Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 66 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 781–792 / 3243 reports
Critical Cisco ASA and FTD VPN Vulnerability CVE-2026-20349: Immediate Action Required
Financial Services2 months ago

Critical Cisco ASA and FTD VPN Vulnerability CVE-2026-20349: Immediate Action Required

In August 2026, Cisco disclosed a high-severity denial-of-service (DoS) vulnerability, identified as CVE-2026-20349, affecting Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) software. This flaw allows unauthenticated, remote attackers to crash affected devices by sending crafted HTTP requests to the Remote Access SSL VPN service. Exploitation results in device reloads, causing significant operational disruptions. The active exploitation of CVE-2026-20349 underscores the critical need for organizations to promptly apply security patches. This incident highlights the persistent threat landscape targeting network infrastructure and the importance of maintaining up-to-date defenses to mitigate potential attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Sandworm's Sophisticated Attack: Trojanized WireGuard VPN Client Targets IT Professionals
Information Technology/IT2 months ago

Sandworm's Sophisticated Attack: Trojanized WireGuard VPN Client Targets IT Professionals

In May 2026, the Russian state-sponsored hacking group Sandworm, specifically its sub-cluster UAC-0145, initiated a sophisticated social engineering campaign targeting IT professionals. Posing as recruiters from reputable IT firms, they engaged victims through fake job offers, leading to interviews conducted over Zoom. During these sessions, candidates were instructed to download a trojanized WireGuard VPN client named 'SopraVPN' from a deceptive SourceForge page. This malicious software, once installed, executed embedded PowerShell code, enabling the attackers to establish persistent access to the victims' systems. The campaign's primary objective was to infiltrate and compromise critical infrastructure and government entities, leveraging the trust and technical expertise of IT professionals to gain unauthorized access to sensitive networks. This incident underscores the evolving tactics of nation-state actors, who are increasingly employing advanced social engineering techniques to bypass traditional security measures. Organizations must remain vigilant, ensuring that their recruitment processes are secure and that employees are educated about potential cyber threats. The use of trojanized software in targeted attacks highlights the necessity for robust endpoint detection and response solutions to detect and mitigate such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Project CAV3RN's Evolving Tactics: Leveraging Google Apps Script and DNS for Stealthy C2
Government Administration2 months ago

Project CAV3RN's Evolving Tactics: Leveraging Google Apps Script and DNS for Stealthy C2

In August 2026, Kaspersky researchers identified an evolution in the Project CAV3RN cyberespionage framework, which has been targeting Israeli organizations since December 2025. The latest development involves a sophisticated command-and-control (C2) module that utilizes Google Apps Script as a relay and employs DNS-based mechanisms for C2 channel selection. This approach allows the malware to blend its communication with legitimate network traffic, thereby evading traditional detection methods. The framework's modular design and rapid development indicate a persistent and adaptable threat. The significance of this incident lies in the increasing trend of threat actors leveraging legitimate cloud services to obfuscate malicious activities. By integrating Google Apps Script and DNS-based techniques, Project CAV3RN exemplifies the challenges in distinguishing between normal and malicious network behavior, underscoring the need for advanced detection strategies.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
DeadLock Ransomware's Innovative Use of Blockchain Technology
Financial Services2 months ago

DeadLock Ransomware's Innovative Use of Blockchain Technology

In July 2025, the DeadLock ransomware group emerged, employing double extortion tactics to encrypt victim environments and threaten the public release of exfiltrated data. Notably, DeadLock utilizes decentralized infrastructure, combining the Session messaging network with blockchain-backed services, specifically Polygon smart contracts, to store and deliver resources throughout the extortion process. This approach enhances the group's operational resilience by making their infrastructure harder to disrupt. As of August 2026, DeadLock has claimed 96 victims, primarily in Italy, Spain, Poland, Türkiye, and the U.S. The group's innovative use of blockchain technology for command-and-control operations signifies a concerning trend in ransomware tactics. By leveraging decentralized platforms, DeadLock demonstrates an evolution in cybercriminal strategies, posing new challenges for traditional defense mechanisms and takedown efforts.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's August 2026 Patch Tuesday: Addressing 398 Vulnerabilities Including Active Zero-Day Exploits
Government Administration2 months ago

Microsoft's August 2026 Patch Tuesday: Addressing 398 Vulnerabilities Including Active Zero-Day Exploits

In August 2026, Microsoft released a comprehensive security update addressing 398 vulnerabilities, including CVE-2026-68820, a zero-day flaw actively exploited in the wild. This vulnerability resides in the Windows kernel's Ancillary Function Driver for WinSock (afd.sys) and allows attackers with existing access to escalate privileges to SYSTEM level by exploiting a race condition. Notably, the Lazarus Group has been linked to the exploitation of this flaw in their Operation Dream Job campaign. Additionally, the update addressed four critical remote code execution vulnerabilities (CVE-2026-62878, CVE-2026-62893, CVE-2026-62815, and CVE-2026-59124) that require no user interaction, emphasizing the urgency for organizations to apply these patches promptly. The release also completed a two-part fix for a SharePoint vulnerability chain, with the initial authentication bypass (CVE-2026-55040) patched in July and the subsequent remote code execution component (CVE-2026-63520) addressed in August. This underscores the importance of timely patch management to mitigate potential exploitation risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AI-Assisted Exploit Chain Unveiled: Unauthenticated RCE in Microsoft SharePoint
Government Administration2 months ago

AI-Assisted Exploit Chain Unveiled: Unauthenticated RCE in Microsoft SharePoint

In August 2026, security researchers identified a critical vulnerability in Microsoft SharePoint, designated as CVE-2026-55040, which allows unauthenticated attackers to impersonate any user, including administrators, without valid credentials. This flaw affects SharePoint Server Subscription Edition, SharePoint Server 2019, and SharePoint Server 2016. Exploiting this vulnerability requires knowledge of the target account's Active Directory security identifier (SID) or user principal name (UPN). Rapid7 further discovered that chaining this authentication bypass with another vulnerability, CVE-2026-63520, enables remote code execution on the server without authentication. Microsoft released patches in July 2026 to address these issues. The discovery underscores the evolving threat landscape, where attackers increasingly leverage AI-assisted tools to identify and exploit vulnerabilities. Organizations must remain vigilant, ensuring timely application of security patches and adopting proactive measures to mitigate such sophisticated attack vectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CyberAv3ngers' Cyberattacks on U.S. Water Systems: A 2026 Analysis
Utilities2 months ago

CyberAv3ngers' Cyberattacks on U.S. Water Systems: A 2026 Analysis

In July 2026, a coordinated series of cyberattacks targeted water and wastewater systems across at least 12 U.S. states, including Minnesota, Georgia, Michigan, South Dakota, Alabama, and New Jersey. The attackers exploited vulnerabilities in internet-exposed programmable logic controllers (PLCs), specifically those from Rockwell Automation, Schneider Electric, and Siemens, to modify configurations and lock out operators. While no water contamination was reported, some systems experienced operational disruptions, such as water pressure drops and the issuance of boil water advisories. These incidents underscore the critical vulnerabilities in the nation's water infrastructure, particularly in smaller utilities lacking robust cybersecurity measures. ([axios.com](https://www.axios.com/2026/08/04/water-cyberattacks-us-iran?utm_source=openai)) The attacks have been tentatively linked to the Iranian state-sponsored group CyberAv3ngers, known for targeting industrial control systems in critical infrastructure sectors. This campaign highlights the escalating cyber threat landscape and the urgent need for enhanced security protocols to protect essential services. ([ampcuscyber.com](https://www.ampcuscyber.com/shadowopsintel/cyberav3ngers-targeting-the-us-water-utilities-ics/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Gunra Ransomware Exploits Fortinet and Schneider Electric Vulnerabilities
Health Care / Life Sciences2 months ago

Gunra Ransomware Exploits Fortinet and Schneider Electric Vulnerabilities

In August 2026, cybersecurity agencies from South Korea and the U.S. issued warnings about Gunra ransomware attacks targeting critical infrastructure sectors worldwide. The attackers exploited vulnerabilities in Schneider Electric PowerLogic P5 (CVE-2024-5559) and Fortinet FortiOS and FortiProxy (CVE-2025-24472) appliances to gain initial access. Employing a double extortion model, they encrypted data and exfiltrated sensitive information, threatening to publish it unless a ransom was paid within five to seven days. Since its emergence in April 2025, Gunra has listed 51 victims, primarily in South Korea, Brazil, Spain, Thailand, and Hong Kong. The group utilizes phishing campaigns and advanced encryption methods like Salsa20 and ChaCha20 to execute their attacks. This incident underscores the evolving tactics of ransomware groups, highlighting the critical need for organizations to promptly patch known vulnerabilities and implement robust security measures to protect against such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Exploiting Windows 11 Plug and Play: A Path to SYSTEM-Level Access
Government Administration2 months ago

Exploiting Windows 11 Plug and Play: A Path to SYSTEM-Level Access

In August 2026, security researchers Alejandro Hernando and Borja Martinez unveiled a method to exploit Windows Plug and Play (PnP) auto-installation processes, enabling unprivileged users to achieve SYSTEM-level code execution on fully updated Windows 11 systems. By emulating specific USB devices, they triggered the installation of signed vendor software containing vulnerabilities, which they chained to escalate privileges. Notably, this attack vector can be executed both physically and remotely via Remote Desktop Protocol (RDP) when USB redirection is enabled. This discovery underscores the critical need for organizations to scrutinize device installation processes and enforce strict policies on USB device usage and redirection settings. The ability to escalate privileges through such mechanisms highlights potential gaps in endpoint security, emphasizing the importance of comprehensive monitoring and control over peripheral device interactions.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Mozilla's Proactive Key Revocation: A Lesson in Supply Chain Security
Computer Software/Engineering2 months ago

Mozilla's Proactive Key Revocation: A Lesson in Supply Chain Security

In August 2026, Mozilla revoked the cryptographic signing key used for Linux distributions of Firefox and Thunderbird after an unencrypted copy was inadvertently committed to a private code repository. Although the repository was private and audit records showed no unauthorized access, Mozilla proactively revoked the key to maintain security integrity. This revocation affects users who manually verify downloads and those using Mozilla's RPM packages, necessitating the import of a new key and the revocation of the old one. The new subkey, valid until August 5, 2028, ensures continued trust in Mozilla's software distributions. This incident underscores the critical importance of secure key management practices within software supply chains. As supply chain attacks become more prevalent, organizations must implement stringent controls to prevent unauthorized access and potential compromises, thereby safeguarding the integrity of their software products.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Gunra Ransomware Group: A Growing Global Threat
Government Administration2 months ago

Gunra Ransomware Group: A Growing Global Threat

In August 2026, U.S. and South Korean cyber agencies issued a joint advisory regarding the Gunra ransomware group, a ransomware-as-a-service (RaaS) operation that has been active since April 2025. Gunra employs double-extortion tactics, encrypting victims' data and threatening to publish it unless a ransom is paid. The group has targeted a wide range of sectors, including academia, financial services, government facilities, healthcare, manufacturing, and utilities, across multiple continents. Notably, Gunra has been recruiting ethical hackers and penetration testers as initial access brokers, offering them a share of the ransom profits in exchange for access to enterprise networks. This advisory underscores the evolving nature of ransomware threats, highlighting the increasing sophistication of RaaS operations and their global reach. Organizations are urged to bolster their cybersecurity defenses, particularly by addressing known vulnerabilities in internet-facing devices and implementing robust access controls to mitigate the risk of such attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Urgent Alert: Progress LoadMaster CVE-2026-8037 Exploitation in 2026
Information Technology/IT3 months ago

Urgent Alert: Progress LoadMaster CVE-2026-8037 Exploitation in 2026

In June 2026, a critical OS command injection vulnerability, identified as CVE-2026-8037, was discovered in Progress Kemp LoadMaster appliances. This flaw allows unauthenticated attackers to execute arbitrary commands by exploiting unsanitized API inputs. Despite the release of security patches by Progress Software, active exploitation attempts were observed starting June 29, 2026, with nearly 300 LoadMaster instances exposed online. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its catalog of actively exploited vulnerabilities on August 7, 2026, urging immediate remediation. The exploitation of CVE-2026-8037 underscores the persistent threat posed by unpatched critical vulnerabilities in widely deployed infrastructure components. Organizations are reminded of the importance of timely patch management and continuous monitoring to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports