Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 40 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 469–480 / 3243 reports
Google Pixel Authorization Flaw CVE-2026-58704 Under Active Attack
Google Pixel Authorization Flaw CVE-2026-58704 Under Active Attack
Government Administration1 month ago

Google Pixel Authorization Flaw CVE-2026-58704 Under Active Attack

CISA added CVE-2026-58704, a Google Pixel improper authorization vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog based on evidence of active exploitation. This vulnerability affects Google Pixel mobile devices and allows attackers to bypass authorization controls, potentially gaining elevated access to device functions and sensitive data. The vulnerability poses significant risks to federal enterprises and organizations using Google Pixel devices in their mobile device management programs. Federal agencies are required under BOD 26-04 to prioritize rapid remediation of KEV vulnerabilities on publicly exposed assets that could grant total control post-exploitation. This addition reflects the growing threat landscape targeting mobile device vulnerabilities, particularly as organizations increasingly rely on mobile endpoints for business operations and remote work scenarios.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Active Zero-Day Exploitation Targets Cisco Email Security Infrastructure
Active Zero-Day Exploitation Targets Cisco Email Security Infrastructure
Financial Services1 month ago

Active Zero-Day Exploitation Targets Cisco Email Security Infrastructure

In September 2024, Cisco disclosed CVE-2026-76461, a critical zero-day vulnerability in Cisco Secure Email Gateway that was actively exploited by unknown threat actors before discovery and patching. The vulnerability allows unauthenticated remote attackers to execute commands with root privileges by sending specially crafted emails through the gateway, effectively granting complete control over the system. Cisco's security team identified active exploitation affecting multiple customers and conducted direct outreach to compromised organizations while implementing emergency mitigations for cloud-managed instances. This incident highlights the growing sophistication of attacks targeting email infrastructure as critical business communication channels become prime targets for espionage and lateral movement operations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Coast Guard and FBI Investigate Maritime Cyberattacks on Foreign Tankers
Coast Guard and FBI Investigate Maritime Cyberattacks on Foreign Tankers
Maritime1 month ago

Coast Guard and FBI Investigate Maritime Cyberattacks on Foreign Tankers

In August 2024, the U.S. Coast Guard and FBI conducted joint offshore security boardings of two foreign commercial tankers in the Gulf of Mexico following cyberattacks that compromised their networks. The first vessel, carrying oil and natural gas, was hacked while transiting the Strait of Gibraltar and lost communications for over 30 hours. Authorities investigated potential Iranian involvement or threat actors exploiting U.S.-Iran tensions, as part of broader concerns about 'dark fleets' carrying sanctioned oil using digital masking techniques. This incident highlights the growing convergence of cybersecurity threats with critical infrastructure and supply chain security, particularly as nation-state actors increasingly target maritime operations to disrupt global commerce and energy transportation networks.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Critical Cisco Email Gateway Zero-Day Highlights Perimeter Security Risks
Financial Services1 month ago

Critical Cisco Email Gateway Zero-Day Highlights Perimeter Security Risks

In September 2026, Cisco disclosed that threat actors were actively exploiting a critical zero-day vulnerability (CVE-2026-76461) in Cisco Secure Email Gateway appliances. The flaw stems from insufficient validation in email parsing logic, allowing unauthenticated remote attackers to execute arbitrary commands with root privileges by sending crafted emails containing malicious SQL statements. CISA immediately added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch within three days. This incident represents the latest in a concerning pattern of Cisco security appliance compromises, with CISA flagging 98 Cisco vulnerabilities as actively exploited since 2021, including seven abused by ransomware gangs.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Ransomware Gangs Exploit Critical VMware vCenter RCE Flaw (CVE-2026-59310)
Information Technology/IT1 month ago

Ransomware Gangs Exploit Critical VMware vCenter RCE Flaw (CVE-2026-59310)

In July 2026, Broadcom patched CVE-2026-59310, a critical directory traversal vulnerability in VMware vCenter's Syslog server that allows unauthenticated remote code execution. Despite urgent patching guidance, threat actors quickly began exploiting the flaw within weeks, with QUIRSO identifying over 361 compromised IP addresses across 47 countries. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog in August and recently flagged it as actively exploited by ransomware gangs, highlighting the critical risk to enterprise virtualization infrastructure. This incident underscores the accelerating timeline between vulnerability disclosure and ransomware exploitation, particularly targeting VMware environments that serve as high-value infrastructure targets for enterprise data access and lateral movement capabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
PaperCut Zero-Day Incident Exposes Critical Gaps in Post-Mythos Security Response
Information Technology/IT1 month ago

PaperCut Zero-Day Incident Exposes Critical Gaps in Post-Mythos Security Response

In August 2026, PaperCut NG/MF servers faced active zero-day exploitation before any patches were available, exemplifying the new reality of AI-accelerated vulnerability discovery. The incident began on August 27 when PaperCut issued an urgent advisory about active exploitation with no CVE, exploit details, or available patches. The first emergency patch released a day later was immediately bypassed, requiring three separate patch iterations over six days while attackers maintained active exploitation capabilities. This incident highlighted the critical gap between disclosure and effective remediation in the post-Mythos era, where disclosure-to-exploitation windows have compressed from an average of 21.5 days to mere hours. This incident represents the new template for zero-day response in an era where artificial intelligence has fundamentally accelerated both vulnerability discovery and weaponization timelines. Organizations now face scenarios where traditional patch-first security models fail, requiring immediate implementation of compensating controls and technique-based validation before exploits become publicly available.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CenterPoint Energy Breach Exposes 7.49M Records Through Unsecured API
Utilities1 month ago

CenterPoint Energy Breach Exposes 7.49M Records Through Unsecured API

CenterPoint Energy, a Houston-based utility serving 7 million customers across Texas, Indiana, Minnesota, and Ohio, confirmed a significant data breach in September 2026 after a threat actor using the alias '4d722e4d656f77' stole 7.49 million customer records. The attacker exploited an unsecured public API lacking rate limiting and web application firewall protection, iterating through millions of customer IDs to extract names, phone numbers, addresses, account numbers, billing amounts, and partial Social Security numbers. When the company failed to respond to the threat actor's initial contact, the stolen data was publicly leaked, prompting multiple class-action lawsuits and SEC disclosure. This incident highlights the critical vulnerability of inadequately secured public APIs in utility infrastructure, occurring amid increased scrutiny of energy sector cybersecurity following recent attacks on critical infrastructure. The breach demonstrates how basic API security misconfigurations can lead to massive data exposure, emphasizing the urgent need for proper rate limiting, authentication, and monitoring on all external-facing systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Iranian Intelligence Weaponizes Telegram in Global HEAVYGRAM Espionage Campaign
Newspapers/Journalism1 month ago

Iranian Intelligence Weaponizes Telegram in Global HEAVYGRAM Espionage Campaign

Since autumn 2023, Iran's Ministry of Intelligence and Security (MOIS) has deployed sophisticated malware called HEAVYGRAM (FBI designation) or CHOSEN BRICK (UK NCSC designation) to conduct extensive cyber espionage operations targeting Iranian dissidents, journalists, and activists worldwide. The Windows-based malware uses Telegram messaging app for command and control, enabling attackers to steal emails, capture screenshots, record audio through microphones, and exfiltrate sensitive communications. Victims are initially compromised through social engineering tactics where attackers impersonate trusted contacts or technical support, delivering malicious files disguised as legitimate applications like Adobe Flash, Norton Antivirus, or even medical scan results. This campaign represents a significant escalation in state-sponsored surveillance capabilities, demonstrating how authoritarian regimes are weaponizing popular communication platforms for transnational repression. The targeting extends beyond digital espionage, with stolen personal information being published on Iranian leak sites to endanger victims' physical safety, highlighting the intersection of cyber operations with traditional intelligence gathering and intimidation tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
VectraRAT: How a $250 Subscription Makes Enterprise Hacking Accessible
Financial Services1 month ago

VectraRAT: How a $250 Subscription Makes Enterprise Hacking Accessible

VectraRAT represents a sophisticated malware-as-a-service (MaaS) platform discovered by SOCRadar researchers in June 2026, offering cybercriminals comprehensive enterprise attack capabilities for just $250 per month. The platform provides a full-stack solution including a custom Windows implant, command-and-control infrastructure, and operator panel built entirely from scratch rather than leveraging existing malware frameworks. The RAT incorporates advanced features like User Account Control bypass, proprietary C2 protocols, credential harvesting, and remote desktop access. Analysis revealed 48% of victims were corporate Windows environments including Enterprise editions and Windows Server 2025, with confirmed data exfiltration from compromised systems across the US, Russia, and Germany. This incident highlights the concerning democratization of sophisticated cyberattack capabilities, as professional-grade attack infrastructure becomes increasingly accessible through affordable subscription models, significantly lowering the technical barriers for cybercriminals targeting enterprise networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Sandworm's Cyclops Blink Evolution: How Russian APT Exploited Cisco Infrastructure
Telecommunications1 month ago

Sandworm's Cyclops Blink Evolution: How Russian APT Exploited Cisco Infrastructure

In September 2026, the Russian state-sponsored threat group Sandworm exploited two critical vulnerabilities in Cisco's Firewall Management Center (FMC) software to deploy an upgraded version of the Cyclops Blink malware. The attackers chained CVE-2026-20079 (a maximum severity authentication bypass flaw) with CVE-2026-20316 (a privilege escalation vulnerability) to gain root access and deploy sophisticated backdoors capable of credential harvesting, network scanning, and traffic interception. This campaign represents a significant evolution of Cyclops Blink from its original 2022 variant, now targeting 64-bit Linux systems with enhanced reconnaissance capabilities across network infrastructure devices. This incident highlights the growing trend of state-sponsored actors targeting critical network infrastructure through vulnerability chaining, demonstrating how APT groups are rapidly adapting their malware arsenals to exploit modern enterprise environments and expanding their attack surface beyond traditional endpoints to network management platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
GitLab's Maximum-Severity Vulnerability: A Supply Chain Security Wake-Up Call
Computer Software/Engineering1 month ago

GitLab's Maximum-Severity Vulnerability: A Supply Chain Security Wake-Up Call

CVE-2026-85706, a maximum-severity path traversal vulnerability in GitLab Community and Enterprise Editions, is being actively exploited by threat actors to compromise software supply chains. The flaw, which received a CVSS score of 10.0, allows unauthenticated attackers to read arbitrary files from GitLab servers, including sensitive credentials and CI/CD secrets. GitLab disclosed and patched the vulnerability on September 10, 2026, but CISA added it to their Known Exploited Vulnerabilities catalog within days due to observed exploitation in the wild. Researchers detected rapid escalation from initial probes to full exploitation, with attackers extracting configuration files and SSH credentials that could enable complete system compromise and lateral movement into development environments. This incident highlights the growing threat to software supply chains as adversaries increasingly target development platforms to gain privileged access to source code, build processes, and deployment pipelines across multiple organizations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CareCam CM2507 IP Cameras: Seven Critical Vulnerabilities Expose Enterprise Networks
Health Care / Life Sciences1 month ago

CareCam CM2507 IP Cameras: Seven Critical Vulnerabilities Expose Enterprise Networks

The CareCam CM2507 IP camera contains seven critical vulnerabilities (CVE-2026-88259 through CVE-2026-81321) that collectively allow complete device compromise. These flaws include missing authentication for video streaming, empty passwords in ONVIF services, cleartext credential storage, weak password hashing, and unauthorized script execution from removable media. Attackers can exploit these vulnerabilities to access live video feeds, extract stored credentials, execute arbitrary code, and pivot to connected networks. The vendor has not responded to CISA's coordination attempts, leaving deployed devices unpatched. This incident highlights the persistent security challenges in IoT devices deployed across commercial facilities worldwide, particularly as organizations increasingly rely on IP cameras for security monitoring while threat actors actively target poorly secured IoT infrastructure for initial access and lateral movement.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports