The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3129 threat reports
Page 260 of 261
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 3109–3120 / 3129 reports
MostereRAT Malware: New Era of EDR Bypass and Persistent Threats
Financial Services9 months ago

MostereRAT Malware: New Era of EDR Bypass and Persistent Threats

In 2024, security researchers uncovered a sophisticated campaign deploying the 'MostereRAT' malware against Windows environments. The threat actor used advanced techniques to deliver an EDR (Endpoint Detection and Response)-killing tool, enabling long-term, covert persistence on infected systems. MostereRAT blends into legitimate network traffic, leverages encrypted channels, and systematically disables or bypasses security controls, making detection and remediation difficult. Impacted organizations faced risks of data exfiltration, lateral movement, and significant business disruption, with attackers maintaining access for extended periods before discovery. This incident highlights the increasing prevalence of anti-EDR malware designed to counter modern defensive capabilities. As organizations adopt stronger endpoint security, attackers are deploying stealthier, more evasive malware, presenting ongoing challenges for incident detection, compliance, and cyber resilience.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Amazon Stops APT29 Watering Hole Leverage of Microsoft Device Code
Government Administration9 months ago

Amazon Stops APT29 Watering Hole Leverage of Microsoft Device Code

In August 2025, Amazon Security Intelligence teams detected and disrupted a sophisticated nation-state watering hole campaign attributed to the Russian-linked APT29 group. The attackers compromised multiple legitimate websites, redirecting unsuspecting visitors to malicious infrastructure designed to exploit Microsoft's device code authentication flow. By tricking users into authorizing attacker-controlled devices, APT29 was able to gain unauthorized access to victim accounts and sensitive data. The rapid response by Amazon limited the scope of the compromise, but the incident highlights evolving tactics by advanced persistent threats targeting cloud identity systems. This incident is notable for its exploitation of widely used authentication protocols and the opportunistic use of trusted websites for redirection. It reflects a broader escalation in targeted attacks on cloud identities and authentication flows, as well as the sophistication of nation-state threat actors seeking persistent access to corporate and government assets.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Q2 2025 Vulnerability Exploitation: Multi-Platform Attacks and C2 Automation
Financial Services9 months ago

Q2 2025 Vulnerability Exploitation: Multi-Platform Attacks and C2 Automation

In Q2 2025, there was a surge in the exploitation of both newly reported and longstanding software vulnerabilities across enterprise environments. Threat actors leveraged critical CVEs—targeting platforms like Microsoft Windows, Linux, document-editing suites, UEFI firmware, AI frameworks, and remote access tools—to gain initial access and escalate privileges on victim systems. Notably, advanced persistent threat (APT) groups demonstrated increased use of C2 frameworks such as Sliver, Metasploit, Havoc, and Brute Ratel to automate exploitation and maintain persistence, highlighting attackers’ growing sophistication and automation. The operational impact ranged from data theft and malware deployment to strategic risks, as attackers pivoted laterally and disabled security mechanisms. The Q2 2025 wave underscores a broader industry trend: attackers are rapidly exploiting both legacy and emerging weaknesses, especially as vulnerability disclosure volumes continue to rise. Automation within C2 frameworks and exploitation targeting multi-cloud and hybrid environments reinforce the urgency to modernize detection and patch-management programs to keep pace with evolving threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI Turbocharges Exploit Development: Are You Ready for Machine-Speed Cyber Threats?
Computer Software/Engineering9 months ago

AI Turbocharges Exploit Development: Are You Ready for Machine-Speed Cyber Threats?

In mid-2024, two independent Israeli cybersecurity researchers developed an AI-powered system, "Auto Exploit," that can generate proof-of-concept exploit code for new vulnerabilities in as little as 15 minutes. Leveraging large language models like Anthropic's Claude and open-source LLMs, the system parses CVE advisories and code patches, quickly creating vulnerable test environments and customized exploit code. This approach successfully produced exploits for 14 open source software vulnerabilities, dramatically shortening the typical window for defenders to patch their systems before seeing exploitation in the wild. The project highlights the risk posed by adversaries who can now weaponize vulnerabilities and bypass LLM guardrails at machine speed, raising the stakes for enterprise security teams. As automation and AI further accelerate exploit development, organizations face increasing pressure to adapt their vulnerability management and incident response processes. The emergence of such techniques indicates a shift where traditional exploitability scoring is less relevant, and exposure of assets becomes the key risk consideration.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TP-Link Routers Hit by 2025 Zero-Day: What You Need to Know About the CWMP Exploit
Telecommunications9 months ago

TP-Link Routers Hit by 2025 Zero-Day: What You Need to Know About the CWMP Exploit

In September 2025, TP-Link confirmed a critical zero-day vulnerability impacting multiple router models, including Archer AX10 and AX1500. Discovered by independent researcher Mehrun (ByteRay), the stack-based buffer overflow exists within the routers' CWMP (CPE WAN Management Protocol) implementation, specifically in handling SOAP messages due to improper validation in 'strncpy' calls. Attackers can exploit this flaw to achieve remote code execution by redirecting devices to malicious CWMP servers or leveraging unchanged default credentials, leading to device compromise. Once compromised, adversaries can reroute DNS queries, intercept traffic, and inject malicious payloads, raising severe risks for users and organizations relying on affected devices. The continued exploitation of similar router vulnerabilities by groups like Quad7 botnet highlights a shift in attacker TTPs towards leveraging consumer and SOHO networking devices as entry points and persistence mechanisms. The prevalence of these attacks underscores the urgent need for robust patch management and secure configuration in edge infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Q2 2025 Global Ransomware Surge: Qilin, Nefilim, Black Kingdom, and the Modern Threat Landscape
Health Care / Life Sciences9 months ago

Q2 2025 Global Ransomware Surge: Qilin, Nefilim, Black Kingdom, and the Modern Threat Landscape

In Q2 2025, the global ransomware threat landscape saw a significant surge with the discovery of 1,702 new ransomware variants and nearly 86,000 users targeted. High-profile law enforcement actions included indictments and extraditions involving Black Kingdom, Nefilim, Ryuk, DoppelPaymer, and RobbinHood operators. Major campaigns leveraged vulnerabilities in SAP NetWeaver, Fortinet devices, and Microsoft Windows (CLFS driver), with actors like Qilin and DragonForce demonstrating adeptness in exploiting zero-days and supply chain weaknesses. Double extortion and rapid lateral movement were widely observed, affecting critical sectors worldwide, including healthcare, government, and managed service providers. This incident underscores the advancement of ransomware attack tactics, the spread of sophisticated variants, and the persistence of threat actors despite law enforcement measures. The continued exploitation of newly discovered vulnerabilities and focus on high-revenue targets highlight the urgent need for enhanced prevention, detection, and incident response across organizations of all sizes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
2025 Spotlight: ESET Uncovers First AI-Powered PromptLock Ransomware
Financial Services9 months ago

2025 Spotlight: ESET Uncovers First AI-Powered PromptLock Ransomware

In September 2025, ESET Research identified PromptLock, the first documented case of AI-powered ransomware. While not deployed in active attacks, PromptLock is a sophisticated proof-of-concept that leverages OpenAI’s gpt-oss-20b model via the Ollama API to create malicious Lua scripts in real-time. Written in Golang for both Windows and Linux, PromptLock automates enumeration, exfiltration, and encryption of target system files, with variants found on VirusTotal. Its design demonstrates the feasibility of AI-augmented malware, where dynamic scripting enables rapid adaptation to environments and highly automated attack flows. PromptLock’s discovery highlights the emergence of AI-driven tactics that could accelerate ransomware development and proliferation. As AI tools become more accessible, the risk of advanced, autonomous threats challenging enterprise security controls grows sharply, signaling a pivotal shift in the threat landscape.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
DSLRoot & the Legal Botnet Threat: How Proxy Networks Create Global Security Gaps
Government Administration9 months ago

DSLRoot & the Legal Botnet Threat: How Proxy Networks Create Global Security Gaps

In August 2025, longstanding residential proxy provider DSLRoot was exposed for recruiting US residents to host dedicated proxy devices on their home Internet lines, including high-risk individuals such as a U.S. Air National Guard member with top-secret clearance. The company, with origins and affiliations in Russia and Eastern Europe, leverages consent-based proxy networks—sometimes referred to as 'legal botnets'—enabling anonymized traffic redirection and potential abuse by third parties. DSLRoot's proxies are promoted on underground forums and have leveraged adware pay-per-install schemes, bypassing traditional ISP terms and offering services worldwide. The incident raised concerns about unmanaged East-West network traffic, lack of egress controls, and gaps in threat detection on residential endpoints, highlighting the ease with which attackers or unauthorized users can exploit commoditized infrastructure for fraud, anonymity, or more severe criminal purposes. This case underscores the growing risks of proxy network abuse, which threatens both enterprise and government environments by eroding identity controls and facilitating untraceable activity. The increasing prevalence of 'legal botnets' fueled by incentives and lax regulation makes this a high-priority issue for organizations seeking to enforce policy, maintain compliance, and detect anomalous traffic patterns across diverse environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Azure AD Credential Exposure: Public Config File Leak Spotlights Cloud Risks
Financial Services9 months ago

Azure AD Credential Exposure: Public Config File Leak Spotlights Cloud Risks

In early 2024, a significant security incident was discovered involving the inadvertent exposure of Azure Active Directory credentials via a misconfigured JSON configuration file. The public accessibility of this file enabled malicious actors to directly authenticate against Microsoft’s OAuth 2.0 endpoints, bypassing traditional security controls and potentially infiltrating cloud environments. Attackers leveraged this cloud misconfiguration to escalate cloud access, risking business-critical Azure resources, data loss, and lateral movement inside affected organizations. Detection came after researchers observed unusual authentication patterns linked to public file sharing, prompting rapid investigation and remediation efforts. The incident underscores how easily overlooked misconfigurations can undermine enterprise cloud security and compliance obligations. The breach highlights ongoing challenges as organizations migrate sensitive workflows to the cloud. Public file exposure, credential leakage, and abuse of identity platforms like Azure Active Directory remain top attack vectors. This incident amplifies recent regulatory scrutiny, reinforces the need for cloud visibility and zero trust practices, and signals rising attacker sophistication in exploiting misconfigured storage and identity controls.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
APT28 Exploits Microsoft Outlook: Inside the 2024 NotDoor Backdoor Attack
Government Administration9 months ago

APT28 Exploits Microsoft Outlook: Inside the 2024 NotDoor Backdoor Attack

In 2024, the Russian state-sponsored group APT28 (also known as Fancy Bear) leveraged a new backdoor called "NotDoor" to infiltrate targeted organizations via Microsoft Outlook. Researchers from Lab52 revealed that attackers delivered NotDoor using DLL sideloading through OneDrive.exe, enabling them to bypass Outlook's macro security and gain persistent access. Once deployed, NotDoor monitored incoming Outlook emails for specific trigger words, allowing APT28 to exfiltrate sensitive data, upload malicious files, and execute remote commands without detection. Outlook's native functions were abused to provide covert communications and stealthy data transfers, making detection difficult. This incident illustrates the continued evolution of state-sponsored attack methods, especially the abuse of ubiquitous business software like Microsoft Outlook for stealthy, command-and-control operations. Organizations face mounting pressure to address advanced persistent threats exploiting native application behaviors and to enhance email and endpoint security in response to these sophisticated tactics.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
FDN3’s Massive Brute-Force Attacks Target VPN & RDP Devices Globally (2025)
Financial Services9 months ago

FDN3’s Massive Brute-Force Attacks Target VPN & RDP Devices Globally (2025)

Between June and July 2025, Ukrainian autonomous system FDN3 (AS211736) orchestrated large-scale brute-force and password spraying attacks targeting SSL VPN and Remote Desktop Protocol (RDP) devices across multiple regions. The campaign, identified and attributed by French cybersecurity firm Intrinsec, involved distributed login attempts to compromise organizations’ remote access infrastructure using stolen or weak credentials. This led to unauthorized system access, at-risk sensitive data, and the potential for further lateral movement inside target environments. The attack underscored the critical vulnerabilities that arise when VPNs and RDP servers are exposed without adequate security controls. This incident is emblematic of the growing trend of threat actors exploiting internet-facing authentication portals with automated credential attacks. As organizations continue to rely on remote access solutions, adversaries are increasingly targeting SSL VPN and RDP endpoints to gain initial entry—a method further complicated by the prevalence of weak password policies, limited anomaly detection, and insufficient segmentation.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
CISA, FBI, and NSA Warn: China-Backed APTs Compromise Global Critical Infrastructure
Telecommunications9 months ago

CISA, FBI, and NSA Warn: China-Backed APTs Compromise Global Critical Infrastructure

In June 2024, leading international cybersecurity agencies—including the CISA, FBI, and NSA—issued a joint advisory detailing the extensive, multi-year espionage campaign attributed to Chinese state-backed actors such as Salt Typhoon. These APTs have targeted critical infrastructure sectors including telecommunications, government, transportation, and defense, largely by exploiting known vulnerabilities in network hardware like routers and firewalls since at least 2021. Attackers leveraged tactics such as modifying access control lists, opening non-standard ports, establishing persistent footholds, and actively capturing sensitive network traffic for credential harvesting, with the aim of gaining long-term, stealthy access and potential disruption capability across global networks. This incident underscores a major strategic escalation from pure data theft to pre-positioning for possible future disruption of vital services. Organizations face heightened pressure to implement robust detection, network segmentation, and security hardening, as state-sponsored campaigns become more brazen and influential across global critical systems.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports