Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 31 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 361–372 / 3243 reports
CISA Elevates WordPress RFI Threat: CVE-2026-87902 Joins Critical KEV Catalog
CISA Elevates WordPress RFI Threat: CVE-2026-87902 Joins Critical KEV Catalog
Computer Software/Engineering1 month ago

CISA Elevates WordPress RFI Threat: CVE-2026-87902 Joins Critical KEV Catalog

CISA has added CVE-2026-87902, a critical WordPress Core Remote File Inclusion vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. This vulnerability allows attackers to include and execute arbitrary files from remote servers, potentially leading to complete system compromise. The addition to the KEV catalog under Binding Operational Directive (BOD) 26-04 requires federal agencies to prioritize rapid remediation of this high-risk vulnerability on publicly exposed assets, as successful exploitation can grant threat actors total control of affected WordPress installations. This incident highlights the continuing evolution of web application attack vectors and the critical importance of timely patch management in an era where WordPress powers over 40% of all websites globally, making such vulnerabilities attractive targets for cybercriminals seeking large-scale compromise opportunities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Cameron Wagenius Sentenced for Multi-Year AT&T and Snowflake Attack Campaign
Cameron Wagenius Sentenced for Multi-Year AT&T and Snowflake Attack Campaign
Telecommunications1 month ago

Cameron Wagenius Sentenced for Multi-Year AT&T and Snowflake Attack Campaign

Former Army soldier Cameron John Wagenius was sentenced to 70 months in prison for orchestrating a multi-year cybercrime campaign targeting major companies including AT&T, Ticketmaster, and Santander. Operating under aliases 'kiberphant0m' and 'cyb3rph4nt0m,' Wagenius collaborated with Connor Moucka to compromise over 165 Snowflake customer environments, stealing billions of records and attempting to extort over $1 million from victims. The breach exposed call detail records of high-profile government officials and resulted in the theft of nearly all AT&T customer phone and text records spanning six months. This case highlights the growing threat of insider compromise and the vulnerability of cloud infrastructure, particularly as organizations increasingly rely on third-party cloud platforms for sensitive data storage. The incident underscores the critical need for enhanced access controls, comprehensive monitoring, and zero-trust security architectures to prevent credential-based attacks and lateral movement.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Four Critical Enterprise Vulnerabilities Added to CISA's Must-Patch List
Four Critical Enterprise Vulnerabilities Added to CISA's Must-Patch List
Banking/Mortgage1 month ago

Four Critical Enterprise Vulnerabilities Added to CISA's Must-Patch List

In September 2026, CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The most severe include CVE-2026-5430, a critical authentication bypass in WSO2 API Manager affecting nearly 1,000 customers across banking, government, and telecommunications sectors, and CVE-2026-71362, a critical authorization flaw in Adobe Commerce allowing account hijacking without authentication. Additional vulnerabilities include a code injection flaw in Microsoft SharePoint (CVE-2026-65660) and an SSH bypass in Mikrotik RouterOS (CVE-2026-67279). Federal agencies received 48-72 hour remediation deadlines, with attackers demonstrating sophisticated JWT token forgery techniques and targeting high-value enterprise infrastructure. This incident highlights the accelerating pace of vulnerability exploitation in 2026, with threat actors increasingly targeting enterprise software platforms that serve as central authentication and API management hubs. The exploitation of WSO2 and Adobe Commerce reflects a strategic shift toward compromising platforms that provide access to multiple downstream systems and customer data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Kiteworks Zero-Day Threat: When Proactive Security Meets Federal Intelligence
Kiteworks Zero-Day Threat: When Proactive Security Meets Federal Intelligence
Financial Services1 month ago

Kiteworks Zero-Day Threat: When Proactive Security Meets Federal Intelligence

In September 2026, Kiteworks, a secure file-sharing platform used by government organizations and enterprises, issued an unprecedented global shutdown advisory after receiving credible threat intelligence from federal law enforcement. The company urged all customers worldwide to shut down their servers for a six-hour window to protect against potential zero-day attacks targeting their systems. While no actual breach was confirmed, the proactive measure highlighted the sophisticated threat landscape facing secure file transfer platforms that handle sensitive documents. The incident underscores the increasing sophistication of threat actors targeting enterprise file-sharing platforms, particularly following successful campaigns by groups like Clop ransomware gang against similar services. This preemptive approach represents a new paradigm in incident response, where organizations act on intelligence rather than waiting for active exploitation, reflecting the evolving threat landscape where secure file platforms have become high-value targets for data theft extortion operations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
How Threat Intelligence Stops Ransomware Before Encryption Begins
How Threat Intelligence Stops Ransomware Before Encryption Begins
Financial Services1 month ago

How Threat Intelligence Stops Ransomware Before Encryption Begins

Modern ransomware operations have evolved beyond simple file encryption to sophisticated multi-stage attacks utilizing Ransomware-as-a-Service (RaaS) models and double or triple extortion tactics. These attacks typically begin with initial access brokers selling compromised credentials, followed by lateral movement through networks before reaching the final encryption stage. The shift toward proactive threat intelligence enables security teams to identify warning signs earlier in the attack lifecycle, including exposed credentials in criminal marketplaces, malicious command-and-control infrastructure, and known attacker behavioral patterns. This intelligence-driven approach allows defenders to disrupt attacks during initial access and C2 phases rather than relying solely on post-encryption recovery measures. This approach is increasingly critical as ransomware groups continuously adapt their tactics, techniques, and procedures (TTPs) while leveraging initial access brokers and sophisticated infrastructure to target specific industries and geographies, making traditional reactive defenses insufficient against evolving threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Russia Escalates Hybrid Cyber-Physical War Against European NATO Members
Russia Escalates Hybrid Cyber-Physical War Against European NATO Members
Utilities1 month ago

Russia Escalates Hybrid Cyber-Physical War Against European NATO Members

Russia has intensified its hybrid warfare campaign across Europe throughout 2026, targeting NATO members and Ukraine supporters through coordinated cyber sabotage, disinformation operations, and physical drone attacks. The campaign has specifically targeted critical infrastructure including water and wastewater systems in Norway and Poland, energy infrastructure, and offshore gas projects in the Black Sea. Russian operations have employed AI-generated content through the CopyCop disinformation network, territorial violations using drones near NATO borders, and cyberattacks against Internet-facing firewalls and VPN infrastructure. The attacks have successfully disrupted services and tested NATO response protocols while maintaining plausible deniability below the threshold of kinetic warfare. This escalation represents a critical shift in modern warfare tactics as state actors increasingly blend cyber operations with physical sabotage to achieve strategic objectives. Intelligence assessments indicate Russia may coalesce these tactics into a full-scale New Generation Warfare campaign over the next two years, particularly following the 2028 US Presidential elections.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CISA Elevates Two Critical Vulnerabilities to KEV Catalog Amid Active Exploitation
CISA Elevates Two Critical Vulnerabilities to KEV Catalog Amid Active Exploitation
Computer Software/Engineering1 month ago

CISA Elevates Two Critical Vulnerabilities to KEV Catalog Amid Active Exploitation

CISA has added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. CVE-2026-5430 affects WSO2 multiple products through a path traversal vulnerability, while CVE-2026-71362 impacts Adobe Commerce and Magento through an incorrect authorization flaw. Both vulnerabilities allow attackers to gain unauthorized access to sensitive systems and data. Under Binding Operational Directive (BOD) 26-04, federal agencies must prioritize rapid remediation of these high-risk vulnerabilities on publicly exposed assets that grant total control post-exploitation. This development reflects the ongoing escalation in vulnerability exploitation tactics, with threat actors increasingly targeting enterprise software platforms and e-commerce systems. The addition reinforces the critical need for organizations to implement risk-based vulnerability management approaches beyond federal requirements.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical WSO2 and Adobe Commerce Vulnerabilities Under Active Attack Added to CISA KEV
Critical WSO2 and Adobe Commerce Vulnerabilities Under Active Attack Added to CISA KEV
E-Learning1 month ago

Critical WSO2 and Adobe Commerce Vulnerabilities Under Active Attack Added to CISA KEV

CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog in September 2026: CVE-2026-5430 affecting WSO2 products and CVE-2026-71362 impacting Adobe Commerce and Magento. CVE-2026-5430 is a path traversal flaw allowing unrestricted file upload and remote code execution, while CVE-2026-71362 enables unauthorized account access through session switching. Security researchers observed active exploitation attempts against honeypots starting September 13, 2026, with attackers using forged JWT tokens and targeting customer account takeovers. Federal agencies must patch by September 27, 2026. These incidents highlight the accelerating timeline between vulnerability disclosure and active exploitation, with attackers moving within days rather than weeks to weaponize critical flaws against high-value enterprise platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Active Exploitation of Roundcube SQL Injection Flaw Threatens Email Security
Active Exploitation of Roundcube SQL Injection Flaw Threatens Email Security
Government Administration1 month ago

Active Exploitation of Roundcube SQL Injection Flaw Threatens Email Security

CVE-2026-48842, a critical pre-authentication SQL injection vulnerability in Roundcube Webmail, is being actively exploited in the wild according to the Canadian Centre for Cyber Security. The flaw affects versions 1.6.x before 1.6.16 and 1.7.x before 1.7.1, allowing unauthenticated attackers to inject arbitrary SQL statements through the virtuser_query plugin via a preg_replace() backslash escape bypass. Despite patches released in May 2026, threat actors continue targeting the over 523,000 Roundcube instances exposed to the internet, potentially accessing mail account credentials and stored messages. This incident highlights the persistent targeting of email infrastructure by threat actors, particularly following previous Roundcube exploits by China-aligned groups like UNK_MassTraction and the addition of other Roundcube vulnerabilities to CISA's Known Exploited Vulnerabilities catalog in early 2026.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CISA Flags SharePoint and RouterOS Vulnerabilities for Active Exploitation
CISA Flags SharePoint and RouterOS Vulnerabilities for Active Exploitation
Government Administration1 month ago

CISA Flags SharePoint and RouterOS Vulnerabilities for Active Exploitation

CISA added two actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog on September 25, 2026: CVE-2026-65660 affecting Microsoft SharePoint (code injection) and CVE-2026-67279 impacting Mikrotik RouterOS (behavioral workflow enforcement flaw). These vulnerabilities are being actively exploited by threat actors and pose significant risks to federal enterprises and organizations worldwide. The addition reinforces CISA's Binding Operational Directive (BOD) 26-04, which requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities on publicly exposed assets. This incident highlights the ongoing challenge of vulnerability management in an era where threat actors rapidly weaponize newly disclosed flaws. With SharePoint being a critical collaboration platform and RouterOS powering networking infrastructure globally, these vulnerabilities represent prime targets for initial access, lateral movement, and potential ransomware deployment campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Storm-2570: The Cross-Ecosystem Ransomware Affiliate Changing the Game
Storm-2570: The Cross-Ecosystem Ransomware Affiliate Changing the Game
Health Care / Life Sciences1 month ago

Storm-2570: The Cross-Ecosystem Ransomware Affiliate Changing the Game

Storm-2570, a cross-ecosystem ransomware affiliate tracked by Microsoft since April 2025, has demonstrated consistent attack patterns across multiple ransomware-as-a-service (RaaS) operations including Qilin, DragonForce, Anubis, and BERT. The threat actor has targeted organizations across 14 sectors in the United States, Canada, United Kingdom, Spain, Netherlands, and Puerto Rico, maintaining uniform tradecraft involving remote management tools like MeshAgent, credential harvesting utilities, and cloud exfiltration tools such as s5cmd and Rclone regardless of the final ransomware payload deployed. This case highlights the growing trend of ransomware affiliates operating independently across multiple RaaS ecosystems, shifting between operations to maximize payout opportunities. The consistent use of commodity tools and techniques across different ransomware families demonstrates how threat actors are becoming more adaptable and sophisticated in their approach to enterprise compromise.

Critical impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Analysis: SolarWinds ARM CVE-2026-28326 Exposes Enterprise Identity Infrastructure
Critical Analysis: SolarWinds ARM CVE-2026-28326 Exposes Enterprise Identity Infrastructure
Financial Services1 month ago

Critical Analysis: SolarWinds ARM CVE-2026-28326 Exposes Enterprise Identity Infrastructure

CVE-2026-28326 is a critical unauthenticated remote code execution vulnerability in SolarWinds Access Rights Manager (ARM) that allows attackers to gain NT AUTHORITY\SYSTEM privileges. The flaw stems from a hardcoded authentication key shipped with every installation, enabling attackers who can reach TCP port 55555 to bypass authentication and exploit .NET deserialization vulnerabilities. Given ARM's role in managing identity governance across Active Directory, file servers, and Exchange systems, successful exploitation provides attackers with extensive access to organizational assets. SolarWinds fixed the vulnerability in version 2026.2.1.7 by removing the vulnerable authentication fallback entirely. This incident highlights the growing threat to identity governance platforms, which have become high-value targets due to their privileged access across enterprise environments. As organizations increasingly adopt zero-trust architectures, securing identity management infrastructure becomes critical to preventing supply chain compromises.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports