Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 38 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 445–456 / 3243 reports
FBI Dismantles NightmareStresser: The Rise and Fall of a Major DDoS Empire
Computer Games1 month ago

FBI Dismantles NightmareStresser: The Rise and Fall of a Major DDoS Empire

On September 17, 2026, the FBI seized the NightmareStresser DDoS-for-hire platform, one of the world's longest-running booter services that enabled cybercriminals to launch massive distributed denial-of-service attacks. The platform, operating through nightmare-stresser.com and nightmarestresser.org domains, boasted over 566,000 registered users and 52 dedicated servers capable of generating attacks up to 200 Gbps. Since 2022, NightmareStresser facilitated hundreds of thousands of DDoS attacks targeting victims worldwide, leveraging compromised IoT devices and routers as attack infrastructure. This seizure highlights the escalating threat of commoditized DDoS services that democratize cyberattacks, enabling even non-technical actors to launch sophisticated infrastructure attacks. The continued evolution of booter services represents a persistent challenge to organizations' availability and business continuity, particularly as these platforms increasingly target critical infrastructure and essential services.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
AI-Powered Credential Harvesting: How Autonomous Attacks Are Rewriting Cybercrime Economics
AI-Powered Credential Harvesting: How Autonomous Attacks Are Rewriting Cybercrime Economics
Financial Services1 month ago

AI-Powered Credential Harvesting: How Autonomous Attacks Are Rewriting Cybercrime Economics

In September 2026, Google Threat Intelligence Group documented sophisticated AI-powered credential harvesting campaigns where threat actors compromised cloud infrastructure and deployed multi-agent attack frameworks in under six hours. These autonomous systems managed vulnerability scanning, troubleshooting, and IP rotation with minimal human intervention, harvesting thousands of third-party credentials. The attacks demonstrated AI's ability to dramatically increase the speed and scale of credential theft operations, with AI-assisted phishing campaigns achieving 54% click-through rates compared to 12% for traditional methods. This incident represents a critical inflection point where AI transforms cybercrime economics, making credential theft operations exponentially more efficient and scalable while traditional authentication mechanisms struggle to distinguish between legitimate users and AI-powered attackers using stolen credentials.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
MovieReaper Campaign Exploits Torrent Supply Chain with Blockchain-Resilient C2
MovieReaper Campaign Exploits Torrent Supply Chain with Blockchain-Resilient C2
Entertainment/Movie Production1 month ago

MovieReaper Campaign Exploits Torrent Supply Chain with Blockchain-Resilient C2

The MovieReaper campaign, active since October 2025, represents a sophisticated multi-stage malware operation targeting users across multiple countries through compromised torrent trackers. Threat actors compromised the itorrents.org repository, causing legitimate torrent sites to inadvertently distribute malicious files disguised as popular movies like 'The Odyssey (2026).' The attack chain employs advanced evasion techniques, uses Solana blockchain for C2 resilience, and deploys a modular framework capable of comprehensive file system access and data exfiltration. Victims span individuals and organizations across Europe, Asia, and Africa, including sectors like government, IT, retail, and transportation. This incident highlights the evolving sophistication of supply chain attacks targeting content distribution platforms and the increasing use of blockchain infrastructure to create resilient command and control networks that resist traditional takedown efforts.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Cisco ISE Zero-Day Exploited in Wild: CVE-2026-76460 Authentication Bypass
Critical Cisco ISE Zero-Day Exploited in Wild: CVE-2026-76460 Authentication Bypass
Computer/Network Security1 month ago

Critical Cisco ISE Zero-Day Exploited in Wild: CVE-2026-76460 Authentication Bypass

In September 2026, Cisco disclosed CVE-2026-76460, a maximum-severity zero-day vulnerability (CVSS 10.0) affecting Identity Services Engine (ISE) and ISE Passive Identity Connector. The flaw allows unauthenticated remote attackers to bypass authentication through insufficient controls on an API endpoint, granting unauthorized access to the web-based management interface and potentially root-level command execution. Cisco confirmed active exploitation in the wild, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with a mandatory patching deadline of September 19, 2026, for federal agencies. This incident highlights the escalating threat landscape targeting critical network infrastructure components, particularly identity and access management systems that serve as foundational security controls for enterprise zero trust architectures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
NightmareStresser Takedown: How US Authorities Disrupted a Massive DDoS Empire
NightmareStresser Takedown: How US Authorities Disrupted a Massive DDoS Empire
Higher Education/Acadamia1 month ago

NightmareStresser Takedown: How US Authorities Disrupted a Massive DDoS Empire

In September 2026, the U.S. Department of Justice seized two domains associated with NightmareStresser, a distributed denial-of-service (DDoS)-for-hire service that facilitated hundreds of thousands of attacks since 2022. The platform operated with over 566,000 registered users across 52 servers, targeting educational institutions, government agencies, gaming platforms, and millions of individuals worldwide. The service offered advanced Layer 4 and Layer 7 attack capabilities, cryptocurrency payment options, and claimed 24/7 availability over eight years of operation. This seizure represents a critical escalation in the ongoing battle against cybercrime-as-a-service platforms, highlighting the urgent need for organizations to implement comprehensive DDoS protection and network security measures as these attacks continue to evolve in sophistication and scale.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Chinese APT FamousSparrow Targets Latin America with Advanced SparroWocky Backdoor
Chinese APT FamousSparrow Targets Latin America with Advanced SparroWocky Backdoor
Government Administration1 month ago

Chinese APT FamousSparrow Targets Latin America with Advanced SparroWocky Backdoor

In August 2025, the China-aligned state-sponsored threat actor FamousSparrow began deploying a new backdoor called SparroWocky across multiple Latin American countries including Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela. The modular C++ backdoor replaced their previous SparrowDoor implant and targeted governmental entities through DLL sideloading techniques. SparroWocky features advanced capabilities including file execution, TCP proxy functionality, command execution, data exfiltration, screenshot capture, and self-deletion mechanisms while leveraging open-source tools like Mbed TLS for secure C2 communications. This campaign represents the evolving sophistication of Chinese APT groups who are increasingly integrating open-source offensive tools directly into custom malware rather than using them as separate utilities. The geographic focus on Latin America suggests either a formal mandate or opportunistic targeting based on current geopolitical circumstances, highlighting the global reach of state-sponsored cyber espionage operations.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds Two Critical Vulnerabilities to KEV Catalog: Cisco ISE and Acronis Backup Under Active Attack
CISA Adds Two Critical Vulnerabilities to KEV Catalog: Cisco ISE and Acronis Backup Under Active Attack
Government Administration1 month ago

CISA Adds Two Critical Vulnerabilities to KEV Catalog: Cisco ISE and Acronis Backup Under Active Attack

CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog in September 2026: CVE-2026-76460 affecting Cisco Identity Services Engine's privileged API usage, and CVE-2026-87886 involving Acronis Backup's incorrect default permissions. Both vulnerabilities are actively exploited in the wild and pose significant risks to federal enterprises. The additions reinforce CISA's Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize rapid remediation of high-risk vulnerabilities on publicly exposed assets that could grant total system control post-exploitation. These KEV additions highlight the ongoing evolution of threat actor tactics targeting identity management systems and backup infrastructure, critical components in modern enterprise security architectures that attackers increasingly exploit for persistence and lateral movement.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
LausivLoader Dissected: How Modern Malware Uses Steganography and Multi-Stage Execution
LausivLoader Dissected: How Modern Malware Uses Steganography and Multi-Stage Execution
Financial Services1 month ago

LausivLoader Dissected: How Modern Malware Uses Steganography and Multi-Stage Execution

In August 2023, security researchers analyzed a sophisticated LausivLoader malware campaign that utilized multi-stage execution chains to evade detection. The attack began with a malspam email containing a fake purchase quotation request, delivering a JavaScript file disguised as a business document. The malware employed innovative inter-process communication techniques, using environment variables to pass data between JavaScript and PowerShell stages, ultimately downloading encrypted payloads hidden within PNG image files using steganography. This multi-layered approach demonstrates advanced evasion tactics including AMSI bypassing, process hollowing, and scheduled task persistence mechanisms. This incident highlights the evolution of commodity malware loaders toward more sophisticated obfuscation and persistence techniques, reflecting broader trends in cybercriminal operations that leverage legitimate system features for malicious purposes.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
How Automated Credential Testing Tools Expose Identity Security Gaps
How Automated Credential Testing Tools Expose Identity Security Gaps
Financial Services1 month ago

How Automated Credential Testing Tools Expose Identity Security Gaps

Praetorian's enhanced Brutus credential testing engine demonstrates the persistent vulnerability of organizations to identity-based attacks in 2024. The tool now automates the complete attack chain from personnel discovery through credential validation across 14 additional protocols including industrial systems like OPC UA and infrastructure management interfaces like IPMI. Brutus systematically identifies organizational personnel through multiple sources, generates username variations, tests credentials against discovered services, and maintains persistence of confirmed credentials for reuse across future assessments. This evolution reflects how attackers continue to exploit weak credential hygiene and password reuse as the primary attack vector into enterprise environments. This development highlights the ongoing reality that most successful cyberattacks still begin with compromised credentials rather than sophisticated zero-day exploits, emphasizing the critical need for robust identity security measures and comprehensive credential management programs.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
FBI Disrupts NightmareStresser: Major DDoS-for-Hire Takedown Exposes Cybercrime-as-a-Service Threats
FBI Disrupts NightmareStresser: Major DDoS-for-Hire Takedown Exposes Cybercrime-as-a-Service Threats
Computer Games1 month ago

FBI Disrupts NightmareStresser: Major DDoS-for-Hire Takedown Exposes Cybercrime-as-a-Service Threats

In December 2024, the FBI and Royal Canadian Mounted Police seized the primary domain and associated websites of NightmareStresser, one of the longest-running and most popular DDoS-for-hire services used by cybercriminals globally. Operating since at least 2022, the service facilitated hundreds of thousands of DDoS attacks against educational institutions, government agencies, gaming platforms, and millions of individuals worldwide. The takedown was part of Operation PowerOFF, an ongoing international effort targeting IP stressers and booter services that make DDoS attacks accessible to non-technical users through user-friendly interfaces and tutorials. This incident highlights the persistent threat of commoditized cyber attack services that democratize sophisticated attack capabilities, enabling script kiddies and low-skilled threat actors to launch disruptive campaigns against critical infrastructure and services with minimal technical expertise required.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
How Iranian Cyber Operations Target the Hidden Infrastructure Behind U.S. Military Power
How Iranian Cyber Operations Target the Hidden Infrastructure Behind U.S. Military Power
Defense/Space1 month ago

How Iranian Cyber Operations Target the Hidden Infrastructure Behind U.S. Military Power

Iranian cyber operations are increasingly targeting the interconnected civilian infrastructure that supports U.S. military operations, including commercial railroads, ports, utilities, and defense contractors. Rather than pursuing catastrophic single attacks, Iranian threat groups are conducting persistent, volume-based campaigns across multiple smaller targets to strain response capabilities and disrupt military logistics chains. Recent attacks on water utilities across 12 states and a four-day power plant outage in the UK demonstrate this strategy of imposing cumulative operational strain rather than seeking headline-grabbing breaches. This threat model reflects Iran's adaptation to prolonged conflict scenarios, where creating sustained disruption across military-supporting infrastructure becomes more strategically valuable than traditional espionage or single-point failures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Google Patches Actively Exploited Android Zero-Day CVE-2026-58704 on Pixel Devices
Google Patches Actively Exploited Android Zero-Day CVE-2026-58704 on Pixel Devices
Telecommunications1 month ago

Google Patches Actively Exploited Android Zero-Day CVE-2026-58704 on Pixel Devices

In September 2026, Google addressed CVE-2026-58704, a high-severity zero-day vulnerability in Android Pixel devices that was actively exploited in targeted attacks. The flaw stems from improper authorization and protection mechanism failures in the Modem subcomponent, allowing attackers with adjacent network access to escalate privileges without user interaction. Google's security update patched this vulnerability along with 109 other security issues, including 12 remote code execution and 89 privilege escalation flaws rated critical or high severity. This incident highlights the growing sophistication of mobile device attacks and the critical importance of rapid patch deployment in enterprise environments where mobile devices access corporate networks and sensitive data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports