Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
CISA Issues Urgent Directive on Fortinet FortiSandbox Vulnerabilities
In July 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent directive for federal agencies to patch two critical vulnerabilities in Fortinet's FortiSandbox platform, identified as CVE-2026-39808 and CVE-2026-25089. These flaws, disclosed in April and June 2026 respectively, allow unauthenticated attackers to execute arbitrary code remotely via command injection attacks. Despite Fortinet's initial advisories, threat intelligence firm Defused observed active exploitation of these vulnerabilities in mid-June 2026, prompting CISA to mandate immediate remediation by July 19, 2026. The exploitation of these vulnerabilities underscores a growing trend of attackers targeting critical infrastructure components. FortiSandbox, integral to many organizations' security architectures, has become a focal point for cyber threats. This incident highlights the necessity for organizations to promptly apply security patches and maintain vigilant monitoring to mitigate emerging threats.
2 months ago
Kill Chain
Understanding the 'LegacyHive' Windows Zero-Day Vulnerability
In July 2026, a security researcher known as 'Nightmare Eclipse' disclosed a zero-day vulnerability named 'LegacyHive' affecting fully patched Windows systems. This local privilege escalation flaw in the Windows User Profile Service allows attackers with local access to load other users' registry hives, including those of administrators, potentially leading to unauthorized access and control over sensitive data. The researcher released a proof-of-concept (PoC) exploit, which, while requiring additional user credentials, still poses a significant security risk. The release of 'LegacyHive' underscores a growing trend of public disclosure of zero-day vulnerabilities, often as a form of protest against perceived mishandling by software vendors. This incident highlights the critical need for organizations to implement robust security measures, including timely patch management and monitoring for unusual system activities, to mitigate the risks associated with such vulnerabilities.
2 months ago
Kill Chain
Understanding the HollowByte OpenSSL DoS Vulnerability
In July 2026, a critical vulnerability known as 'HollowByte' was identified in OpenSSL, allowing unauthenticated attackers to induce a denial-of-service (DoS) condition on servers by sending a mere 11-byte payload. This flaw exploits the TLS handshake process, where the server allocates memory based on the declared size in the handshake header without verifying the actual payload size. Consequently, attackers can cause excessive memory allocation, leading to server instability or crashes. The OpenSSL team has addressed this issue in version 4.0.1 and backported fixes to earlier versions. Organizations are urged to update their OpenSSL installations promptly to mitigate potential disruptions. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/?utm_source=openai)) The HollowByte vulnerability underscores the persistent risks associated with foundational internet security protocols. As cyber threats evolve, it is imperative for organizations to remain vigilant, ensuring timely updates and robust security practices to safeguard against emerging vulnerabilities.
2 months ago
Kill Chain
OpenSSL HollowByte Flaw: Critical DoS Vulnerability Discovered
In July 2026, a vulnerability named 'HollowByte' was discovered in OpenSSL, allowing unauthenticated attackers to trigger a denial-of-service (DoS) condition on servers by sending a malicious 11-byte payload. This flaw causes the server to allocate significant memory for a message that never arrives, leading to potential service disruptions. The OpenSSL team has silently patched this vulnerability without assigning a CVE identifier or issuing an advisory. Organizations relying on OpenSSL for secure communications should prioritize updating to the latest patched versions to mitigate this risk. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/hollowbyte-ddos-flaw-bloats-openssl-server-memory-with-11-byte-payload/?utm_source=openai)) The HollowByte vulnerability underscores the critical importance of timely patch management and the need for organizations to stay vigilant about silent fixes in widely used libraries. As cyber threats continue to evolve, ensuring that foundational security components like OpenSSL are up-to-date is essential to maintain robust defense mechanisms.
2 months ago
Kill Chain
Salt Typhoon Cyberattack 2024: A Wake-Up Call for Surveillance System Security
In October 2024, the Salt Typhoon cyberattack, allegedly backed by China, targeted U.S. wiretap systems, granting attackers access to sensitive intelligence and law enforcement communications collected by major U.S. internet service providers such as Verizon, AT&T, and Lumen Technologies. The breach exploited systems designed for lawful surveillance, highlighting vulnerabilities in government-mandated surveillance infrastructure. This incident underscores the critical need for robust cybersecurity measures to protect sensitive communication channels from state-sponsored cyber espionage. The Salt Typhoon attack is part of a broader pattern of advanced persistent threats linked to Beijing, raising significant national security concerns regarding foreign access to critical U.S. surveillance infrastructure.
2 months ago
Kill Chain
BoryptGrab Malware Campaign Exploits Fake GitHub Repositories in 2026
In July 2026, cybersecurity researchers uncovered a large-scale malware campaign involving 292 fake GitHub repositories impersonating legitimate software projects. These repositories distributed a variant of the BoryptGrab infostealer, which targets sensitive data from web browsers, cryptocurrency wallets, and messaging applications. The malware was delivered through trojanized installers that exploited DLL side-loading techniques, allowing attackers to harvest credentials and financial information from unsuspecting users. The campaign primarily targeted users in the United States, Germany, Romania, and Venezuela, leading to significant data breaches and financial losses. This incident underscores the growing trend of cybercriminals leveraging trusted platforms like GitHub to distribute malware. The sophistication of the campaign, including the use of search engine optimization to promote malicious repositories, highlights the need for enhanced vigilance and verification processes when downloading software from online sources.
2 months ago
Kill Chain
ACR Stealer's ClickFix Campaign: A Wake-Up Call for Cybersecurity
In mid-2026, the ACR Stealer malware exploited ClickFix social engineering tactics to infiltrate enterprise networks. By deceiving users into executing commands via fake verification prompts, attackers deployed two primary infection chains: one utilizing WebDAV and PowerShell scripts, and another employing mshta.exe with obfuscated PowerShell. Both methods aimed to exfiltrate browser-stored credentials, session tokens, and sensitive Microsoft 365 documents, including files from OneDrive and SharePoint. This incident underscores a significant shift towards sophisticated social engineering attacks that bypass traditional security measures. The reliance on user interaction highlights the critical need for enhanced user awareness and robust endpoint protection strategies to mitigate such threats.
2 months ago
Kill Chain
CISA Adds Exploited SharePoint RCE Zero-Day CVE-2026-58644 to KEV
In July 2026, Microsoft disclosed CVE-2026-58644, a critical deserialization vulnerability in SharePoint Server, allowing unauthenticated remote code execution. This flaw affects SharePoint Server Subscription Edition, 2019, and Enterprise Server 2016. Exploitation requires an attacker to send a specially crafted network request, leading to potential full server compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by July 19, 2026. The inclusion of CVE-2026-58644 in CISA's catalog underscores the urgency of addressing this vulnerability, as it has been actively exploited in the wild. Organizations using affected SharePoint versions should prioritize patching to mitigate the risk of unauthorized access and potential data breaches.
2 months ago
Kill Chain
GoSerpent Malware: A Persistent Threat to Southeast Asian Governments
In late 2025, cybersecurity researchers identified a new malware strain named GoSerpent, actively targeting government and diplomatic entities in Southeast Asia. Discovered by Kaspersky in February 2026, GoSerpent is designed to establish long-term access for intelligence gathering by connecting to external servers and deploying secondary payloads for data collection and credential dumping. The malware's capabilities include setting up SOCKS5 proxy servers, enabling attackers to route traffic through compromised hosts and mask their true IP addresses. Additional tools such as ThumbcacheService for file collection and Mimikatz for credential extraction have been employed to facilitate data exfiltration through network shared drives. ([thehackernews.com](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html?utm_source=openai)) The resurgence of GoSerpent in May 2026, with evolved tools like the Stowaway RAT and enhanced data exfiltration methods, underscores the persistent and adaptive nature of cyber threats targeting sensitive government information. This incident highlights the critical need for robust cybersecurity measures and continuous monitoring to detect and mitigate sophisticated espionage campaigns. ([thehackernews.com](https://thehackernews.com/2026/07/new-goserpent-malware-targets-southeast.html?utm_source=openai))
2 months ago
Kill Chain
Armenia Detains Russian Tourist Mistaken for REvil Hacker
In June 2026, Armenian authorities detained Russian tourist Aleksandr Yuryevich Ermakov at Yerevan's Zvartnots airport, acting on a U.S. extradition request for a REvil ransomware suspect named Aleksandr Gennadievich Ermakov. The U.S. alleges that the wanted individual participated in Sodinokibi/REvil attacks from April 2019 to July 2021, affecting over 1,000 victims, including entities in the Northern District of Texas. However, the detained man's lawyers assert that he is not the individual sought by the U.S., highlighting discrepancies in personal details and emphasizing that the actual suspect is serving a sentence in Russia, restricting his travel. This incident underscores the complexities and potential misidentifications in international cybercrime enforcement efforts, especially when dealing with common names and limited identifying information. It also highlights the ongoing global pursuit of REvil affiliates, reflecting the persistent threat posed by ransomware groups and the challenges in dismantling their networks.
2 months ago
Kill Chain
CISA Adds Three Exploited Vulnerabilities to KEV Catalog
On July 16, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. The vulnerabilities include two OS command injection flaws in Fortinet FortiSandbox (CVE-2026-25089 and CVE-2026-39808) and a deserialization of untrusted data vulnerability in Microsoft SharePoint (CVE-2026-58644). These vulnerabilities are commonly exploited by malicious actors and pose significant risks to federal enterprises. The inclusion of these vulnerabilities in the KEV Catalog underscores the critical need for organizations to prioritize patching and remediation efforts. With the increasing frequency of such exploits, it is imperative for entities to adopt risk-based vulnerability management practices to safeguard their systems against potential breaches.
2 months ago
Kill Chain
Scattered Spider's 2024 Cyberattack on Transport for London: A Case Study
Between August 31 and September 3, 2024, the cybercriminal group Scattered Spider executed a sophisticated cyberattack on Transport for London (TfL). Utilizing social engineering techniques, they infiltrated TfL's network, leading to significant disruptions in technical services, including the Oyster payment system and third-party APIs. The attack necessitated a mass password reset for all 28,000 TfL employees and resulted in financial losses estimated at £29 million. ([nationalcrimeagency.gov.uk](https://www.nationalcrimeagency.gov.uk/news/cyber-criminals-who-hacked-into-transport-for-londons-computer-network-are-convicted?utm_source=openai)) This incident underscores the escalating threat posed by cybercriminal groups employing advanced social engineering tactics to target critical infrastructure. Organizations must enhance their cybersecurity measures, particularly in employee training and network security protocols, to mitigate such risks.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports