Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 81 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 961–972 / 3243 reports
Introducing Google's Gemini 3.5 Flash Cyber: Revolutionizing Vulnerability Detection
Computer Software/Engineering3 months ago

Introducing Google's Gemini 3.5 Flash Cyber: Revolutionizing Vulnerability Detection

On July 21, 2026, Google's DeepMind announced the release of Gemini 3.5 Flash Cyber, an AI model designed to rapidly identify, validate, and patch software vulnerabilities. Built upon the 3.5 Flash architecture, this specialized model is tailored for cybersecurity applications, offering a cost-effective and efficient alternative to larger models. Initially, Gemini 3.5 Flash Cyber will be available exclusively to governments and trusted partners through CodeMender, an AI-powered agent for vulnerability discovery and patching. In evaluations, the model demonstrated superior performance, uncovering more unique vulnerabilities compared to its predecessors and other models, including Anthropic's Claude Opus 4.6. For instance, when tested on the V8 JavaScript Engine, Gemini 3.5 Flash Cyber identified 55 unique confirmed issues, surpassing the 47 found by Gemini 3.5 Flash and the 36 by Opus 4.6. This advancement underscores Google's commitment to enhancing software security through AI-driven solutions. ([deepmind.google](https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/?utm_source=openai)) The introduction of Gemini 3.5 Flash Cyber is particularly relevant in the current cybersecurity landscape, where the rapid identification and remediation of vulnerabilities are critical. As AI models become more adept at discovering security flaws, tools like Gemini 3.5 Flash Cyber provide defenders with a proactive means to address potential threats before they can be exploited. This development reflects a broader trend towards integrating AI into cybersecurity practices to bolster defenses against increasingly sophisticated attacks. ([deepmind.google](https://deepmind.google/blog/introducing-gemini-3-5-flash-cyber/?utm_source=openai))

Threat report

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical ServiceNow AI Platform Vulnerability CVE-2026-6875 Exploited in the Wild
Information Technology/IT3 months ago

Critical ServiceNow AI Platform Vulnerability CVE-2026-6875 Exploited in the Wild

In July 2026, a critical vulnerability (CVE-2026-6875) was identified in the ServiceNow AI Platform, allowing unauthenticated attackers to execute arbitrary code by escaping the platform's script sandbox. ServiceNow promptly released patches throughout June 2026 to address this flaw. However, by mid-July, threat intelligence firm Defused reported active exploitation of this vulnerability in the wild, posing significant risks to organizations utilizing the platform. ([thehackernews.com](https://thehackernews.com/2026/07/critical-servicenow-ai-platform-flaw.html?utm_source=openai)) The exploitation of CVE-2026-6875 underscores the increasing targeting of AI platforms by cyber adversaries. This incident highlights the urgency for organizations to apply security patches promptly and to enhance monitoring of AI-driven systems to mitigate emerging threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI's Role in Accelerating Exploit Development: A Call for Immediate Action
Financial Services3 months ago

AI's Role in Accelerating Exploit Development: A Call for Immediate Action

In July 2026, cybersecurity experts highlighted a critical shift in vulnerability exploitation dynamics. Traditionally, organizations had weeks to patch known vulnerabilities before attackers could develop exploits. However, advancements in AI have drastically reduced this window. For instance, AI systems like Claude Mythos Preview have demonstrated the capability to reverse-engineer patches into working exploits within an hour of a patch's release. This rapid turnaround means that unpatched systems are at immediate risk, as attackers can weaponize vulnerabilities almost as soon as they are disclosed. This development underscores the urgent need for organizations to rethink their vulnerability management strategies. The traditional approach of patching within weeks is no longer sufficient. Organizations must adopt proactive measures, such as continuous monitoring, real-time threat intelligence, and automated patch management, to stay ahead of rapidly evolving threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Zimbra's Critical Security Update: Addressing SNMP Command Injection and XSS Vulnerabilities
Financial Services3 months ago

Zimbra's Critical Security Update: Addressing SNMP Command Injection and XSS Vulnerabilities

In July 2026, Zimbra released version 10.1.20 to address multiple critical security vulnerabilities, including a command injection flaw in the SNMP monitoring component and four cross-site scripting (XSS) vulnerabilities in the Classic Web Client. These flaws could allow unauthenticated attackers to execute arbitrary OS commands and malicious scripts, potentially compromising email servers and user sessions. Additionally, a mail forwarding restriction bypass (CVE-2026-50055) was patched, which could have allowed authenticated users to exfiltrate emails despite restrictions being enabled. The prompt release of these patches underscores the importance of timely software updates to mitigate potential security risks. Organizations using Zimbra are advised to upgrade to version 10.1.20 immediately to protect against these vulnerabilities and maintain the integrity of their email systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Highlights Four New Exploited Vulnerabilities in KEV Catalog
Government Administration3 months ago

CISA Highlights Four New Exploited Vulnerabilities in KEV Catalog

On July 21, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. These vulnerabilities include CVE-2021-27137, a stack-based buffer overflow in DD-WRT; CVE-2026-0770, an inclusion of functionality from untrusted control sphere in Langflow; CVE-2026-63030, an interpretation conflict in WordPress Core; and CVE-2026-60137, an SQL injection in WordPress Core. Such vulnerabilities are common attack vectors for malicious actors and pose significant risks to federal enterprises. The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by unpatched software. Organizations are urged to prioritize remediation of these vulnerabilities to mitigate potential exploitation and enhance their cybersecurity posture.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Qilin Ransomware Exploits PAN-OS Vulnerability CVE-2026-0257
Financial Services3 months ago

Qilin Ransomware Exploits PAN-OS Vulnerability CVE-2026-0257

In June 2026, threat actors exploited a high-severity authentication bypass vulnerability (CVE-2026-0257) in Palo Alto Networks' PAN-OS software to deploy Qilin (aka Agenda) ransomware. This flaw allowed unauthenticated attackers to establish unauthorized VPN sessions, leading to direct network access. Post-exploitation activities included credential harvesting, lateral movement via administrative shares, and disabling security measures before executing the ransomware payload. The attacks varied from rapid encryption-only operations to extensive data exfiltration and double-extortion tactics, indicating multiple affiliates under the Qilin ransomware-as-a-service (RaaS) model. This incident underscores the critical importance of promptly patching known vulnerabilities, as threat actors rapidly exploit such flaws to gain initial access. The diverse post-exploitation strategies highlight the adaptability of RaaS affiliates, emphasizing the need for comprehensive defense-in-depth strategies to mitigate ransomware threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation
Government Administration3 months ago

Critical SharePoint RCE CVE-2026-50522 Under Active Exploitation

In July 2026, Microsoft disclosed CVE-2026-50522, a critical deserialization vulnerability in SharePoint Server versions 2016, 2019, and Subscription Edition. This flaw allows unauthenticated remote attackers to execute arbitrary code over the network. Following the release of a public proof-of-concept exploit, active exploitation was detected, with attackers extracting SharePoint machine keys to maintain persistent access. Organizations are urged to apply the latest patches and rotate credentials to mitigate potential breaches. ([thehackernews.com](https://thehackernews.com/2026/07/critical-sharepoint-rce-cve-2026-50522.html?utm_source=openai)) The exploitation of CVE-2026-50522 underscores a broader trend of attackers targeting deserialization vulnerabilities in widely used enterprise applications. This incident highlights the critical need for organizations to proactively address such vulnerabilities to prevent unauthorized access and potential data breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ServiceNow AI Platform Vulnerability CVE-2026-6875 Exploited in the Wild
Information Technology/IT3 months ago

ServiceNow AI Platform Vulnerability CVE-2026-6875 Exploited in the Wild

In April 2026, a critical vulnerability (CVE-2026-6875) was identified in the ServiceNow AI Platform, allowing unauthenticated attackers to escape the sandbox and execute code remotely. ServiceNow promptly addressed the flaw in hosted instances and released security updates for self-hosted customers on July 13, 2026. Despite these measures, threat intelligence firm Defused reported active exploitation of this vulnerability in the wild as of July 20, 2026. This incident underscores the persistent threat posed by unpatched vulnerabilities in widely used enterprise platforms. Organizations relying on ServiceNow's AI Platform must ensure they have applied the latest security updates to mitigate potential risks associated with this flaw.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
HollowGraph Malware: Exploiting Microsoft 365 Calendars for Covert C2 Operations
Government Administration3 months ago

HollowGraph Malware: Exploiting Microsoft 365 Calendars for Covert C2 Operations

In June 2026, cybersecurity researchers identified a sophisticated malware component named HollowGraph, which exploits Microsoft 365 calendar events to establish covert command-and-control (C2) channels. By leveraging the Microsoft Graph API, the malware communicates through calendar entries dated May 13, 2050, embedding commands and exfiltrated data within event attachments. This technique allows the malware to blend seamlessly with legitimate network traffic, evading traditional detection mechanisms. The campaign primarily targets Israeli organizations, with evidence suggesting links to the Iranian-nexus threat actor Lyceum. The use of trusted cloud services for C2 communications underscores the evolving tactics of state-sponsored cyber espionage groups. ([thehackernews.com](https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html?utm_source=openai)) The discovery of HollowGraph highlights a concerning trend in cyber threats: the abuse of legitimate cloud services to mask malicious activities. As organizations increasingly rely on cloud-based platforms, adversaries are adapting their methods to exploit these trusted environments. This incident serves as a critical reminder for enterprises to enhance monitoring of cloud service activities and implement robust security measures to detect and mitigate such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Unveiling the AI-Driven Phishing Toolkit Behind Recent WebDAV Malware Attacks
Government Administration3 months ago

Unveiling the AI-Driven Phishing Toolkit Behind Recent WebDAV Malware Attacks

In July 2026, cybersecurity firm Rapid7 discovered an exposed server containing a comprehensive AI-assisted phishing toolkit. The toolkit comprised 1,048 files, including lure templates, execution experiments, and builder notes. One active campaign targeted Windows users in Mexico, delivering an infostealer via a fake government ID-lookup site over WebDAV. The attack exploited CVE-2025-33053, a WebDAV working-directory hijack vulnerability, allowing attackers to execute malicious payloads without triggering security warnings. The operator utilized generative AI tools to rapidly develop and test phishing delivery methods, mirroring legitimate software development practices. This incident underscores the evolving threat landscape where cybercriminals leverage AI to enhance the sophistication and efficiency of their attacks. Organizations must adapt their defense strategies to counteract these advanced tactics, emphasizing the need for continuous monitoring, employee training, and the implementation of robust security measures to mitigate the risks posed by AI-driven cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Russian Hackers Exploit IP Cameras to Monitor NATO Military Logistics
Defense/Space3 months ago

Russian Hackers Exploit IP Cameras to Monitor NATO Military Logistics

In July 2026, Dutch intelligence agencies AIVD and MIVD disclosed that Russian state-backed hackers systematically compromised internet-connected IP cameras across Europe and Ukraine. By exploiting devices with default passwords and outdated firmware, these actors accessed video feeds to monitor military transport routes and weapons shipments bound for Kyiv. In Ukraine, the compromised cameras were used to identify the locations of Ukrainian military personnel, leading to targeted attacks on troops and equipment. This operation highlights the vulnerability of unsecured IoT devices and their potential exploitation for espionage and military purposes. The incident underscores the critical need for robust cybersecurity measures, especially for devices connected to the internet. Organizations are urged to secure IP cameras by updating firmware, changing default credentials, and restricting public internet access to prevent unauthorized surveillance and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
HollowGraph Malware: Exploiting Microsoft 365 Calendars for Covert Operations
Financial Services3 months ago

HollowGraph Malware: Exploiting Microsoft 365 Calendars for Covert Operations

In July 2026, cybersecurity researchers identified a sophisticated malware named HollowGraph, which exploits Microsoft 365 calendars to establish covert command and control (C2) channels. By leveraging the Microsoft Graph API, the malware creates calendar events dated to May 13, 2050, embedding operator instructions and exfiltrating stolen data as attachments. This method allows malicious communications to blend seamlessly with legitimate Microsoft 365 traffic, evading traditional detection mechanisms. The malware has been linked to the Cavern backdoor framework, previously associated with Iranian-nexus threat actors, and has primarily targeted Israeli organizations. ([thehackernews.com](https://thehackernews.com/2026/07/hollowgraph-malware-hides-c2-and-stolen.html?utm_source=openai)) The discovery of HollowGraph underscores the evolving tactics of threat actors who are increasingly abusing trusted cloud services to conduct espionage activities. Organizations must enhance their monitoring of Microsoft Graph API activities and implement stringent access controls to detect and prevent such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports