Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 86 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 1021–1032 / 3243 reports
SonicWall SMA1000 Zero-Day Vulnerabilities: Immediate Action Required
Financial Services3 months ago

SonicWall SMA1000 Zero-Day Vulnerabilities: Immediate Action Required

In July 2026, SonicWall disclosed two critical vulnerabilities in its SMA1000 series appliances: CVE-2026-15409, a server-side request forgery flaw, and CVE-2026-15410, a post-authentication code injection vulnerability. These flaws allowed unauthenticated attackers to make unauthorized requests and authenticated administrators to execute arbitrary OS commands, respectively. Both vulnerabilities were actively exploited in zero-day attacks, prompting SonicWall to release urgent security patches. Organizations utilizing affected SMA1000 models were advised to upgrade to the latest firmware versions immediately and to inspect their systems for indicators of compromise. This incident underscores the persistent targeting of remote access solutions by threat actors, highlighting the necessity for continuous monitoring, timely patching, and comprehensive security measures to protect against evolving cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft's Unprecedented Patch Tuesday: 622 Vulnerabilities Addressed
Financial Services3 months ago

Microsoft's Unprecedented Patch Tuesday: 622 Vulnerabilities Addressed

On July 14, 2026, Microsoft released patches for a record-breaking 622 vulnerabilities across its product suite, including Windows, Office, Azure, Defender, and SQL Server. Notably, two zero-day vulnerabilities were actively exploited: CVE-2026-56155 in Active Directory Federation Services, allowing local privilege escalation to administrator, and CVE-2026-56164 in SharePoint Server, enabling network-based privilege escalation without authentication. Additionally, a BitLocker security feature bypass (CVE-2026-50661) was publicly disclosed prior to the patch release. ([securityweek.com](https://www.securityweek.com/microsoft-patches-record-622-vulnerabilities-including-two-exploited-zero-days/?utm_source=openai)) This unprecedented volume of patches underscores the increasing complexity of Microsoft's ecosystem and the growing sophistication of threat actors. Organizations are urged to prioritize applying these updates promptly to mitigate potential risks associated with these vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SAP Releases Critical Patch for NetWeaver ABAP Vulnerability CVE-2026-44747
Computer Software/Engineering3 months ago

SAP Releases Critical Patch for NetWeaver ABAP Vulnerability CVE-2026-44747

In July 2026, SAP released a critical security update addressing CVE-2026-44747, a memory corruption vulnerability in SAP NetWeaver Application Server ABAP. This flaw allows authenticated attackers to exploit memory management errors, potentially leading to unauthorized data access, modification, or system unavailability. The vulnerability affects multiple versions of the SAP NetWeaver AS ABAP kernel, including 7.22, 7.53, 7.54, 7.77, 7.89, 7.93, 9.16, 9.18, 9.19, and 9.20. Organizations using these versions are urged to apply the provided patches promptly to mitigate the risk of exploitation. The disclosure of CVE-2026-44747 underscores the ongoing challenges in securing enterprise resource planning (ERP) systems. As these platforms are integral to business operations, vulnerabilities within them present significant risks. This incident highlights the necessity for organizations to maintain rigorous patch management practices and to stay vigilant against emerging threats targeting critical business applications.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
FBI Issues Warning on Fake Permit Fee Phishing Scam
Government Administration3 months ago

FBI Issues Warning on Fake Permit Fee Phishing Scam

In March 2026, the FBI issued a public alert regarding a sophisticated phishing campaign where cybercriminals impersonated city and county planning officials to defraud property owners. By leveraging publicly accessible permit records, these actors sent emails to individuals with active applications, demanding payments for fictitious permit fees via wire transfers, peer-to-peer transfers, or cryptocurrency. The emails were meticulously crafted, incorporating real permit details to enhance credibility, leading victims to authorize payments that bypassed traditional fraud detection mechanisms. This scheme resulted in significant financial losses and highlighted vulnerabilities in existing payment verification processes. The urgency of this issue is underscored by the rapid escalation of government impersonation scams, which nearly doubled in reported losses to approximately $798 million in 2025. The increasing sophistication of these attacks, particularly their ability to exploit publicly available data and evade standard fraud detection systems, necessitates immediate attention and the development of more robust security measures to protect individuals and businesses from such fraudulent activities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Russian Cyberattacks in 2026 Exploit Weak Router Security
Government Administration3 months ago

Russian Cyberattacks in 2026 Exploit Weak Router Security

In July 2026, state-sponsored threat actors affiliated with Russia's Federal Security Service (FSB) Center 16 exploited weakly protected routers and networking equipment to infiltrate critical infrastructure networks globally. Targeted sectors included defense, energy, financial services, government, and healthcare. The attackers utilized techniques such as scanning for exposed SNMP services with default or easily guessed passwords and exploiting known vulnerabilities in Cisco devices. This activity led to significant disruptions and data breaches across multiple countries. The incident underscores the persistent threat posed by nation-state actors exploiting basic security lapses. It highlights the urgent need for organizations to implement robust network security measures, including updating device firmware, enforcing strong authentication protocols, and disabling unnecessary services to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
ClickFix Malware Campaign: A 2026 Cybersecurity Wake-Up Call
Financial Services3 months ago

ClickFix Malware Campaign: A 2026 Cybersecurity Wake-Up Call

In early 2026, a significant malware campaign known as 'ClickFix' exploited a critical vulnerability in the Ghost Content Management System (CVE-2026-26980) to compromise over 700 websites, including those of prominent educational institutions and tech companies. Attackers injected malicious JavaScript into these sites, presenting users with fake Cloudflare verification prompts that instructed them to execute commands leading to malware installation. This social engineering tactic effectively bypassed traditional security defenses, resulting in widespread data breaches and operational disruptions. The ClickFix campaign underscores a growing trend in cyber threats where attackers leverage trusted platforms and social engineering to deploy malware. The rapid evolution of such tactics highlights the need for organizations to adopt advanced detection methods, such as YARA-based structural analysis, and to enhance user awareness training to mitigate the risks associated with these sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Strengthening Router Security Against State-Sponsored Cyber Threats
Telecommunications3 months ago

Strengthening Router Security Against State-Sponsored Cyber Threats

In July 2026, a joint advisory from the NSA, CISA, FBI, and international partners highlighted that Russian FSB Center 16 cyber actors, also known as Berserk Bear and Dragonfly, have been exploiting poorly configured and vulnerable networking devices worldwide. These actors primarily target critical infrastructure sectors such as communications, energy, defense, financial services, government facilities, and healthcare. Their tactics include scanning for devices with default or weak SNMP credentials and exploiting known vulnerabilities in Cisco devices and protocols, enabling unauthorized access and potential disruption of essential services. This incident underscores the persistent threat posed by state-sponsored cyber actors targeting critical infrastructure through common vulnerabilities. Organizations are urged to enhance their network security by updating device configurations, disabling legacy protocols, and implementing strong authentication measures to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
U.S. Sanctions 1VPNS and Cryptor Seller for Enabling Ransomware Attacks
Financial Services3 months ago

U.S. Sanctions 1VPNS and Cryptor Seller for Enabling Ransomware Attacks

On July 13, 2026, the U.S. Department of the Treasury's Office of Foreign Assets Control (OFAC) sanctioned First VPN Service (1VPNS), its Ukrainian administrator Dmytro Rashevskyi, and Belarusian cryptor seller Yevgeniy Vladimirovich Silayev for facilitating ransomware attacks against American entities. 1VPNS provided anonymizing infrastructure that enabled ransomware groups to obscure their operations, while Silayev sold cryptors that disguised malware to evade detection. These services were instrumental in attacks targeting U.S. businesses, financial services, hospitals, and municipal governments, resulting in billions of dollars in losses. ([publicnow.com](https://www.publicnow.com/view/0E2E8ABF10AF6840E4588F09B8C6B2408783C702?utm_source=openai)) This action underscores the U.S. government's commitment to disrupting the cybercriminal ecosystem by targeting not only the perpetrators but also the enablers of ransomware operations. The sanctions highlight the critical role that infrastructure providers and tool developers play in the proliferation of ransomware, emphasizing the need for comprehensive cybersecurity measures and international cooperation to combat these threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds CVE-2008-4128 to Known Exploited Vulnerabilities Catalog
Government Administration3 months ago

CISA Adds CVE-2008-4128 to Known Exploited Vulnerabilities Catalog

On July 13, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2008-4128 to its Known Exploited Vulnerabilities (KEV) Catalog. This vulnerability, a Cross-Site Request Forgery (CSRF) flaw in the HTTP Administration component of Cisco IOS 12.4 running on 871 Integrated Services Routers, allows remote attackers to execute arbitrary commands. Despite being disclosed in 2008, recent evidence indicates active exploitation, prompting CISA to mandate federal agencies to apply mitigations by July 16, 2026. The resurgence of exploitation of this 17-year-old vulnerability underscores the persistent risk posed by unpatched legacy systems. Organizations are urged to reassess their network infrastructure, prioritize the remediation of known vulnerabilities, and implement robust patch management practices to mitigate potential threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding OAuth Client ID Spoofing in Microsoft Entra ID
Financial Services3 months ago

Understanding OAuth Client ID Spoofing in Microsoft Entra ID

In early 2026, attackers began exploiting a technique known as OAuth client ID spoofing to stealthily enumerate user accounts and validate credentials within Microsoft Entra ID environments. By submitting authentication requests with spoofed client IDs—identifiers that do not correspond to registered applications—attackers could infer valid usernames and passwords without generating successful sign-in events, thereby evading traditional detection mechanisms. This method allowed unauthorized access to cloud services without alerting defenders. ([proofpoint.com](https://www.proofpoint.com/us/blog/threat-insight/oauth-client-id-spoofing-why-fake-client-ids-are-gaining-traction-stealthy?utm_source=openai)) The adoption of OAuth client ID spoofing signifies a shift in attacker tactics towards more covert credential validation methods. Organizations must enhance their monitoring strategies to detect such evasive techniques and implement robust authentication policies to mitigate the risk of unauthorized access.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ESET Uncovers Vulnerable Microsoft-Signed UEFI Shims Allowing Secure Boot Bypass
Computer Hardware3 months ago

ESET Uncovers Vulnerable Microsoft-Signed UEFI Shims Allowing Secure Boot Bypass

In July 2026, ESET researchers identified 11 outdated, Microsoft-signed UEFI shim bootloaders vulnerable to Secure Boot bypasses. These shims, versions 0.9 and below, allow attackers to execute untrusted code during system boot, potentially deploying malicious UEFI bootkits. Exploitation isn't limited to systems with the affected software installed; attackers can introduce these vulnerable shims to any UEFI system trusting the Microsoft Corporation UEFI CA 2011 certificate. Microsoft addressed this by revoking the vulnerable shims in its June 9, 2026 Patch Tuesday update. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/07/14/3326630/0/en/eset-research-discovers-vulnerable-uefi-shims-undermining-devices-secure-boot.html?utm_source=openai)) This incident underscores the critical need for organizations to regularly update and monitor bootloader components. The discovery highlights the risks associated with outdated firmware and the importance of timely patch management to maintain system integrity.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
EU and UK Sanction Russian Entities Over Cyberespionage Campaign
Government Administration3 months ago

EU and UK Sanction Russian Entities Over Cyberespionage Campaign

In July 2026, the European Union and the United Kingdom imposed coordinated sanctions on Russian military intelligence officers, hackers, and private companies in response to a prolonged cyberespionage campaign attributed to Russian actors. The EU targeted nine individuals and four entities, while the UK sanctioned 24 individuals and organizations. These sanctions, including asset freezes and travel bans, were directed at actors linked to Russia's FSB and GRU intelligence agencies, accused of conducting cyber operations targeting governments and critical infrastructure since 2010. Key affected countries include France, Germany, Poland, the Netherlands, and Finland, with specific incidents such as the sabotage of Polish railway infrastructure highlighted. ([apnews.com](https://apnews.com/article/1d3c542e1409b54a10856eacad18b7ca?utm_source=openai)) This incident underscores the escalating threat of state-sponsored cyberattacks on critical infrastructure and governmental networks. The coordinated response by the EU and UK reflects a growing recognition of the need for unified action against cyber threats, emphasizing the importance of robust cybersecurity measures and international cooperation to safeguard national security and public services.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports