Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 44 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 517–528 / 3243 reports
Russian AI Agents Exploit PaperCut Flaws in Global Campaign Hitting 395 Organizations
Russian AI Agents Exploit PaperCut Flaws in Global Campaign Hitting 395 Organizations
Higher Education/Acadamia1 month ago

Russian AI Agents Exploit PaperCut Flaws in Global Campaign Hitting 395 Organizations

In August 2026, a Russian-speaking threat actor orchestrated an unprecedented AI-powered exploitation campaign targeting PaperCut NG/MF servers worldwide. Using hundreds of AI agents powered by OpenAI's Codex and DeepSeek models, the attackers automated exploit development for CVE-2026-81578 and CVE-2026-82078, compromising 440 PaperCut instances across 395 organizations in 48 countries within days. The campaign demonstrated alarming speed, with attackers achieving remote code execution in under four hours and domain administrator privileges in just seven minutes at some targets, primarily affecting educational institutions. This incident marks a critical inflection point in cybersecurity, showcasing how AI can compress traditional attack timelines from weeks to minutes. As threat actors increasingly weaponize AI for automated vulnerability discovery and exploitation, organizations face an unprecedented challenge where human-speed incident response becomes obsolete against machine-speed attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
How Cisco FMC Vulnerabilities Enabled Qilin Ransomware and Russian APT Attacks
How Cisco FMC Vulnerabilities Enabled Qilin Ransomware and Russian APT Attacks
Computer/Network Security1 month ago

How Cisco FMC Vulnerabilities Enabled Qilin Ransomware and Russian APT Attacks

In September 2026, Cisco Talos revealed that three distinct threat actor clusters had exploited two critical vulnerabilities in Cisco's Secure Firewall Management Center (FMC). The attacks leveraged CVE-2026-20079, a maximum-severity authentication bypass flaw, and CVE-2026-20316, a static credential vulnerability. These exploits enabled attackers to deploy web shells, steal credentials, establish persistent access, and ultimately deploy Qilin ransomware and Cyclops Blink malware. The incidents demonstrate sophisticated post-compromise activities including network reconnaissance, credential harvesting, and deployment of advanced persistent threat tooling across compromised infrastructure. This incident highlights the escalating sophistication of ransomware operations and state-sponsored campaigns targeting critical network security infrastructure. As organizations increasingly rely on centralized security management platforms, these systems become high-value targets that provide attackers with extensive network visibility and control capabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ThreatsDay September 2026: The Week AI-Powered Attacks and Mass-Scale Scams Converged
ThreatsDay September 2026: The Week AI-Powered Attacks and Mass-Scale Scams Converged
Financial Services1 month ago

ThreatsDay September 2026: The Week AI-Powered Attacks and Mass-Scale Scams Converged

A comprehensive security bulletin from September 2026 revealed multiple coordinated cyber campaigns targeting various platforms and services. Key incidents included malicious Chrome and Firefox extensions stealing cryptocurrency wallet data, AI-powered intrusions by Chinese-speaking operators targeting government systems across Asia, and a massive fake e-commerce operation called DoppelCart using over 119,000 domains to steal payment card details. Additional threats encompassed shadow AI risks exposing corporate data, sophisticated M&A wire fraud schemes, phishing campaigns abusing Google services, and various malware deployments leading to ransomware attacks. These incidents highlight the current surge in multi-vector attack campaigns leveraging AI automation, browser extension abuse, and social engineering at unprecedented scale. The convergence of AI-assisted vulnerability discovery, shadow IT adoption, and increasingly sophisticated phishing infrastructure represents a critical inflection point requiring immediate organizational attention to zero trust implementation and egress security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Mantax Otax: The Android Threat That Encrypts, Steals, and Terrorizes Victims
Mantax Otax: The Android Threat That Encrypts, Steals, and Terrorizes Victims
Banking/Mortgage1 month ago

Mantax Otax: The Android Threat That Encrypts, Steals, and Terrorizes Victims

Mantax Otax, a sophisticated Android malware strain discovered in September 2026, combines ransomware, spyware, and harassment capabilities to target Indonesian users through malicious APKs distributed outside Google Play. The malware uses accessibility services to gain extensive device control, encrypts files on older Android versions (9 and below) using victim-specific AES keys, and steals sensitive data including SMS messages, call logs, WhatsApp conversations, and real-time screen recordings. Beyond encryption and data theft, version 2 introduced psychological harassment features including jumpscare overlays, forced audio messages, and repeated dialog boxes to pressure victims into paying ransoms through Firebase-hosted chat negotiations. This incident highlights the growing trend of multi-vector mobile threats that combine financial extortion with psychological manipulation, demonstrating how threat actors are evolving beyond traditional ransomware to create more coercive attack campaigns targeting vulnerable mobile ecosystems in developing markets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Chinese AI Firms Conduct Industrial-Scale Theft of US Frontier AI Models
Chinese AI Firms Conduct Industrial-Scale Theft of US Frontier AI Models
Computer Software/Engineering1 month ago

Chinese AI Firms Conduct Industrial-Scale Theft of US Frontier AI Models

In September 2026, US government agencies including the FBI, NSA, and CISA issued a joint advisory accusing Chinese AI companies of conducting industrial-scale model distillation campaigns against leading US AI models. The companies, including Alibaba, DeepSeek, MiniMax, Moonshot AI, StepFun, and Z.AI, allegedly extracted billions of tokens from OpenAI's GPT, Anthropic's Claude, Google's Gemini, and SpaceX's Grok models since late 2024. Using sophisticated techniques including chain-of-thought reasoning extraction, automated failover systems, and proxy networks to evade detection, these firms reportedly violated terms of service to steal proprietary capabilities and reduce their own development costs. DeepSeek's publicly quoted training costs of $5.6 million were deemed misleading as they excluded the true cost of maliciously acquired data through extensive distillation operations. This incident highlights the escalating AI intellectual property theft landscape as nation-state actors increasingly target frontier AI capabilities to accelerate domestic development while circumventing export controls and sanctions. The systematic nature of these campaigns represents a new category of cyber threat that traditional security frameworks are ill-equipped to address.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ShieldCrash Exploit Exposes Critical Gaps in Windows Defender Security
ShieldCrash Exploit Exposes Critical Gaps in Windows Defender Security
Computer Software/Engineering1 month ago

ShieldCrash Exploit Exposes Critical Gaps in Windows Defender Security

In September 2026, the security researcher known as Nightmare-Eclipse released 'ShieldCrash,' a zero-day privilege escalation exploit targeting Microsoft's Windows Defender Malware Protection Engine. This exploit bypasses Microsoft's patch for the previous CVE-2026-69414 'ShieldBreak' vulnerability, demonstrating arbitrary file read capabilities under SYSTEM privileges across all supported Windows versions. The exploit is part of an ongoing vendetta by the researcher against Microsoft, who has been releasing monthly zero-day exploits since April 2026, often followed by patch bypasses that expose incomplete remediation efforts. This incident highlights the growing trend of adversarial security research where legitimate researchers turn hostile due to vendor disputes, creating sustained security risks for enterprise environments relying on Windows infrastructure and endpoint protection solutions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Infrastructure Under Siege: CISA's September 2026 Emergency Patch Alert
Critical Infrastructure Under Siege: CISA's September 2026 Emergency Patch Alert
Government Administration1 month ago

Critical Infrastructure Under Siege: CISA's September 2026 Emergency Patch Alert

CISA added three critical vulnerabilities to its Known Exploited Vulnerabilities catalog on September 10, 2026, affecting Cisco Secure Firewall Management Center (CVE-2026-20079), Citrix NetScaler ADC/Gateway (CVE-2026-19490), and Fortinet products (CVE-2025-25249). The Cisco flaw allows unauthenticated attackers to bypass authentication and gain root access, while active exploitation was detected in August 2026. The Fortinet vulnerability has been weaponized by Russian-speaking threat actors to deploy PivotC2 malware, compromising over 178 devices across 3,000+ targeted IP addresses since July 2026. This incident highlights the accelerating exploitation of network infrastructure devices as primary attack vectors, with threat actors increasingly targeting edge devices that lack robust monitoring capabilities. The multi-vendor nature of these simultaneous exploits demonstrates the coordinated scanning and opportunistic targeting of perimeter security appliances by sophisticated threat groups.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Russian Threat Actor Weaponizes AI Agents in Massive PaperCut Exploitation Campaign
Russian Threat Actor Weaponizes AI Agents in Massive PaperCut Exploitation Campaign
Primary/Secondary Education1 month ago

Russian Threat Actor Weaponizes AI Agents in Massive PaperCut Exploitation Campaign

In September 2026, a suspected Russian-speaking threat actor leveraged hundreds of AI agents powered by OpenAI Codex and DeepSeek models to exploit CVE-2026-81578 and CVE-2026-82078 vulnerabilities in PaperCut NG/MF print management software. The attacker compromised over 440 instances across 395 organizations in 48 countries, primarily targeting educational institutions. Using an AI-driven exploitation pipeline, the threat actor achieved domain administrator access in some cases within seven minutes of initial compromise, demonstrating unprecedented speed and scale in automated attacks. This incident represents a paradigm shift in cybersecurity threats, showcasing how AI is being weaponized to accelerate every stage of the attack lifecycle from vulnerability research to exploitation at scale. As AI-powered offensive capabilities become more accessible, organizations face an asymmetric threat landscape where attackers can conduct sophisticated campaigns with minimal human intervention.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Gigabud Banking Trojan Weaponizes Android Work Profiles in Advanced Evasion Campaign
Gigabud Banking Trojan Weaponizes Android Work Profiles in Advanced Evasion Campaign
Banking/Mortgage1 month ago

Gigabud Banking Trojan Weaponizes Android Work Profiles in Advanced Evasion Campaign

The Gigabud banking trojan has evolved its attack methodology by leveraging Android work profiles to evade detection by banking applications' security checks. Active since 2022 and attributed to the GoldFactory threat group, this remote access trojan now deploys a secondary app called Vwork that creates isolated work profiles on infected devices and installs tampered banking applications within them. By operating from within these separated environments, the trojan can conduct fraudulent transactions while remaining hidden from malware detection systems that scan the device's personal space. Group-IB confirmed active infections across Indonesia with estimated losses of $960,000 between February and July 2026, though the technique has been observed targeting multiple countries including Brazil, Colombia, Egypt, Mexico, and several Southeast Asian nations. This incident represents a significant evolution in mobile banking malware, demonstrating how threat actors are adapting legitimate Android enterprise features for malicious purposes. As organizations increasingly rely on mobile banking and BYOD policies, understanding these sophisticated evasion techniques becomes critical for developing effective mobile security strategies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Proxmox VE Under Attack: Port 8006 Scanning Campaign Targets Virtualization Infrastructure
Proxmox VE Under Attack: Port 8006 Scanning Campaign Targets Virtualization Infrastructure
Information Technology/IT1 month ago

Proxmox VE Under Attack: Port 8006 Scanning Campaign Targets Virtualization Infrastructure

Following Proxmox's advisory about a vulnerability in older Proxmox VE version 7 systems, security researchers observed a significant increase in scanning activity targeting port 8006 and brute force attacks against the virtualization platform's authentication endpoints. Attackers are exploiting the /api2/json/access/ticket endpoint with credential stuffing attempts and conducting reconnaissance through fingerprinting requests to identify vulnerable Proxmox installations. The vulnerability affects unsupported version 7 installations, creating exposure for organizations running outdated virtualization infrastructure. This activity represents a coordinated effort to identify and compromise virtualization platforms that manage critical infrastructure workloads. The scanning campaign demonstrates how quickly threat actors capitalize on disclosed vulnerabilities, even in end-of-life software versions that organizations may still be running in production environments.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Security Flaws Expose Healthcare Data Through NextGen Mirth Connect Integration Platform
Critical Security Flaws Expose Healthcare Data Through NextGen Mirth Connect Integration Platform
Health Care / Life Sciences1 month ago

Critical Security Flaws Expose Healthcare Data Through NextGen Mirth Connect Integration Platform

NextGen Healthcare's Mirth Connect integration platform versions 4.7.1 and earlier contain three critical vulnerabilities disclosed by CISA in September 2026. These include a SQL injection flaw (CVE-2026-82583) allowing authenticated users to execute arbitrary SQL commands through the Database Connector API, and two XML External Entity (XXE) injection vulnerabilities (CVE-2026-78224, CVE-2026-82578) in the XSLT Transformer and XML batch processing components. Successful exploitation could lead to credential disclosure, arbitrary file writes, data exfiltration, and denial-of-service conditions affecting healthcare data integration workflows. These vulnerabilities highlight the growing security risks in healthcare integration platforms as attackers increasingly target healthcare infrastructure. The disclosure comes amid heightened scrutiny of healthcare cybersecurity following recent high-profile attacks on medical systems and the critical role of data integration platforms in healthcare operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Check Point Patches Critical VPN Certificate Vulnerabilities Enabling Unauthenticated RCE
Check Point Patches Critical VPN Certificate Vulnerabilities Enabling Unauthenticated RCE
Financial Services1 month ago

Check Point Patches Critical VPN Certificate Vulnerabilities Enabling Unauthenticated RCE

Check Point disclosed two critical vulnerabilities (CVE-2026-85102 and CVE-2026-85103) in September 2026, both rated 9.8 CVSS, affecting its Security Gateways and Management Server products. The flaws involve improper VPN certificate validation and a heap-based buffer overflow during ASN.1 certificate decoding, enabling unauthenticated remote code execution under specific conditions. Check Point discovered both vulnerabilities internally with no evidence of active exploitation, and began distributing fixes via Live Patch and Jumbo Hotfix updates on September 9, 2026. These vulnerabilities highlight the ongoing challenge of VPN infrastructure security as organizations continue expanding remote access capabilities. The discovery follows a pattern of critical VPN flaws throughout 2026, emphasizing the need for robust certificate validation mechanisms and proactive patch management in network security appliances.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports