Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 37 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 433–444 / 3243 reports
Critical Bransys ELD Vulnerabilities Expose Transportation Fleet Data Through Hardcoded Credentials
Critical Bransys ELD Vulnerabilities Expose Transportation Fleet Data Through Hardcoded Credentials
Transportation1 month ago

Critical Bransys ELD Vulnerabilities Expose Transportation Fleet Data Through Hardcoded Credentials

In September 2026, CISA disclosed critical vulnerabilities in Bransys Electronic Logging Device (ELD) systems affecting both Android and iOS versions. The vulnerabilities included hardcoded MQTT and FTP credentials (CVE-2026-86520, CVE-2026-77960) and cleartext transmission of sensitive information (CVE-2026-86689). These flaws could allow unauthorized attackers to access real-time telemetry data from active devices across multiple transportation carriers, potentially compromising driver location data, vehicle diagnostics, and compliance records. The vendor has released patches requiring users to update to Android version 11.00.00 or iOS version 1.1.54. This incident highlights the growing security risks in critical transportation infrastructure as IoT devices become more interconnected. With increasing regulatory scrutiny on supply chain security and the recent focus on transportation system vulnerabilities following nation-state attacks on critical infrastructure, organizations must prioritize secure development practices and regular security assessments of embedded systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
September 2026: When AI Became Both Weapon and Target in Massive Multi-Vector Campaign
September 2026: When AI Became Both Weapon and Target in Massive Multi-Vector Campaign
Financial Services1 month ago

September 2026: When AI Became Both Weapon and Target in Massive Multi-Vector Campaign

September 2026 witnessed an unprecedented surge in multi-vector cyberattacks, with threat actors exploiting everything from AI agent vulnerabilities to traditional infrastructure weaknesses. Notable incidents included the CL-CRI-1171 pay-per-install operation distributing malware through YouTube channels, large-scale attacks on exposed LocalAI instances compromising 230 systems including Thai military infrastructure, and the emergence of AI agents capable of rewriting their own models mid-task. Additional threats ranged from insider SIM swap operations netting $600,000 in losses to new ransomware families like Settra claiming 70 victims globally. The campaign demonstrates how attackers are successfully combining traditional attack vectors with emerging AI-powered techniques to maximize impact across diverse targets. This surge reflects the growing sophistication of cybercriminal ecosystems that are rapidly adapting to exploit both legacy vulnerabilities and cutting-edge AI technologies, creating a perfect storm of traditional and next-generation threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Vulnerabilities Expose Schneider Electric NetBotz Environmental Monitors to Attack
Critical Vulnerabilities Expose Schneider Electric NetBotz Environmental Monitors to Attack
Utilities1 month ago

Critical Vulnerabilities Expose Schneider Electric NetBotz Environmental Monitors to Attack

Schneider Electric disclosed multiple critical vulnerabilities in its NetBotz 5-750/755 environmental monitoring devices affecting versions 5.5.2 and prior. The vulnerabilities include CVE-2026-13336, an OS command injection flaw that could allow arbitrary Linux command execution through maliciously modified system backups, and CVE-2026-13337, a Hibernate SQL injection vulnerability enabling malicious HQL query injection via web interfaces. These devices monitor critical infrastructure environments including temperature, humidity, and security systems across commercial facilities and manufacturing sectors worldwide. The vulnerabilities pose significant risks of device manipulation, unauthorized data access, and potential compromise of critical infrastructure monitoring capabilities. Schneider Electric has released version 5.6.0 as a remediation, requiring system restart for proper installation. The company emphasizes the importance of network segmentation and access controls to mitigate exploitation risks in industrial control environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Check Point Management Flaw: CVE-2026-91843 Enables Root Access Without Authentication
Critical Check Point Management Flaw: CVE-2026-91843 Enables Root Access Without Authentication
Banking/Mortgage1 month ago

Critical Check Point Management Flaw: CVE-2026-91843 Enables Root Access Without Authentication

In September 2026, Check Point disclosed CVE-2026-91843, a critical stack overflow vulnerability in Security Management and Log Servers that allows unauthenticated attackers to execute code as root remotely. The flaw, rated 9.8 on the CVSS scale, affects the login process before authentication and is triggered by overly long usernames in login requests. Check Point released a LivePatch fix and reported no evidence of active exploitation, though the vulnerability affects multiple product versions across R82.10, R82, R81.20, R81.10, and older end-of-support branches. This represents the fifth critical management server vulnerability disclosed by Check Point since July 2026. This incident highlights the accelerating trend of critical infrastructure vulnerabilities targeting network security management platforms, coinciding with increased regulatory scrutiny and the urgent need for organizations to secure their security infrastructure itself as attackers increasingly target the tools meant to protect enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
RatHat Android Malware: AI-Powered Threat Achieves Persistent Shell Access
RatHat Android Malware: AI-Powered Threat Achieves Persistent Shell Access
Banking/Mortgage1 month ago

RatHat Android Malware: AI-Powered Threat Achieves Persistent Shell Access

In September 2026, cybersecurity researchers identified RatHat, a sophisticated Android malware operated by China-based threat actors that leverages artificial intelligence for device navigation and control. The malware spreads through smishing campaigns and malvertising, using multiple anti-analysis techniques to evade detection. Once installed, RatHat abuses Android's Accessibility services to enable ADB debugging, allowing attackers to maintain shell-level access even after the malicious app is uninstalled. The malware features overlay attacks for credential theft, screen recording, SMS interception, and communicates with generative AI systems to automate device interactions and navigation. This incident highlights the evolving sophistication of mobile threats, particularly the integration of AI-powered automation in malware operations and the abuse of legitimate Android debugging features for persistent access. As mobile devices become primary targets for state-sponsored actors, organizations face increased risks from advanced persistent threats that can maintain access beyond traditional app-based security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Vulnerabilities Disclosed in Hitachi Energy Power Grid Control Systems
Critical Vulnerabilities Disclosed in Hitachi Energy Power Grid Control Systems
Oil/Energy/Solar/Greentech1 month ago

Critical Vulnerabilities Disclosed in Hitachi Energy Power Grid Control Systems

CISA published advisory ICSA-26-260-03 disclosing critical vulnerabilities in Hitachi Energy's FACTS Control Platform (FCP) affecting multiple versions from 3.4.0 to 4.1.1 when deployed with the GWS component. The vulnerabilities include SQL injection (CVE-2024-4872), path traversal (CVE-2024-3980), session hijacking (CVE-2024-3982), missing authentication (CVE-2024-7940), and open redirect (CVE-2024-7941) with CVSS scores ranging from 4.3 to 9.9. These flaws could allow authenticated attackers to execute code injection, access critical system files, hijack sessions, and redirect users to malicious sites, potentially compromising the confidentiality, integrity, and availability of critical power grid infrastructure. This disclosure highlights the growing cybersecurity challenges facing operational technology in the energy sector, particularly as industrial control systems become increasingly connected and targeted by sophisticated threat actors seeking to disrupt critical infrastructure operations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical Linux Kernel Vulnerabilities Added to CISA KEV Catalog
Critical Linux Kernel Vulnerabilities Added to CISA KEV Catalog
Government Administration1 month ago

Critical Linux Kernel Vulnerabilities Added to CISA KEV Catalog

CISA has added two critical Linux kernel vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog in September 2026, following evidence of active exploitation in the wild. CVE-2025-39964, a race condition vulnerability, and CVE-2026-53266, an out-of-bounds write vulnerability, both target the Linux kernel and can grant attackers total system control post-exploitation. These additions reinforce the agency's Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize rapid remediation of high-risk vulnerabilities on publicly exposed assets that could lead to complete system compromise. The identification of these actively exploited kernel vulnerabilities highlights the ongoing evolution of threat actor tactics targeting foundational infrastructure components. As organizations increasingly adopt cloud-native and hybrid architectures, kernel-level vulnerabilities represent critical attack surfaces that can bypass traditional security controls and enable privilege escalation across entire computing environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
APT36 Evolves Tactics with Rust Malware and GitHub Infrastructure in Operation RapidRust
APT36 Evolves Tactics with Rust Malware and GitHub Infrastructure in Operation RapidRust
Government Administration1 month ago

APT36 Evolves Tactics with Rust Malware and GitHub Infrastructure in Operation RapidRust

In September 2026, the Pakistan-aligned threat group Transparent Tribe (APT36) launched Operation RapidRust, targeting government and defense entities in India and Afghanistan with four new malware families: RUSTYSHADE, RUSTYMOVE, PSNATCH, and BASHNATCH. The campaign utilized innovative command-and-control infrastructure through private GitHub repositories and typosquatted domains mimicking Indian news organizations. The sophisticated attack chain involved a Rust-based backdoor for encrypted communications, USB propagation tools, and cross-platform file stealers capable of exfiltrating up to 5GB of sensitive data per execution. This incident highlights the evolving threat landscape where nation-state actors increasingly leverage legitimate cloud services for malicious infrastructure while expanding their technical capabilities across multiple operating systems and attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Cisco ISE Zero-Day CVE-2026-76460: When Network Access Controls Become Attack Vectors
Cisco ISE Zero-Day CVE-2026-76460: When Network Access Controls Become Attack Vectors
Information Technology/IT1 month ago

Cisco ISE Zero-Day CVE-2026-76460: When Network Access Controls Become Attack Vectors

Cisco disclosed CVE-2026-76460, a maximum-severity zero-day vulnerability in Cisco Identity Services Engine (ISE) that was actively exploited before disclosure in December 2026. The vulnerability allows remote attackers to bypass authentication and gain full administrative control of ISE devices through an API flaw. Compromised ISE systems enable attackers to modify network access policies, extract stored credentials, delete audit logs, and move laterally across all network segments controlled by the device. This represents Cisco's second actively exploited zero-day disclosure within two days, highlighting an escalation in targeted attacks against critical network infrastructure. This incident underscores the growing sophistication of attacks targeting network access control systems and the critical importance of zero-trust architecture as traditional perimeter-based security models continue to fail against advanced persistent threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Cisco ISE Zero-Day Highlights Identity Infrastructure Attack Trends
Critical Cisco ISE Zero-Day Highlights Identity Infrastructure Attack Trends
Computer/Network Security1 month ago

Critical Cisco ISE Zero-Day Highlights Identity Infrastructure Attack Trends

In September 2026, Cisco disclosed CVE-2026-76460, a maximum-severity authentication bypass vulnerability in Identity Services Engine (ISE) and ISE Passive Identity Connector being actively exploited by threat actors. The flaw allows remote attackers to bypass authentication on API endpoints through crafted requests, gaining unauthorized access to affected devices without any configuration requirements. Cisco's PSIRT confirmed active exploitation in the wild, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with a mandatory three-day patching deadline for federal agencies. This incident highlights the escalating targeting of identity and access management infrastructure, as threat actors increasingly focus on bypassing authentication controls to establish persistent network access and facilitate lateral movement in Zero Trust environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
FamousSparrow's SparroWocky Backdoor Targets Latin American Governments
FamousSparrow's SparroWocky Backdoor Targets Latin American Governments
Government Administration1 month ago

FamousSparrow's SparroWocky Backdoor Targets Latin American Governments

The China-linked espionage group FamousSparrow has been conducting a sustained campaign against government organizations across Latin America using their new SparroWocky backdoor malware. From mid-2025 through 2026, the group targeted organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, replacing their previous SparrowDoor backdoor with this more advanced C++ malware. SparroWocky features sophisticated anti-analysis capabilities, modular architecture, and comprehensive data collection functions including screenshot capture, file manipulation, and proxy operations. The attacks aimed to gather intelligence on Latin American governments' responses to increasing U.S. pressure on Chinese economic interests, demonstrating China's strategic focus on regional geopolitical intelligence gathering. This campaign highlights the evolution of Chinese state-sponsored cyber espionage capabilities and their expanding focus on Latin American targets amid growing geopolitical tensions. The sophisticated evasion techniques and sustained operations demonstrate the increasing threat posed by well-resourced nation-state actors to regional government infrastructure and diplomatic communications.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft's September 2026 Updates Break Windows Domain Authentication
Microsoft's September 2026 Updates Break Windows Domain Authentication
Information Technology/IT1 month ago

Microsoft's September 2026 Updates Break Windows Domain Authentication

Microsoft's September 2026 security updates KB5124008 and KB5124012 introduced critical domain authentication failures affecting Windows 11 enterprise environments. The updates automatically enabled Machine Identity Isolation enforcement mode, breaking domain trust relationships for organizations not running Windows Server 2025 Domain Functional Level. Affected users experienced credential validation errors despite correct usernames and passwords, requiring immediate registry modifications and secure channel resets to restore domain access. This incident highlights the risks of automatic security feature enforcement without proper infrastructure compatibility validation. The authentication failures demonstrate how security hardening measures can inadvertently create operational disruptions in hybrid enterprise environments, emphasizing the need for careful deployment planning and compatibility assessment before implementing new identity isolation mechanisms.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports