Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 57 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 673–684 / 3243 reports
CISA Red Team Results Expose Critical Cybersecurity Gaps in Government vs Water Sector
Government Administration2 months ago

CISA Red Team Results Expose Critical Cybersecurity Gaps in Government vs Water Sector

In 2024, CISA conducted red team exercises against two organizations - one government and one water sector entity - with dramatically different outcomes. Both organizations were successfully breached through phishing campaigns, but while the government organization failed to detect or respond to the simulated attack, allowing red teamers to gain elevated privileges and move laterally across systems undetected, the water sector organization quickly identified the intrusion and quarantined affected systems within 2-20 minutes. The exercise revealed critical gaps in detection capabilities, cloud security controls, and incident response procedures across both sectors. This incident highlights the urgent need for improved cybersecurity defenses in critical infrastructure sectors, particularly as nation-state actors increasingly target water facilities and government systems. The stark contrast in detection and response capabilities demonstrates the growing maturity gap in cybersecurity readiness across different sectors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Mass Zimbra Server Compromise: CVE-2026-73570 Exploitation Reaches 270+ Instances
Government Administration2 months ago

Mass Zimbra Server Compromise: CVE-2026-73570 Exploitation Reaches 270+ Instances

In August 2026, threat actors exploited CVE-2026-73570, a high-severity command injection vulnerability in Zimbra Collaboration Suite's SNMP monitoring component, to compromise over 270 Zimbra instances worldwide. The vulnerability allows unauthenticated attackers to achieve remote code execution when SNMP notifications are enabled. Despite Synacor patching the flaw in ZCS version 10.1.20 on July 20, 2026, CERT Polska and Shadowserver reported active exploitation with over 8,200 unpatched instances still exposed. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch within three days. This incident underscores the continued targeting of email infrastructure by cybercriminals and state-sponsored groups, particularly given Zimbra's widespread use among government agencies and businesses. The rapid exploitation timeline and global scale of compromises highlight the critical importance of timely patch management for Internet-facing collaboration platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Major DDoS Attack Cripples Norway's Government Digital Services
Government Administration2 months ago

Major DDoS Attack Cripples Norway's Government Digital Services

A large-scale distributed denial-of-service (DDoS) attack disrupted Norway's shared government digital infrastructure starting August 25, 2026, at 03:38 CEST. The attack targeted services operated by the Norwegian Digitalization Agency (Digdir) and its provider Vivicta, affecting critical public services including ID-porten electronic IDs, eSignering digital signatures, secure government mail, and inter-agency data exchange. Multiple services experienced complete unavailability for periods, with citizens encountering failed connections, slow responses, and extended login times across tax administration, business communication platforms, and public record access systems. This incident represents the third DDoS attack against Norway's digital government infrastructure in 2026, highlighting the increasing targeting of critical national digital services by threat actors seeking to disrupt public sector operations and citizen access to essential government services.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
AnonyMousKIT Deploys AI Voice Agents in Sophisticated iPhone Passcode Phishing Campaign
Telecommunications2 months ago

AnonyMousKIT Deploys AI Voice Agents in Sophisticated iPhone Passcode Phishing Campaign

AnonyMousKIT, a phishing-as-a-service platform active since early 2024, exploits voice AI agents to extract passcodes from stolen iPhone owners and bypass Apple's Activation Lock security feature. The operation spans 506 domains with 168 storefront brands as resellers, conducting over 200 calls to victims between August 2025 and May 2026. The AI agents impersonate Apple Support representatives, convincing victims to provide device passcodes and Apple ID credentials through sophisticated social engineering tactics, enabling attackers to unlock stolen devices, access iCloud data, and resell hardware at premium prices. This incident represents the alarming evolution of cybercriminal infrastructure, where AI-powered automation enables large-scale social engineering attacks targeting mobile device security. As voice AI becomes more sophisticated and accessible, threat actors are leveraging these technologies to circumvent traditional phishing detection methods and exploit human trust in voice communications.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Zimbra's Critical RCE Flaw Highlights the New Reality of Emergency Patching
Government Administration2 months ago

Zimbra's Critical RCE Flaw Highlights the New Reality of Emergency Patching

In August 2026, CISA issued a three-day emergency patching directive for CVE-2026-73570, a critical remote code execution vulnerability in Zimbra Collaboration Suite. The flaw allows unauthenticated attackers to execute arbitrary commands on servers with SNMP notifications enabled through specially crafted SMTP requests. Active exploitation was reported by Poland's CERT Polska, prompting the accelerated response timeline. Successful attacks provide access to email communications, calendars, contacts, and organizational intelligence that can facilitate follow-on attacks. This incident exemplifies the shrinking window between vulnerability disclosure and active exploitation, driven by AI-enabled exploit development that reduces the time from patch analysis to working exploits from weeks to mere days.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Oracle WebLogic Under Attack: CVE-2026-21962 Exploitation Campaign Analysis
Government Administration2 months ago

Oracle WebLogic Under Attack: CVE-2026-21962 Exploitation Campaign Analysis

In August 2026, CISA added CVE-2026-21962, a maximum-severity Oracle WebLogic Server vulnerability, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw allows unauthenticated attackers with network access to compromise Oracle HTTP Server and WebLogic Server Proxy Plug-ins, leading to unauthorized data access and modification. Despite patches being available since January 2026, threat actors have actively exploited this vulnerability alongside other persistent WebLogic flaws, with researchers observing coordinated attacks from specific IP addresses targeting multiple enterprise environments. This incident demonstrates the ongoing challenge of patch management in enterprise environments and the persistent threat to web-facing Oracle infrastructure. The vulnerability's exploitation highlights how attackers continue leveraging a small set of highly-effective, simple-to-exploit vulnerabilities to compromise enterprise systems, particularly in organizations with delayed patching cycles.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
E4del and PINHOLE RATs Turn FTP Services Into Covert Communication Channels
Financial Services2 months ago

E4del and PINHOLE RATs Turn FTP Services Into Covert Communication Channels

Cybersecurity researchers have identified a sophisticated new campaign employing FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans (RATs) named E4del and PINHOLE. The threat actors behind this campaign are exploiting legitimate FTP services to establish command-and-control infrastructure while blending seamlessly with regular network traffic. This novel technique allows attackers to maintain persistent access to compromised systems while evading traditional detection methods that focus on more conventional C2 communication channels. The campaign demonstrates advanced operational security awareness and represents a significant evolution in how threat actors establish and maintain covert communication channels. This incident highlights the growing trend of threat actors exploiting legitimate services and protocols for malicious purposes, making detection increasingly challenging for traditional security tools. As organizations continue to expand their digital infrastructure, the abuse of standard network services like FTP for covert communication channels represents a critical blind spot in many security monitoring strategies.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
How Frontier AI Models Are Forcing a Vulnerability Management Revolution
Financial Services2 months ago

How Frontier AI Models Are Forcing a Vulnerability Management Revolution

The emergence of Frontier AI models like Anthropic's Mythos has fundamentally disrupted traditional vulnerability management practices by enabling machine-speed identification of zero-day flaws and automated exploit chaining. Organizations previously relying on CVSS scores, EPSS rankings, and CISA's KEV list now face an accelerated threat landscape where vulnerabilities are weaponized faster than legacy patching cycles can address them. This paradigm shift demands immediate transformation of vulnerability management programs toward exposure management frameworks that assess true organizational risk beyond traditional scoring metrics. The revolution requires automated patch deployment strategies, ring-based testing methodologies, and critical stakeholder conversations about uptime requirements versus security imperatives in an era of AI-driven exploit development. This transformation represents a critical inflection point as cybersecurity programs must evolve from reactive, siloed approaches to proactive, integrated vulnerability and patch management ecosystems capable of matching AI-driven threat velocity.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Escalates Oracle HTTP Server Vulnerability to KEV Status After Active Exploitation
Financial Services2 months ago

CISA Escalates Oracle HTTP Server Vulnerability to KEV Status After Active Exploitation

CISA has added CVE-2026-21962, an improper access control vulnerability in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. This vulnerability poses significant risks to federal enterprises and allows attackers to bypass authentication mechanisms, potentially leading to unauthorized system access and data compromise. The addition reinforces CISA's Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize rapid remediation of high-risk vulnerabilities that grant total control of assets post-exploitation. This incident highlights the ongoing trend of state-sponsored and cybercriminal groups increasingly targeting enterprise web infrastructure vulnerabilities, particularly Oracle systems that are widely deployed across government and critical infrastructure sectors, making immediate patching and risk assessment essential.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Red Team Assessment Exposes Critical Gap Between Strong and Weak SOC Operations
Government Administration2 months ago

CISA Red Team Assessment Exposes Critical Gap Between Strong and Weak SOC Operations

CISA conducted simultaneous red team assessments at two organizations in August 2026, revealing stark differences in defensive capabilities. Both organizations suffered full domain compromise and sensitive business system access, but Organization A failed to detect any malicious activity while Organization B rapidly identified and contained threats within 2-20 minutes. The assessments exposed critical gaps in cloud security, Active Directory configurations, and incident response processes across both critical infrastructure entities. This incident highlights the growing sophistication of identity-based attacks and the urgent need for organizations to mature their cloud security postures as threat actors increasingly target hybrid environments and exploit authentication mechanisms like Entra ID and AWS IAM.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Federal Agencies Race Against 3-Day Deadline to Patch Critical Zimbra Exploit
Government Administration2 months ago

Federal Agencies Race Against 3-Day Deadline to Patch Critical Zimbra Exploit

In August 2026, CISA issued an emergency directive ordering federal agencies to patch CVE-2026-73570 within three days after confirming active exploitation of a critical remote code execution vulnerability in Zimbra Collaboration Suite. The flaw allows unauthenticated attackers to execute arbitrary commands through improper input sanitization in the SNMP monitoring component. Over 270 compromised Zimbra instances have been identified, with more than 12,000 servers potentially exposed online, affecting hundreds of millions of users worldwide including government agencies. This incident highlights the accelerating pace of vulnerability exploitation and the persistent targeting of email infrastructure by threat actors. With Zimbra's extensive deployment across government and enterprise environments, and given recent APT campaigns targeting similar platforms, organizations face increased pressure to implement rapid patch management and enhanced monitoring capabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
South Korean Government Platform Breach Exposes 5,000 Records Due to Key Management Failures
Government Administration2 months ago

South Korean Government Platform Breach Exposes 5,000 Records Due to Key Management Failures

In July 2026, South Korea's government-backed startup support platform Modu-ui Changup suffered a data breach affecting approximately 5,000 applicants. The incident occurred when encryption keys were improperly exposed through API responses, allowing attackers to decrypt previously encrypted personal information including email addresses, startup ideas, and evaluation comments. Investigators identified 39 South Korean IP addresses involved in accessing the leaked data through AI-based web crawling techniques, with the breach attributed to fundamental failures in encryption key management architecture. This incident highlights the growing threat landscape where traditional encryption approaches fail when key management practices are inadequate, particularly as AI-driven attack methods become more sophisticated and government platforms face increased scrutiny for data protection failures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports