Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 54 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 637–648 / 3243 reports
PaperCut Zero-Day Exploits Force Double Emergency Patches for Critical RCE Flaws
Higher Education/Acadamia2 months ago

PaperCut Zero-Day Exploits Force Double Emergency Patches for Critical RCE Flaws

In August 2026, PaperCut released emergency patches for two actively exploited zero-day vulnerabilities (CVE-2026-82078 and CVE-2026-81578) affecting PaperCut NG and MF print management software. The vulnerabilities allowed unauthenticated attackers to bypass authentication and achieve remote code execution on vulnerable servers. After security researchers discovered multiple bypass techniques for the initial patches, PaperCut was forced to release a second emergency patch with additional hardening measures. The attacks appear to be limited and targeted, with threat actors conducting system reconnaissance on compromised servers. This incident highlights the persistent threat to network-accessible management interfaces and the growing sophistication of attackers who can quickly develop bypass techniques for security patches. It underscores the critical importance of implementing zero-trust network segmentation and egress controls to limit the impact of successful initial compromises.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Critical PaperCut Vulnerability Chain Enables Unauthenticated Remote Code Execution
Higher Education/Acadamia2 months ago

Critical PaperCut Vulnerability Chain Enables Unauthenticated Remote Code Execution

In August 2026, threat actors actively exploited two chained vulnerabilities in PaperCut NG and MF print management software to achieve unauthenticated remote code execution. CVE-2026-81578 (CVSS 8.8) allows attackers to bypass authentication through improper access control, while CVE-2026-82078 (CVSS 9.4) enables unsafe dynamic class loading for arbitrary code execution. Huntress researchers observed limited exploitation targeting internet-facing instances, with attackers performing reconnaissance commands and deploying Java payloads to fingerprint systems and exfiltrate data before cleaning up evidence. This incident highlights the growing trend of vulnerability chaining attacks targeting enterprise infrastructure software, particularly as organizations increasingly rely on cloud-connected print management systems that often lack proper network segmentation and access controls.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Berlin Government Refuses Ransom After Rhysida Steals 5.79TB of Citizen Data
Government Administration2 months ago

Berlin Government Refuses Ransom After Rhysida Steals 5.79TB of Citizen Data

In August 2026, the Rhysida ransomware group successfully infiltrated Berlin's state administrative network, exfiltrating 5.79 terabytes of data including personal information on over 12,000 individuals between August 7-12. The attackers gained initial access through compromised VPN credentials and deployed double extortion tactics, demanding ransom payment while threatening to leak stolen government data. Berlin's leadership, including Governing Mayor Kai Wegner, publicly refused to pay the ransom despite ongoing extortion attempts, maintaining operations while conducting forensic investigation with federal authorities. This incident highlights the continued evolution of ransomware groups targeting critical government infrastructure, particularly as threat actors like Rhysida increasingly focus on high-profile public sector victims to maximize pressure and potential payouts through leaked sensitive citizen data.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
NovaCookies Phishing Campaign Weaponizes DocuSign to Hijack Microsoft 365 Sessions
Financial Services2 months ago

NovaCookies Phishing Campaign Weaponizes DocuSign to Hijack Microsoft 365 Sessions

NovaCookies, a subscription-based phishing platform advertised on Telegram for $320 monthly, has compromised hundreds of organizations across the U.S., U.K., Germany, and U.A.E. by systematically targeting Microsoft 365 sessions. Operating as an Adversary-in-the-Middle proxy, the platform exploits legitimate DocuSign services to deliver counterfeit document-sharing notifications that bypass standard security filters. The attack uses OAuth error-redirect techniques to guide victims through legitimate Microsoft endpoints before routing them to phishing infrastructure, enabling real-time theft of credentials and multi-factor authentication codes. This incident highlights the evolving sophistication of phishing-as-a-service platforms that leverage trusted cloud services to evade detection, representing a growing trend where threat actors weaponize legitimate business applications to conduct large-scale credential harvesting operations against corporate networks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
ZBT Router Backdoors: How Chinese Manufacturer Compromised Global Networks
Telecommunications2 months ago

ZBT Router Backdoors: How Chinese Manufacturer Compromised Global Networks

In August 2026, security researchers discovered that Shenzhen Zhibotong Electronics Co. Ltd. (ZBT), a major Chinese router manufacturer, had embedded multiple backdoors in firmware across millions of white-label routers sold globally. The backdoors, dubbed 'EndlessDoors,' 'SpeakingStone,' and 'DarkLantern,' provided root-level access and command-and-control capabilities to attackers. With ZBT producing 3.57 million units annually and exporting to over 50 countries including the US, Canada, Germany, and Australia, the supply chain compromise potentially affected hundreds of thousands of edge devices in critical infrastructure, corporate networks, and remote installations like oil pipelines. This incident exemplifies the growing threat of nation-state supply chain attacks targeting network infrastructure, particularly as organizations increasingly deploy edge devices with cellular connectivity in remote locations that are difficult to monitor and update.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
APT28 Deploys New HOOKEDGE Backdoor Against European Diplomatic Targets
Government Administration2 months ago

APT28 Deploys New HOOKEDGE Backdoor Against European Diplomatic Targets

Between September 2025 and April 2026, Russian state-sponsored threat actor APT28 (Fancy Bear) conducted cyber espionage campaigns against government and diplomatic organizations in Romania, Spain, and Turkey using a previously undocumented backdoor called HOOKEDGE. The lightweight Windows batch script was delivered through macro-enabled Microsoft Word documents with diplomatic-themed lures, representing an evolution of APT28's HEADLACE backdoor with improved evasion capabilities and webhook-based command-and-control infrastructure. This incident highlights the persistent targeting of European diplomatic entities by Russian APT groups amid ongoing geopolitical tensions, demonstrating how threat actors continuously refine lightweight tooling to maintain access while adapting to defensive countermeasures and infrastructure limitations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PaperCut Zero-Day Exploitation: Securing Enterprise Print Infrastructure
Higher Education/Acadamia2 months ago

PaperCut Zero-Day Exploitation: Securing Enterprise Print Infrastructure

In August 2026, PaperCut disclosed that threat actors were actively exploiting a zero-day vulnerability affecting all versions of PaperCut NG and MF print management software. The company confirmed multiple customer incidents and released emergency patches for versions 25 and 26. Attackers targeted internet-exposed PaperCut Application Servers, with indicators including suspicious post-exploitation activity from pc-app.exe processes and manipulated database logs. The vulnerability allowed unauthorized access to print management systems used across enterprise environments globally. This incident highlights the continued targeting of enterprise infrastructure software, particularly print management systems that often have broad network access and limited security oversight in corporate environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Factory Implants in ZBT Routers Expose Global Supply Chain Security Crisis
Telecommunications2 months ago

Factory Implants in ZBT Routers Expose Global Supply Chain Security Crisis

In August 2026, VulnCheck disclosed two previously undocumented factory implants, SPEAKINGSTONE and DARKLANTERN, found in firmware for routers manufactured by Shenzhen Zhibotong Electronics (ZBT). Both implants, tracked as CVE-2026-74232 and CVE-2026-74233 with CVSS scores of 9.3-9.8, provide unauthenticated remote attackers with root access to affected devices. SPEAKINGSTONE operates as a surveillance implant that beacons to hardcoded command-and-control servers, while DARKLANTERN listens on UDP port 9992 with ineffective authentication. VulnCheck identified over 200 internet-facing DARKLANTERN instances across 22 countries and received beacons from 392 unique devices when they registered the backup C2 domain. This incident highlights the growing threat of supply chain attacks targeting network infrastructure, particularly as organizations increasingly rely on low-cost networking equipment from overseas manufacturers. The discovery comes amid heightened awareness of nation-state activities targeting critical infrastructure and follows similar findings in Chinese-manufactured networking equipment.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog - Immediate Action Required
Government Administration2 months ago

CISA Adds Three Actively Exploited Vulnerabilities to KEV Catalog - Immediate Action Required

In August 2026, CISA added three critical vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. The additions include CVE-2023-49105 affecting ownCloud's authentication mechanisms, CVE-2026-53362 targeting Linux kernel systems, and CVE-2026-66384 exploiting JFrog Artifactory's path traversal controls. These vulnerabilities represent significant attack vectors that threat actors are actively leveraging to compromise federal and enterprise systems, with exploitation potentially leading to complete system compromise and unauthorized access to sensitive data repositories. The timing of these KEV additions coincides with increased scrutiny on federal cybersecurity following recent high-profile breaches and the implementation of BOD 26-04, which mandates risk-based vulnerability management for federal agencies. Organizations face mounting pressure to rapidly patch these specific vulnerabilities while implementing comprehensive visibility and control measures to prevent similar exploitation attempts.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
ServiceNow AI Platform Hit by Three CVSS 10.0 Vulnerabilities Enabling Unauthenticated Code Execution
Information Technology/IT2 months ago

ServiceNow AI Platform Hit by Three CVSS 10.0 Vulnerabilities Enabling Unauthenticated Code Execution

In August 2026, ServiceNow disclosed four critical security vulnerabilities in its AI Platform, including three rated 10.0 on the CVSS scale. The flaws include CVE-2026-18885 (GraphQL code injection), CVE-2026-18886 (improper access control), and CVE-2026-74820 (SQL injection), all exploitable by unauthenticated attackers to execute arbitrary code, escalate privileges, and access sensitive data. ServiceNow deployed patches to hosted instances but left self-hosted customers to apply fixes independently, creating potential exposure windows for organizations managing their own deployments. This incident highlights the growing threat landscape surrounding AI platforms and enterprise software-as-a-service solutions. With the increasing adoption of AI-powered business applications and the recent trend of maximum-severity vulnerabilities in cloud platforms, organizations face elevated risks from sophisticated attacks targeting critical infrastructure components that handle sensitive corporate data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Unit 42 Confirms First AI-Enhanced Multi-Vector Cyberattacks in the Wild
Financial Services2 months ago

Unit 42 Confirms First AI-Enhanced Multi-Vector Cyberattacks in the Wild

Palo Alto Networks' Unit 42 has documented a significant escalation in cybersecurity threats, reporting the first confirmed case of AI-enhanced multi-vector attacks in the wild. In one investigated incident, attackers leveraged agentic AI frameworks to exploit 50 enterprise applications and vulnerabilities within 10 hours—a process that would have traditionally taken 10 days. The attackers demonstrated machine-speed reconnaissance, vulnerability discovery, and exploitation across the entire attack chain, representing what Unit 42 characterizes as a generational shift in cybersecurity. This development validates Unit 42's April 2024 prediction that AI capabilities demonstrated in controlled environments would reach adversaries within a year. The emergence of these attacks coincides with widespread availability of frontier AI models and agentic frameworks, fundamentally altering the threat landscape and challenging existing defensive strategies built for human-speed attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Emergency CISA Directive: Citrix NetScaler RCE Vulnerability Under Active Attack
Government Administration2 months ago

Emergency CISA Directive: Citrix NetScaler RCE Vulnerability Under Active Attack

CISA has issued an emergency directive ordering federal agencies to patch Citrix NetScaler appliances by August 29, 2026, following active exploitation of CVE-2026-8452, a high-severity memory overflow vulnerability. The flaw affects NetScaler ADC and Gateway appliances configured with VPN or AAA virtual servers, allowing unauthenticated attackers to achieve remote code execution as root. Initially categorized by Citrix as only capable of denial-of-service attacks, security researchers later demonstrated full RCE capabilities, leading to widespread "pray and spray" attacks deploying web shells on compromised systems. This incident highlights the critical security risks facing network infrastructure devices, particularly as threat actors increasingly target VPN and gateway appliances for initial access. With over 22,000 NetScaler ADC and 1,800 Gateway instances exposed online, this vulnerability represents a significant attack surface that could enable lateral movement and data exfiltration across enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports