Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 4 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 37–48 / 3243 reports
C3RB3R Ransomware Is Encrypting Synology NAS Devices — Here Is What You Need to Know
C3RB3R Ransomware Is Encrypting Synology NAS Devices — Here Is What You Need to Know
Information Technology/IT6 days ago

C3RB3R Ransomware Is Encrypting Synology NAS Devices — Here Is What You Need to Know

In late October 2026, Synology issued an urgent advisory warning customers that threat actors were actively exploiting a critical remote-code-execution vulnerability (CVE-2024-10441, patched December 2024) in unpatched DiskStation Manager (DSM) software to deploy C3RB3R ransomware against internet-exposed NAS devices. Attackers encrypted victim data and appended a .L0CK3D extension, then demanded thousands of dollars for a decryption tool sold via a dark-web portal. With Shadowserver tracking over 380,000 internet-facing Synology NAS devices, the attack surface is substantial, and user reports on Reddit and BleepingComputer forums confirmed widespread infections well before Synology's formal advisory. C3RB3R (also called CerberImposter) has a documented history of pivoting from enterprise servers—Atlassian Confluence and GitLab—to edge storage appliances, demonstrating ransomware operators' strategy of targeting high-value, often-neglected network perimeter devices. The campaign underscores how unpatched NAS gear exposed directly to the internet continues to be a reliable ransomware entry point, elevating urgency for patch discipline and perimeter access controls across all industries.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Vapor Panda's ARTEX AI Campaign: How China-Nexus Hackers Automated Attacks on 200+ Organizations
Vapor Panda's ARTEX AI Campaign: How China-Nexus Hackers Automated Attacks on 200+ Organizations
Government Administration6 days ago

Vapor Panda's ARTEX AI Campaign: How China-Nexus Hackers Automated Attacks on 200+ Organizations

Beginning October 17, 2026, a China-nexus threat actor tracked as Vapor Panda deployed ARTEX, an open-source multi-agent AI penetration-testing framework, in a sweeping cyberespionage campaign targeting more than 200 organizations across 14 countries. Victims span telecommunications providers in the United States and Belgium, government ministries in Greece, the Middle East, and Latin America, pharmaceutical and semiconductor firms, defense contractors, and financial institutions. AI agents orchestrated by DeepSeek and a second commercial LLM autonomously performed reconnaissance, exploited vulnerabilities, deployed web shells, harvested credentials, and pivoted laterally—all while human operators issued instructions in Chinese and intervened only at critical decision points. At least nine organizations were fully compromised, and the BLOODALCHEMY backdoor was deployed against government targets in Latin America and the Middle East. This campaign represents a structural shift in nation-state tradecraft: AI agents now enable a single operator team to run dozens of simultaneous intrusions at machine speed, dramatically lowering the cost of large-scale cyberespionage. The DIVD breach—where ARTEX chained two zero-days to achieve root in 12 minutes—illustrates how agentic AI compresses the attacker's kill chain to intervals too short for human-speed defenses to interrupt.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
November 2026 Threat Roundup: Record Crypto Heist, Nation-State Relay Networks, AI Ransomware, and 50+ Critical CVEs
November 2026 Threat Roundup: Record Crypto Heist, Nation-State Relay Networks, AI Ransomware, and 50+ Critical CVEs
Financial Services6 days ago

November 2026 Threat Roundup: Record Crypto Heist, Nation-State Relay Networks, AI Ransomware, and 50+ Critical CVEs

The week of November 2, 2026 surfaced a convergence of high-severity threats spanning ransomware, nation-state intrusion, supply-chain compromise, infostealer campaigns, and DDoS botnets. North Korean group TraderTraitor set a new record by stealing $6.43 billion in cryptocurrency from Binance across 11 blockchains. Chinese state actor Volt Typhoon deployed a covert relay infrastructure called Silent Train using compromised SOHO, IoT, and enterprise devices to execute zero-day attacks against critical infrastructure. Supply-chain incidents hit Cursor Marketplace via a backdoored Claude Code extension and Polymarket via a hijacked third-party JavaScript service, while the Go-based Kairos botnet and uCreator Android spyware rounded out a broad and escalating threat landscape. This week's incidents underscore a structural shift: attackers are increasingly weaponizing trusted tools, third-party integrations, and covert relay networks to bypass perimeter defenses. The convergence of AI-assisted ransomware development (Aur0ra/Gold Ogre), supply-chain poisoning, and nation-state pre-positioning signals that organizations relying on implicit trust in software ecosystems and internal network flows face compounding, intersecting risks with shrinking detection windows.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CyberStrikeAI in the Wild: When the Attacker's Brain Is an LLM
CyberStrikeAI in the Wild: When the Attacker's Brain Is an LLM
Education Management6 days ago

CyberStrikeAI in the Wild: When the Attacker's Brain Is an LLM

In early 2025, Kaspersky's Cyber Threat Intelligence team uncovered an active campaign leveraging CyberStrikeAI, an open-source Go-based C2 framework that embeds a large language model orchestrator server-side to automate post-exploitation decisions. Threat actors—assessed with moderate confidence as Chinese-speaking based on script comments, timezone patterns, and tool provenance—compromised SQL Server 16.0.1000 instances at education-sector organizations across Africa and Latin America. Within hours of deploying the AI-driven implant, attackers achieved domain compromise via automated Kerberoasting, LSASS dumping, DCSync, Golden Ticket attacks, and SMB/WMI lateral movement, culminating in database exfiltration. The entire operation from agent deployment to domain administrator compromise completed in three to four days. This campaign marks one of the first publicly documented in-the-wild uses of an LLM embedded directly into attack orchestration rather than used for preparatory tasks. The AI layer did not introduce novel techniques but dramatically lowered operator skill requirements and compressed the post-exploitation timeline from weeks to hours, signaling a structural shift in how advanced persistent threats will operate at scale going forward.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PapRAT & BITTER: How a South Asian Espionage Group Is Weaponizing Windows Against Critical Infrastructure
PapRAT & BITTER: How a South Asian Espionage Group Is Weaponizing Windows Against Critical Infrastructure
Government Administration6 days ago

PapRAT & BITTER: How a South Asian Espionage Group Is Weaponizing Windows Against Critical Infrastructure

In late 2026, FortiGuard Labs attributed a sophisticated cyber espionage campaign to BITTER (TA397), a South Asian threat group active since 2013, targeting government, energy, and engineering organizations across South Asia. The campaign deployed PapRAT, a custom remote access Trojan recently rewritten from C++ to Rust, via three distinct infection chains leveraging legitimate Windows utilities such as ftp.exe, VHDX disk images, and WebDAV-delivered LNK files. PapRAT enables attackers to execute commands, capture screenshots, manipulate files, and download secondary payloads including WmRAT, providing persistent remote control over compromised Windows systems while evading signature-based endpoint detection. This campaign highlights a growing trend of state-linked espionage actors combining native OS living-off-the-land techniques with custom malware written in memory-safe languages like Rust to frustrate traditional defenses. As geopolitical tensions in South Asia intensify, organizations in critical sectors face heightened risk from persistent, evolving threat actors who continuously retool their capabilities to maintain long-term access.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
SysGoRAT and AI-Generated Scripts: How CL-UNK-1211 Weaponized LLMs Against Government Linux Infrastructure
SysGoRAT and AI-Generated Scripts: How CL-UNK-1211 Weaponized LLMs Against Government Linux Infrastructure
Government Administration6 days ago

SysGoRAT and AI-Generated Scripts: How CL-UNK-1211 Weaponized LLMs Against Government Linux Infrastructure

Between October 2025 and April 2026, a threat cluster designated CL-UNK-1211 conducted a sustained cyber espionage campaign against government Linux server infrastructure. Attackers deployed SysGoRAT, a custom Go-based remote access trojan communicating over WebSocket C2, alongside AI-generated PHP and shell scripts for reconnaissance, credential harvesting, and email exfiltration. The group replaced .bashrc files, injected code into PHP login pages, and scanned configuration files for cleartext credentials. Attempts to compress and exfiltrate government mailboxes and social media account data were observed, alongside deliberate log wiping and deployment of red-team markers to disguise malicious activity as legitimate penetration testing. This campaign reflects an accelerating trend of state-affiliated threat actors integrating large language models and agentic AI frameworks to compress attack timelines, reduce manual overhead, and rapidly adapt post-exploitation tooling. As agentic offensive frameworks like ARTEX, PentAGI, and Hexstrike proliferate, defenders must reckon with machine-speed intrusion cycles that outpace conventional detection and response cadences.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
How Fake IT Help Desks on Teams and a Forgotten Certificate Turned Into a Full Domain Compromise
How Fake IT Help Desks on Teams and a Forgotten Certificate Turned Into a Full Domain Compromise
Information Technology/IT6 days ago

How Fake IT Help Desks on Teams and a Forgotten Certificate Turned Into a Full Domain Compromise

In late 2026, Microsoft investigated two intrusions in which attackers impersonated IT help desk staff via Microsoft Teams, convincing employees to grant remote access through Windows Quick Assist. The threat actors then exploited misconfigured Active Directory Certificate Services (AD CS) — specifically ESC1 and ESC8 vulnerabilities disclosed in 2021 — to obtain authentication certificates for privileged accounts, including domain controllers. In the first case, a single privileged account excluded from automatic containment allowed the attacker to reach a file server and exfiltrate data to an external SFTP server using a renamed Rclone binary. The second case was contained after workstation isolation. These intrusions underscore a dangerous convergence of social engineering, identity-based persistence, and misconfigured PKI infrastructure. As organizations accelerate cloud adoption and hybrid work, AD CS misconfigurations remain widespread, and Teams-based impersonation continues to scale — making identity hygiene and certificate auditing critical defensive priorities heading into 2027.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
DarkBlinders 2026: How an Iran-Nexus APT Compromised Israeli and Iraqi Kurdish Government Cloud Infrastructure
DarkBlinders 2026: How an Iran-Nexus APT Compromised Israeli and Iraqi Kurdish Government Cloud Infrastructure
Government Administration6 days ago

DarkBlinders 2026: How an Iran-Nexus APT Compromised Israeli and Iraqi Kurdish Government Cloud Infrastructure

Between August and October 2026, the Iran-nexus threat actor DarkBlinders conducted an active cyber espionage campaign targeting a high-profile individual in Israel and a government cloud environment in the Kurdistan Region of Iraq. The group combined spear-phishing, fake recruitment lures impersonating Dubai Airports, and trojanized Visual Studio coding challenges to deliver SHELBYLOADER V2 and SHELBYC2, a GitHub-based backdoor. Credential-harvesting lookalike domains, AppDomainManager injection, DLL sideloading, and a tunneling utility called Blackwood were used to establish persistent, covert access to sensitive government infrastructure. DarkBlinders is assessed with medium confidence to be a sub-cluster of APT34 (OilRig), Iran's most prolific state-sponsored group. Its expanding victimology, novel delivery chains, and growing overlap with clusters UNC5795 and UNC5187 signal a deliberate escalation in Iranian cyber operations against Middle Eastern government targets at a time of heightened geopolitical tensions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
NetamLoader: How a .NET Supply Chain Implant Infiltrated Asian Government Networks Through Windows Update Directories
NetamLoader: How a .NET Supply Chain Implant Infiltrated Asian Government Networks Through Windows Update Directories
Government Administration1 week ago

NetamLoader: How a .NET Supply Chain Implant Infiltrated Asian Government Networks Through Windows Update Directories

In the first half of 2026, a previously undocumented .NET assembly-loading framework dubbed NetamLoader was discovered targeting a custom Windows 10 build used exclusively by government entities in Asia. The attack, uncovered by Kaspersky, is suspected to be a supply chain intrusion in which adversaries compromised a trusted third-party vendor to deliver a malicious Windows Cabinet (CAB) archive mimicking legitimate Patch My PC endpoint management components. The multi-stage payload chain exploited AppDomainManager injection to bypass antimalware defenses, established covert command-and-control communications via a domain impersonating OpenAI services, and deleted forensic artifacts to cover its tracks. The full scope of data exfiltration remains unconfirmed. NetamLoader represents a significant escalation in state-level supply chain espionage tradecraft, combining living-off-the-land binaries, multi-layered XAML-based payload staging, and AMSI bypass within a single framework. As governments worldwide accelerate sovereign OS adoption, attackers are pre-positioning implants inside the very software update pipelines designed to secure those platforms, making detection and attribution exceptionally difficult.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
CVSS 10.0: How a Single Public Certificate Unlocks Root Access in LXD and MicroCloud
CVSS 10.0: How a Single Public Certificate Unlocks Root Access in LXD and MicroCloud
Information Technology/IT1 week ago

CVSS 10.0: How a Single Public Certificate Unlocks Root Access in LXD and MicroCloud

A maximum-severity vulnerability (CVE-2026-112816, CVSS 10.0) in Canonical's LXD container hypervisor and MicroCloud clustering platform allows a network-adjacent attacker to impersonate any trusted client without possessing that client's private key. By exploiting a flaw in mutual-TLS certificate-chain validation, an attacker who obtains a trusted client's public certificate—information that is not secret—can attach it to their own TLS handshake and be accepted as that client. If the impersonated identity carries administrative rights, the attacker gains root access to the underlying host. Canonical released fixed snap versions (LXD 6.10.1, 5.21.9, 5.0.11, 4.0.15; MicroCloud 3.4.1, 2.1.5) following disclosure by the Incus community fork, which patched the same flaw in version 7.6.0. This incident underscores a growing pattern of authentication-bypass flaws in cloud-native infrastructure control planes. As organizations scale containerized and clustered workloads, improperly validated identity in east-west API paths creates a silent privilege-escalation highway—an attack surface that perimeter firewalls and endpoint agents alone cannot address.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
SMS of Death: How CVE-2026-58882 Lets Attackers Remotely Crash Android Phones with a Single Text
SMS of Death: How CVE-2026-58882 Lets Attackers Remotely Crash Android Phones with a Single Text
Telecommunications1 week ago

SMS of Death: How CVE-2026-58882 Lets Attackers Remotely Crash Android Phones with a Single Text

In October 2026, security researcher Mark Blah disclosed CVE-2026-58882, a zero-click denial-of-service vulnerability in Android's WapPushOverSms.decodeWapPdu function, dubbed 'SMS of Death.' By sending a specially crafted eight-byte WAP Push message to port 2948, an unauthenticated remote attacker can trigger a NegativeArraySizeException that crashes the com.android.phone process, severing cellular connectivity, dropping active calls—including emergency 911 calls—and potentially forcing devices into persistent reboot loops requiring factory resets. Google silently patched Android 14–17 in its October 2026 security bulletin, but Android 12 and 13 devices remain unpatched and exposed. A public proof-of-concept exploit is now available on GitHub, dramatically lowering the barrier to weaponization. The public release of a working PoC elevates this from theoretical risk to active threat. With hundreds of millions of Android 12/13 devices still in circulation globally, enterprises relying on mobile endpoints for authentication, operations, or emergency communications face immediate exposure. The incident highlights the enduring fragility of the Android patch ecosystem, where carrier and OEM delays routinely leave critical vulnerabilities open long after upstream fixes are available.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Black October 2026: How the PHP2SHELL–Fragnesia Exploit Chain Rooted 25 Firewalls—and What Node2Shell Means for Your Cloud Runtime Stack
Black October 2026: How the PHP2SHELL–Fragnesia Exploit Chain Rooted 25 Firewalls—and What Node2Shell Means for Your Cloud Runtime Stack
Government Administration1 week ago

Black October 2026: How the PHP2SHELL–Fragnesia Exploit Chain Rooted 25 Firewalls—and What Node2Shell Means for Your Cloud Runtime Stack

In late October 2026, a cluster of critical vulnerabilities collectively dubbed 'Black October' shook enterprise and government security teams simultaneously. Threat actors chained PHP2SHELL (CVE affecting ~70% of websites) with a Linux kernel privilege escalation flaw called Fragnesia (CVE-2026-46300) to achieve unauthenticated remote code execution followed by full root access on 25 PAN-OS firewall and management servers across the U.S., Japan, Taiwan, and South Korea—including three U.S. government-affiliated systems. Concurrently, a critical memory corruption flaw in the Brotli decoder (CVE-2026-111497, CVSS 9.2), dubbed Node2Shell, silently fixed upstream months earlier, enabled code execution against Node.js, Python, and .NET runtimes before coordinated public disclosure on October 21, 2026. Black October underscores a dangerous trend: attackers are no longer relying on single-vulnerability exploits but are engineering multi-stage exploit chains that defeat piecemeal patching strategies. The simultaneous targeting of network infrastructure, web runtimes, and supply-chain components signals a maturation in adversarial tradecraft that demands layered, zero-trust network controls beyond endpoint patching alone.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports