Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 67 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 793–804 / 3243 reports
LexisNexis 2026 Third-Party Vendor Breach: A Wake-Up Call for Supply Chain Security
Legal Services3 months ago

LexisNexis 2026 Third-Party Vendor Breach: A Wake-Up Call for Supply Chain Security

In August 2026, LexisNexis identified unusual activity on servers managed by a third-party vendor, leading to the immediate shutdown of its Diligence, Metabase API, and Newsdesk services. The company is collaborating with a cybersecurity forensic firm to investigate the incident and is rebuilding affected systems in a new environment before restoring services. This incident underscores the critical importance of securing third-party vendor relationships, as vulnerabilities in external systems can directly impact core business operations. Organizations must implement stringent vendor risk management practices to mitigate such risks.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
SonicWall SMA1000 Vulnerabilities Exploited by Ransomware Gangs
Financial Services3 months ago

SonicWall SMA1000 Vulnerabilities Exploited by Ransomware Gangs

In July 2026, SonicWall disclosed two critical vulnerabilities in its SMA1000 series appliances: CVE-2026-15409, a server-side request forgery flaw, and CVE-2026-15410, a code injection vulnerability. These flaws allowed unauthenticated attackers to execute arbitrary commands, leading to unauthorized access and potential data breaches. ([sonicwall.com](https://www.sonicwall.com/support/notices/%E8%A3%BD%E5%93%81%E3%81%AB%E9%96%A2%E3%81%99%E3%82%8B%E9%87%8D%E8%A6%81%E3%81%AA%E3%81%8A%E7%9F%A5%E3%82%89%E3%81%9B-sma-1000%E3%82%B7%E3%83%AA%E3%83%BC%E3%82%BA%E3%81%AB%E8%A4%87%E6%95%B0%E3%81%AE%E8%84%86%E5%BC%B1%E6%80%A7/kA1VN000001nv6D0AQ?utm_source=openai)) The U.S. Cybersecurity and Infrastructure Security Agency (CISA) confirmed that ransomware groups have actively exploited these vulnerabilities, emphasizing the urgency for organizations to apply the available patches promptly. The exploitation of these vulnerabilities underscores a growing trend of attackers targeting remote access solutions to infiltrate corporate networks. Organizations must prioritize securing their remote access infrastructure to prevent such breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
StormEncryptor Ransomware: Exploiting N-central Vulnerability CVE-2026-18577
Information Technology/IT3 months ago

StormEncryptor Ransomware: Exploiting N-central Vulnerability CVE-2026-18577

In August 2026, the financially motivated threat actor Storm-1175, previously associated with Medusa ransomware, began deploying a new ransomware strain named StormEncryptor. The attacks were likely initiated by exploiting an authentication-bypass vulnerability (CVE-2026-18577) in the N-central remote monitoring and management tool. Once inside the network, the attackers utilized tools like AnyDesk and SimpleHelp for remote management, Advanced IP Scanner for network discovery, and Mimikatz to extract credentials. StormEncryptor, written in C++, appends the ".encrypted" extension to files and drops a ransom note titled '!!!README_FIRST!!!.txt' in each directory, demanding contact within three days to prevent data leakage. This incident underscores the evolving tactics of ransomware groups, highlighting the rapid transition from initial access to data exfiltration and encryption. The exploitation of vulnerabilities in widely used management tools like N-central emphasizes the critical need for organizations to promptly apply security patches and monitor for signs of compromise to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Check Point VPN Vulnerability Exploited by Qilin Ransomware Group
Health Care / Life Sciences3 months ago

Critical Check Point VPN Vulnerability Exploited by Qilin Ransomware Group

In May 2026, a critical authentication bypass vulnerability, CVE-2026-50751, was discovered in Check Point's Remote Access VPN and Mobile Access products utilizing the deprecated IKEv1 protocol. This flaw allowed unauthenticated remote attackers to establish VPN connections without valid credentials, effectively granting unauthorized access to internal networks. The Qilin ransomware group exploited this vulnerability, initiating attacks as early as May 7, 2026, targeting several organizations globally. Check Point became aware of these exploits by June 4, 2026, and promptly released patches and mitigation measures to address the issue. The exploitation of CVE-2026-50751 underscores the persistent threat posed by ransomware groups like Qilin, who rapidly adapt to exploit known vulnerabilities. This incident highlights the critical importance of timely vulnerability management and the need for organizations to deprecate outdated protocols to prevent unauthorized access and potential data breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Storm-1175's New StormEncryptor Ransomware Exploits N-central Vulnerability
Information Technology/IT3 months ago

Storm-1175's New StormEncryptor Ransomware Exploits N-central Vulnerability

In August 2026, Microsoft disclosed that Storm-1175, a financially motivated threat actor linked to China, deployed a new ransomware strain named StormEncryptor. This malware, written in C++, appends the ".encrypted" extension to files and drops a ransom note titled "!!!README_FIRST!!!.txt" in each directory. The group likely exploited CVE-2026-18577, a critical authentication bypass vulnerability in N-able's N-central platform, to gain initial access. This flaw allows unauthenticated attackers to obtain full control over managed endpoints. Storm-1175's rapid exploitation of such vulnerabilities underscores the urgency for organizations to apply patches promptly and monitor their environments for signs of compromise. The emergence of StormEncryptor signifies a shift in Storm-1175's tactics, moving from the previously used Medusa ransomware to a new, custom-developed strain. This evolution highlights the group's adaptability and the increasing sophistication of ransomware campaigns targeting critical infrastructure sectors globally.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Operation Lunar Peek: A Deep Dive into the Exploitation of PAN-OS Vulnerabilities
Computer Software/Engineering3 months ago

Operation Lunar Peek: A Deep Dive into the Exploitation of PAN-OS Vulnerabilities

In November 2024, Palo Alto Networks disclosed two critical vulnerabilities in its PAN-OS software: CVE-2024-0012, an authentication bypass flaw, and CVE-2024-9474, a privilege escalation issue. Exploited together in a campaign dubbed 'Operation Lunar Peek,' these vulnerabilities allowed unauthenticated attackers to gain root access to firewall management interfaces. Approximately 2,000 devices were compromised, primarily in the United States and India, leading to unauthorized administrative actions and potential configuration tampering. This incident underscores the escalating sophistication of cyber threats, where attackers rapidly exploit vulnerabilities before patches are widely applied. It highlights the necessity for organizations to adopt proactive vulnerability management strategies, including timely patching and restricting access to critical management interfaces, to mitigate the risk of similar exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
OpenAI Pauses Astra AI Model Development Amid Cybersecurity Concerns
Computer Software/Engineering3 months ago

OpenAI Pauses Astra AI Model Development Amid Cybersecurity Concerns

In August 2026, OpenAI announced a temporary pause in the development of its latest AI model, Astra, due to concerns over its potential autonomous cybersecurity capabilities. Internal evaluations revealed that Astra might possess significant cyber functions, prompting the company to intensify safety testing and halt any internal activities failing to meet newly tightened security standards. This decision marks one of the first known instances where an AI lab has proactively slowed the development of its own model because of cybersecurity risks. The move mirrors actions taken by rival AI lab Anthropic, which released a safer version of its model Mythos in June. The situation highlights the growing tension between rapid AI progress and the slower development of corresponding regulatory frameworks. ([axios.com](https://www.axios.com/2026/08/07/openai-astra-model-delay-cybersecurity-risks?utm_source=openai)) This incident underscores the urgent need for robust containment systems, better-defined operational constraints, proactive monitoring, and legal frameworks to manage AI's rapidly growing capabilities. Experts suggest that testing setups failed to isolate models from sensitive systems, and underestimated capabilities of AI agents in interpreting broad goals in unintended, harmful ways. ([techradar.com](https://www.techradar.com/pro/security/why-are-so-many-ai-models-going-rogue-the-experts-weigh-in?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
HelloNet APT Exploits ViPNet Updates to Infiltrate Russian Organizations
Information Technology/IT3 months ago

HelloNet APT Exploits ViPNet Updates to Infiltrate Russian Organizations

In May 2026, a sophisticated Advanced Persistent Threat (APT) campaign, dubbed 'HelloNet,' was identified targeting large Russian organizations across sectors such as government, energy, transport, education, and logistics. The attackers exploited the update mechanism of ViPNet, a widely used secure networking product, by placing a malicious DLL ('wtsapi32.dll', known as 'HelloInjector') in the ViPNet Update System directory. This DLL was sideloaded by the legitimate 'itcsrvup64.exe' executable, leading to code injection into 'svchost.exe' and establishing persistence. The malware suite included components like 'HelloProxy' for traffic proxying, 'HelloExecutor' for command execution, 'HelloCleaner' for log file sanitization, and 'HelloBackdoor,' a Rust-based backdoor facilitating file manipulation and command execution. The campaign has been active since at least May 2026 and remains ongoing. ([mallory.ai](https://www.mallory.ai/stories/019f6a67-711c-7c67-8cd3-4c88705a116b?utm_source=openai)) This incident underscores the evolving tactics of APT groups in leveraging trusted software update mechanisms to infiltrate secure networks. The use of multiple sophisticated malware components highlights the need for organizations to implement robust monitoring and validation processes for software updates to prevent similar breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical Passkey Vulnerabilities Uncovered: Bypassing Phishing-Resistant MFA
Banking/Mortgage3 months ago

Critical Passkey Vulnerabilities Uncovered: Bypassing Phishing-Resistant MFA

In August 2026, researchers identified multiple vulnerabilities in passkey authentication systems, revealing methods to bypass phishing-resistant multi-factor authentication (MFA) without compromising underlying cryptographic protocols. These attacks exploited weaknesses in Windows Event Logging Service (CVE-2026-34348), Google Password Manager's synced passkeys, and Windows Hello for Business, allowing unauthorized access through replayed authentication materials and malware manipulation. The incidents underscore the necessity for organizations to reassess the security of passkey implementations and enhance endpoint protections to mitigate such sophisticated threats. As passkeys gain popularity as a passwordless authentication method, these findings highlight the importance of continuous vigilance and adaptation to emerging attack vectors targeting authentication mechanisms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Kimsuky Integrates Offline AI to Elevate Cyber Espionage Tactics in 2026
Government Administration3 months ago

Kimsuky Integrates Offline AI to Elevate Cyber Espionage Tactics in 2026

In August 2026, the North Korean state-sponsored hacking group Kimsuky was identified leveraging offline artificial intelligence (AI) tools to enhance their cyber espionage capabilities. By integrating AI models such as Ollama and GPT4All into their infrastructure, Kimsuky aimed to automate malware development and refine phishing campaigns, making them more sophisticated and harder to detect. This strategic shift signifies a notable advancement in their operational tactics, potentially increasing the efficiency and effectiveness of their cyber attacks. The adoption of AI by threat actors like Kimsuky underscores a broader trend in the cyber threat landscape, where adversaries are increasingly utilizing advanced technologies to enhance their operations. This evolution necessitates that organizations bolster their cybersecurity defenses, focusing on behavioral analysis and anomaly detection to identify and mitigate AI-driven threats effectively.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Head Mare Group Exploits TrueConf Vulnerabilities to Deploy Backdoors
Government Administration3 months ago

Head Mare Group Exploits TrueConf Vulnerabilities to Deploy Backdoors

In August 2026, the Head Mare hacktivist group exploited vulnerabilities in unpatched TrueConf video conferencing servers to replace client installers with malicious versions containing backdoors. By leveraging flaws identified as KLCERT-26-057 and KLCERT-26-058, attackers achieved remote code execution, escalated privileges to NT AUTHORITY\SYSTEM, and deployed web shells for persistent access. This allowed them to collect sensitive information, access databases, and distribute trojanized client installers embedded with the PhantomCore backdoor. Users downloading these installers inadvertently installed malware, granting attackers further access to organizational networks. This incident underscores the critical importance of timely patch management and the risks associated with supply chain attacks. Organizations must ensure that all software, especially communication tools like TrueConf, are regularly updated to mitigate vulnerabilities. The rise of such sophisticated attacks highlights the need for comprehensive security strategies that encompass both technical defenses and user awareness training.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Metabase Zero-Day Vulnerability Exploited in August 2026
Financial Services3 months ago

Critical Metabase Zero-Day Vulnerability Exploited in August 2026

In August 2026, Metabase, a business intelligence and data visualization platform, disclosed a critical zero-day vulnerability that allowed unauthenticated remote attackers to inject arbitrary SQL into the application database. This flaw enabled attackers to gain administrator access, modify configurations, steal stored credentials, and access connected databases. The vulnerability affected versions 1.58 and above, with patches released to address the issue. Organizations using self-hosted versions were urged to apply these patches immediately to mitigate potential exploitation. This incident underscores the persistent threat posed by zero-day vulnerabilities in widely used software platforms. It highlights the importance of proactive security measures, timely patch management, and continuous monitoring to detect and respond to unauthorized access attempts promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports