Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 30 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 349–360 / 3243 reports
CISA Issues KEV Alert for Actively Exploited Citrix NetScaler Vulnerabilities
CISA Issues KEV Alert for Actively Exploited Citrix NetScaler Vulnerabilities
Government Administration1 month ago

CISA Issues KEV Alert for Actively Exploited Citrix NetScaler Vulnerabilities

CISA has added two critical Citrix NetScaler vulnerabilities (CVE-2026-88771 and CVE-2026-88772) to its Known Exploited Vulnerabilities (KEV) Catalog on September 27, 2026, based on evidence of active exploitation in the wild. The vulnerabilities involve improper input validation and memory buffer restrictions, making them attractive targets for threat actors seeking to compromise network infrastructure. These flaws pose significant risks to federal enterprises and organizations worldwide, as NetScaler appliances are commonly deployed as critical network gateways and load balancers. The addition reinforces CISA's Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize rapid remediation of high-risk vulnerabilities that grant total system control post-exploitation. This incident highlights the ongoing threat landscape where network appliances remain prime targets for initial access and persistent compromise, particularly as organizations expand their hybrid cloud infrastructures and remote access capabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Citrix NetScaler Zero-Days Under Active Attack: CVE-2026-88771 & CVE-2026-88772
Critical Citrix NetScaler Zero-Days Under Active Attack: CVE-2026-88771 & CVE-2026-88772
Financial Services1 month ago

Critical Citrix NetScaler Zero-Days Under Active Attack: CVE-2026-88771 & CVE-2026-88772

CISA has confirmed active exploitation of critical zero-day vulnerabilities CVE-2026-88771 and CVE-2026-88772 affecting Citrix NetScaler ADC and Gateway products worldwide. These vulnerabilities enable remote code execution and have been added to CISA's Known Exploited Vulnerabilities catalog. Threat actors are leveraging these flaws to gain unauthorized access to enterprise networks, potentially compromising sensitive data and critical infrastructure. The vulnerabilities affect widely deployed network appliances that serve as critical entry points for remote access and application delivery. This incident underscores the growing threat landscape targeting network infrastructure components, as attackers increasingly focus on exploiting zero-day vulnerabilities in perimeter security devices to establish persistent footholds in enterprise environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
NeedyMantis Malware: How Advanced APT Groups Are Evolving Post-Compromise Persistence
NeedyMantis Malware: How Advanced APT Groups Are Evolving Post-Compromise Persistence
Telecommunications1 month ago

NeedyMantis Malware: How Advanced APT Groups Are Evolving Post-Compromise Persistence

Microsoft Threat Intelligence discovered NeedyMantis, a sophisticated modular malware family used in targeted operations against telecommunications organizations, universities, medical nonprofits, and government contractors since October 2025. The malware, deployed by China-linked threat actor Storm-3069 and potentially others, employs advanced evasion techniques including custom encrypted archives, multiple loaders, and DLL sideloading to maintain persistent access in victim environments. NeedyMantis represents a concerning evolution in post-compromise tooling, combining multiple layers of obfuscation with modular architecture that enables operators to extend functionality and evade detection across diverse target environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical NetScaler Zero-Days CVE-2026-88771 & CVE-2026-88772: Mass Exploitation Targeting Network Infrastructure
Critical NetScaler Zero-Days CVE-2026-88771 & CVE-2026-88772: Mass Exploitation Targeting Network Infrastructure
Financial Services1 month ago

Critical NetScaler Zero-Days CVE-2026-88771 & CVE-2026-88772: Mass Exploitation Targeting Network Infrastructure

In September 2026, Citrix disclosed that two critical zero-day vulnerabilities in NetScaler ADC and Gateway systems, CVE-2026-88771 and CVE-2026-88772, were being actively exploited in the wild. CVE-2026-88771 is a remote code execution vulnerability allowing unauthenticated attackers to run commands against NetScaler systems, while CVE-2026-88772 is a memory overflow vulnerability affecting DTLS configurations. Both vulnerabilities carry a CVSS v4.0 score of 9.5, with Palo Alto Networks identifying over 50,000 potentially vulnerable exposed instances globally. The exploitation demonstrates attackers' continued focus on critical infrastructure components that serve as gateways to enterprise networks. This incident highlights the accelerating pace of zero-day exploitation against network infrastructure, particularly as organizations increasingly rely on application delivery controllers and secure gateways for hybrid cloud connectivity and remote access.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
RSA Signature Forgery Attack Resurfaces: What Organizations Need to Know
RSA Signature Forgery Attack Resurfaces: What Organizations Need to Know
Banking/Mortgage1 month ago

RSA Signature Forgery Attack Resurfaces: What Organizations Need to Know

A revived cryptographic attack against RSA digital signatures has gained attention in 2026, demonstrating the ability to forge signatures without factoring the underlying keys. Originally researched in 2007, this subexponential-time attack specifically targets pure RSA signatures without padding or formatting. Researchers successfully forged messages for 1024-bit RSA using 1380 CPU core-years over five months, highlighting vulnerabilities in legacy implementations. The attack exploits mathematical properties of RSA to create valid signatures for arbitrary messages without recovering private keys, though it only affects unpadded signature schemes rarely used in modern production systems. This attack resurfaces amid growing concerns about cryptographic resilience as quantum computing advances and organizations evaluate their long-term security postures, making legacy RSA implementations a critical assessment priority.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
ShinyHunters Escalates to Personal War Against FBI in Unprecedented 2024 Breach
ShinyHunters Escalates to Personal War Against FBI in Unprecedented 2024 Breach
Law Enforcement1 month ago

ShinyHunters Escalates to Personal War Against FBI in Unprecedented 2024 Breach

In late 2024, the ShinyHunters cybercrime group breached the FBI's jobs website and claimed to have stolen sensitive data on nearly every FBI agent and job applicants. The stolen data reportedly includes agents' personal contact information, family member details, duty assignments, and personnel specialties. Unlike their typical financially-motivated attacks, ShinyHunters targeted the FBI to dispute claims in an agency public service announcement about their operations, demanding the FBI retract or amend the report by a specified deadline. The breach exposed critical counterintelligence risks and put FBI personnel and their families at serious physical safety risk, as the data could serve as a roadmap for hostile actors, cartels, and other threats to locate and target specific agents. This incident represents a dangerous escalation from traditional cybercrime to personal retaliation against law enforcement, highlighting the evolving threat landscape where cybercriminals increasingly target government agencies for ideological rather than purely financial motives.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Critical Citrix NetScaler Zero-Days Exploited: CVE-2026-88771 & CVE-2026-88772 Analysis
Critical Citrix NetScaler Zero-Days Exploited: CVE-2026-88771 & CVE-2026-88772 Analysis
Financial Services1 month ago

Critical Citrix NetScaler Zero-Days Exploited: CVE-2026-88771 & CVE-2026-88772 Analysis

In September 2026, Citrix confirmed that two critical NetScaler remote code execution zero-day vulnerabilities (CVE-2026-88771 and CVE-2026-88772) were being actively exploited in attacks. Both vulnerabilities carry a severity score of 9.5, with CVE-2026-88771 affecting all NetScaler ADC and Gateway deployments through improper input validation, and CVE-2026-88772 exploiting memory overflow when DTLS is enabled. The attacks prompted emergency warnings from national cybersecurity agencies and IT suppliers, with organizations advised to immediately shut down NetScaler appliances before patches became available. These edge devices are particularly valuable targets as they provide attackers initial network perimeter access without first compromising internal endpoints. This incident highlights the continuing evolution of zero-day exploitation targeting critical infrastructure components, particularly as threat actors increasingly focus on edge appliances and VPN gateways. The coordinated response from multiple national CERTs and the invocation of the EU Cyber Resilience Act demonstrates the growing regulatory and security community emphasis on rapid threat intelligence sharing.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Citrix NetScaler Zero-Days Leave Enterprise Networks Exposed
Critical Citrix NetScaler Zero-Days Leave Enterprise Networks Exposed
Financial Services1 month ago

Critical Citrix NetScaler Zero-Days Leave Enterprise Networks Exposed

In September 2026, two unpatched zero-day vulnerabilities enabling remote code execution were discovered being actively exploited against Citrix NetScaler ADC and Gateway appliances. Security firm watchTowr reported the flaws based on forensic investigations, with no official patches available from Citrix at the time of disclosure. The vulnerabilities affect critical edge infrastructure handling VPN access, load balancing, and authentication for enterprise networks. Multiple organizations reportedly took their NetScaler appliances offline as a precautionary measure while awaiting vendor fixes and guidance. This incident underscores the growing trend of attackers targeting network edge appliances as high-value entry points into enterprise environments, particularly as organizations expand their hybrid cloud architectures and remote access capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Inside the Kiberphant0m Breach: How a U.S. Soldier Exploited Cloud Vulnerabilities to Steal 100M+ Telecom Records
Inside the Kiberphant0m Breach: How a U.S. Soldier Exploited Cloud Vulnerabilities to Steal 100M+ Telecom Records
Telecommunications1 month ago

Inside the Kiberphant0m Breach: How a U.S. Soldier Exploited Cloud Vulnerabilities to Steal 100M+ Telecom Records

U.S. Army soldier Cameron John Wagenius, operating under the cybercriminal alias "Kiberphant0m," exploited Snowflake cloud storage vulnerabilities to steal call and text metadata for over 100 million AT&T customers in 2024. Working with co-conspirators from a military base in South Korea, Wagenius targeted telecommunications companies worldwide including AT&T and Verizon, using exposed credentials and lack of multi-factor authentication to access sensitive data. The group extorted victims for Bitcoin payments, with AT&T reportedly paying $370,000 in ransom, before Wagenius was sentenced to 70 months in federal prison and ordered to pay nearly $300,000 in restitution. This incident highlights the growing threat of insider attacks and the critical importance of cloud security controls, as organizations increasingly face sophisticated extortion schemes targeting cloud-stored telecommunications metadata and customer information.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Kiteworks Takes Unprecedented Precautionary Shutdown Following Federal Threat Intelligence
Kiteworks Takes Unprecedented Precautionary Shutdown Following Federal Threat Intelligence
Financial Services1 month ago

Kiteworks Takes Unprecedented Precautionary Shutdown Following Federal Threat Intelligence

In September 2026, Kiteworks (formerly Accellion) took the unprecedented step of urging customers to shut down their systems for nine hours as a precautionary measure after receiving credible threat intelligence from federal authorities about an imminent cyber attack. The company emphasized that no evidence of compromise was found and that all known vulnerabilities had been addressed in software release 9.5.1. This proactive response demonstrates how threat intelligence sharing between government agencies and private sector entities can enable preventive security measures. This incident highlights the growing sophistication of threat actor reconnaissance and the critical importance of proactive threat intelligence in modern cybersecurity defense strategies, particularly given the increasing frequency of supply chain and managed service provider attacks targeting multiple organizations simultaneously.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical SharePoint RCE and MikroTik RouterOS Vulnerabilities Under Active Attack
Critical SharePoint RCE and MikroTik RouterOS Vulnerabilities Under Active Attack
Government Administration1 month ago

Critical SharePoint RCE and MikroTik RouterOS Vulnerabilities Under Active Attack

In September 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog following evidence of active exploitation in the wild. CVE-2026-65660, a remote code execution flaw in Microsoft SharePoint Server initially misclassified as a spoofing vulnerability, allows authenticated attackers to execute arbitrary code over the network. Simultaneously, CVE-2026-67279 affecting MikroTik RouterOS was chained with CVE-2026-86060 in an exploit dubbed 'MikroTrick' to achieve complete administrative takeover of internet-exposed routers without authentication. Microsoft confirmed reliable evidence of attacks against SharePoint but has not disclosed attribution, scope, or impact details. These incidents highlight the growing sophistication of threat actors exploiting trust boundary failures and authentication bypass vulnerabilities to gain initial access to critical infrastructure components.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
ShinyHunters Exploits Oracle PeopleSoft Flaw with Advanced WAF Bypass Technique
ShinyHunters Exploits Oracle PeopleSoft Flaw with Advanced WAF Bypass Technique
Higher Education/Acadamia1 month ago

ShinyHunters Exploits Oracle PeopleSoft Flaw with Advanced WAF Bypass Technique

The ShinyHunters-affiliated threat group UNC6240 launched a renewed mass exploitation campaign in September 2026, targeting Oracle PeopleSoft systems globally across education, healthcare, government, and technology sectors. The attackers weaponized CVE-2026-35273, a critical remote code execution vulnerability, by developing a WAF bypass technique using URL-encoded characters to evade security controls. The campaign deployed web shells on dozens of systems, established persistent access through legitimate RMM tools like MeshAgent, and deployed the SIDEEYE backdoor for credential theft and data exfiltration, ultimately leading to ransomware deployment and data extortion threats. This incident highlights the evolving sophistication of ransomware groups in bypassing modern security architectures, particularly the limitations of signature-based WAF protection against adaptive threat actors who can rapidly modify exploits to evade detection rules.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports