Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 48 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 565–576 / 3243 reports
Telerik UI Padding Oracle Exploit: CVE-2026-13181 RCE Chain Puts Web Apps at Risk
Telerik UI Padding Oracle Exploit: CVE-2026-13181 RCE Chain Puts Web Apps at Risk
Computer Software/Engineering2 months ago

Telerik UI Padding Oracle Exploit: CVE-2026-13181 RCE Chain Puts Web Apps at Risk

In July 2026, Progress Software patched a critical vulnerability chain in Telerik UI for ASP.NET AJAX (CVE-2026-13181) that allows unauthenticated remote code execution. Security firm TantoSec released a working exploit in September 2026, demonstrating how attackers can chain a padding oracle vulnerability with unguarded type resolution to achieve code execution on vulnerable web applications. The attack requires specific non-default configurations including custom encryption keys, affecting versions 2010.1.309 through 2026.2.519. While no confirmed exploitation has been reported for these specific CVEs, the Telerik component has a history of being targeted by ransomware groups and nation-state actors through previous vulnerabilities. This incident highlights the persistent risks in web application components and the importance of timely patching, especially given Telerik's history as a favored target for sophisticated threat actors seeking initial access to enterprise networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
PaperCut Vulnerabilities Exploited in Massive Credential Theft Campaign Against Schools
PaperCut Vulnerabilities Exploited in Massive Credential Theft Campaign Against Schools
Higher Education/Acadamia2 months ago

PaperCut Vulnerabilities Exploited in Massive Credential Theft Campaign Against Schools

In September 2026, threat actors actively exploited two chained PaperCut vulnerabilities (CVE-2026-81578 and CVE-2026-82078) to conduct widespread credential theft attacks against educational institutions across the United States and Europe. The attack chain leveraged an authentication bypass vulnerability followed by remote code execution to deploy registry harvesting tools, Metasploit payloads, and create privileged accounts on compromised print management servers. Arctic Wolf researchers observed attackers systematically extracting Windows registry hives, searching configuration files for sensitive credentials, and establishing persistent access through Meterpreter sessions, targeting organizations from K-12 schools to major universities. This campaign highlights the continued targeting of educational infrastructure, which often lacks robust security controls and runs legacy systems with delayed patching cycles, making institutions particularly vulnerable to supply chain and third-party application exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Flags Critical Chrome V8 Vulnerability CVE-2026-85046 for Active Exploitation
CISA Flags Critical Chrome V8 Vulnerability CVE-2026-85046 for Active Exploitation
Computer Software/Engineering2 months ago

CISA Flags Critical Chrome V8 Vulnerability CVE-2026-85046 for Active Exploitation

CISA added CVE-2026-85046, a Google Chromium V8 type confusion vulnerability, to its Known Exploited Vulnerabilities (KEV) Catalog on September 4, 2026, based on evidence of active exploitation. Type confusion vulnerabilities in browser engines allow attackers to bypass memory protections and achieve arbitrary code execution, making them highly valuable for threat actors targeting end users. The vulnerability poses significant risks to federal enterprises and requires immediate patching under BOD 26-04. Browser-based attacks continue to represent a critical threat vector as organizations increasingly rely on web applications and remote work environments. V8 engine vulnerabilities are particularly concerning due to Chrome's widespread adoption and the potential for supply chain attacks through compromised websites.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Serbian Government Spyware Campaign Threatens EU Accession Amid Surveillance Scandal
Serbian Government Spyware Campaign Threatens EU Accession Amid Surveillance Scandal
Government Administration2 months ago

Serbian Government Spyware Campaign Threatens EU Accession Amid Surveillance Scandal

In 2024, Serbian government authorities conducted systematic surveillance operations against student activists and political opposition using Pegasus and NoviSpy spyware. The SHARE Foundation, in collaboration with Amnesty International and The Citizen Lab, discovered infections on activists' phones, with evidence linking NoviSpy deployments directly to Serbian state authorities. The campaign targeted individuals ahead of elections, representing a coordinated effort to suppress political dissent through digital surveillance. This surveillance operation has prompted 29 European Parliament members to demand delays in Serbia's EU accession process until a full investigation is completed and rule-of-law accountability is established. This incident exemplifies the growing trend of nation-state actors weaponizing commercial spyware against civil society, particularly in countries seeking international legitimacy while simultaneously suppressing domestic opposition through sophisticated surveillance technologies.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Chrome Zero-Day CVE-2026-85046: Enterprise Defense Against Browser Exploitation
Chrome Zero-Day CVE-2026-85046: Enterprise Defense Against Browser Exploitation
Banking/Mortgage2 months ago

Chrome Zero-Day CVE-2026-85046: Enterprise Defense Against Browser Exploitation

In September 2026, Google patched CVE-2026-85046, a high-severity type confusion vulnerability in Chrome's V8 JavaScript engine that was actively exploited in the wild. The zero-day flaw, discovered by security researcher Salvatore Gulizia, could be triggered through specially crafted HTML pages containing malicious JavaScript, potentially enabling remote code execution within Chrome's sandboxed renderer process. This marked the sixth actively exploited Chrome zero-day patched by Google in 2026, highlighting an escalating pattern of browser-based attacks targeting the widely-used V8 engine across multiple incidents throughout the year. This incident underscores the current surge in browser exploitation campaigns as attackers increasingly target client-side vulnerabilities to establish initial access, particularly through JavaScript engines that process untrusted web content at scale across millions of users daily.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CrowdStrike FalconFlank Zero-Day Exposes Critical Endpoint Security Risks
CrowdStrike FalconFlank Zero-Day Exposes Critical Endpoint Security Risks
Computer/Network Security2 months ago

CrowdStrike FalconFlank Zero-Day Exposes Critical Endpoint Security Risks

In September 2026, security researcher 'Nightmare Eclipse' disclosed FalconFlank, a zero-day privilege escalation vulnerability affecting CrowdStrike Falcon's endpoint security platform on Windows 11 and Windows Server systems. The exploit abuses the Office malicious macros remediation feature to spawn command prompts with SYSTEM privileges, allowing attackers to gain administrative control over protected endpoints. CrowdStrike acknowledged the vulnerability and advised customers to disable the Microsoft Office File Suspicious Macro Removal policy setting while maintaining protection through Cloud Anti-malware settings. This disclosure was part of a broader campaign by the researcher targeting multiple security vendors including Kaspersky, Avast, and Nvidia with similar zero-day exploits. The incident highlights ongoing challenges in endpoint security software becoming attack vectors themselves, particularly as organizations increasingly rely on comprehensive security suites for protection.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
39 New Attack Methods Compromise Passkey Authentication Security
39 New Attack Methods Compromise Passkey Authentication Security
Financial Services2 months ago

39 New Attack Methods Compromise Passkey Authentication Security

Security researchers have documented 39 distinct methods for compromising passkey authentication systems, revealing critical vulnerabilities in the infrastructure surrounding FIDO2 cryptography. These attack vectors include assertion mining, prompt flooding, credential interface deception, synced vault compromise, and malicious enrollment processes. While the core FIDO2 cryptography remains intact, attackers are successfully exploiting weaknesses in browsers, operating systems, cloud synchronization services, and user interfaces to bypass authentication controls. This research highlights the urgent need for enterprises to reassess their passwordless authentication strategies, as attackers are increasingly targeting the ecosystem around passkeys rather than the cryptographic protocols themselves.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Toy Ghouls Evolves with Custom HiveMQ and Element Backdoors
Toy Ghouls Evolves with Custom HiveMQ and Element Backdoors
Financial Services2 months ago

Toy Ghouls Evolves with Custom HiveMQ and Element Backdoors

In July 2026, cybersecurity researchers identified two custom backdoors developed by the Toy Ghouls threat group (also known as Bearlyfy, Laboo.boo, and Feral Wolf), marking a significant evolution in their tactics. The financially motivated group, which has been targeting Russian organizations since 2025, deployed mqtt-bird-agent and matrix-bird-agent backdoors that use unconventional communication channels - the HiveMQ MQTT broker and Element messenger respectively. These backdoors are delivered via Windows Remote Management (WinRM) and establish persistence as Windows services, enabling full remote control of infected systems through encrypted configuration files and regular command execution capabilities. This represents a shift from the group's previous reliance on publicly available tools and leaked ransomware builders toward sophisticated custom malware development. The evolution of Toy Ghouls demonstrates the increasing sophistication of financially motivated threat actors who are developing novel communication methods to evade traditional security detection mechanisms and maintain persistent access to compromised environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Citrix NetScaler Authentication Bypass Under Active Exploitation
Critical Citrix NetScaler Authentication Bypass Under Active Exploitation
Financial Services2 months ago

Critical Citrix NetScaler Authentication Bypass Under Active Exploitation

In September 2026, attackers began exploiting CVE-2026-19490, a critical authentication bypass vulnerability in Citrix NetScaler appliances configured as AAA virtual servers or Gateway services. Security researchers at Previdian detected exploitation attempts from Australia, United States, and Germany targeting this flaw that allows unprivileged threat actors to bypass authentication remotely. With over 22,000 NetScaler ADC appliances and nearly 1,700 Gateway instances exposed online according to Shadowserver, this represents a significant attack surface for organizations relying on these critical infrastructure components. This incident highlights the accelerating timeline between vulnerability disclosure and active exploitation, as attackers quickly weaponized publicly available proof-of-concept code. The pattern mirrors previous Citrix vulnerabilities that have been extensively abused by ransomware groups, making immediate patching critical for preventing potential breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Mythos 5 AI Demonstrates Autonomous Cyber Attacks: The 6-Month Countdown Begins
Mythos 5 AI Demonstrates Autonomous Cyber Attacks: The 6-Month Countdown Begins
Financial Services2 months ago

Mythos 5 AI Demonstrates Autonomous Cyber Attacks: The 6-Month Countdown Begins

In September 2026, Booz Allen Hamilton confirmed that Anthropic's Mythos 5 AI model achieved autonomous end-to-end network compromise capabilities, scoring 80 on their new Cyber Weapon Index. The model successfully executed complete attack chains without human intervention, demonstrating reconnaissance, exploitation, and lateral movement across production-grade enterprise networks. This milestone represents a fundamental shift in cybersecurity threats, as AI-powered attacks can now operate at machine speed and scale, compressing traditional multi-week attack timelines into days or hours. The emergence of autonomous AI attackers marks a critical inflection point where traditional human-speed defenses become inadequate against machine-speed offensive operations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
GPT-6 Astra Scores Perfect on ExploitBench: The Dawn of AI-Powered Cyber Warfare
GPT-6 Astra Scores Perfect on ExploitBench: The Dawn of AI-Powered Cyber Warfare
Computer Software/Engineering2 months ago

GPT-6 Astra Scores Perfect on ExploitBench: The Dawn of AI-Powered Cyber Warfare

OpenAI released GPT-6 Astra in September 2026, achieving a perfect 100% score on ExploitBench, demonstrating unprecedented AI-driven exploit development capabilities including zero-day vulnerability exploitation and privilege escalation on hardened systems. While the public release includes safeguards blocking proof-of-concept exploit generation, the underlying model can autonomously develop working exploits for recently disclosed vulnerabilities and achieve arbitrary code execution in secured environments. OpenAI launched the $1 billion Daybreak initiative to provide subsidized access to defensive cybersecurity organizations while restricting offensive capabilities. This incident highlights the critical dual-use nature of frontier AI models as cyber weapons become increasingly accessible through artificial intelligence, requiring immediate policy frameworks for AI-powered exploit development and defensive capability distribution.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Chrome V8 Zero-Day CVE-2026-85046: Critical Browser Security Incident Analysis
Chrome V8 Zero-Day CVE-2026-85046: Critical Browser Security Incident Analysis
Banking/Mortgage2 months ago

Chrome V8 Zero-Day CVE-2026-85046: Critical Browser Security Incident Analysis

Google patched CVE-2026-85046, a high-severity type confusion vulnerability in Chrome's V8 JavaScript engine, actively exploited in the wild. The zero-day flaw allowed remote attackers to execute arbitrary code through crafted HTML pages, representing the sixth Chrome zero-day addressed by Google in 2026. Security researcher Salvatore Gulizia discovered the bug in V8's compilers that led to array element type confusion, enabling arbitrary read/write operations on the JavaScript heap. This incident highlights the continued targeting of browser engines by threat actors seeking code execution capabilities through web-based attack vectors, emphasizing the critical importance of rapid patch deployment for client-side security vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports