Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 33 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 385–396 / 3243 reports
Critical Vulnerabilities Expose Botslab Dashcams to Complete Remote Takeover
Critical Vulnerabilities Expose Botslab Dashcams to Complete Remote Takeover
Transportation1 month ago

Critical Vulnerabilities Expose Botslab Dashcams to Complete Remote Takeover

CISA published advisory ICSA-26-267-01 detailing 13 critical vulnerabilities in Botslab G980H dashcams affecting two firmware versions worldwide. The vulnerabilities include authentication bypass, session hijacking, predictable session identifiers, hard-coded credentials, unencrypted communications, and path traversal flaws with CVSS scores up to 8.8. Attackers with adjacent network access can gain unauthorized device control, access sensitive recordings and location data, intercept WiFi credentials, and potentially install malicious firmware. Botslab has not responded to CISA's coordination efforts, leaving users without official patches or remediation guidance. This incident highlights the growing security risks in IoT devices within transportation infrastructure, as dashcams increasingly capture sensitive location data and connect to corporate networks through fleet management systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Salt Typhoon Attack Exposes Critical Telecom Vulnerabilities, Drives Senate Cybersecurity Action
Salt Typhoon Attack Exposes Critical Telecom Vulnerabilities, Drives Senate Cybersecurity Action
Telecommunications1 month ago

Salt Typhoon Attack Exposes Critical Telecom Vulnerabilities, Drives Senate Cybersecurity Action

The Salt Typhoon campaign represents one of the most significant nation-state espionage operations against U.S. telecommunications infrastructure, attributed to Chinese threat actors who infiltrated major telecom carriers including Verizon, AT&T, and T-Mobile. Beginning in 2022 and persisting through 2024, the attackers gained deep access to telecommunications networks, intercepting communications from high-profile political figures including presidential candidates, and accessing sensitive customer data and call records. The breach exposed critical vulnerabilities in telecom infrastructure security and prompted bipartisan legislative action to establish mandatory cybersecurity standards for the telecommunications sector. This incident highlights the urgent need for Zero Trust network segmentation and encrypted communications as nation-state actors increasingly target critical infrastructure. The persistence and scope of Salt Typhoon demonstrate how traditional perimeter-based security models fail against sophisticated adversaries who can maintain long-term access to compromise sensitive communications and national security information.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical F5 BIG-IP APM Zero-Day Under Active Attack: What Organizations Need to Know
Critical F5 BIG-IP APM Zero-Day Under Active Attack: What Organizations Need to Know
Financial Services1 month ago

Critical F5 BIG-IP APM Zero-Day Under Active Attack: What Organizations Need to Know

F5 disclosed CVE-2026-94127, a critical zero-day vulnerability in BIG-IP APM (Access Policy Manager) being actively exploited for remote code execution attacks in September 2026. The flaw affects instances configured as OAuth Authorization Servers and has prompted emergency patching advisories from both F5 and CISA, which added it to the Known Exploited Vulnerabilities catalog. With over 14,700 exposed BIG-IP APM instances detected by Shadowserver, the vulnerability poses significant risks to enterprise networks and critical infrastructure. This incident underscores the escalating threat to network access management solutions as attackers increasingly target authentication and authorization infrastructure to gain privileged network access and establish persistent footholds in enterprise environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical Zero-Day in Arista VeloCloud Orchestrator Exposes SD-WAN Infrastructure Risk
Critical Zero-Day in Arista VeloCloud Orchestrator Exposes SD-WAN Infrastructure Risk
Telecommunications1 month ago

Critical Zero-Day in Arista VeloCloud Orchestrator Exposes SD-WAN Infrastructure Risk

In September 2026, Arista Networks disclosed CVE-2026-93952, a maximum-severity zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments that was being actively exploited. The flaw stems from improper input validation in certificate-based authentication, allowing remote attackers to access privileged internal VCO host functionality without requiring system privileges or user interaction. The U.S. CISA immediately added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies secure their networks within 48 hours. This incident highlights the escalating threat to SD-WAN infrastructure as organizations increasingly rely on hybrid connectivity solutions. With Arista being a Fortune 500 company serving over 10,000 customers worldwide, this zero-day demonstrates how critical network infrastructure remains a high-value target for sophisticated threat actors seeking to compromise enterprise connectivity and potentially pivot to broader network access.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
September 2026: State-Sponsored Groups Target Network Management Infrastructure
September 2026: State-Sponsored Groups Target Network Management Infrastructure
Telecommunications1 month ago

September 2026: State-Sponsored Groups Target Network Management Infrastructure

The September 2026 InfraTrust Pulse report revealed a concerning escalation in attacks targeting network infrastructure management systems, with 158 security advisories covering 1,699 vulnerabilities across 17 vendors. Attackers successfully exploited critical flaws in Cisco Secure Firewall Management Center (CVE-2026-20079), Cisco Identity Services Engine (CVE-2026-76460), and SonicWall SMA 1000 appliances before vendors could patch them. State-sponsored groups including Sandworm and ransomware gangs like Qilin chained these vulnerabilities to gain root access, deploy tunneling tools, harvest credentials, and establish persistent control over enterprise network infrastructure. This incident represents a strategic shift where threat actors are bypassing individual network devices to compromise the centralized management platforms that control entire network fabrics, amplifying their impact across organizations' critical infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Check Point Security Gateway Under Attack: Critical VPN RCE Vulnerability Exploited in the Wild
Check Point Security Gateway Under Attack: Critical VPN RCE Vulnerability Exploited in the Wild
Computer/Network Security1 month ago

Check Point Security Gateway Under Attack: Critical VPN RCE Vulnerability Exploited in the Wild

Check Point confirmed active exploitation of CVE-2026-85102, a critical pre-authentication remote code execution vulnerability in its Security Gateway VPN certificate-handling functionality, beginning September 12, 2026. Threat actors used anonymizing infrastructure including VPNs and proxies to hide their locations while exploiting the flaw. The Dutch NCSC had previously warned of imminent exploitation on September 10. A second zero-day vulnerability, CVE-2026-93616, affecting the Management web service has been exploited since July 23, allowing script execution and Java class loading. CISA added both flaws to its Known Exploited Vulnerabilities catalog with a September 25 remediation deadline. This incident highlights the persistent targeting of VPN infrastructure by sophisticated threat actors, reflecting the broader trend of exploiting network perimeter security solutions that became critical during remote work adoption and continue to serve as high-value attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
MikroTrick Vulnerability Chain Compromises MikroTik Routers Without Authentication
MikroTrick Vulnerability Chain Compromises MikroTik Routers Without Authentication
Telecommunications1 month ago

MikroTrick Vulnerability Chain Compromises MikroTik Routers Without Authentication

In September 2026, attackers exploited the MikroTrick vulnerability chain (CVE-2026-67279 and CVE-2026-86060) to gain full administrative control of internet-exposed MikroTik routers without passwords or SSH keys. The attack combined an SSH state-machine flaw that bypassed authentication with an argument-injection vulnerability in RouterOS login process. Evidence shows active exploitation began September 2, 2026, one day before patches were released, with attackers creating privileged accounts and exfiltrating configuration data from compromised devices. This incident highlights the growing threat to network infrastructure devices as nation-state actors and cybercriminals increasingly target routers and edge devices for persistent access and lateral movement capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
GitLab Email Token Flaw Enables Supply Chain Attacks Through CI/CD Pipeline Compromise
GitLab Email Token Flaw Enables Supply Chain Attacks Through CI/CD Pipeline Compromise
Computer Software/Engineering1 month ago

GitLab Email Token Flaw Enables Supply Chain Attacks Through CI/CD Pipeline Compromise

In September 2026, Aikido Security disclosed a critical vulnerability in GitLab's email-based issue creation feature that allows attackers to impersonate users and execute unauthorized code commits. The flaw stems from GitLab's private email addresses for filing issues, which contain non-expiring tokens that can be exploited by anyone who obtains them. Attackers can use these leaked addresses to commit code patches to any branch the user has access to, including main branches, and trigger CI/CD jobs that execute with the victim's permissions. The attack bypasses IP restrictions and two-factor authentication, potentially compromising entire development pipelines and supply chains. This incident highlights the growing sophistication of supply chain attacks targeting developer infrastructure and CI/CD environments. As organizations increasingly rely on automated development workflows and DevOps practices, vulnerabilities in platforms like GitLab pose significant risks to software integrity and organizational security posture.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Massive Chinese Relay Network Exposed Circumventing US AI Model Controls
Massive Chinese Relay Network Exposed Circumventing US AI Model Controls
Computer Software/Engineering1 month ago

Massive Chinese Relay Network Exposed Circumventing US AI Model Controls

In September 2026, Team Cymru researchers discovered a vast network of over 80,000 AI relay servers enabling Chinese users to access frontier AI models from US companies including OpenAI, Anthropic, Google, and xAI while masking their identities and locations. The relay infrastructure allows systematic circumvention of geographic restrictions and terms of service, with evidence suggesting large-scale model distillation attempts. Over an eight-day period, Chinese IP addresses transmitted 14TB of data through relay stations, with particularly suspicious traffic to Anthropic showing a 58:1 upload-to-download ratio consistent with AI model cloning operations. This campaign leverages open-source software packages like Claude Relay Service and sub2api, distributed through GitHub and Telegram channels with thousands of subscribers, pointing to widespread adoption of these circumvention techniques. This incident highlights the growing sophistication of AI intellectual property theft operations and the urgent need for enhanced detection capabilities as nation-state actors increasingly target frontier AI models for competitive advantage.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Gulf Cyber Crisis: UAE and Saudi Arabia Under AI-Powered Attack Siege
Gulf Cyber Crisis: UAE and Saudi Arabia Under AI-Powered Attack Siege
Financial Services1 month ago

Gulf Cyber Crisis: UAE and Saudi Arabia Under AI-Powered Attack Siege

The United Arab Emirates and Saudi Arabia absorbed 50% of all cyberattacks recorded across the Gulf region in the first half of 2026, with organizations experiencing nearly 2,700 attacks per week compared to the global average of 2,300. The attacks have shifted from highly visible DDoS and website defacements to sophisticated, targeted intrusions focusing on vulnerability exploitation (38% of initial access vectors), stealthy infiltration of critical infrastructure, and data gathering operations. These financially-motivated cybercriminals are leveraging AI tools to accelerate exploit development and target the expanded attack surfaces created by aggressive digital transformation initiatives in both nations. This incident reflects the broader evolution of cyber threats in 2026, where AI-assisted attackers are demonstrating near-autonomous capabilities that can progress faster than traditional defense mechanisms. The emergence of autonomous sandbox breakouts and AI-accelerated vulnerability discovery represents a fundamental shift in the threat landscape, forcing organizations to rethink their cybersecurity strategies beyond conventional perimeter defenses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
ShinyHunters Claims FBI Breach: Zero-Day Attack on Law Enforcement
ShinyHunters Claims FBI Breach: Zero-Day Attack on Law Enforcement
Law Enforcement1 month ago

ShinyHunters Claims FBI Breach: Zero-Day Attack on Law Enforcement

In September 2026, the ShinyHunters cybercrime group claimed to have breached the FBI's systems using a zero-day vulnerability in Oracle PeopleSoft, allegedly stealing sensitive data on current and former FBI employees and job applicants. The attackers defaced the FBI jobs website and claimed access to Criminal Justice, HR, and Medlink services. This attack was reportedly conducted in retaliation for an FBI public service announcement warning against paying the group's ransom demands following their Canvas LMS attacks in May 2026. This incident highlights the escalating boldness of cybercriminal groups directly targeting law enforcement agencies and exploiting enterprise software vulnerabilities. The targeting represents a significant shift in threat actor behavior, moving beyond traditional corporate victims to challenge government authority directly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
UTA0565 Exploits Chrome-Windows Zero-Day Chain in Sophisticated Campaign Against Asian Governments
UTA0565 Exploits Chrome-Windows Zero-Day Chain in Sophisticated Campaign Against Asian Governments
Government Administration1 month ago

UTA0565 Exploits Chrome-Windows Zero-Day Chain in Sophisticated Campaign Against Asian Governments

In September 2026, Chinese threat actor UTA0565 exploited a zero-day exploit chain targeting Google Chrome and Microsoft Windows vulnerabilities (CVE-2026-85046, CVE-2026-87491, CVE-2026-85880) to deploy CLEANGULP malware. The attackers used fake websites masquerading as legitimate media organizations and NGOs to target Asian government entities, particularly through phishing campaigns related to Hong Kong activist Chow Hang-tung. The exploit chain allowed attackers to break out of Chrome's sandbox and achieve remote code execution, demonstrating sophisticated coordinated efforts within the Chinese cyber espionage community. This incident highlights the growing sophistication of state-sponsored actors utilizing coordinated zero-day exploit chains and the increasing targeting of government entities through social engineering campaigns tied to geopolitical events.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports