Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 29 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 337–348 / 3243 reports
Kiteworks' Proactive Response Prevents Critical Vulnerability Exploitation in 2026
Kiteworks' Proactive Response Prevents Critical Vulnerability Exploitation in 2026
Financial Services1 month ago

Kiteworks' Proactive Response Prevents Critical Vulnerability Exploitation in 2026

In September 2026, Kiteworks (formerly Accellion) proactively shut down its systems for nine hours after receiving federal intelligence about a potential imminent cyber attack. During this precautionary shutdown, the company discovered and patched a previously unknown critical vulnerability that affected less than 1% of its customer base. Working with federal intelligence authorities, Kiteworks developed and deployed a fix while systems were offline, implementing additional protective layers across all environments. No evidence suggests the vulnerability was ever exploited maliciously, and all systems were safely restored after the threat window passed. This incident highlights the growing trend of proactive cybersecurity measures and public-private intelligence sharing in 2026, as organizations increasingly prioritize prevention over reaction in the face of sophisticated nation-state threats and coordinated attack campaigns targeting critical infrastructure providers.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
State Surveillance Exploits WhatsApp and Signal Device Linking Features
State Surveillance Exploits WhatsApp and Signal Device Linking Features
Law Enforcement1 month ago

State Surveillance Exploits WhatsApp and Signal Device Linking Features

German law enforcement has been exploiting device linking features in encrypted messaging apps WhatsApp and Signal to conduct surveillance operations. The technique involves connecting a police-controlled computer to a suspect's messaging account through either physical access to their device or intercepting verification codes via state-sanctioned phishing attacks and SMS interception. Once connected, all messages are delivered to the law enforcement device without breaking encryption, effectively bypassing the security protections these apps provide. This surveillance method has raised significant concerns about digital privacy and the potential for abuse of legitimate messaging features by state actors. This incident highlights the growing sophistication of state-sponsored surveillance techniques that exploit legitimate application features rather than traditional cryptographic attacks. As governments worldwide expand digital surveillance capabilities and encrypted communications become more prevalent, understanding these attack vectors is crucial for both individual privacy protection and organizational security planning.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk
Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk
Financial Services1 month ago

Citrix NetScaler Zero-Day Crisis: When Vendor Silence Puts Organizations at Risk

In September 2024, Citrix NetScaler appliances became targets of active zero-day exploitation involving CVE-2026-88771 and CVE-2026-88772, both rated 9.5 on the CVSS scale. Attackers exploited a command injection vulnerability affecting all NetScaler devices in default configurations, achieving remote code execution. The incident was particularly notable for Citrix's delayed disclosure, leaving customers without official warnings for over 36 hours while exploitation was actively occurring. Security professionals, insurance providers, and researchers issued unofficial warnings through back channels before Citrix finally published patches and advisories. With over 50,000 publicly exposed NetScaler instances potentially vulnerable, the incident highlighted critical gaps in vendor communication during active exploitation scenarios. This incident underscores the growing trend of attackers targeting network infrastructure appliances as initial access vectors, particularly in an era where traditional perimeter security models are increasingly inadequate. The delayed vendor response demonstrates the urgent need for organizations to implement zero-trust architectures and real-time threat detection capabilities rather than relying solely on vendor patches and advisories.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence
Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence
Financial Services1 month ago

Kiteworks Sets New Standard with Proactive System Shutdown Following Federal Threat Intelligence

In December 2024, Kiteworks, a secure file transfer provider, issued an unprecedented advisory telling customers to take production systems offline following credible threat intelligence from federal authorities about an imminent cyberattack. The company proactively shut down customer environments over the weekend while working with federal intelligence agencies and security partners including Mandiant. During the shutdown, Kiteworks discovered and patched a critical vulnerability in their Advanced Forms product affecting approximately 50 organizations, with no evidence of exploitation. The company resumed normal operations after continuous monitoring showed no malicious activity. This incident highlights the growing trend of proactive threat response and public-private intelligence sharing in cybersecurity. As supply chain attacks continue to target file transfer and collaboration platforms, the willingness of vendors to prioritize security over operational convenience signals a maturation in industry threat response practices.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action
Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action
Government Administration1 month ago

Emergency Patching: Citrix NetScaler Zero-Days Demand Immediate Action

In September 2026, CISA issued emergency directives ordering federal agencies to patch two critical Citrix NetScaler zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) by Wednesday after confirming active exploitation. The vulnerabilities allow unauthenticated remote code execution on NetScaler ADC and Gateway appliances, affecting thousands of internet-exposed instances. Threat actors were observed placing shellcode directly into memory on vulnerable systems, prompting national cybersecurity agencies to advise organizations to immediately shut down unpatched NetScaler deployments. This incident highlights the persistent targeting of network infrastructure appliances that serve as critical trust boundaries in enterprise environments. The rapid exploitation of these zero-days demonstrates the increasing sophistication of threat actors who can weaponize vulnerabilities within hours of discovery, making traditional patch cycles inadequate for defending against modern attack timelines.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Bitget Resumes Operations After $387.5M North Korean Crypto Heist
Bitget Resumes Operations After $387.5M North Korean Crypto Heist
Financial Services1 month ago

Bitget Resumes Operations After $387.5M North Korean Crypto Heist

In September 2026, cryptocurrency exchange Bitget suffered a major security breach attributed to North Korean state-sponsored hackers who stole $387.5 million from the platform's hot and warm wallets. The attackers compromised a critical backend system within Bitget's wallet infrastructure, enabling them to spoof transaction data and trigger unauthorized fund transfers across multiple blockchain networks including Ethereum, XRP Ledger, Arbitrum, Avalanche, Optimism, BSC, and Base. Bitget temporarily suspended all withdrawals as a security measure before gradually resuming services starting with Bitcoin withdrawals. This incident highlights the continuing evolution of North Korean cyber operations targeting cryptocurrency exchanges, representing part of an estimated $6 billion in crypto assets stolen since 2017. The breach demonstrates sophisticated techniques for compromising wallet infrastructure and the ongoing threat to digital asset platforms from nation-state actors seeking to circumvent international sanctions.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Citrix NetScaler Vulnerabilities Under Active Attack: What Security Teams Need to Know
Critical Citrix NetScaler Vulnerabilities Under Active Attack: What Security Teams Need to Know
Financial Services1 month ago

Critical Citrix NetScaler Vulnerabilities Under Active Attack: What Security Teams Need to Know

CISA added two critical Citrix NetScaler ADC and Gateway vulnerabilities (CVE-2026-88771 and CVE-2026-88772) to its Known Exploited Vulnerabilities catalog following reports of active global exploitation. CVE-2026-88771 (CVSS 9.5) allows unauthenticated remote code execution through improper input validation in a Perl script, while CVE-2026-88772 (CVSS 9.5) enables RCE via memory buffer operations when DTLS is enabled. Attackers are exploiting these flaws to achieve root-level access on vulnerable NetScaler appliances, potentially compromising enterprise network infrastructure and VPN gateways. This incident highlights the continued targeting of network appliances as critical attack vectors, particularly as organizations expand their hybrid cloud deployments and remote access infrastructure. The pre-authentication nature of these exploits makes them especially dangerous for threat actors seeking initial network footholds.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
JadePuffer's AI-Powered Ransomware: The Future of Automated Cloud Attacks
JadePuffer's AI-Powered Ransomware: The Future of Automated Cloud Attacks
Information Technology/IT1 month ago

JadePuffer's AI-Powered Ransomware: The Future of Automated Cloud Attacks

In June 2026, the JadePuffer ransomware operator (tracked by Microsoft as Storm-3168) conducted sophisticated AI-driven attacks against Azure cloud tenants using compromised service principals. The threat actor employed autonomous AI agents to automate the entire attack chain, including reconnaissance, credential theft, lateral movement, and destructive operations targeting over 100 storage accounts, Key Vaults, Function Apps, and Virtual Machines. The destructive phase lasted only seven minutes, with attackers systematically removing backup protections and attempting to make recovery more difficult to support potential ransomware extortion. This incident represents a critical evolution in ransomware tactics, demonstrating how threat actors are weaponizing AI agents to accelerate and scale cloud-native attacks. The emergence of agentic AI in cybercrime signals a new era of automated, intelligent threats that can operate at machine speed against cloud infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How 16,000+ Misconfigured Supabase Databases Exposed Critical Data in 2026
How 16,000+ Misconfigured Supabase Databases Exposed Critical Data in 2026
Computer Software/Engineering1 month ago

How 16,000+ Misconfigured Supabase Databases Exposed Critical Data in 2026

In September 2026, cybersecurity researchers at UpGuard discovered over 16,000 misconfigured Supabase databases exposing sensitive data including personally identifiable information, passwords, and authentication tokens. The exposures affected diverse organizations globally, from a U.S. valet service with 100,000+ customer records to a Canadian immigration service with nearly 5,000 user records including 884 plaintext passwords. Researchers attributed these widespread misconfigurations to poor application security settings, missing row-level security policies, and the increasing use of AI-assisted development tools that create databases without proper security awareness from developers. This incident highlights the growing security risks associated with AI-powered development platforms and cloud database misconfigurations. As AI-assisted coding becomes more prevalent, accounting for over 60% of new Supabase databases, the potential for systematic security oversights increases dramatically, making comprehensive cloud security posture management and zero-trust architectures more critical than ever.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Storm-3069 APT Deploys NeedyMantis for Long-Term Network Persistence
Storm-3069 APT Deploys NeedyMantis for Long-Term Network Persistence
Telecommunications1 month ago

Storm-3069 APT Deploys NeedyMantis for Long-Term Network Persistence

Microsoft identified NeedyMantis, a sophisticated malware family used by Storm-3069 (suspected China-nexus threat actor) to maintain persistent access in targeted networks since October 2025. The malware employs DLL sideloading techniques with legitimate programs like Poedit, curl, and TightVNC to establish covert command-and-control channels via HTTPS and WebSocket connections. Organizations affected include telecommunications companies, universities, medical nonprofits, intergovernmental organizations, and government contractors, with the campaign linked to the DAEMON Tools supply chain compromise discovered in May 2026. This incident highlights the growing sophistication of state-sponsored APT groups leveraging supply chain attacks and living-off-the-land techniques to achieve long-term persistence. The campaign demonstrates how threat actors are increasingly targeting critical infrastructure and sensitive sectors through legitimate software channels.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Apple's CVE-2026-86950: Critical CoreGraphics Vulnerability Exploited in Targeted Attacks
Apple's CVE-2026-86950: Critical CoreGraphics Vulnerability Exploited in Targeted Attacks
Computer Software/Engineering1 month ago

Apple's CVE-2026-86950: Critical CoreGraphics Vulnerability Exploited in Targeted Attacks

Apple disclosed CVE-2026-86950, a critical out-of-bounds write vulnerability in CoreGraphics that enables arbitrary code execution through maliciously crafted files. Meta Product Security discovered this flaw, which Apple confirmed was exploited in sophisticated targeted attacks against specific individuals running iOS versions prior to iOS 27. The vulnerability affects older versions of iOS, iPadOS, and macOS, requiring users to update to iOS 26.7.1, iPadOS 26.7.1, macOS Tahoe 26.7.1, or macOS Sequoia 15.8.1 to mitigate the risk. This incident highlights the ongoing threat of zero-day exploits being weaponized in targeted surveillance campaigns, particularly as nation-state actors and sophisticated threat groups increasingly focus on mobile device exploitation for intelligence gathering operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ShinyHunters Investigation: How Reformed Hacker's Arrest Triggered Massive FBI Breach
ShinyHunters Investigation: How Reformed Hacker's Arrest Triggered Massive FBI Breach
Government Administration1 month ago

ShinyHunters Investigation: How Reformed Hacker's Arrest Triggered Massive FBI Breach

Dutch authorities arrested Pepijn van der Stap, a 23-year-old convicted cybercriminal known as 'Umbreon,' in connection with the ShinyHunters hacking group's data theft and extortion operations. Following his arrest in September 2026, remaining ShinyHunters members escalated their attacks dramatically, compromising the FBI's job application site and stealing sensitive data from over 5,000 federal officials. The group exploited a PeopleSoft vulnerability (CVE-2026-35273) to conduct mass attacks across government, healthcare, and education sectors, generating nearly $100 million in extortion payments in 2026. This incident highlights the evolving threat landscape where cybercriminal groups rapidly adapt their operations and leadership structures when key members are compromised. The brazen targeting of federal law enforcement agencies and the group's public taunting behavior demonstrates an alarming escalation in cybercriminal boldness and operational sophistication.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports