Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 34 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 397–408 / 3243 reports
Critical Ubuntu Container Escape Flaw Highlights Need for Stronger Isolation
Critical Ubuntu Container Escape Flaw Highlights Need for Stronger Isolation
Information Technology/IT1 month ago

Critical Ubuntu Container Escape Flaw Highlights Need for Stronger Isolation

A critical use-after-free vulnerability (CVE-2026-80521) in Ubuntu Linux's AF_UNIX socket subsystem allows attackers to escape containers and gain root access on host systems. Security firm DepthFirst published exploit code targeting Ubuntu 26.04, 24.04, and 22.04 LTS releases after discovering the flaw through AI-assisted research. The vulnerability affects the kernel's garbage collector for AF_UNIX sockets, creating a race condition that bypasses namespace isolation, cgroup limits, and seccomp filtering. While the upstream Linux kernel was patched in August 2026, Ubuntu has not yet shipped fixes for any affected releases, leaving containerized workloads vulnerable to privilege escalation attacks. This incident represents a growing trend of AI-accelerated vulnerability discovery making container escapes increasingly accessible to attackers. With nearly 5,700 Linux kernel CVEs published in 2026—the highest annual total on record—organizations must reconsider treating containers as security boundaries and adopt stronger isolation mechanisms like microVMs.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Adds Four Critical Vulnerabilities to KEV Catalog Under New BOD 26-04 Requirements
CISA Adds Four Critical Vulnerabilities to KEV Catalog Under New BOD 26-04 Requirements
Government Administration1 month ago

CISA Adds Four Critical Vulnerabilities to KEV Catalog Under New BOD 26-04 Requirements

On September 22, 2026, CISA added four critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog after detecting active exploitation in the wild. The vulnerabilities span Check Point security appliances (CVE-2026-85102, CVE-2026-93616), Arista VeloCloud Orchestrator (CVE-2026-93952), and F5 BIG-IP APM systems (CVE-2026-94127), affecting certificate validation, path traversal, input validation, and buffer overflow protections. These flaws enable attackers to achieve remote code execution and gain total system control on publicly exposed enterprise infrastructure. The addition coincides with the enforcement of Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize rapid remediation of KEV-listed vulnerabilities on internet-facing assets while establishing new requirements for compromise assessments prior to patching.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Chinese APT Group UTA0565 Weaponizes Chrome and Microsoft Zero-Days in Coordinated Espionage Campaign
Chinese APT Group UTA0565 Weaponizes Chrome and Microsoft Zero-Days in Coordinated Espionage Campaign
Government Administration1 month ago

Chinese APT Group UTA0565 Weaponizes Chrome and Microsoft Zero-Days in Coordinated Espionage Campaign

In September 2024, Volexity researchers identified UTA0565, a Chinese state-aligned threat group, exploiting a triple-chain of zero-day vulnerabilities in Chrome and Microsoft Windows. The group leveraged CVE-2026-85046, CVE-2026-87491 (Chrome JavaScript engine RCE flaws), and CVE-2026-85880 (Windows ALPC privilege escalation) between September 3-4, before patches were available. UTA0565 deployed sophisticated phishing campaigns targeting Asian government entities with fake websites impersonating legitimate organizations, ultimately delivering the previously undocumented CLEANGULP malware family for espionage operations. This incident represents a concerning trend of coordinated exploit sharing within China's cyber espionage ecosystem, as multiple threat groups including APT31 have weaponized the same vulnerability chains. The sophisticated nature of these attacks and their targeting of government entities highlights the escalating capabilities and coordination among state-sponsored actors in exploiting zero-day vulnerabilities for strategic intelligence collection.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
ShinyHunters Escalates to FBI Attack: When Ransomware Groups Target Law Enforcement
ShinyHunters Escalates to FBI Attack: When Ransomware Groups Target Law Enforcement
Law Enforcement1 month ago

ShinyHunters Escalates to FBI Attack: When Ransomware Groups Target Law Enforcement

In December 2024, the notorious cybercrime group ShinyHunters claimed responsibility for attacking FBI systems, specifically targeting the FBIjobs.gov website and temporarily defacing the jobs portal. The group alleged they stole sensitive data on nearly all FBI agents and job applicants, marking a direct escalation against federal law enforcement. The attack was reportedly motivated by ShinyHunters' dispute with an FBI public service announcement that contained what they claimed were false allegations about their operations. This incident represents a significant escalation in the group's targeting strategy, moving from typical corporate victims to directly confronting law enforcement agencies. This attack highlights the growing boldness of ransomware groups in 2024, as threat actors increasingly target critical infrastructure and government entities. The incident underscores the evolving threat landscape where cybercriminals are willing to directly challenge law enforcement, potentially signaling a shift toward more brazen attacks on government systems.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Chinese Threat Actors Exploit Zyxel Switch Flaw to Steal Government Data
Chinese Threat Actors Exploit Zyxel Switch Flaw to Steal Government Data
Government Administration1 month ago

Chinese Threat Actors Exploit Zyxel Switch Flaw to Steal Government Data

In September 2026, CISA added CVE-2026-7273 to its Known Exploited Vulnerabilities catalog after Chinese-speaking threat actors exploited a stack-based buffer overflow in Zyxel GS1900 series switches. The vulnerability allows unauthenticated attackers to execute OS commands via malicious HTTP requests. GreyNoise reported that attackers successfully compromised nearly 1,000 switches across 48 countries, exfiltrating sensitive data. CISA ordered federal agencies to patch by Thursday under BOD 26-04. This incident highlights the ongoing risk to network infrastructure devices that often lack proper security monitoring and timely patching. As threat actors increasingly target edge devices for initial access and data exfiltration, organizations must prioritize vulnerability management for network equipment beyond traditional endpoints and servers.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
BigDiskBuster Zero-Day Exploit Disables Windows Defender Updates Across All Windows Versions
BigDiskBuster Zero-Day Exploit Disables Windows Defender Updates Across All Windows Versions
Computer/Network Security1 month ago

BigDiskBuster Zero-Day Exploit Disables Windows Defender Updates Across All Windows Versions

In September 2026, security researcher Abdelhamid Naceri released BigDiskBuster, a new Windows Defender zero-day exploit that blocks Microsoft antivirus updates across all supported Windows versions. This denial-of-service attack prevents Defender from receiving critical platform and signature updates when running in the background, leaving systems vulnerable to emerging threats. The exploit is part of an ongoing campaign by Naceri, a former Microsoft employee, who has released nearly a dozen zero-day exploits since April 2026 following an alleged wrongful termination dispute. This incident highlights the growing trend of insider threats and the weaponization of security research for personal grievances. As organizations increasingly rely on endpoint protection platforms, attacks that disable security updates represent a critical threat vector that can leave entire infrastructures exposed to evolving malware campaigns.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Critical D-Link Router Zero-Day Exposes Network Infrastructure to Immediate Exploitation
Critical D-Link Router Zero-Day Exposes Network Infrastructure to Immediate Exploitation
Telecommunications1 month ago

Critical D-Link Router Zero-Day Exposes Network Infrastructure to Immediate Exploitation

D-Link disclosed a critical zero-day vulnerability (CVE-2026-86296) affecting DIR-822A dual-band Wi-Fi routers in September 2026. The maximum-severity flaw stems from a stack-based buffer overflow in the DHCP server component, allowing unauthenticated attackers on the local network to send crafted DHCP packets and potentially achieve remote code execution. With public proof-of-concept exploit code available and no patch currently released, affected devices face immediate exploitation risk for botnet recruitment and DDoS attacks. This incident highlights the persistent threat landscape targeting legacy network infrastructure, particularly as threat actors increasingly weaponize published exploits to rapidly compromise unpatched devices for large-scale cybercriminal operations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
SideCopy APT Expands to Target Indian Academic Institutions with Advanced ReverseRAT Campaign
SideCopy APT Expands to Target Indian Academic Institutions with Advanced ReverseRAT Campaign
Higher Education/Acadamia1 month ago

SideCopy APT Expands to Target Indian Academic Institutions with Advanced ReverseRAT Campaign

The Pakistan-linked APT group SideCopy has expanded its targeting beyond Indian government entities to include academic institutions through sophisticated spear-phishing campaigns in 2026. The threat actors utilize weaponized ZIP archives containing malicious LNK files that abuse mshta.exe to execute obfuscated HTML applications, ultimately deploying the ReverseRAT malware for data exfiltration and remote access. The attack chain employs multi-stage obfuscation, anti-forensic self-deletion routines, and encrypted command-and-control communications to evade detection while harvesting system metadata, credentials, and sensitive documents from compromised networks. This incident highlights the evolving threat landscape where state-sponsored groups are diversifying their target profiles to include educational institutions, recognizing their value as repositories of intellectual property and research data. The sophistication of SideCopy's techniques demonstrates the growing challenge organizations face in defending against adaptive APT groups that continuously refine their tradecraft.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Check Point Zero-Day Attack: How CVE-2026-93616 Compromised Enterprise Security Infrastructure
Check Point Zero-Day Attack: How CVE-2026-93616 Compromised Enterprise Security Infrastructure
Computer/Network Security1 month ago

Check Point Zero-Day Attack: How CVE-2026-93616 Compromised Enterprise Security Infrastructure

Check Point Software released emergency hotfixes in September 2026 to address CVE-2026-93616, a critical path traversal vulnerability in Security Management Servers that allows unauthenticated attackers to upload and execute arbitrary scripts. The company confirmed active exploitation against multiple customers, with attackers leveraging the flaw to gain unauthorized access to centralized security management infrastructure that controls enterprise network policies and logs. This represents the latest in a series of Check Point zero-day exploitations targeting critical infrastructure components. This incident highlights the growing trend of threat actors targeting network security management platforms as high-value entry points into enterprise environments, reflecting an evolution toward infrastructure-level attacks that bypass traditional perimeter defenses.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ShinyHunters Targets FBI: Zero-Day PeopleSoft Attack Exposes Government Cloud Vulnerabilities
ShinyHunters Targets FBI: Zero-Day PeopleSoft Attack Exposes Government Cloud Vulnerabilities
Government Administration1 month ago

ShinyHunters Targets FBI: Zero-Day PeopleSoft Attack Exposes Government Cloud Vulnerabilities

In September 2026, the ShinyHunters extortion gang claimed to have breached FBI systems using a zero-day vulnerability in Oracle PeopleSoft, allegedly accessing FBI-managed AWS GovCloud infrastructure and stealing 2-3TB of sensitive data including employee and job applicant information. The threat actors defaced the FBI Jobs website and claimed access to Criminal Justice, HR, and Medlink services before the FBI quickly took affected systems offline. ShinyHunters stated the attack was retaliation against an FBI FLASH report published in May 2026 that detailed the group's activities and demanded corrections within one week. This incident highlights the growing trend of threat actors targeting government infrastructure through supply chain vulnerabilities and using high-profile breaches as leverage against law enforcement agencies. The exploitation of zero-day vulnerabilities in enterprise applications like PeopleSoft demonstrates the critical need for enhanced security measures in government cloud environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Chinese State-Sponsored Hackers Exploit WordPress and ZyXEL Flaws in Massive Government Data Theft Campaign
Chinese State-Sponsored Hackers Exploit WordPress and ZyXEL Flaws in Massive Government Data Theft Campaign
Government Administration1 month ago

Chinese State-Sponsored Hackers Exploit WordPress and ZyXEL Flaws in Massive Government Data Theft Campaign

A Chinese-speaking threat actor linked to the Red Heron group conducted a sophisticated multi-vector campaign from June to August 2026, exploiting critical vulnerabilities in WordPress Core (CVE-2026-63030, CVE-2026-60137) and ZyXEL GS1900 switches (CVE-2026-7273) to breach government and business organizations across 48 countries. The attackers compromised 996 devices and exfiltrated over 18,500 sensitive records containing government personnel data, law enforcement information, and plaintext credentials through advanced reconnaissance and database infiltration techniques. This incident highlights the growing sophistication of state-sponsored threat actors who leverage publicly available exploits within days of their release to target critical infrastructure and government entities. The campaign's timing coincided with increased geopolitical tensions and demonstrates how adversaries rapidly weaponize disclosed vulnerabilities to achieve strategic intelligence objectives.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
TrustSink Attack Exploits External MFA Providers to Steal Credentials
TrustSink Attack Exploits External MFA Providers to Steal Credentials
Financial Services1 month ago

TrustSink Attack Exploits External MFA Providers to Steal Credentials

Security researchers at Varonis Threat Labs discovered TrustSink, a sophisticated attack technique that allows threat actors with privileged Microsoft Entra access to register malicious external MFA providers. The attack works by intercepting legitimate login attempts and presenting users with convincing fake Microsoft password prompts, capturing credentials in plaintext while allowing authentication to complete normally. Once deployed, the rogue provider remains persistent in the authentication flow, capturing passwords even after credential resets, making it particularly dangerous for credential harvesting operations. This technique highlights the growing sophistication of identity-based attacks as organizations increasingly rely on federated authentication and external MFA providers. With threat actors continuously evolving their tactics to exploit trusted authentication mechanisms, the TrustSink attack demonstrates critical vulnerabilities in multi-factor authentication implementations.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports