Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
CISA Adds Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
On July 22, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2026-16232 and CVE-2026-50522. CVE-2026-16232 is an authentication bypass vulnerability in Check Point SmartConsole, allowing unauthenticated remote attackers to gain administrative access and modify security policies. CVE-2026-50522 is a deserialization vulnerability in Microsoft SharePoint, enabling unauthorized remote code execution without authentication. Both vulnerabilities are actively exploited, posing significant risks to organizations using these platforms. The inclusion of these vulnerabilities in the KEV Catalog underscores the increasing trend of attackers targeting critical infrastructure through widely used enterprise applications. Organizations are urged to prioritize the remediation of these vulnerabilities to mitigate potential breaches and maintain compliance with security directives.
1 month ago
Kill Chain
Chaos Ransomware's msaRAT: Exploiting Browsers for Stealthy C2 Channels
In July 2026, the Chaos ransomware group deployed a new Rust-based remote access trojan (RAT) named msaRAT. This malware leverages the Chrome DevTools Protocol to control headless instances of Chrome or Edge browsers on compromised Windows machines, routing command-and-control (C2) traffic through WebRTC channels. By utilizing legitimate browser processes, msaRAT effectively conceals malicious communications, making detection and mitigation challenging for defenders. This incident underscores a growing trend among threat actors to exploit trusted applications and services to evade detection. The use of browser-mediated C2 channels highlights the need for enhanced behavior-based detection mechanisms and vigilant monitoring of legitimate application processes to identify and thwart such sophisticated attacks.
1 month ago
Kill Chain
Russian Cyberespionage Campaign Exploits Zimbra Vulnerability CVE-2025-66376
In July 2025, a Russian state-sponsored cyberespionage group, identified as CL-STA-1114 (also known as Void Blizzard and LAUNDRY BEAR), initiated a campaign targeting Zimbra webmail users across sectors such as government, defense, transportation, and finance in regions including NATO member states, Ukraine, CIS countries, and Africa. The attackers exploited a zero-click vulnerability in the Zimbra Collaboration Suite (CVE-2025-66376), allowing them to inject malicious JavaScript payloads via specially crafted HTML emails. This exploit enabled the exfiltration of sensitive data, including login credentials, email archives, and search histories, without any user interaction. The continued exploitation of CVE-2025-66376 underscores the critical need for organizations to promptly apply security patches and enhance their email security measures. The sophistication of this attack, particularly its zero-click nature, highlights the evolving tactics of nation-state actors and the importance of proactive defense strategies to protect sensitive information.
1 month ago
Kill Chain
White House Accuses Moonshot AI of Distilling Anthropic's Fable Model
In July 2026, the White House accused Chinese AI company Moonshot AI of illicitly distilling Anthropic's Fable model to develop their own Kimi K3 model. This process involved creating a sophisticated internal platform to conduct large-scale distillation against U.S. models, allowing them to switch between multiple methods of access to avoid detection. The U.S. government expressed concerns over the unauthorized use of proprietary technology and the potential national security implications. ([cyberscoop.com](https://cyberscoop.com/white-house-accuses-moonshot-ai-anthropic-model-distillation/?utm_source=openai)) This incident underscores the escalating tensions in the global AI race, highlighting the challenges in protecting intellectual property and the need for robust cybersecurity measures to prevent unauthorized access and replication of advanced AI models.
1 month ago
Kill Chain
CISA Orders Immediate Patching of Langflow RCE Vulnerability CVE-2026-0770
In July 2026, the Cybersecurity and Infrastructure Security Agency (CISA) mandated U.S. federal agencies to urgently patch a critical vulnerability in Langflow, a visual framework for building AI agents. Identified as CVE-2026-0770, this flaw allows unauthenticated attackers to execute arbitrary code with root privileges by exploiting the 'exec_globals' parameter in the 'validate' endpoint. Exploitation attempts were first observed on June 27, 2026, with over 220 incidents from 64 unique IP addresses, leading to malware deployment and unauthorized access to sensitive data. This incident underscores the escalating threats targeting AI development tools and the necessity for robust security measures. The active exploitation of CVE-2026-0770 highlights the importance of prompt vulnerability management and the need for organizations to stay vigilant against emerging attack vectors in AI frameworks.
2 months ago
Kill Chain
South Korea's Diplomatic Academy Data Breach: A 10-Month Undetected Cyberattack
In April 2025, an unidentified threat actor exploited a zero-day vulnerability in the Korea National Diplomatic Academy's online education system, maintaining unauthorized access until February 2026. This breach exposed personal information—including names, user IDs, email addresses, and encrypted passwords—of approximately 10,000 individuals associated with South Korea's Ministry of Foreign Affairs, including current and former diplomats. The compromised system, established in 2022 for remote training during the COVID-19 pandemic, was taken offline in February 2026 upon detection of the intrusion. This incident underscores the escalating sophistication of cyberattacks targeting governmental institutions and the critical need for robust cybersecurity measures. The prolonged undetected access highlights vulnerabilities in monitoring and threat detection systems, emphasizing the importance of regular security audits and timely patch management to mitigate potential breaches.
2 months ago
Kill Chain
Critical Ubuntu snap-confine Vulnerability (CVE-2026-8933) Grants Local Root Access
In July 2026, a high-severity local privilege escalation vulnerability, CVE-2026-8933, was identified in Ubuntu's snap-confine component. This flaw allows unprivileged local users to gain root access on default installations of Ubuntu Desktop versions 24.04, 25.10, and 26.04. The vulnerability arises from improper initialization of privilege boundaries in snap-confine when configured with set-capabilities, enabling attackers to execute arbitrary code with full root privileges. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-8933?utm_source=openai)) This incident underscores the critical importance of promptly addressing privilege escalation vulnerabilities, especially in widely used operating systems like Ubuntu. Organizations must ensure timely application of security patches to mitigate potential risks associated with such flaws.
2 months ago
Kill Chain
Critical Vulnerability in Adobe Acrobat Chrome Extension Exposes User Data
In June 2026, a critical vulnerability (CVE-2026-48294) was identified in the Adobe Acrobat PDF Extension for Chrome, affecting versions up to 26.5.2.2. This Universal Cross-Site Scripting (UXSS) flaw allowed attackers to bypass the browser's same-origin policy, enabling unauthorized access to users' session data across different web origins. Exploitation required user interaction, such as visiting a maliciously crafted URL or interacting with a compromised webpage. The vulnerability was promptly patched by Adobe following its disclosure. The incident underscores the persistent risks associated with browser extensions, especially those with extensive user bases like Adobe Acrobat's, which boasts over 314 million users. It highlights the importance of regular security assessments and prompt patching to mitigate potential data breaches stemming from such vulnerabilities.
2 months ago
Kill Chain
Cloudflare's Defense Against a Massive Multi-Vector DDoS Attack in 2026
In July 2026, Cloudflare successfully mitigated a massive multi-vector distributed denial-of-service (DDoS) attack that peaked at nearly 2 terabits per second. The attack was orchestrated using approximately 15,000 bots running variants of the Mirai malware, which had compromised Internet of Things (IoT) devices and unpatched GitLab instances. The assault combined DNS amplification attacks and UDP floods, aiming to overwhelm Cloudflare's infrastructure. The swift and effective response by Cloudflare prevented any significant service disruptions. ([computing.co.uk](https://www.computing.co.uk/news/4040452/cloudflare-blocked-multi-vector-ddos-attack-peaked-tbps?utm_source=openai)) This incident underscores the escalating sophistication and scale of DDoS attacks, highlighting the critical need for robust, adaptive defense mechanisms. The exploitation of IoT devices and unpatched software as attack vectors emphasizes the importance of comprehensive security practices, including regular patching and monitoring of networked devices.
2 months ago
Kill Chain
Unveiling the Azure DevOps MCP Server Vulnerability
In July 2026, a critical vulnerability was discovered in Microsoft's Azure DevOps Model Context Protocol (MCP) server. This flaw allowed attackers to embed invisible comments within pull request descriptions, which, when processed by AI coding agents, could execute unauthorized actions across projects. The exploit leveraged the absence of prompt-injection guardrails in the MCP server's handling of pull request descriptions, enabling attackers to access sensitive data and perform actions beyond their permissions. This incident underscores the growing risks associated with integrating AI agents into development workflows without robust security measures. As AI tools become more prevalent, ensuring they operate within strict security boundaries is imperative to prevent similar vulnerabilities.
2 months ago
Kill Chain
International Authorities Dismantle Kratos Phishing Platform
In July 2026, German and U.S. law enforcement agencies, in collaboration with Indonesian authorities, dismantled the Kratos phishing-as-a-service (PhaaS) platform. This operation led to the seizure of over 200 servers and the arrest of the alleged developer in Indonesia. Kratos enabled approximately 1,800 cybercriminal groups to conduct around 15,000 phishing campaigns monthly, targeting victims across more than 30 countries, primarily in Europe and the United States. The platform's advanced techniques allowed attackers to bypass multi-factor authentication (MFA) by capturing session cookies, granting unauthorized access to Microsoft 365 accounts. The takedown of Kratos underscores the escalating sophistication of phishing operations and the critical need for organizations to adopt robust security measures. The incident highlights the importance of implementing phishing-resistant authentication methods and continuous monitoring to detect and mitigate such advanced threats.
2 months ago
Kill Chain
CVE-2026-11374: Critical ManageEngine SSO Vulnerability Exposes Accounts to Takeover
In June 2026, a critical vulnerability (CVE-2026-11374) was identified in ManageEngine's ADSelfService Plus, RecoveryManager Plus, M365 Manager Plus, and ADAudit Plus when integrated with AD360. This flaw allowed unauthenticated attackers to predict Single Sign-On (SSO) tickets, leading to potential account takeovers. The vulnerability stemmed from the generation of predictable SSO tickets, enabling attackers to impersonate legitimate users and gain unauthorized access to sensitive systems. ManageEngine promptly addressed the issue by releasing patches for the affected products, enhancing the randomness of SSO ticket generation to prevent exploitation. This incident underscores the importance of robust authentication mechanisms and the need for organizations to stay vigilant against evolving attack vectors targeting identity and access management systems. The rise in sophisticated authentication bypass techniques highlights the necessity for continuous monitoring and timely application of security patches to safeguard critical infrastructure.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports