Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
WhatsApp Phishing Campaign Installs ManageEngine RMM Tool via VBScript
In June 2026, a sophisticated phishing campaign was identified targeting users of WhatsApp Desktop and WhatsApp Web across multiple countries, including Malaysia, Brazil, India, Mexico, Singapore, the U.K., Spain, Taiwan, and Australia. Attackers utilized compromised WhatsApp accounts to distribute malicious Visual Basic Script (VBScript) files disguised as legitimate business documents, such as invoices and billing statements. Upon execution, these scripts installed ManageEngine Endpoint Central, a legitimate Remote Monitoring and Management (RMM) tool, granting attackers full remote control over the victim's system. This unauthorized access enabled the exfiltration of sensitive data, installation of additional malware, and potential lateral movement within corporate networks. This incident underscores a concerning trend in cyber threats where attackers leverage legitimate software tools to evade detection and maintain persistent access within compromised systems. The use of social engineering tactics, such as distributing malware through trusted communication platforms like WhatsApp, highlights the evolving nature of phishing campaigns and the necessity for organizations to enhance their security awareness training and implement robust endpoint protection measures.
2 months ago
Kill Chain
Critical Cisco Unified CM Vulnerability CVE-2026-20230 Under Active Exploitation
In June 2026, a critical server-side request forgery (SSRF) vulnerability, identified as CVE-2026-20230, was discovered in Cisco Unified Communications Manager (Unified CM) and its Session Management Edition (Unified CM SME). This flaw allows unauthenticated remote attackers to send crafted HTTP requests, enabling them to write files to the underlying operating system and potentially escalate privileges to root. Cisco released security updates on June 3, 2026, to address this vulnerability. ([sec.cloudapps.cisco.com](https://sec.cloudapps.cisco.com/security/center/content/CiscoSecurityAdvisory/cisco-sa-cucm-ssrf-cXPnHcW?vs_f=Cisco+Security+Advisory%26vs_cat%3DSecurity+Intelligence%26vs_type%3DRSS%26vs_p%3DCisco+Unified+Communications+Manager+Server-Side+Request+Forgery+Vulnerability%26vs_k%3D1&utm_source=openai)) By June 23, 2026, threat intelligence firm Defused reported active exploitation of this vulnerability in the wild. Attackers were observed using file:// payloads to create test files on vulnerable devices, indicating reconnaissance activities. The availability of a proof-of-concept exploit increases the urgency for organizations to apply the provided patches promptly.
2 months ago
Kill Chain
FortiBleed: Unprecedented Credential Harvesting Targets FortiGate Firewalls
In June 2026, a Russian-speaking initial access broker initiated 'FortiBleed,' a large-scale credential-harvesting operation targeting over 430,000 FortiGate firewalls globally. The campaign involved deploying custom sniffers on compromised devices to capture cleartext and hashed credentials, which were then used to infiltrate Active Directory domains and other services. This incident underscores the critical need for organizations to secure their network devices, as attackers increasingly exploit firewall vulnerabilities to gain unauthorized access. The widespread impact of FortiBleed highlights the importance of regular security assessments and prompt patch management.
2 months ago
Kill Chain
Operation Endgame: Dismantling the SocGholish Malware Network
In June 2026, an international law enforcement operation, as part of Operation Endgame, dismantled the SocGholish malware framework by seizing 106 servers and remediating nearly 15,000 compromised WordPress websites. SocGholish, active since 2017, utilized traffic distribution systems (TDSs) to redirect users to fake browser updates, thereby gaining initial access to victims' networks. This access was often sold to cybercriminal groups like Evil Corp, facilitating ransomware deployments and espionage activities. The takedown significantly disrupted a major component of the cybercrime ecosystem, highlighting the critical role of TDSs in malware distribution. ([darkreading.com](https://www.darkreading.com/cyber-risk/socgholish-takedown-malicious-tds-threats?utm_source=openai)) The operation underscores the persistent threat posed by sophisticated social engineering tactics and the exploitation of legitimate web infrastructure. Organizations are reminded to maintain vigilant cybersecurity practices, including regular updates to content management systems, monitoring for unauthorized changes, and educating users about the risks of unsolicited software updates.
2 months ago
Kill Chain
Critical Vulnerability in Hubbell Aclara Metrum Cellular Web Interface (CVE-2026-1840)
In June 2026, a critical vulnerability (CVE-2026-1840) was identified in the Hubbell Aclara Metrum Cellular Web Interface, affecting versions prior to v2.1.0.105. This flaw allows unauthorized access to critical system functions due to missing authentication controls, enabling attackers to alter device configurations and disrupt operations, potentially leading to loss of communications. The vulnerability poses significant risks to the energy sector, particularly in the United States, where these devices are widely deployed. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-1740?utm_source=openai)) The incident underscores the importance of robust authentication mechanisms in industrial control systems. With increasing cyber threats targeting critical infrastructure, organizations must prioritize timely firmware updates and implement comprehensive security measures to mitigate such vulnerabilities.
2 months ago
Kill Chain
SonicWall Vulnerability CVE-2024-40766: A Ransomware Exploitation Case Study
In August 2024, SonicWall disclosed CVE-2024-40766, a critical improper access control vulnerability in SonicOS affecting Gen 5, Gen 6, and Gen 7 firewalls. Despite the availability of patches, ransomware groups such as Akira and Fog have been actively exploiting this vulnerability since September 2024, leading to unauthorized access and rapid encryption of organizational data. By December 2024, approximately 48,933 devices remained unpatched and publicly exposed, with attacks escalating in mid-2025, particularly targeting Gen 7 firewalls. In some cases, attackers achieved data encryption within 55 minutes of initial access. The continued exploitation of CVE-2024-40766 underscores the critical importance of not only applying security patches but also addressing post-patch configurations. Organizations must ensure comprehensive remediation, including password resets, account audits, and proper configuration of security settings, to prevent exploitation by threat actors leveraging known vulnerabilities.
2 months ago
Kill Chain
Guarding AI Memory: Microsoft's Comprehensive Security Approach
In June 2026, Microsoft published an article titled 'Guarding AI Memory,' highlighting the critical importance of securing AI memory systems. The article discusses how AI memory transforms AI systems from stateless tools into learning collaborators, thereby increasing their attack surface. It emphasizes that without memory, attackers need to achieve their objectives in a single prompt, whereas with AI memory, they can shape behavior gradually over time or plant memories that influence agent reasoning after the original context is gone and user awareness is lower. Microsoft outlines a defense-in-depth approach to protect AI memory, spanning every layer of the stack: storage, retrieval, model interaction, and user control. This approach includes implementing sanitization checks on memory writes, governing stored memories with existing data policies, and providing observability through audit logs. The article also presents a guiding framework for building safe AI memory, emphasizing principles such as establishing intent and provenance before persistence, enforcing boundaries outside the model, treating retrieval as a risk decision, providing full lifecycle visibility for security teams, and keeping users in control. This publication underscores the evolving threat landscape in AI systems and the necessity for robust security measures to protect AI memory from potential attacks.
2 months ago
Kill Chain
Unveiling the Complexity: Dual Threat Actors Exploit SharePoint Vulnerabilities in 2026
In June 2026, Microsoft's Detection and Response Team (DART) investigated a complex cyber intrusion involving two unrelated threat actors operating simultaneously within the same environment. The initial access was achieved through exploitation of known vulnerabilities in on-premises SharePoint servers, notably CVE-2025-49706 and CVE-2025-49704. One actor, identified as Storm-2603, utilized legitimate tools like Velociraptor to map the environment and established multiple remote access channels via Cloudflare tunneling, Zoho Assist, and SSH connections configured through Visual Studio Code. Concurrently, a second, unidentified actor employed techniques such as malicious DLL sideloading and custom backdoors, complicating detection and attribution. This dual-actor presence enabled sustained access and obfuscated the full scope of the intrusion. This incident underscores the evolving complexity of cyber threats, where multiple actors may exploit the same vulnerabilities simultaneously, blending tactics to evade detection. It highlights the critical need for organizations to implement comprehensive patch management, enhance identity security, and maintain continuous visibility across their environments to detect and respond to such sophisticated attacks effectively.
2 months ago
Kill Chain
Five Eyes Alliance Issues Urgent Warning on AI-Driven Cyber Threats
In June 2026, the intelligence agencies of the Five Eyes alliance—comprising the United States, Canada, the United Kingdom, Australia, and New Zealand—issued a joint statement warning that advanced AI models capable of executing sophisticated cyberattacks are expected to become publicly accessible within months. These frontier AI models, such as Anthropic's Fable 5 and OpenAI's Daybreak, possess capabilities that could significantly enhance both offensive and defensive cyber operations. The agencies highlighted vulnerabilities in legacy systems, slow patching processes, unnecessary internet connectivity, weak identity and access controls, and inadequate pre-incident planning as critical weaknesses that these AI models could exploit. This development underscores the urgency for organizations to reassess and strengthen their cybersecurity postures. The rapid evolution of AI technologies means that cyber risk assumptions can become outdated swiftly, necessitating proactive measures to adapt to and withstand emerging threats. The warning also reflects broader concerns about the democratization of powerful AI tools and their potential misuse in cyber warfare.
2 months ago
Kill Chain
FortiBleed Campaign: A Wake-Up Call for Network Security
In June 2026, the FortiBleed campaign targeted over 430,000 Fortinet FortiGate firewalls globally, employing a custom Golang-based tool named 'FortigateSniffer' to intercept and extract authentication credentials from network traffic. Attackers initially gained administrative access through credential stuffing and brute-force attacks, subsequently deploying the sniffer to monitor 24 protocols, including RADIUS, NTLM, Kerberos, and LDAP, thereby harvesting sensitive authentication data. This incident underscores the escalating sophistication of cyber threats, highlighting the critical need for organizations to implement robust security measures such as multi-factor authentication, regular credential updates, and vigilant monitoring of network traffic to detect unauthorized activities.
3 months ago
Kill Chain
INTERPOL Highlights Escalating Cyber Threats in Asia-Pacific
INTERPOL's 2025/2026 Asia and South Pacific Cyberthreat Assessment Report highlights a significant surge in cybercrime across the region, driven by rapid digitalization and organized criminal networks. Phishing has emerged as the most prevalent and financially damaging form of cybercrime, with over half of the surveyed countries reporting that cybercrime accounts for more than 30% of all recorded crimes. The report also notes a rise in ransomware attacks, deepfake scams, and AI-driven frauds targeting sectors such as real estate, manufacturing, and financial services. ([interpol.int](https://www.interpol.int/content/download/24327/file/CYBER_ASP%20Cyber%20Threat%20Assessment%20Report_2025_2026_v4.pdf?utm_source=openai)) This escalation underscores the urgent need for enhanced cybersecurity measures and international cooperation to combat the evolving threat landscape. The increasing sophistication of cybercriminal tactics, including the use of AI and ransomware-as-a-service models, poses a substantial risk to both public and private sectors. ([interpol.int](https://www.interpol.int/content/download/24327/file/CYBER_ASP%20Cyber%20Threat%20Assessment%20Report_2025_2026_v4.pdf?utm_source=openai))
3 months ago
Kill Chain
React2Shell (CVE-2025-55182) Exploitation: A December 2025 Cybersecurity Incident
In December 2025, a critical vulnerability known as React2Shell (CVE-2025-55182) was disclosed, affecting React Server Components versions 19.0.0 through 19.2.0. This flaw allowed unauthenticated remote code execution via improper deserialization in the Flight protocol. Within hours of disclosure, multiple state-sponsored threat groups, including China's Earth Lamia and Jackpot Panda, as well as North Korean actors, began exploiting the vulnerability to deploy malware, establish persistent access, and exfiltrate data. The rapid exploitation led to significant security incidents across various sectors globally. ([aws.amazon.com](https://aws.amazon.com/blogs/security/china-nexus-cyber-threat-groups-rapidly-exploit-react2shell-vulnerability-cve-2025-55182/?utm_source=openai)) The React2Shell incident underscores the critical importance of prompt patching and vigilant monitoring. The swift exploitation by sophisticated threat actors highlights the need for organizations to enhance their vulnerability management processes and adopt proactive security measures to mitigate emerging threats effectively.
3 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports