Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 46 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 541–552 / 3243 reports
Microsoft's Record-Breaking 974 CVE Patch Tuesday: Zero-Days and Wormable Threats Demand Immediate Action
Microsoft's Record-Breaking 974 CVE Patch Tuesday: Zero-Days and Wormable Threats Demand Immediate Action
Financial Services2 months ago

Microsoft's Record-Breaking 974 CVE Patch Tuesday: Zero-Days and Wormable Threats Demand Immediate Action

Microsoft's September 2026 Patch Tuesday set a new record with 974 CVEs, marking the fourth consecutive month of substantially larger security updates driven by AI-assisted vulnerability discovery. Two zero-day vulnerabilities (CVE-2026-85880 and CVE-2026-81963) are under active exploitation, targeting Windows Advanced Local Procedure Call and Windows Update Stack respectively. The release includes 13 critical flaws, 20 wormable CVEs creating network contagion risks, and a cluster of near-maximum severity remote code execution bugs affecting Windows Shell, NFS services, and Microsoft Word. With 438 elevation of privilege vulnerabilities and 260 remote code execution flaws, attackers gained unprecedented attack surface across Windows, Office, SQL Server, and Azure environments. This massive vulnerability disclosure represents the new normal as AI transforms cybersecurity landscapes, creating larger attack surfaces while simultaneously enabling faster discovery of long-standing security gaps before malicious actors can exploit them.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How Attackers Use Multi-Hop Google Redirects to Bypass Email Security
How Attackers Use Multi-Hop Google Redirects to Bypass Email Security
Financial Services2 months ago

How Attackers Use Multi-Hop Google Redirects to Bypass Email Security

In September 2026, cybersecurity researchers at KnowBe4 identified a sophisticated phishing campaign exploiting multiple Google services to evade detection systems. Threat actors chained together Google Meet, DoubleClick, Google Custom Search, and other Google infrastructure to create multi-hop redirect sequences that appear legitimate to security gateways. The campaign dynamically constructs credential harvesting pages based on victim email addresses and deploys ScreenConnect remote access tools through fake identity verification prompts. Victims' stolen credentials are delivered to operators via Telegram channels within seconds, along with IP addresses, geolocation data, and organizational details. This incident highlights the evolving sophistication of phishing attacks that abuse trusted infrastructure to bypass traditional security controls. As threat actors increasingly leverage legitimate cloud services for malicious purposes, organizations face growing challenges in detecting attacks that appear benign at every inspection point until the final malicious payload is delivered.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Workflow Identity Hijacking: The New AI Attack Vector Bypassing Enterprise Security
Workflow Identity Hijacking: The New AI Attack Vector Bypassing Enterprise Security
Financial Services2 months ago

Workflow Identity Hijacking: The New AI Attack Vector Bypassing Enterprise Security

Security researchers at Noma Labs have identified a new AI attack vector called 'workflow identity hijacking' that exploits authorization design flaws in enterprise AI pipelines. The attack allows threat actors to bypass standard security controls by sending seemingly benign requests through unauthenticated entry points like support emails or web forms. The AI workflow processes these requests using high-privilege service accounts, enabling unauthorized data access and exfiltration without traditional prompt injection techniques. This represents a fundamental shift from model manipulation to identity delegation vulnerabilities in AI systems. This attack vector is particularly relevant now as organizations rapidly deploy AI automation without proper identity scoping and least privilege principles, creating widespread exposure to data breaches through seemingly legitimate AI interactions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft's Record 974-Vulnerability Patch Release Signals AI-Driven Security Era
Microsoft's Record 974-Vulnerability Patch Release Signals AI-Driven Security Era
Government Administration2 months ago

Microsoft's Record 974-Vulnerability Patch Release Signals AI-Driven Security Era

In September 2026, Microsoft released a record-breaking security update addressing 974 vulnerabilities across its software portfolio, including two actively exploited zero-day flaws (CVE-2026-85880 and CVE-2026-81963). Both zero-days are privilege escalation vulnerabilities affecting Windows Advanced Local Procedure Call and Windows Update Stack respectively, allowing attackers to gain SYSTEM-level privileges. The massive patch release included 723 Windows vulnerabilities, 111 Office flaws, and over 110 critical severity issues, bringing Microsoft's 2026 total to over 2,600 patches - more than double the previous annual record. This unprecedented vulnerability disclosure reflects the acceleration of AI-assisted security research and automated vulnerability discovery tools. The scale demonstrates how artificial intelligence is revolutionizing both offensive security research and defensive patching cycles, fundamentally changing the threat landscape and forcing organizations to adapt their vulnerability management strategies for an era of exponential security disclosure growth.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical SAP Kernel Vulnerability Exposes Enterprise Systems to Complete Compromise
Critical SAP Kernel Vulnerability Exposes Enterprise Systems to Complete Compromise
Financial Services2 months ago

Critical SAP Kernel Vulnerability Exposes Enterprise Systems to Complete Compromise

SAP released critical security updates in September 2026 addressing multiple vulnerabilities, including CVE-2026-44756, a maximum-severity CVSS 10.0 flaw in SAP Extended Passport Processing. Discovered by Onapsis and codenamed OVERPASS, this memory corruption vulnerability allows unauthenticated remote attackers to execute arbitrary operating system commands with SAP administrative privileges. The flaw affects SAP kernel code across multiple protocols including web, GUI, and RFC layers, making it reachable through internet-facing components without requiring credentials. Successful exploitation enables complete compromise of SAP business data, lateral movement to connected systems, and manipulation of critical application configurations. This incident highlights the growing threat landscape targeting enterprise resource planning systems as organizations increasingly digitize their core business processes. With SAP systems managing critical financial and operational data for thousands of enterprises globally, kernel-level vulnerabilities represent existential risks that bypass traditional authentication controls and demand immediate remediation efforts.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
ShieldCrash Exposes Critical Gap in Microsoft Defender Patch Strategy
ShieldCrash Exposes Critical Gap in Microsoft Defender Patch Strategy
Computer/Network Security2 months ago

ShieldCrash Exposes Critical Gap in Microsoft Defender Patch Strategy

In September 2026, security researcher Chaotic Eclipse demonstrated a critical patch bypass vulnerability dubbed 'ShieldCrash' affecting Microsoft Defender's Malware Protection Engine. This zero-day exploit bypasses the incomplete fix for CVE-2026-69414 (ShieldBreak), allowing arbitrary file read operations with SYSTEM privileges on all supported Windows versions. Despite Microsoft's August 2026 patch addressing the original ShieldBreak vulnerability, the researcher revealed that specific attack vectors remained unpatched, enabling continued exploitation of the same underlying security flaw through alternative code paths. This incident highlights the growing trend of researchers discovering incomplete security patches in enterprise endpoint protection platforms, with similar vulnerabilities recently disclosed in CrowdStrike Falcon, Kaspersky, and Avast products, demonstrating systemic challenges in comprehensive vulnerability remediation across the cybersecurity industry.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
F5 BIG-IP Under Attack: Memory-Resident Web Shell Evades Traditional Detection
F5 BIG-IP Under Attack: Memory-Resident Web Shell Evades Traditional Detection
Financial Services2 months ago

F5 BIG-IP Under Attack: Memory-Resident Web Shell Evades Traditional Detection

A sophisticated malware campaign targeting F5 BIG-IP Access Policy Manager appliances exploits CVE-2025-53521 to inject PHP web shells directly into memory rather than storing them on disk. The malware, tracked as c05d5254 and PoisonedRefresh, hooks Apache functions to modify three specific PHP scripts in memory when loaded, enabling command execution through normal web requests while evading traditional file-based detection. The attack chain begins with exploitation of the critical remote code execution vulnerability (CVSS 9.8) and establishes persistence through infected system binaries and installation media. This incident highlights the evolution of fileless malware techniques and the growing sophistication of infrastructure-focused attacks. As organizations increasingly rely on application delivery controllers and load balancers for critical services, attackers are developing advanced evasion techniques that challenge traditional security monitoring approaches, making network-level visibility and behavioral analysis essential for detection.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
CISA's September 2026 KEV Update: Four Critical Vulnerabilities Under New Federal Mandate
CISA's September 2026 KEV Update: Four Critical Vulnerabilities Under New Federal Mandate
Computer Software/Engineering2 months ago

CISA's September 2026 KEV Update: Four Critical Vulnerabilities Under New Federal Mandate

On September 8, 2026, CISA added four actively exploited vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, including critical flaws in Adobe Commerce/Magento (CVE-2026-75650), Microsoft Windows (CVE-2026-81963, CVE-2026-85880), and N-able N-central (CVE-2026-86218). These vulnerabilities enable template injection attacks, privilege escalation through link following, heap-based buffer overflow exploitation, and static code injection in management platforms. The additions coincide with the new Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize remediation of high-risk vulnerabilities that grant total system control post-exploitation. This incident reflects the ongoing evolution of vulnerability management from traditional patch-all approaches to risk-based prioritization, driven by increasingly sophisticated threat actors who rapidly weaponize disclosed vulnerabilities against internet-exposed infrastructure and enterprise management platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Chrome V8 Zero-Day Exploited in Wild: Critical Browser Security Implications for Enterprise
Chrome V8 Zero-Day Exploited in Wild: Critical Browser Security Implications for Enterprise
Banking/Mortgage2 months ago

Chrome V8 Zero-Day Exploited in Wild: Critical Browser Security Implications for Enterprise

In September 2026, Google patched CVE-2026-87491, an actively exploited zero-day vulnerability in Chrome's V8 JavaScript engine that allowed remote code execution within the browser sandbox. The out-of-bounds write flaw enabled attackers to execute arbitrary code through crafted HTML pages, representing the seventh Chrome zero-day exploited in the wild during 2026. Google acknowledged active exploitation but withheld details about the attack methods and threat actors to protect users during the patch deployment phase. This incident highlights the persistent targeting of browser engines by sophisticated threat actors who continue developing novel exploitation techniques against widely-used platforms. The frequency of Chrome zero-days in 2026 demonstrates an escalation in browser-based attacks as threat actors adapt to improved endpoint security measures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Chinese AI Companies Accused of Massive Intellectual Property Theft Through Model Distillation
Chinese AI Companies Accused of Massive Intellectual Property Theft Through Model Distillation
Computer Software/Engineering2 months ago

Chinese AI Companies Accused of Massive Intellectual Property Theft Through Model Distillation

U.S. intelligence agencies NSA, CISA, and FBI have accused Chinese AI companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI of conducting systematic industrial-scale distillation attacks against American frontier AI models since late 2024. These companies extracted billions of tokens from Anthropic Claude, OpenAI GPT, Google Gemini, and SpaceXAI Grok models through bulk premium subscriptions, API abuse, and proxy networks to circumvent geographic restrictions. The attacks violated terms of service and resulted in significantly reduced development timelines and costs for Chinese AI models while undermining intellectual property protections of U.S. companies. This incident highlights the evolving landscape of AI-powered intellectual property theft and the increasing sophistication of state-sponsored technology transfer operations, demonstrating how legitimate AI research techniques can be weaponized for competitive advantage at national scales.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Industrial-Scale AI Theft: How Chinese Companies Systematically Extracted US Frontier Model Capabilities
Industrial-Scale AI Theft: How Chinese Companies Systematically Extracted US Frontier Model Capabilities
Computer Software/Engineering2 months ago

Industrial-Scale AI Theft: How Chinese Companies Systematically Extracted US Frontier Model Capabilities

Since late 2024, Chinese artificial intelligence companies including DeepSeek, Moonshot AI, Alibaba, MiniMax, StepFun, and Z.AI have conducted systematic industrial-scale knowledge distillation campaigns against U.S. frontier AI models including Claude, GPT, Gemini, and Grok. These companies extracted billions of tokens across millions of API requests, violating terms of service while using sophisticated techniques including chain-of-thought reasoning extraction, automated failover systems, and gray market proxy networks to bypass geographic restrictions. The campaigns represent a core component of Chinese AI development strategy rather than supplementary research, enabling significantly reduced development costs and accelerated model training timelines while threatening U.S. technological leadership in artificial intelligence. This incident highlights the emerging threat of AI model theft through systematic knowledge distillation, representing a new category of intellectual property theft that combines traditional cybersecurity evasion techniques with advanced AI research methodologies, requiring coordinated industry-wide defensive measures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CareCam Pro IP Cameras Expose Critical Bootloader Vulnerability CVE-2026-85083
CareCam Pro IP Cameras Expose Critical Bootloader Vulnerability CVE-2026-85083
Health Care / Life Sciences2 months ago

CareCam Pro IP Cameras Expose Critical Bootloader Vulnerability CVE-2026-85083

CISA disclosed CVE-2026-85083, a critical vulnerability in CareCam Pro IP cameras (model ANJIA AJL33PC0801) that exposes hard-coded credentials in the bootloader authentication system. Attackers with physical access can exploit this weakness to gain privileged bootloader access, enabling unauthorized firmware modification and complete device compromise. The vulnerability affects devices deployed worldwide across commercial facilities, with CareCam reportedly unresponsive to coordination efforts from CISA. This incident highlights the persistent security challenges in IoT infrastructure where manufacturers continue to implement insecure authentication mechanisms. As organizations increasingly rely on IP cameras for security monitoring and operational visibility, such fundamental design flaws create significant attack surface expansion and compliance risks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports