Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 42 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 493–504 / 3243 reports
Telegram Desktop XSS Flaw Exposed Chat Exports to Hidden JavaScript Attacks
Telegram Desktop XSS Flaw Exposed Chat Exports to Hidden JavaScript Attacks
Legal Services1 month ago

Telegram Desktop XSS Flaw Exposed Chat Exports to Hidden JavaScript Attacks

In June 2026, security researchers ExPatch discovered a critical cross-site scripting (XSS) vulnerability in Telegram Desktop's HTML export feature that allowed malicious bots to embed hidden JavaScript code in chat messages. The flaw affected versions 4.15.1 through 6.9.3, spanning over two years from March 2024 to July 2026. Attackers could exploit this by creating bot messages with script tags in button text, which would execute when users opened exported HTML files in browsers, potentially exfiltrating entire chat histories to attacker-controlled servers or manipulating displayed content. This incident highlights the growing risk of supply chain vulnerabilities in popular communication platforms and the delayed disclosure challenges facing the cybersecurity community. As organizations increasingly rely on messaging platforms for business communications and data export features for compliance, such vulnerabilities expose sensitive corporate communications to potential theft and manipulation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Breakthrough Research: How Behavioral Clustering Unmasks Hidden Cloud Identity Threats
Breakthrough Research: How Behavioral Clustering Unmasks Hidden Cloud Identity Threats
Financial Services1 month ago

Breakthrough Research: How Behavioral Clustering Unmasks Hidden Cloud Identity Threats

In September 2026, Palo Alto Networks Unit 42 published groundbreaking research on cloud identity behavioral clustering, analyzing over 40,000 identities across 125 cloud environments over two months. The research utilized unsupervised machine learning algorithms including UMAP and HDBSCAN to automatically categorize cloud identities into distinct functional roles such as administrators, DevOps, backup services, and security tools. The study revealed that traditional identity and access management (IAM) policies often fail to reflect actual identity behavior, creating significant security blind spots that attackers exploit through masquerading techniques and over-privileged access. This research represents a critical advancement in cloud security methodology, demonstrating how behavioral analysis can distinguish between legitimate operational activity and potential security breaches by mapping what identities actually do versus what they are permitted to do.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft's Record 972 Vulnerability Patch Signals New AI-Driven Cybersecurity Era
Microsoft's Record 972 Vulnerability Patch Signals New AI-Driven Cybersecurity Era
Computer Software/Engineering1 month ago

Microsoft's Record 972 Vulnerability Patch Signals New AI-Driven Cybersecurity Era

In September 2026, Microsoft released an unprecedented security update addressing 972 vulnerabilities, with 112 classified as critical severity. This represents a dramatic escalation from 570 vulnerabilities patched just two months prior, demonstrating the impact of AI-powered vulnerability discovery tools on the cybersecurity landscape. The massive patch volume reflects an industry-wide acceleration in vulnerability identification, with Microsoft, Google, and other major technology companies releasing record-breaking security updates throughout 2026. This incident highlights the double-edged nature of AI in cybersecurity, as the same technologies enabling defenders to identify vulnerabilities at unprecedented scale are simultaneously empowering attackers to reverse-engineer exploits from patches within hours of release, creating an increasingly compressed window for organizations to deploy critical security updates.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
UNC3569 Exploits Tencent Sogou Flaw to Deploy GrayRabbit Backdoor in Supply Chain Attack
UNC3569 Exploits Tencent Sogou Flaw to Deploy GrayRabbit Backdoor in Supply Chain Attack
Computer Software/Engineering1 month ago

UNC3569 Exploits Tencent Sogou Flaw to Deploy GrayRabbit Backdoor in Supply Chain Attack

In September 2026, researchers at Gen Digital disclosed that the China-aligned threat group UNC3569 actively exploited CVE-2026-51990, a critical one-click remote code execution vulnerability in Tencent's Sogou Input Method for Windows. The attack chain leveraged three weaknesses: unvalidated command-line argument injection through sgbiz: URI handlers, unrestricted URL navigation in embedded webviews, and an outdated unsandboxed Chromium 80 engine. Successfully exploited systems were infected with GrayRabbit backdoor malware, enabling remote shell access, file transfers, and system reconnaissance. Tencent patched the vulnerability in April 2026 with version 16.3.0.3498, but the underlying browser engine remains outdated and unsandboxed. This incident highlights the growing sophistication of supply chain attacks targeting widely-deployed software with hundreds of millions of users, particularly as nation-state actors increasingly exploit legacy components and inadequate input validation to achieve persistent access in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Dutch NCSC Issues Urgent Warning: Critical Check Point VPN Vulnerabilities Under Imminent Threat
Dutch NCSC Issues Urgent Warning: Critical Check Point VPN Vulnerabilities Under Imminent Threat
Financial Services1 month ago

Dutch NCSC Issues Urgent Warning: Critical Check Point VPN Vulnerabilities Under Imminent Threat

The Dutch National Cyber Security Centre (NCSC) issued an urgent warning on September 12, 2026, about imminent exploitation of two critical vulnerabilities in Check Point VPN products. CVE-2026-85102 involves improper certificate validation during VPN negotiation, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoder. Both flaws allow remote code execution on Security Gateways and Management Servers, affecting versions R81.20, R82, R82.10, R81.10.x, and R82.00.x. Check Point released patches on September 9, but the NCSC warns exploitation attempts are expected soon, potentially allowing attackers to gain full system control, access confidential data, and disrupt operations. This incident highlights the growing threat landscape targeting VPN infrastructure, particularly as organizations continue to rely heavily on remote access solutions post-pandemic. The combination of critical severity scores and the NCSC's assessment of imminent exploitation underscores the urgency for organizations to prioritize patch management and implement additional VPN security controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Flags Critical JFrog Artifactory and ConnectWise ScreenConnect Vulnerabilities Under Active Attack
CISA Flags Critical JFrog Artifactory and ConnectWise ScreenConnect Vulnerabilities Under Active Attack
Information Technology/IT1 month ago

CISA Flags Critical JFrog Artifactory and ConnectWise ScreenConnect Vulnerabilities Under Active Attack

CISA has added three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. The vulnerabilities include two JFrog Artifactory flaws (CVE-2026-42016 and CVE-2026-42018) involving incorrect authorization and improper authentication, plus a ConnectWise ScreenConnect vulnerability (CVE-2026-84869) related to improper privilege management and missing authorization. These vulnerabilities pose significant risks to federal enterprises and are being actively exploited by malicious cyber actors as frequent attack vectors. The addition reinforces CISA's Binding Operational Directive (BOD) 26-04, which requires federal agencies to prioritize rapid remediation of high-risk vulnerabilities that can grant total system control post-exploitation, while encouraging all organizations to adopt risk-based vulnerability management practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Elevates GitLab Path Traversal Vulnerability to Known Exploited Status
CISA Elevates GitLab Path Traversal Vulnerability to Known Exploited Status
Computer Software/Engineering1 month ago

CISA Elevates GitLab Path Traversal Vulnerability to Known Exploited Status

CISA has added CVE-2026-85706, a path traversal vulnerability affecting GitLab Community Edition and Enterprise Edition, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation. Path traversal vulnerabilities allow attackers to access files and directories outside the intended scope by manipulating file path parameters, potentially leading to unauthorized data access, system compromise, or privilege escalation. This addition reinforces the critical nature of the vulnerability and mandates rapid remediation by Federal Civilian Executive Branch agencies under BOD 26-04. This incident highlights the ongoing trend of attackers targeting DevOps platforms and source code management systems, which have become critical infrastructure for modern software development. As organizations increasingly rely on GitLab and similar platforms for code repositories and CI/CD pipelines, vulnerabilities in these systems pose significant supply chain risks that can cascade across multiple downstream applications and services.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Conti Ransomware Operative Sentenced: Lessons from a $150M Cybercrime Empire
Conti Ransomware Operative Sentenced: Lessons from a $150M Cybercrime Empire
Health Care / Life Sciences1 month ago

Conti Ransomware Operative Sentenced: Lessons from a $150M Cybercrime Empire

In September 2026, Ukrainian national Oleksii Oleksiyovych Lytvynenko was sentenced to four years in prison for his role in the Conti ransomware operation that targeted over 1,000 victims worldwide between 2020 and 2022. Lytvynenko joined the cybercrime syndicate in September 2021, personally compromising 12 companies across the U.S. and overseas, developing malicious loader tools, and managing stolen data as part of double extortion attacks. The Conti operation collected over $150 million in ransom payments before shutting down in 2022, with its members later forming new ransomware groups including BlackCat, Black Basta, and Hive. This sentencing represents ongoing law enforcement efforts to dismantle ransomware ecosystems, as threat actors continue evolving tactics through splintered operations and increasingly sophisticated extortion schemes targeting critical infrastructure organizations worldwide.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How ShinyHunters Weaponized Claude AI to Harvest Secrets from 1.8 Million Android Apps
How ShinyHunters Weaponized Claude AI to Harvest Secrets from 1.8 Million Android Apps
Computer Software/Engineering1 month ago

How ShinyHunters Weaponized Claude AI to Harvest Secrets from 1.8 Million Android Apps

Between December 2025 and August 2026, multiple threat groups including ShinyHunters, Russian state-sponsored Midnight Blizzard, and Chinese espionage group GTG-10007 systematically abused Anthropic's Claude AI model for large-scale cyberattacks. The most significant operation involved ShinyHunters member 'frkoo' deploying an automated credential-harvesting pipeline across AWS infrastructure that extracted secrets from 1.8 million Android applications and compromised over 40 Microsoft corporate tenants within 34 hours. The AI-enhanced attacks enabled rapid progression from initial access to administrative control in under three hours, with confirmed breaches across government, healthcare, energy, and technology sectors. This incident represents a critical inflection point where AI capabilities are being weaponized at unprecedented scale and speed, fundamentally changing the threat landscape and requiring immediate reassessment of defensive strategies against AI-enhanced cybercrime operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Florida DMV Breach Exposes Risks of Shared Government Database Access
Florida DMV Breach Exposes Risks of Shared Government Database Access
Government Administration1 month ago

Florida DMV Breach Exposes Risks of Shared Government Database Access

In September 2026, the Florida Department of Highway Safety and Motor Vehicles (FLHSMV) confirmed that its DAVID driver database was breached by the ShinyHunters extortion group, who claimed to have stolen over 200,000 driver records. The attack was executed using compromised credentials from a Plant City Police Department employee that had been improperly stored on a personal device. The breach was discovered on September 4, 2026, and quickly mitigated, with FLHSMV working alongside state law enforcement agencies in their response. This incident highlights the growing trend of cybercriminals targeting government databases through compromised credentials and the critical importance of proper credential management across interconnected systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
UAC-0099 Deploys GuardBreaker AI Manipulation Against Ukraine
UAC-0099 Deploys GuardBreaker AI Manipulation Against Ukraine
Health Care / Life Sciences1 month ago

UAC-0099 Deploys GuardBreaker AI Manipulation Against Ukraine

In September 2026, Russia-aligned threat group UAC-0099 deployed a novel AI manipulation technique called GuardBreaker against Ukrainian targets. The attackers embedded nuclear weapon prompts within malicious VBScript comments to trigger AI safety mechanisms and prevent automated malware analysis systems from examining their code. This represents a significant evolution in adversarial tactics, where threat actors manipulate AI defensive reasoning rather than increasing malware sophistication to achieve compromise. This incident highlights the accelerating arms race between AI-powered security tools and adversaries who exploit their limitations. With AI systems now discovering vulnerabilities at unprecedented speed and scale, traditional 90-day patch cycles are obsolete, creating an urgent need for multilayered defense strategies that don't rely solely on AI-based detection mechanisms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
The $21 Billion AI Scam Crisis: How Artificial Intelligence Became the Ultimate Social Engineer
The $21 Billion AI Scam Crisis: How Artificial Intelligence Became the Ultimate Social Engineer
Financial Services1 month ago

The $21 Billion AI Scam Crisis: How Artificial Intelligence Became the Ultimate Social Engineer

AI-enabled social engineering attacks have reached unprecedented sophistication, with cybercriminals leveraging large language models to create highly personalized and emotionally manipulative scams. Research by Fred Heiding of Menlo Park Intelligence reveals that AI systems excel at human manipulation through voice cloning, long-term relationship building, and cultural context adaptation. The FBI's Internet Crime Center reports that fraud losses skyrocketed from $4 billion in 2020 to $21 billion in 2025, primarily targeting vulnerable populations including senior citizens who develop emotional dependencies on AI-powered scam bots. This asymmetric threat landscape highlights a critical security gap where traditional technical defenses prove inadequate against AI-enhanced social engineering, as human cognitive vulnerabilities cannot be patched like software systems.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports