Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 53 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 625–636 / 3243 reports
Chinese QTFY Threat Actor Targeted Federal Agencies Through Sophisticated IoT Botnet Operations
Telecommunications2 months ago

Chinese QTFY Threat Actor Targeted Federal Agencies Through Sophisticated IoT Botnet Operations

In August 2026, the U.S. Department of Justice corrected previous statements about Chinese state-sponsored threat actor QTFY (QT AND QTCYBER), clarifying that federal agencies including NASA, DOE, DOJ, HHS, NIH, and the U.S. Senate were targeted rather than successfully compromised. QTFY, operating since 2018 through Nanjing Xinjiuwei Network Technology Co with backing from China's Ministry of State Security, provided reconnaissance and proxy services using tools like QScan vulnerability scanner and QTRouter obfuscation network. The FBI disrupted the group's infrastructure, which facilitated cyber espionage through an industrialized botnet of compromised IoT devices and leased VPS servers. This incident highlights the persistent and sophisticated nature of Chinese state-sponsored espionage campaigns targeting critical U.S. infrastructure, demonstrating how adversaries leverage compromised IoT devices to blend malicious traffic with legitimate network activity and evade detection through decentralized operational relay networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Fire Ant APT Turns Cisco Routers Into Credential Harvesting Platforms
Telecommunications2 months ago

Fire Ant APT Turns Cisco Routers Into Credential Harvesting Platforms

In 2026, the China-linked Fire Ant threat group expanded their espionage operations beyond VMware hypervisors to compromise Cisco IOS XR routers, TACACS servers, and Linux management hosts across high-value networks. The attackers transformed compromised routers into collection platforms, capturing network traffic, harvesting administrator credentials, and suppressing security logs to blind defenders. Fire Ant deployed custom malware including TacTap for credential theft, BridgeAgent backdoor, and router-specific implants that modified system libraries to hide their presence from network administrators. This incident demonstrates the evolving sophistication of nation-state actors targeting critical network infrastructure, particularly as organizations increasingly rely on hybrid cloud architectures. The attackers' ability to compromise trusted network devices highlights the growing threat to supply chain security and the need for enhanced monitoring of network edge devices that traditional security controls often overlook.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds Critical PaperCut Vulnerabilities to KEV Following Active Exploitation
Government Administration2 months ago

CISA Adds Critical PaperCut Vulnerabilities to KEV Following Active Exploitation

In August 2026, CISA added two critical PaperCut NG/MF vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. CVE-2026-81578 involves missing authentication for critical functions, while CVE-2026-82078 represents an unsafe reflection vulnerability. These vulnerabilities affect PaperCut's widely-deployed print management software used across enterprise environments. The addition to KEV indicates threat actors are actively leveraging these flaws to compromise federal and private sector organizations, potentially leading to unauthorized system access and lateral movement. This incident highlights the continuing evolution of attack vectors targeting enterprise infrastructure software, particularly as organizations increasingly rely on cloud-hybrid print management solutions that bridge on-premises and cloud environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Spring Ring Campaign: How Attackers Weaponized Microsoft Teams for Enterprise Compromise
Financial Services2 months ago

Spring Ring Campaign: How Attackers Weaponized Microsoft Teams for Enterprise Compromise

Between January and April 2026, cybersecurity researchers uncovered the Spring Ring operation, a coordinated social engineering campaign targeting over 150 employees across at least 10 organizations. Threat actors leveraged external Microsoft Teams accounts to impersonate IT help desk personnel, initiating voice phishing (vishing) calls that coerced victims into executing remote monitoring tools or custom malware. The most sophisticated variant escalated from vishing to NTLM relay attacks using PetitPotam exploits, targeting domain controllers for enterprise-wide compromise. The campaign demonstrates how attackers weaponize trusted collaboration platforms, exploiting the default "Chat with Anyone" feature to bypass traditional email-based security controls and establish direct communication channels with unsuspecting employees. This incident reflects the broader evolution of social engineering attacks, where collaboration tools have become the new frontier for cybercriminals. As organizations increasingly rely on SaaS platforms for daily operations, attackers are adapting their tactics to exploit the inherent trust users place in these environments, making identity-based attacks a critical emerging threat vector.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Silver Fox Weaponizes Signed Adware to Deploy ValleyRAT Backdoor
Computer Software/Engineering2 months ago

Silver Fox Weaponizes Signed Adware to Deploy ValleyRAT Backdoor

In August 2026, the Silver Fox threat actor deployed ValleyRAT backdoor malware disguised as QN Wallpaper, a legitimate Chinese adware application. The attack leveraged DLL sideloading techniques to execute malicious code within a signed process, bypassing security controls when users added the software to antivirus exclusions. The malware disabled Windows Defender, established persistence, and provided attackers with full remote access capabilities including keylogging, screenshot capture, and additional payload delivery. Kaspersky recorded over 100,000 detections affecting 1,500+ users primarily in China and India throughout 2026. This incident highlights the growing trend of threat actors weaponizing legitimate signed applications and exploiting user trust in digital certificates. As organizations increasingly rely on application whitelisting and signature-based security controls, attackers are adapting by compromising the software supply chain and abusing code signing processes to evade detection.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Legal Filing Prompt Injection Attack: When AI Security Meets the Courtroom
Law Practice/Law Firms2 months ago

Legal Filing Prompt Injection Attack: When AI Security Meets the Courtroom

In August 2026, a novel attack vector emerged where an individual embedded hidden AI instructions within a legal court filing, attempting to manipulate AI systems that might process the document to rule in their favor. This prompt injection attack represents a sophisticated evolution of adversarial AI techniques, moving beyond traditional digital platforms into legal and governmental processes. The incident demonstrates how threat actors are adapting prompt injection methods to exploit AI systems in critical decision-making contexts, potentially compromising judicial integrity and administrative processes. This incident highlights the growing urgency around AI security as organizations increasingly deploy AI systems for document processing, legal research, and decision support. With the rapid adoption of AI in government, healthcare, and enterprise environments, similar prompt injection attacks could target any AI-powered system that processes external documents or user inputs.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TerminalFix Malware Campaign Exploits Fake Cloudflare CAPTCHAs for Enterprise Network Access
Financial Services2 months ago

TerminalFix Malware Campaign Exploits Fake Cloudflare CAPTCHAs for Enterprise Network Access

In August 2026, Microsoft disclosed a sophisticated social engineering campaign called TerminalFix that uses fake Cloudflare CAPTCHA verifications on compromised websites to trick users into executing malicious PowerShell commands. The attack employs a multi-stage process involving DLL sideloading, steganographic payload extraction, Active Directory reconnaissance, and deployment of a Python-based reverse-tunnel implant that provides persistent network-level proxy access to attackers. This campaign represents a dangerous evolution of ClickFix techniques, specifically targeting enterprise environments across multiple sectors with the ability to escalate privileges, bypass security controls, exfiltrate data, and deploy ransomware. This incident highlights the growing sophistication of social engineering attacks that combine legitimate-looking interfaces with advanced post-exploitation techniques, reflecting the increased threat landscape complexity organizations face as attackers adapt their methods to bypass traditional security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
TerminalFix Campaign: When Fake CAPTCHAs Lead to Network Tunneling
Financial Services2 months ago

TerminalFix Campaign: When Fake CAPTCHAs Lead to Network Tunneling

Microsoft Threat Intelligence discovered the TerminalFix campaign in August 2026, a sophisticated evolution of ClickFix attacks targeting organizations across multiple industries. The campaign uses compromised websites displaying fake Cloudflare CAPTCHA verification overlays to trick users into executing malicious PowerShell commands through Windows Terminal. Unlike traditional ClickFix variants that deliver single infostealers, TerminalFix deploys a complex multi-stage attack chain combining DLL sideloading, steganographic payload extraction from PNG images, extensive Active Directory reconnaissance, and a custom Python-based reverse tunnel implant that provides persistent network-level proxy access through compromised hosts. This campaign represents a significant escalation in social engineering attacks, as it transforms victim machines into network pivot points for lateral movement and potential ransomware deployment. The sophisticated combination of legitimate binary abuse, steganographic concealment, and persistent tunneling capabilities demonstrates advanced threat actor evolution in bypassing modern security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
ATF Breach Exposes Critical Need for Federal Cybersecurity Enhancement
Government Administration2 months ago

ATF Breach Exposes Critical Need for Federal Cybersecurity Enhancement

In early 2025, the Bureau of Alcohol, Tobacco, Firearms and Explosives (ATF) confirmed a cyberattack on a standalone computer system containing sensitive information about investigation targets. The Qilin ransomware group, a Russian-speaking financially-motivated threat actor, claimed responsibility for the breach. ATF officials quickly isolated the affected system, which was not connected to other agency networks including case management or laboratory systems. The incident was classified as a major incident by senior ATF officials, though the agency maintained its operational capabilities remained unaffected. This attack represents a concerning escalation in ransomware targeting against federal law enforcement agencies. The Qilin group has become one of the most active global ransomware threats since 2022, claiming hundreds of victims across more than 60 countries. Their targeting of a federal law enforcement agency marks a significant shift in threat actor boldness, particularly given the sensitive nature of ATF investigation data and the unlikely prospect of ransom payment from a government entity.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
ServiceNow AI Platform Hit by Three Critical Security Vulnerabilities
Information Technology/IT2 months ago

ServiceNow AI Platform Hit by Three Critical Security Vulnerabilities

ServiceNow disclosed three critical maximum-severity vulnerabilities (CVE-2026-18885, CVE-2026-18886, CVE-2026-74820) in its AI Platform affecting over 100,000 enterprise applications at 85% of Fortune 500 companies. The flaws enable unauthenticated attackers to execute code injection, SQL injection, and privilege escalation attacks without user interaction. While no active exploitation has been confirmed, ServiceNow's history of targeted attacks and the platform's extensive enterprise adoption create significant risk exposure across critical business workflows. This disclosure highlights the growing attack surface of AI-integrated enterprise platforms as threat actors increasingly target foundational business infrastructure. The timing coincides with heightened scrutiny of platform security following recent high-profile breaches of similar enterprise SaaS providers.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Gitea Vulnerability Exposes 8,300+ Development Servers to Code Execution Attacks
Computer Software/Engineering2 months ago

Critical Gitea Vulnerability Exposes 8,300+ Development Servers to Code Execution Attacks

Over 8,300 Internet-exposed Gitea servers remain vulnerable to CVE-2026-60004, a critical code injection flaw that allows authenticated attackers to execute arbitrary shell commands through the diffpatch API endpoint. The vulnerability, reported by Salesforce security researcher Shai Rod, enables remote code execution with Gitea service account privileges by submitting malicious patches. With Gitea's default self-registration feature enabled, unauthenticated attackers can register accounts, create repositories, and exploit the flaw without prior credentials. Despite patches being available since July 27, 2026, threat actors are actively exploiting unpatched servers to deploy cryptocurrency mining malware. This incident highlights the growing threat landscape targeting DevOps infrastructure and self-hosted development platforms. As organizations increasingly adopt cloud-native development practices and hybrid environments, securing code repositories and CI/CD pipelines has become critical to preventing supply chain attacks and protecting intellectual property.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
ownCloud Vulnerability CVE-2023-49105 Exploited in Philippine Nuclear Espionage Campaign
Defense/Space2 months ago

ownCloud Vulnerability CVE-2023-49105 Exploited in Philippine Nuclear Espionage Campaign

In August 2026, a Chinese-speaking threat actor exploited CVE-2023-49105, a critical ownCloud WebDAV authentication bypass vulnerability, to steal sensitive nuclear research data from a Philippine research body. The attacker used custom Python scripts to exploit the flaw's pre-signed URL mechanism, downloading 176 files totaling 372 MB including nuclear material records, strategic plans, reactor components, and employee data. The incident also involved a parallel attack on a Philippine marine engineering company serving the Navy, exploiting CVE-2024-28000 in WordPress LiteSpeed Cache plugin, highlighting coordinated cyber espionage targeting Philippine defense and nuclear sectors. This incident underscores the escalating cyber threats targeting critical infrastructure in the Asia-Pacific region amid South China Sea tensions, with state-affiliated actors increasingly focusing on nuclear and defense-related intelligence gathering through unpatched cloud collaboration platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports