lateral movement and persistent access to victim networks. This campaign highlights the evolving threat landscape where edge infrastructure devices remain prime targets due to their internet exposure and position outside traditional endpoint protection coverage. With over 42,000 potentially vulnerable NetScaler instances globally and multiple threat actor groups actively exploiting these flaws for botnet recruitment and access brokering, organizations face immediate risks to their perimeter security and internal networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Cloud Misconfigurations Expose Transportation IoT Platform: Viidure Dashcam Security Analysis
Critical Cloud Misconfigurations Expose Transportation IoT Platform: Viidure Dashcam Security Analysis
Transportation1 month ago

Critical Cloud Misconfigurations Expose Transportation IoT Platform: Viidure Dashcam Security Analysis

In September 2026, CISA disclosed critical vulnerabilities in Viidure's Dashcam Android Application affecting versions up to 3.3.1.260403. Two severe flaws were identified: CVE-2026-94204, a cloud storage misconfiguration with public-read permissions exposing all user data and system files globally, and CVE-2026-96587, hardcoded credentials embedded in the application code providing full platform access. The vulnerabilities achieved CVSS scores of 7.5 and 10.0 respectively, with potential for complete platform compromise including unauthorized access to live dashcam footage, user records, firmware files, and critical system operations. Viidure failed to respond to CISA's coordination attempts, leaving users without vendor-provided remediation. This incident highlights the growing threat of cloud misconfigurations in IoT ecosystems, particularly as connected vehicle technologies proliferate across transportation infrastructure. The combination of exposed cloud storage and embedded credentials represents a concerning pattern in mobile application security that threatens critical infrastructure sectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CSuite Phishing Campaign Demonstrates Evolution of Executive-Targeted Cyber Attacks
CSuite Phishing Campaign Demonstrates Evolution of Executive-Targeted Cyber Attacks
Information Technology/IT1 month ago

CSuite Phishing Campaign Demonstrates Evolution of Executive-Targeted Cyber Attacks

In September 2026, ANY.RUN researchers identified a sophisticated CSuite phishing campaign targeting U.S. executives and C-suite personnel across 351 analyzed incidents. The operation used convincing business lures mimicking Adobe, DocuSign, Zoom, and Microsoft 365 services to deliver dual-payload attacks. Attackers deployed both credential harvesting mechanisms to steal Microsoft 365 sessions and remote management tools like ScreenConnect and Action1 for persistent endpoint access. The campaign primarily affected technology, manufacturing, government, and consulting sectors, with 51% of incidents originating in the United States. This incident highlights the evolving threat landscape where attackers increasingly combine identity theft with endpoint compromise to maximize impact. As organizations adopt hybrid work models and cloud-first strategies, these multi-vector attacks exploit the expanded attack surface between email systems and remote access infrastructure, making traditional perimeter defenses insufficient against modern business email compromise schemes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
The Browser Battlefield: Six Attack Techniques Reshaping Cybersecurity in 2026
The Browser Battlefield: Six Attack Techniques Reshaping Cybersecurity in 2026
Financial Services1 month ago

The Browser Battlefield: Six Attack Techniques Reshaping Cybersecurity in 2026

Browser-based attacks have emerged as the predominant threat vector in 2026, with most breaches now originating within browser sessions rather than traditional network perimeters. Cybercriminals are exploiting the browser's privileged position as the primary interface for business applications, executing complete attack chains from initial access to data exfiltration without ever leaving the browser environment. These sophisticated attacks leverage advanced techniques including malicious browser extensions, DOM manipulation, credential harvesting through fake authentication portals, and abuse of legitimate browser APIs to maintain persistence and evade detection. The rise of browser-centric attacks reflects the broader shift toward cloud-first architectures and remote work models, making traditional network-based security controls less effective against threats that operate within trusted user sessions and legitimate application contexts.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover
Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover
Public Safety1 month ago

Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover

A critical command injection vulnerability (CVE-2026-22755) with a CVSS score of 10.0 has been discovered in VIVOTEK camera firmware affecting 38+ camera models across V Series, C Series, S Series, Dome, Panoramic, and Bullet product lines. The vulnerability allows remote attackers to achieve command execution with root privileges on affected devices without authentication, leading to complete system compromise. CISA published this advisory after discovering a public proof of concept exploit, indicating the vulnerability is actively exploitable in the wild. VIVOTEK has released firmware updates to address the issue and recommends immediate patching of all affected camera systems. This vulnerability affects critical infrastructure sectors including government facilities, transportation systems, energy, and financial services deployed worldwide, with VIVOTEK being a Taiwan-based manufacturer of network surveillance equipment.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports