Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 52 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 613–624 / 3243 reports
FBI Warns of Sophisticated OAuth Consent Phishing Campaign Targeting Prominent Figures
Government Administration2 months ago

FBI Warns of Sophisticated OAuth Consent Phishing Campaign Targeting Prominent Figures

The FBI issued a public alert in late 2025 regarding a sophisticated OAuth consent phishing campaign targeting high-profile individuals, their family members, and associates through commercial messaging applications. Attackers impersonate government officials, journalists, and public personalities to trick victims into granting access to legitimate cloud services like Microsoft or Google under the pretense of reviewing documents. Once OAuth permissions are granted, attackers gain persistent access to emails, files, and sensitive data that cannot be revoked simply by changing passwords, requiring victims to manually invalidate tokens in application security settings. This campaign highlights the growing trend of identity-centric attacks that bypass traditional security measures including multi-factor authentication, representing a significant evolution in social engineering tactics that exploit trusted authentication protocols against prominent targets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
PaperCut Zero-Day Attack: How Print Infrastructure Became the New Attack Vector
Higher Education/Acadamia2 months ago

PaperCut Zero-Day Attack: How Print Infrastructure Became the New Attack Vector

Two critical zero-day vulnerabilities in PaperCut NG and MF print management software (CVE-2026-81578 and CVE-2026-82078) were actively exploited by threat actors in August 2026 for data theft attacks. The flaws can be chained to bypass authentication and achieve remote code execution on vulnerable servers used by over 100 million users across 70,000 organizations globally. PaperCut Software released three emergency patches within a week to address the vulnerabilities, but threat intelligence indicates attackers are exploiting these flaws to dump database tables and steal sensitive data from exposed servers. With over 800 PaperCut servers still exposed online and a history of ransomware groups targeting similar vulnerabilities, this incident highlights the critical risk posed by internet-facing print management infrastructure. This incident underscores the growing trend of attackers targeting enterprise software zero-days for immediate data theft rather than prolonged persistence, reflecting the increasing sophistication and speed of modern threat actors in monetizing newly discovered vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Exchange Server Vulnerability Leaves 22,000 Organizations at Risk
Financial Services2 months ago

Critical Exchange Server Vulnerability Leaves 22,000 Organizations at Risk

In September 2026, security researchers discovered that nearly 22,000 Microsoft Exchange servers remained vulnerable to CVE-2026-62911, a high-severity authentication bypass vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition. The flaw allows attackers with basic privileges to execute capture-replay attacks and hijack all user mailboxes on targeted servers. Despite Microsoft patching the vulnerability in August 2026, most servers remain unpatched, with Germany showing 85% of on-premises Exchange installations still vulnerable. The Netherlands NCSC reported that exploit code is already publicly available online. This incident highlights the persistent challenge of legacy system security as Exchange 2016 and 2019 reached end-of-support in October 2026, with Extended Security Updates ending the same month, leaving organizations exposed to mounting authentication bypass attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
TerminalFix Campaign Exposes Enterprise Vulnerability to PowerShell Social Engineering
Financial Services2 months ago

TerminalFix Campaign Exposes Enterprise Vulnerability to PowerShell Social Engineering

The TerminalFix campaign represents a sophisticated evolution of ClickFix social engineering attacks, targeting enterprise networks through fake Cloudflare CAPTCHA overlays that trick users into executing malicious PowerShell commands. First documented by Microsoft researchers in August 2026, this multistage attack establishes persistent access through DLL sideloading, steganographic payloads hidden in PNG images, and Python-based reverse tunnels that provide direct access to internal networks. The campaign has successfully compromised organizations across multiple industries, with attackers leveraging this access for privilege escalation, security control bypass, data exfiltration, and ransomware deployment. This incident highlights the growing sophistication of social engineering attacks that bypass traditional security controls by manipulating user trust and exploiting legitimate system tools like PowerShell for malicious purposes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
The Rise of Repeatable Cybercrime: How ClickFix Became 2026's Dominant Attack Vector
Financial Services2 months ago

The Rise of Repeatable Cybercrime: How ClickFix Became 2026's Dominant Attack Vector

In 2026, cybercriminals have shifted from developing sophisticated new attack methods to perfecting repeatable, scalable procedures that work consistently across targets. Microsoft's threat intelligence team identified ClickFix as the most common initial access method, accounting for 47% of observed attacks. This social engineering technique tricks users into executing malicious commands by placing them on their clipboard through deceptive web pages. Bitdefender's analysis of 700,000 security incidents revealed that 84% of high-severity breaches involved legitimate administrative tools already present on victim systems, demonstrating the widespread adoption of 'living off the land' tactics. This trend represents a fundamental evolution in cybercrime business models, where threat actors prioritize operational efficiency over technical innovation. The shift coincides with declining ransom payments and increased victim volumes, forcing attackers to optimize for cost-effectiveness and repeatability rather than sophistication.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Guildma (Astaroth) Malware Evolves with Advanced Geofencing and Evasion Techniques
Banking/Mortgage2 months ago

Guildma (Astaroth) Malware Evolves with Advanced Geofencing and Evasion Techniques

In August 2026, a sophisticated Guildma (Astaroth) malware campaign targeted Brazilian users through geofenced phishing emails written in Brazilian Portuguese. The attack required victims to access malicious links from Brazil-based IP addresses with Brazilian Portuguese language and regional settings, demonstrating advanced evasion techniques. The malware was delivered via a zip archive containing a Windows shortcut that utilized alternate data streams to deploy a 64-bit DLL, which subsequently installed an AutoIt-compiled Guildma payload for credential theft and information stealing. This campaign represents the continued evolution of Brazilian-origin banking trojans that have expanded globally, leveraging sophisticated geofencing and language-based targeting to evade detection and analysis. The use of legitimate cloud infrastructure like Azure websites and advanced evasion techniques demonstrates how threat actors are adapting to modern security controls while maintaining persistence through alternate data streams and AutoIt compilation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
DoD Refrigeration Systems Under Cyber Attack: When Supply Chains Become Attack Vectors
Defense/Space2 months ago

DoD Refrigeration Systems Under Cyber Attack: When Supply Chains Become Attack Vectors

In August 2026, multiple U.S. Department of Defense military base commissaries experienced simultaneous refrigeration system failures across at least seven installations, including Fort Irwin, F.E. Warren Air Force Base, Fort Huachuca, Naval Station Newport, Columbus Air Force Base, Travis Air Force Base, and Naval Air Station Lemoore. The coordinated nature and timing of these outages strongly suggests a sophisticated cyber attack targeting critical infrastructure systems within the military supply chain. The Pentagon acknowledged awareness of the disruptions but declined to provide details about the scope or attribution of the incidents. This incident highlights the growing threat to operational technology and IoT devices within critical infrastructure environments. As nation-state actors increasingly target supply chain vulnerabilities and connected systems, the simultaneous failure of refrigeration systems across geographically dispersed military installations demonstrates how cyber threats can disrupt essential services and potentially compromise food safety and operational readiness.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Federal Whistleblower Exposes Critical Security Flaws in USPS Election Systems
Government Administration2 months ago

Federal Whistleblower Exposes Critical Security Flaws in USPS Election Systems

A federal whistleblower has exposed critical security and operational flaws in the U.S. Postal Service's rushed deployment of three new IT systems designed to control mail-in ballot processing for the 2026 midterm elections. The complaint reveals that USPS bypassed standard software development practices, including pre-release testing and security validation, to implement systems that could reject entire batches of ballots based on single scanning errors. The Federal Ballot Mail Portal and associated verification systems were developed in a matter of weeks rather than months, creating significant risks to election integrity and voter disenfranchisement. This incident highlights the growing intersection of cybersecurity vulnerabilities and critical infrastructure, particularly as election systems become increasingly digitized without proper security oversight. The rushed deployment of untested systems in mission-critical environments reflects broader challenges organizations face when political pressure overrides established security protocols and development best practices.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Berlin Government Falls Victim to Rhysida Ransomware: 5.79TB of Critical Data Stolen
Government Administration2 months ago

Berlin Government Falls Victim to Rhysida Ransomware: 5.79TB of Critical Data Stolen

In August 2026, the Rhysida ransomware gang successfully breached Berlin's city administration network, exfiltrating 5.79 TB of sensitive government data comprising 1.44 million files. The attack, discovered in mid-August and publicly claimed on August 28, targeted multiple Senate departments including Mobility, Transport, Climate Protection and Environment. The stolen data includes government records, personnel files, plaintext credentials, banking information, classified documents, and critical infrastructure assessments of Berlin's water supply. Berlin's Mayor Kai Wergner confirmed the city will not pay the ransom, while federal security agencies investigate the incident. This attack highlights the escalating threat of ransomware groups targeting critical government infrastructure and the increasing sophistication of data exfiltration campaigns. With Rhysida leveraging GDPR violations as additional pressure tactics, the incident demonstrates how modern ransomware operators are weaponizing regulatory frameworks to maximize extortion potential against public sector entities.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Fire Ant Hackers Transform Cisco Routers Into Covert Espionage Platforms
Telecommunications2 months ago

Fire Ant Hackers Transform Cisco Routers Into Covert Espionage Platforms

Chinese Fire Ant hackers, linked to the UNC3886 espionage group, evolved their tactics in August 2026 by compromising Cisco IOS XR routers to establish covert surveillance platforms. The threat actors deployed custom malware creating hidden GRE tunnels, suppressed system logs, and transformed network infrastructure into collection points for traffic monitoring and reconnaissance. They captured network traffic via PCAP files uploaded to external FTP servers, exposing internal topology, authentication flows, and communications across trusted network paths to enable lateral movement into high-value connected environments. This incident highlights the growing trend of nation-state actors targeting critical network infrastructure as initial access points, moving beyond traditional endpoint compromises to leverage trusted network devices for persistent espionage operations and supply chain infiltration.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
North Korean Job Fraud Campaign Expands Beyond IT Into Healthcare and Sales Sectors
Health Care / Life Sciences2 months ago

North Korean Job Fraud Campaign Expands Beyond IT Into Healthcare and Sales Sectors

North Korean threat actors have significantly expanded their fraudulent employment scheme beyond the traditional IT sector, with confirmed infiltrations into healthcare, sales, and marketing roles across Fortune 500 companies and government agencies. The campaign, tracked as Famous Chollima, Jasper Sleet, and PurpleDelta, leverages AI-generated identities, stolen documents, and sophisticated deception techniques including real-time ChatGPT responses during interviews and KVM switches for remote device control. Recent investigations by Huntress and Recorded Future revealed workers using fabricated personas to apply to over 1,100 companies, generating millions in illicit revenue that funds North Korea's nuclear weapons program while creating unprecedented insider threats for organizations worldwide. This expansion represents a critical evolution in state-sponsored infiltration tactics, as traditional cybersecurity defenses prove inadequate against legitimately hired employees who perform actual work while potentially accessing sensitive data and systems from within trusted network perimeters.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
ValleyRAT Backdoor Campaign: When Adware Becomes Advanced Persistent Threat
Computer Software/Engineering2 months ago

ValleyRAT Backdoor Campaign: When Adware Becomes Advanced Persistent Threat

In 2024, cybersecurity researchers discovered ValleyRAT backdoor malware masquerading as legitimate adware, specifically targeting users through a modified Chinese desktop wallpaper management tool called QN Wallpaper. The attack campaign, attributed to the Silver Fox threat group, affected over 100,000 detections across more than 1,500 unique users, primarily in China and India. The malware used DLL sideloading techniques to execute under signed processes, disabled Windows Defender, and deployed sophisticated backdoor capabilities including keylogging, clipboard monitoring, screenshot capture, and remote module loading for additional payload deployment. This incident highlights the evolving threat landscape where attackers increasingly abuse legitimate software distribution channels and signed binaries to evade detection, representing a significant shift toward supply chain compromises and living-off-the-land techniques that challenge traditional security approaches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports