Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 268 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 3205–3216 / 3243 reports
How Stark Industries Evaded EU Sanctions: The Persistence of Bulletproof Hosts in 2025
Financial Services10 months ago

How Stark Industries Evaded EU Sanctions: The Persistence of Bulletproof Hosts in 2025

In May 2025, Stark Industries Solutions Ltd.—a notorious bulletproof hosting provider closely linked to Russian cyberattacks and disinformation—was placed under EU financial sanctions, alongside its Moldova-based conduits and owners. Despite these efforts, Stark rapidly rebranded as the[.]hosting, shifted its assets to new legal entities (including Dutch-based WorkTitans BV and Moldova's PQ Hosting Plus S.R.L.), and maintained operational infrastructure with covert support from providers like MIRhosting. Investigations revealed continued operations and asset management by the original threat actors, rendering the sanctions ineffective and allowing persistent delivery of DDoS campaigns, Russian-language proxy services, and malware with minimal disruption. This incident highlights the sophisticated resilience and adaptability of bulletproof hosting operations, as well as the challenges for regulators attempting to curtail nation-state-aligned cyber infrastructure. Similar evasion techniques—including cross-border asset transfers and complex corporate rebranding—are on the rise, escalating pressure on global cybersecurity, law enforcement, and compliance efforts.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Gentlemen Ransomware Exploits Vulnerable Driver to Disable Enterprise Security (2024)
Financial Services10 months ago

Gentlemen Ransomware Exploits Vulnerable Driver to Disable Enterprise Security (2024)

In early 2024, the Gentlemen ransomware group executed a sophisticated attack leveraging a vulnerable version of the ThrottleStop.sys driver to disable antivirus and endpoint detection and response (EDR) systems. By exploiting this signed but flawed driver, the attackers were able to gain kernel-level privileges, terminate security defenses, and deploy ransomware effectively across targeted organizations. The impact resulted in rapid file encryption, significant operational disruption, and increased ransom demands as incident response capabilities were bypassed. This incident highlights the growing trend of ransomware operators abusing trusted, vulnerable drivers to evade security controls. The ease with which attackers weaponize driver vulnerabilities underscores the urgent need for organizations to enhance driver and device control, patch management, and implement Zero Trust security strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
SonicWall Firewalls Under Siege: Akira Ransomware Exploits CVE-2024-40766
Financial Services10 months ago

SonicWall Firewalls Under Siege: Akira Ransomware Exploits CVE-2024-40766

Between July and August 2024, Akira ransomware affiliates targeted SonicWall firewall devices by exploiting CVE-2024-40766, a vulnerability in the SSL VPN protocol, combined with widespread configuration errors. Despite the availability of patches, attackers successfully accessed devices where remediation steps such as local password resets after firmware upgrades and proper multi-factor authentication (MFA) implementation were neglected. These campaigns leveraged misconfigured LDAP group permissions and compromised credentials to gain initial access, enabling Akira to steal sensitive data and encrypt systems across numerous organizations. The resulting attacks led to data theft, system downtime, and expensive ransom demands, with impacts observed globally, including within Australia. Akira’s ongoing surge illustrates the growing sophistication and persistence of ransomware groups in targeting both unpatched and improperly configured perimeter devices. This attack wave highlights the critical need for organizations to not only apply security patches promptly but to rigorously follow up with secure configuration and identity management measures to prevent operational and financial losses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Microsoft September 2025 Patch Tuesday: Critical Vulnerabilities in Cloud, URL Security Zones, and More
Financial Services10 months ago

Microsoft September 2025 Patch Tuesday: Critical Vulnerabilities in Cloud, URL Security Zones, and More

On September 9, 2025, Microsoft released its September Patch Tuesday updates, addressing 177 vulnerabilities across its ecosystem, including 86 that impacted Microsoft products directly. Among these, 13 were rated as critical, and two had already been publicly disclosed. Notable vulnerabilities included improper URL security zone classification (CVE-2025-54107, CVE-2025-54917), which could allow attackers to bypass security features, and several remote code execution flaws affecting critical workloads. While none of these vulnerabilities were exploited before disclosure, their wide range—including issues in Azure, Office, and the Windows kernel—signals continued risk across cloud and on-premises environments. These vulnerabilities highlight evolving attacker techniques, such as zone misclassification and privilege escalation in cloud services, while underscoring the complexity of patch management in hybrid infrastructures. The scale of affected Microsoft and open-source components (like Azure Linux/Mariner) points to the growing regulatory and operational urgency for comprehensive and timely vulnerability management.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Apple 2025 Spyware Surge: Targeted Zero-Day Attacks Threaten High-Profile Users
Newspapers/Journalism10 months ago

Apple 2025 Spyware Surge: Targeted Zero-Day Attacks Threaten High-Profile Users

In 2025, Apple issued multiple urgent notifications to users after detecting a series of targeted spyware attacks leveraging zero-day vulnerabilities on iOS devices. According to French CERT-FR, at least four documented incidents since the beginning of the year involved highly sophisticated, zero-click exploits that required no user interaction. Victims included journalists, politicians, lawyers, activists, and executives in sensitive sectors. Attackers used a combination of a patched Apple zero-day (CVE-2025-43300) and a WhatsApp vulnerability (CVE-2025-55177) to compromise devices, potentially granting remote access to communications and sensitive data. Apple recommended enabling Lockdown Mode and soliciting help from digital security hotlines, but did not attribute the attacks to a specific group or region. This incident underscores increasing use of mercenary spyware and zero-day exploits for high-profile targeting, reflecting the growing challenges of defending against advanced persistent threats. The case highlights the urgency for rapid patching, proactive security postures, and global awareness of targeted surveillance campaigns in both the public and private sectors.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Ascension Health 2024: Kerberoasting Ransomware Attack Exposes Microsoft Security Risks
Health Care / Life Sciences10 months ago

Ascension Health 2024: Kerberoasting Ransomware Attack Exposes Microsoft Security Risks

In May 2024, Ascension Health experienced a major ransomware breach, impacting over 5.6 million patient records. Attackers exploited a contractor’s click on a malicious Bing search result in Microsoft Edge, leveraging a 'Kerberoasting' attack against Microsoft Active Directory. By abusing weak and legacy RC4-encrypted Kerberos service account credentials, attackers escalated privileges and moved laterally across sensitive healthcare infrastructure, ultimately exfiltrating patient data and disrupting operations. The incident highlighted significant shortcomings in Microsoft's default security settings and communication of critical risks to enterprise customers, even after prior warnings from security experts and U.S. government officials. The breach is emblematic of a rising trend in identity-based and ransomware attacks exploiting outdated cryptographic standards across critical infrastructure sectors, especially healthcare. Regulatory and public scrutiny on vendor responsibility, ransomware defense, and secure default configurations have intensified following this high-profile compromise.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Panama Ministry of Economy Breach: INC Ransomware’s 2025 Attack Explained
Government Administration10 months ago

Panama Ministry of Economy Breach: INC Ransomware’s 2025 Attack Explained

In September 2025, Panama's Ministry of Economy and Finance (MEF) announced a cyber incident after the INC Ransomware gang claimed liability for a breach. The ministry reported detecting malicious software on one workstation, activating security protocols, and asserting no core systems or sensitive data were affected. However, INC Ransom posted evidence and claimed to have exfiltrated over 1.5 TB of emails, financial, and budgeting documents from MEF. The threat actor listed MEF on its leak site and began releasing data samples, raising concerns about the extent of exposure. This incident underscores the continued evolution and impact of ransomware-as-a-service (RaaS) operations targeting government and finance sectors. With INC Ransom’s repeated high-profile attacks, the breach reflects the growing risk of sophisticated data theft and extortion campaigns confronting public sector organizations globally.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Ransomware Surge Hits State & Local Agencies: Lessons from Nevada and St. Paul
Government Administration10 months ago

Ransomware Surge Hits State & Local Agencies: Lessons from Nevada and St. Paul

In August 2024, both the State of Nevada and the City of St. Paul, Minnesota, experienced disruptive ransomware attacks that resulted in significant outages and data theft. Attackers exploited gaps in cybersecurity readiness and funding reductions to compromise critical municipal systems, leading to the shutdown of public services and exfiltration of sensitive information. Incident response efforts included engagement with federal agencies like the FBI and CISA, although full recovery remained ongoing for several weeks and required costly investigations, with losses projected to reach $17 million for St. Paul alone. These incidents illustrate the rising threat to smaller government entities, exacerbated by declining federal cybersecurity resources. The sophistication and operational impact of ransomware attacks continue to increase, underscoring urgent calls for improved resilience, incident response planning, and investment in cyber hygiene—especially amid tightening budgets and evolving threat tactics.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
How Salt Typhoon & Volt Typhoon Forced a U.S. Critical Infrastructure Cybersecurity Rethink
Telecommunications10 months ago

How Salt Typhoon & Volt Typhoon Forced a U.S. Critical Infrastructure Cybersecurity Rethink

Between 2021 and 2023, advanced Chinese threat actors known as Salt Typhoon and Volt Typhoon conducted highly covert cyber intrusions targeting U.S. telecommunications networks and critical infrastructure sectors. These groups utilized advanced tactics such as "living off the land," abusing legitimate administrative tools, and blending into east-west network traffic, making detection and remediation extremely challenging for defenders. Their primary objectives ranged from long-term espionage and persistent access to prepositioning for potential disruptive attacks in the event of geopolitical conflict. The hacks led federal agencies like the FBI and CISA to revise investigative methods, shifting to assume attackers may already be inside the network and forcing collaboration to uncover subtle anomalies rather than clear indicators. This incident is indicative of a broader industry trend: state-backed actors increasingly focus on stealth, cloud environments, and edge devices, targeting managed service providers and exploiting blind spots in monitoring. Their evolving tactics closely align with growing regulatory and CISO concern for stronger east-west visibility, zero trust controls, and continuous threat hunting across hybrid cloud infrastructure.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
KazMunayGas Penetration Test Mistaken for Russian Cyberattack: Lessons From a Simulated Incident
Oil/Energy/Solar/Greentech10 months ago

KazMunayGas Penetration Test Mistaken for Russian Cyberattack: Lessons From a Simulated Incident

In early 2024, Kazakhstan's largest oil company, KazMunayGas, was mistakenly believed to have suffered a cyberattack attributed to a Russian Advanced Persistent Threat (APT) group using a compromised employee email account. Initial reports claimed that attackers breached internal systems, raising alarm over possible business disruption and data compromise. However, after internal review, the company clarified the activity was actually part of an authorized penetration testing exercise, not a malicious breach, and no operational impact or data loss occurred. This incident comes amid heightened concern about cyberthreats targeting energy companies, particularly in regions where geopolitical tensions and state-sponsored actors are active. It demonstrates the confusion that can arise when security drills mimic genuine adversary tactics, highlighting the necessity for robust communication around cybersecurity validation activities.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Microsoft Patch Tuesday 2025: Patch Critical Privilege Escalation Flaws Now
Information Technology/IT10 months ago

Microsoft Patch Tuesday 2025: Patch Critical Privilege Escalation Flaws Now

In September 2025, Microsoft released patches addressing 81 vulnerabilities across enterprise products and core Windows systems. No vulnerabilities were detected as actively exploited, but experts cautioned that several critical and high-severity flaws could become prime targets. Notably, CVE-2025-55232 (CVSS 9.8) enables unauthenticated code execution on Microsoft High Performance Compute Pack installations. Critical elevation of privilege issues, such as CVE-2025-54918 (Windows NTLM) and CVE-2025-55234 (Windows SMB), expose organizations to potential lateral movement, ransomware, and large-scale data exfiltration risks if not remediated. This incident underscores the growing urgency of rapid patch cycles as attacker interest in privilege escalation and lateral movement techniques surges. With threat actors leveraging unpatched vulnerabilities for ransomware and data theft, organizations must bolster detection and enforcement around privilege-oriented exploits.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
How Outdated Encryption in Microsoft Defaults Enabled the 2024 Ascension Ransomware Attack
Health Care / Life Sciences10 months ago

How Outdated Encryption in Microsoft Defaults Enabled the 2024 Ascension Ransomware Attack

In February 2024, Ascension, one of the largest healthcare organizations in the United States, suffered a massive ransomware attack linked to longstanding encryption flaws in Microsoft’s default configurations. Attackers infiltrated Ascension’s network via a phishing email opened by a contractor on a company laptop using default Microsoft Edge and Bing settings. Exploiting weak encryption (RC4) and leveraging the Kerberoasting technique on Microsoft Active Directory, the ransomware group rapidly gained administrative privileges and deployed malware across the organization’s systems. This breach compromised sensitive data belonging to over 5.6 million patients, including personal, medical, payment, insurance, and government identification records, and severely disrupted business operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports