Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 59 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 697–708 / 3243 reports
Delta Flight 591 Wi-Fi Hack: When DEF CON Tools Turn Into In-Flight Threats
Airlines/Aviation2 months ago

Delta Flight 591 Wi-Fi Hack: When DEF CON Tools Turn Into In-Flight Threats

In August 2026, a passenger on Delta Air Lines Flight 591 from Las Vegas to Atlanta compromised the aircraft's in-flight Wi-Fi system following the Black Hat and DEF CON conferences. The attacker disabled the legitimate Wi-Fi service and created a rogue access point named "Delta WiFi Fast" that redirected users to a phishing page designed to harvest credentials. Federal authorities launched an investigation into the incident, with suspicion falling on DEF CON attendees who may have used commercially available Wi-Fi Pineapple devices purchased at the conference. This incident highlights the growing risk of in-flight cybersecurity threats as aviation systems become increasingly connected. The ease with which commercially available penetration testing tools can be weaponized in confined, high-security environments demonstrates critical gaps in aviation cybersecurity protocols and passenger device restrictions during flight operations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Microsoft Entra ID Maximum-Severity Flaw Exploited: CVE-2026-69836 Analysis
Financial Services2 months ago

Microsoft Entra ID Maximum-Severity Flaw Exploited: CVE-2026-69836 Analysis

Microsoft disclosed a maximum-severity vulnerability (CVE-2026-69836, CVSS 10.0) in Entra ID that allowed remote code execution through deserialization of untrusted data. The flaw, discovered by security engineer Robert Fitzpatrick, was actively exploited in the wild before Microsoft implemented full mitigation. The vulnerability affected Microsoft's cloud-based identity and access management service, formerly known as Azure Active Directory, enabling unauthorized attackers to execute code over a network without proper validation of user-controlled data. This incident highlights the continued targeting of identity infrastructure by sophisticated threat actors, coinciding with increased attacks on cloud authentication services and the growing adoption of zero-trust architectures across enterprise environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
SANS Researchers Expose Massive Entra ID Password Spray Campaign
Financial Services2 months ago

SANS Researchers Expose Massive Entra ID Password Spray Campaign

Security researchers at SANS Internet Storm Center have documented widespread password spray attacks targeting Microsoft Entra ID (formerly Azure AD) environments, with attackers systematically attempting authentication against multiple user accounts using common passwords. The attacks, detected through PowerShell-based log analysis of Entra ID audit logs, showed attackers leveraging rotating proxy services to evade IP-based blocking while targeting organizations that had migrated to cloud services but failed to implement proper monitoring. Multiple organizations were found to have inadequate conditional access policies, allowing attackers to probe authentication systems from unexpected geographic locations and compromise accounts through credential stuffing techniques. This incident highlights the critical gap many organizations face when transitioning to cloud infrastructure - abandoning the rigorous log monitoring practices they maintained for on-premises systems, creating blind spots that attackers actively exploit through automated credential attacks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Adds Critical TrueConf Server Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA Adds Critical TrueConf Server Vulnerabilities to Known Exploited Vulnerabilities Catalog

CISA has added two critical TrueConf Server vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. CVE-2026-72529 involves missing authentication for critical functions, while CVE-2026-72530 represents a code injection vulnerability, both allowing attackers to gain total control of affected systems. These vulnerabilities pose significant risks to federal enterprises and private organizations using TrueConf's video conferencing solutions, with threat actors actively leveraging these flaws to establish persistent access and execute unauthorized commands on compromised servers. This incident highlights the growing trend of attackers targeting collaboration and communication platforms, particularly as hybrid work environments continue to expand the attack surface of enterprise networks and create new pathways for initial compromise and lateral movement.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Johnson Controls Fire Safety System Exposes Credentials in Memory: CVE-2026-27875 Analysis

Johnson Controls Fire Safety System Exposes Credentials in Memory: CVE-2026-27875 Analysis

Johnson Controls Simplex Incident Manager versions 2.01 and earlier contain a critical vulnerability (CVE-2026-27875) that stores user credentials including passwords and authentication tokens in unencrypted form within system memory. This cleartext storage vulnerability allows local attackers with low privileges to extract sensitive authentication data using memory-dumping tools, potentially leading to unauthorized access to fire safety systems and connected critical infrastructure. The vulnerability affects fire safety management systems deployed worldwide across critical manufacturing, commercial facilities, government services, transportation systems, and energy sectors. Johnson Controls has released patched version 2.01.01 to address this security flaw and recommends immediate upgrades along with enhanced access controls and endpoint monitoring. This incident highlights the growing concern over insecure credential management in industrial control systems as threat actors increasingly target OT environments. With fire safety systems being critical infrastructure components, credential exposure vulnerabilities pose significant risks to facility security and emergency response capabilities.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Active Exploitation of Critical Zimbra RCE Vulnerability Threatens Email Infrastructure Worldwide

Active Exploitation of Critical Zimbra RCE Vulnerability Threatens Email Infrastructure Worldwide

In August 2026, CERT Polska warned that attackers are actively exploiting CVE-2026-73570, a critical remote code execution vulnerability in Zimbra Collaboration Suite. The flaw allows unauthenticated attackers to execute arbitrary commands through improper sanitization in the SNMP monitoring component. With over 12,100 Zimbra servers exposed online globally, this vulnerability poses significant risks to hundreds of millions of users across businesses and government agencies worldwide. The Zimbra security team released a patch in version 10.1.20 on July 20, 2026. This incident highlights the ongoing trend of nation-state actors and cybercriminals targeting collaboration platforms for initial access and credential harvesting. Zimbra vulnerabilities have been consistently exploited by Russian APT groups including Winter Vivern, APT29, and APT28, making rapid patching and monitoring critical for organizations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Critical MLflow AI Platform Vulnerability Exploited for Cloud Credential Theft

Critical MLflow AI Platform Vulnerability Exploited for Cloud Credential Theft

CISA added CVE-2026-64849, a critical DNS-rebinding server-side request forgery vulnerability in MLflow's webhook delivery system, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw allows unauthenticated attackers to remotely access internal services and cloud metadata configurations on unpatched MLflow instances, enabling theft of AWS IAM credentials and other sensitive data. MLflow, an open-source AI engineering platform with over 30 million monthly downloads, patched the vulnerability in version 3.15.0, but federal agencies have only two weeks to secure their systems under BOD 26-04. This incident highlights the growing attack surface created by AI infrastructure components as organizations rapidly adopt machine learning platforms without adequate security hardening, making AI systems prime targets for credential theft and lateral movement.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(low)
Read report
Manic Android Malware Introduces Peer-to-Peer Data Exfiltration via Nearby Devices
Banking/Mortgage2 months ago

Manic Android Malware Introduces Peer-to-Peer Data Exfiltration via Nearby Devices

The Manic Android malware, active since February 2026, represents a sophisticated mobile threat targeting banking, government, and cryptocurrency applications across Central and Western Europe, with primary focus on Ukraine. This malware employs transparent overlays to capture user inputs, leverages Android Accessibility services for comprehensive device control, and implements an innovative peer-to-peer data exfiltration mechanism using Wi-Fi Direct and Bluetooth connections through nearby infected devices. Manic can intercept SMS messages, capture lock PINs, monitor screens, collect location data, and provide remote access to operators via WebRTC sessions, targeting over 169 applications including banking, eID, payment, and authenticator apps. This incident highlights the evolving sophistication of mobile banking malware and the increasing threat to critical infrastructure applications, particularly government eID systems, as attackers develop novel exfiltration methods that bypass traditional network-based security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Citrix NetScaler Authentication Bypass Vulnerabilities Demand Immediate Action
Financial Services2 months ago

Critical Citrix NetScaler Authentication Bypass Vulnerabilities Demand Immediate Action

On August 20, 2026, Citrix disclosed two critical vulnerabilities affecting NetScaler Gateway and NetScaler ADC appliances. The most severe flaw, CVE-2026-19490, allows remote unauthenticated attackers to bypass authentication when appliances are configured as AAA virtual servers or Gateway services with SAML Action enabled. The second vulnerability, CVE-2026-19489, enables denial-of-service attacks when SIP ALG is enabled on large-scale NAT configurations. With over 24,000 NetScaler instances exposed online and Citrix's history of 22 exploited vulnerabilities in five years, immediate patching is critical. This incident highlights the continuing trend of authentication bypass vulnerabilities targeting enterprise network infrastructure, particularly VPN and remote access solutions that became critical during hybrid work adoption and remain prime targets for initial access in modern cyber campaigns.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Russian APT29 Clusters Weaponize OAuth and WhatsApp in Sophisticated 2026 Espionage Campaign

Russian APT29 Clusters Weaponize OAuth and WhatsApp in Sophisticated 2026 Espionage Campaign

Between March and August 2026, three suspected Russian cyber espionage clusters (UNC6293, UNC7005, and UNC5976) conducted sophisticated authentication-focused attacks targeting academics, diplomats, defense personnel, and think tank researchers across Europe and the United States. The threat actors, linked to APT29/Ice Relic operations, exploited legitimate OAuth flows, WhatsApp device linking, and captive Wi-Fi portals to compromise personal accounts through highly targeted phishing campaigns. Their operations included the CaptiveCrunch campaign that hijacked hotel and airport Wi-Fi networks, deployed CornFlake RAT and ChocoShell infostealers, and potentially compromised managed service providers in supply chain attacks affecting approximately 70 victim locations globally. These incidents highlight the evolving threat landscape where state-sponsored actors increasingly abuse legitimate authentication mechanisms and trusted infrastructure to bypass traditional security controls, making detection significantly more challenging for organizations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
How Pakistan's Transparent Tribe Exploited Cybersecurity Gaps in Afghan Infrastructure
Telecommunications2 months ago

How Pakistan's Transparent Tribe Exploited Cybersecurity Gaps in Afghan Infrastructure

Pakistan's Transparent Tribe (APT36) conducted an active cyber espionage campaign against Afghan government and telecommunications organizations from December 2025 through August 2026, deploying new malware variants including Patchcord and Sheetcord backdoors. The threat actor successfully compromised an Afghan Telecom IT officer and an international company's Afghan subsidiary, stealing sensitive data and WhatsApp communications for further social engineering attacks. While attacks against Indian government agencies including the Ministries of Defense and Foreign Affairs were attempted, these were unsuccessful due to India's superior cybersecurity defenses and proactive blocking by CERT-In. This incident highlights the growing sophistication of regional APT groups targeting countries with immature cybersecurity infrastructures, particularly in the context of heightened geopolitical tensions in South Asia and the Taliban's governance challenges in Afghanistan.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
NASA Spacecraft Control Vulnerability Highlights Critical Infrastructure Security Gaps
Defense/Space2 months ago

NASA Spacecraft Control Vulnerability Highlights Critical Infrastructure Security Gaps

In August 2026, Cycode security researchers disclosed critical vulnerabilities in NASA's AIT-GUI spacecraft control software that allowed unauthenticated attackers to issue arbitrary commands to spacecraft and instruments. The flaw chain, rated 9.4 CVSS, affected AIT-GUI versions 2.5.1 and earlier, exposing command endpoints without authentication, authorization, or CSRF protection. Attackers could execute server-side scripts, run command sequences, and issue spacecraft commands via simple HTTP POST requests to the web interface that bound to all network interfaces by default. This incident highlights the growing risk of AI-assisted vulnerability research and the critical need for secure-by-default configurations in operational technology environments. As space infrastructure becomes increasingly digitized and interconnected, authentication gaps in command and control systems represent existential risks to mission-critical operations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Looking for threats in a different sector?

Browse All Threat Reports