Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 27 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 313–324 / 3243 reports
Anjvision Streaming Device Vulnerabilities Expose Critical Infrastructure to Remote Compromise
Anjvision Streaming Device Vulnerabilities Expose Critical Infrastructure to Remote Compromise
Computer/Network Security1 month ago

Anjvision Streaming Device Vulnerabilities Expose Critical Infrastructure to Remote Compromise

In September 2026, CISA disclosed nine critical vulnerabilities (CVE-2026-100291 through CVE-2026-100299) affecting Anjvision YSSD-RTMP-H5 streaming devices firmware version 3.3.2.4. The vulnerabilities include unauthenticated ONVIF endpoint access, OS command injection through hidden debug interfaces, lack of cryptographic verification for firmware updates, hardcoded cloud API credentials, and weak DES-based password encryption. These flaws could allow attackers to access sensitive information, execute system-level commands, or achieve full device compromise. Anjvision has not responded to CISA's mitigation requests, leaving users without vendor-provided fixes. This incident highlights the growing security crisis in IoT and ICS devices, where vendors consistently deploy products with fundamental security flaws and fail to provide timely remediation when vulnerabilities are discovered.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Baicells Nova 430H Vulnerability Exposes Cellular Networks to DoS Attacks
Critical Baicells Nova 430H Vulnerability Exposes Cellular Networks to DoS Attacks
Telecommunications1 month ago

Critical Baicells Nova 430H Vulnerability Exposes Cellular Networks to DoS Attacks

A critical vulnerability (CVE-2026-96274) was discovered in Baicells Nova 430H eNodeB equipment that allows unauthenticated attackers within radio range to cause denial-of-service conditions. The flaw stems from improper validation of uplink messages during connection setup, where malformed NAS payloads can trigger shutdowns of signaling associations between the eNodeB and core network. This results in temporary service disruptions affecting cellular connectivity until systems re-establish their connections. Baicells has not responded to CISA's mitigation requests, leaving users without vendor support for this high-severity issue. This vulnerability highlights the growing security risks in critical communications infrastructure, particularly as 5G networks expand globally and nation-state actors increasingly target telecommunications equipment for disruption and espionage campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Cisco SD-WAN Manager Vulnerability Enables Complete Network Takeover
Critical Cisco SD-WAN Manager Vulnerability Enables Complete Network Takeover
Telecommunications1 month ago

Critical Cisco SD-WAN Manager Vulnerability Enables Complete Network Takeover

In September 2026, Cisco disclosed active exploitation of CVE-2026-76504, a critical authentication bypass vulnerability in Cisco Catalyst SD-WAN Manager with a CVSS score of 9.8. The flaw allows remote attackers to use the Manager's API with administrator privileges without any credentials by exploiting URI encoding mishandling in HTTP requests. Attackers can bypass authentication rules and gain full control over SD-WAN networks, particularly targeting internet-exposed Manager instances. The vulnerability affects the core network infrastructure management system used by enterprises to control their Cisco SD-WAN deployments. This incident highlights the increasing sophistication of network infrastructure attacks and the critical importance of securing management interfaces. As organizations accelerate SD-WAN adoption for hybrid cloud connectivity, vulnerabilities in centralized management systems represent high-value targets that can compromise entire network architectures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-73570 Exploitation: Defending Against Zimbra Command Injection Attacks
CVE-2026-73570 Exploitation: Defending Against Zimbra Command Injection Attacks
Financial Services1 month ago

CVE-2026-73570 Exploitation: Defending Against Zimbra Command Injection Attacks

Microsoft Threat Intelligence identified exploitation of CVE-2026-73570, an unauthenticated OS command injection vulnerability in Zimbra Collaboration Suite's SNMP notification path. Between July 2026 and August 2026, threat actors exploited internet-facing Zimbra mail servers through crafted SMTP requests, achieving initial access without authentication. The attacks involved JSP web shell deployment, privilege escalation through PAM configuration manipulation, credential harvesting of Zimbra authentication secrets, and attempted exfiltration of mailbox data using cloud storage tools. Multiple organizations across different regions and industries were compromised, with attackers demonstrating both automated payload delivery and hands-on-keyboard operations. This incident highlights the growing trend of attackers targeting mail server infrastructure as a gateway for enterprise compromise, particularly exploiting command injection vulnerabilities in widely deployed collaboration platforms before patches are broadly applied.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Major Cybercrime Takedown: ShinyHunters Leader Arrested in International Operation
Major Cybercrime Takedown: ShinyHunters Leader Arrested in International Operation
Government Administration1 month ago

Major Cybercrime Takedown: ShinyHunters Leader Arrested in International Operation

Dutch authorities arrested 24-year-old Pepjin van der Stap in Amsterdam, identified as an alleged leader of the notorious ShinyHunters cybercrime group. The arrest occurred shortly before ShinyHunters claimed responsibility for breaching FBI systems and stealing sensitive data on federal agents. Since 2024, van der Stap and his co-conspirators allegedly compromised over 140 organizations, extracting at least $70 million in extortion payments by targeting third-party vendors and cloud platforms, then threatening to publish stolen sensitive data. The FBI stated this represents a major breakthrough in their ongoing investigation into one of the most prolific cybercrime groups currently operating, with seized evidence potentially leading to additional arrests of ShinyHunters members. This arrest highlights the escalating global law enforcement response to ransomware and extortion groups, particularly those exploiting cloud infrastructure vulnerabilities and supply chain weaknesses to maximize organizational impact.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
State Actors Exploited Citrix NetScaler Zero-Days for Three Weeks Undetected
State Actors Exploited Citrix NetScaler Zero-Days for Three Weeks Undetected
Financial Services1 month ago

State Actors Exploited Citrix NetScaler Zero-Days for Three Weeks Undetected

In September 2024, advanced persistent threat actors, suspected to be state-sponsored, exploited two critical zero-day vulnerabilities (CVE-2026-88772 and CVE-2026-88771) in Citrix NetScaler appliances for over three weeks before detection. The attacks began on September 3rd and remained undetected until late September, compromising dozens of organizations across government, financial services, education, telecom, and professional services sectors in North America and Europe. Attackers deployed novel tunneler malware, conducted internal reconnaissance, performed credential theft, and exfiltrated sensitive data through sophisticated lateral movement techniques. This incident highlights the growing trend of threat actors targeting edge devices and security appliances, which accounted for 48% of enterprise zero-day attacks in 2023. The extended dwell time and lack of endpoint detection capabilities on these devices create significant blind spots for defenders.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Iranian Cyberattacks on US Water Utilities Expose Critical Infrastructure Vulnerabilities
Iranian Cyberattacks on US Water Utilities Expose Critical Infrastructure Vulnerabilities
Utilities1 month ago

Iranian Cyberattacks on US Water Utilities Expose Critical Infrastructure Vulnerabilities

Throughout summer 2024, water utilities across the United States faced a sustained campaign of cyberattacks primarily attributed to Iranian threat actors, targeting internet-exposed operational technology (OT) systems and programmable logic controllers (PLCs). The attacks exploited aging infrastructure built for durability rather than cybersecurity, with attackers gaining initial access through exposed OT systems, vulnerable PLCs, and compromised integrator connections. The incidents prompted the Water Information Sharing and Analysis Center (WaterISAC) to accelerate threat intelligence sharing and partner with Cyware to enhance sector-wide cyber defense capabilities. These attacks underscore the growing threat to critical infrastructure as nation-state actors increasingly target industrial control systems amid escalating global tensions. The incidents highlight the vulnerability of legacy OT environments and demonstrate how threat actors are exploiting the convergence of IT and OT networks to compromise essential services.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Star Blizzard Scales Espionage Operations with RedFlick Malware Campaign
Star Blizzard Scales Espionage Operations with RedFlick Malware Campaign
Government Administration1 month ago

Star Blizzard Scales Espionage Operations with RedFlick Malware Campaign

In 2026, Russian FSB-affiliated threat group Star Blizzard significantly expanded their espionage operations, shifting from targeted spear-phishing to large-scale automated phishing campaigns using novel RedFlick malware. The group launched at least 13 distinct campaigns targeting over 100 organizations primarily in the US and UK, including Ukrainian entities, NGOs, think tanks, and government organizations supporting Ukraine. RedFlick's streamlined infection flow requires only a single user interaction and deploys the CosmicPulse backdoor through scheduled tasks to evade detection. This tactical evolution demonstrates how state-sponsored actors are adapting to increase operational scale and success rates while maintaining stealth capabilities for long-term intelligence collection against geopolitically significant targets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Apple Patches Critical CoreGraphics Zero-Day Used in Sophisticated Mobile Attacks
Apple Patches Critical CoreGraphics Zero-Day Used in Sophisticated Mobile Attacks
Computer Software/Engineering1 month ago

Apple Patches Critical CoreGraphics Zero-Day Used in Sophisticated Mobile Attacks

Apple patched a critical zero-day vulnerability (CVE-2026-86950) in CoreGraphics that was actively exploited in highly sophisticated targeted attacks against iOS users. The out-of-bounds write flaw, discovered by Meta Product Security, affected multiple Apple device generations and could lead to arbitrary code execution when processing maliciously crafted files. Apple confirmed the vulnerability was exploited in extremely sophisticated attacks against specific individuals on iOS versions prior to iOS 27, prompting immediate security updates across iOS, iPadOS, macOS, watchOS, and tvOS platforms. This incident highlights the continued evolution of nation-state and advanced persistent threat actors targeting mobile platforms with zero-day exploits, reflecting the growing sophistication of mobile device attacks and the critical need for rapid patch deployment in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Kiteworks Emergency Response: Lessons from a Federal Cybersecurity Warning
Kiteworks Emergency Response: Lessons from a Federal Cybersecurity Warning
Financial Services1 month ago

Kiteworks Emergency Response: Lessons from a Federal Cybersecurity Warning

In September 2026, Kiteworks (formerly Accellion) issued a precautionary advisory asking customers to shut down their systems after federal intelligence authorities warned of a potentially imminent cyberattack targeting a critical vulnerability in their Private Content Network platform. The company, which serves thousands of global corporations and government agencies with over 100 million end-users, quickly patched the unnamed critical flaw affecting less than 1% of customers and restored all hosted systems within 48 hours. No evidence of compromise or suspicious activity was detected during the shutdown period. This incident highlights the ongoing targeting of enterprise file-sharing platforms by cybercriminals, particularly given Kiteworks' history with the Clop ransomware gang's exploitation of their legacy FTA software in 2021, which resulted in breaches affecting hundreds of high-profile organizations including cybersecurity firms, energy companies, and government agencies.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
The DIVD AI Agent Attack: When Machines Hack Autonomously
The DIVD AI Agent Attack: When Machines Hack Autonomously
Computer/Network Security1 month ago

The DIVD AI Agent Attack: When Machines Hack Autonomously

In September 2026, the Dutch Institute for Vulnerability Disclosure (DIVD) suffered an unprecedented AI-driven cyberattack that marked a new evolution in autonomous threat capabilities. The attack began with exploitation of an undisclosed technical vulnerability, followed by deployment of an automated AI agent that conducted post-exploitation activities independently. The AI agent operated autonomously across DIVD's network, making real-time decisions at machine speed while leaving behind extensive evidence due to poor training and configuration. The attack was described as 'loud and very messy' with the agent interfering with its own operations and over-documenting its activities. This incident represents a critical inflection point as threat actors increasingly weaponize AI for autonomous network operations, demonstrating how machine-speed attacks can overwhelm traditional detection and response capabilities while creating new categories of unpredictable adversarial behavior.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
New Spectre v2 BTR Attack Exposes Critical CPU Vulnerabilities in Linux Systems
New Spectre v2 BTR Attack Exposes Critical CPU Vulnerabilities in Linux Systems
Information Technology/IT1 month ago

New Spectre v2 BTR Attack Exposes Critical CPU Vulnerabilities in Linux Systems

A new Spectre v2 attack variant called Branch Target Reuse (BTR) has been discovered by researchers at VUsec and Scuola Superiore Sant'Anna, capable of extracting Linux root password hashes from Intel processors within 3-5 minutes. The attack exploits stale information in CPU branch predictors when just-in-time (JIT) engines reuse memory for new code, allowing attackers to trick processors into executing wrong instructions and exposing sensitive data through cache traces. The vulnerability affects modern Intel, AMD, and ARM processors, with fixes already merged into the Linux kernel under CVE-2026-64507 and CVE-2026-64508. This discovery is particularly significant as it demonstrates that CPU side-channel attacks remain a persistent threat despite years of mitigation efforts, with the attack proving effective against commodity JIT engines including Firefox's SpiderMonkey and GraalVM.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports