Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
EvilTokens Phishing Campaign: A New Threat to Microsoft 365 Security
In February 2026, the phishing-as-a-service platform EvilTokens emerged, compromising over 340 Microsoft 365 organizations across five countries within five weeks. The attack exploited the OAuth device code authentication flow, tricking users into entering a short code at microsoft.com/devicelogin and completing their MFA challenge. Unbeknownst to them, this granted attackers valid refresh tokens with access to emails, files, calendars, and contacts, all without stealing passwords or bypassing MFA. This method effectively bypassed traditional identity defenses, as the OAuth consent screen has become an instinctive click for many users. ([thehackernews.com](https://thehackernews.com/2026/05/the-new-phishing-click-how-oauth.html?utm_source=openai)) The incident underscores a significant shift in phishing tactics, highlighting the exploitation of legitimate authentication processes to gain unauthorized access. As attackers increasingly leverage such methods, organizations must reassess their security protocols to address these evolving threats.
4 months ago
Kill Chain
Microsoft Disrupts Fox Tempest's Malware-Signing Service Operation
In May 2026, Microsoft disrupted Fox Tempest, a financially motivated threat actor operating a malware-signing-as-a-service (MSaaS) platform. Fox Tempest exploited Microsoft's Artifact Signing to generate over a thousand fraudulent code-signing certificates, enabling other cybercriminals to distribute malware, including Rhysida ransomware, Oyster, Lumma Stealer, and Vidar, under the guise of legitimate software. This operation facilitated attacks across various sectors globally, including healthcare, education, government, and financial services. The takedown involved revoking the fraudulent certificates and dismantling the infrastructure supporting Fox Tempest's operations. The incident underscores the evolving tactics of cybercriminals who abuse legitimate services to enhance the credibility of their malware, thereby evading traditional security measures. It highlights the critical need for organizations to implement robust security controls, including advanced threat detection and response capabilities, to mitigate the risks posed by such sophisticated attack vectors.
4 months ago
Kill Chain
INTERPOL's Operation Ramz: A Landmark Cybercrime Crackdown in the MENA Region
Between October 2025 and February 2026, INTERPOL coordinated Operation Ramz, a large-scale cybercrime crackdown across 13 Middle East and North African countries. This operation led to 201 arrests, the identification of 382 additional suspects, and the seizure of 53 servers. Authorities disrupted various cybercrime activities, including phishing services, malware distribution, and financial scams, affecting nearly 4,000 victims. Notably, in Jordan, police uncovered a human trafficking scheme linked to financial fraud scams, rescuing 15 victims coerced into criminal activities. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) This operation underscores the escalating threat of cybercrime in the MENA region and highlights the effectiveness of international collaboration in combating such activities. The involvement of private sector partners like Group-IB, Kaspersky, and Team Cymru provided critical threat intelligence, facilitating the identification and dismantling of malicious infrastructures. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/kaspersky-supports-interpols-operation-ramz-in-mena-region-resulting-in-over-200-arrests?utm_source=openai))
4 months ago
Kill Chain
Microsoft's 2026 Takedown of Fox Tempest: A Major Blow to Cybercrime
In May 2026, Microsoft, through its Digital Crimes Unit, successfully dismantled the infrastructure of Fox Tempest, a cybercrime service that produced and sold over 1,000 fraudulent code-signing certificates. These certificates were utilized by various ransomware groups, including Rhysida and Vanilla Tempest, to make malicious software appear legitimate, thereby bypassing security defenses. The operation involved seizing domain names, websites, and Azure resources linked to Fox Tempest, effectively disrupting their malware-signing-as-a-service operations. ([axios.com](https://www.axios.com/2026/05/19/microsoft-fox-tempest-law-enforcement-takedown?utm_source=openai)) This incident underscores a significant shift in cybercriminal tactics, moving upstream to exploit software verification systems. The ability to fabricate trusted certificates at scale poses a substantial threat to global cybersecurity, emphasizing the need for enhanced vigilance and robust verification processes within software supply chains.
4 months ago
Kill Chain
Critical 'DirtyDecrypt' Vulnerability in Linux Kernel: Exploit Released
In May 2026, a local privilege escalation vulnerability in the Linux kernel's rxgk module, dubbed 'DirtyDecrypt' (also known as 'DirtyCBC'), was disclosed. This flaw allows attackers to gain root access on certain Linux systems by exploiting a missing Copy-On-Write (COW) guard in the rxgk_decrypt_skb function. The vulnerability, identified as CVE-2026-31635, was patched on April 25, 2026. Successful exploitation requires the CONFIG_RXGK configuration option enabled, affecting distributions like Fedora, Arch Linux, and openSUSE Tumbleweed. A proof-of-concept exploit has been released, demonstrating the ease of exploitation on unpatched systems. This incident underscores a growing trend of privilege escalation vulnerabilities in the Linux kernel, following similar disclosures such as 'Dirty Frag,' 'Fragnesia,' and 'Copy Fail.' The rapid succession of these vulnerabilities highlights the critical need for timely patch management and vigilant system monitoring to mitigate potential security risks.
4 months ago
Kill Chain
INTERPOL's Operation Ramz: A Major Cybercrime Crackdown in the MENA Region
Between October 2025 and February 2026, INTERPOL coordinated Operation Ramz, a large-scale cybercrime crackdown across 13 Middle Eastern and North African countries. The operation led to the arrest of 201 individuals and the identification of 382 additional suspects involved in phishing, malware distribution, and online fraud. Authorities seized 53 servers and identified 3,867 victims, disrupting significant malicious infrastructure and preventing further cyber threats. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) This operation underscores the escalating threat of cybercrime in the MENA region and highlights the effectiveness of international collaboration in combating such activities. The involvement of private cybersecurity firms like Kaspersky and Group-IB demonstrates the critical role of public-private partnerships in enhancing global cybersecurity efforts. ([kaspersky.co.za](https://www.kaspersky.co.za/about/press-releases/kaspersky-supports-interpols-operation-ramz-in-mena-region-resulting-in-over-200-arrests?utm_source=openai))
4 months ago
Kill Chain
INTERPOL's Operation Ramz: A Landmark Cybercrime Crackdown in MENA
Between October 2025 and February 2026, INTERPOL coordinated Operation Ramz, a significant cybercrime crackdown across 13 Middle East and North Africa (MENA) countries. This operation led to the arrest of 201 individuals and the identification of 382 additional suspects involved in various cybercrimes, including phishing, malware distribution, and financial fraud. Authorities seized 53 servers and identified 3,867 victims, highlighting the extensive impact of these cybercriminal activities. ([interpol.int](https://www.interpol.int/News-and-Events/News/2026/201-arrests-in-first-of-its-kind-cybercrime-operation-in-MENA-region?utm_source=openai)) The success of Operation Ramz underscores the effectiveness of international collaboration in combating cybercrime. As cyber threats continue to evolve and proliferate, such coordinated efforts are crucial in disrupting malicious networks and protecting potential victims from emerging cyber scams and attacks.
4 months ago
Kill Chain
Clop Ransomware Targets Cloud Clearway Group in March 2026 Attack
In March 2026, the Clop ransomware group executed a cyberattack on Cloud Clearway Group, a leading IT services firm in Canada. The attackers encrypted sensitive data and threatened to release it unless their ransom demands were met. This incident underscores the persistent threat posed by Clop, which has been responsible for numerous high-profile attacks targeting various sectors globally. The attack on Cloud Clearway Group highlights the evolving tactics of ransomware groups, emphasizing the need for organizations to bolster their cybersecurity defenses. With ransomware attacks becoming more sophisticated and frequent, businesses must prioritize proactive measures to mitigate potential risks and ensure data security.
4 months ago
Kill Chain
Red-Teaming Reveals Critical Vulnerabilities in Government Education AI Assistant
In early 2026, a government-deployed AI assistant designed to handle education-related inquiries was subjected to a comprehensive red-teaming assessment. The evaluation revealed that, despite robust defenses against direct prompt injections and social engineering tactics, the AI system was vulnerable to structural manipulation techniques. Specifically, attackers successfully bypassed semantic filters by embedding malicious commands within JSON structures and utilizing Base64 encoding, leading the AI to generate unauthorized outputs, including phishing payloads and the disclosure of its own system prompts. These findings underscore the critical need for AI systems to implement multi-layered security measures that address both semantic and structural vulnerabilities to prevent exploitation through prompt injection attacks. The incident highlights the evolving nature of AI security threats, particularly the sophistication of prompt injection techniques that can circumvent traditional safeguards. As AI systems become increasingly integrated into sensitive sectors like education, it is imperative for organizations to adopt comprehensive security frameworks that encompass regular red-teaming exercises, advanced input validation, and continuous monitoring to detect and mitigate emerging threats effectively.
4 months ago
Kill Chain
Iranian Hackers Compromise U.S. Fuel Monitoring Systems in 2026
In May 2026, Iranian hackers reportedly breached automatic tank gauge (ATG) systems monitoring fuel levels at gas stations across multiple U.S. states. These systems, exposed online without password protection, allowed attackers to alter display readings without affecting actual fuel levels. While no physical damage occurred, the incident underscores vulnerabilities in critical infrastructure. ([abc17news.com](https://abc17news.com/politics/national-politics/cnn-us-politics/2026/05/15/exclusive-hackers-have-breached-tank-readers-at-us-gas-stations-officials-suspect-iran-is-responsible/?utm_source=openai)) This breach highlights the evolving nature of cyber warfare, where nation-state actors target essential services. The incident serves as a stark reminder for organizations to secure internet-facing operational technology systems to prevent potential disruptions and safety hazards.
4 months ago
Kill Chain
Unveiling Fast16: The Pre-Stuxnet Cyber Sabotage Tool
In May 2026, cybersecurity researchers uncovered 'fast16,' a sophisticated Lua-based malware designed to sabotage nuclear weapons testing simulations. Developed as early as 2005, predating Stuxnet by two years, fast16 targeted engineering applications like LS-DYNA and AUTODYN to corrupt uranium-compression simulations essential for nuclear weapon design. The malware selectively tampered with high-explosive simulations, activating only when material density exceeded 30 g/cm³, a threshold indicative of uranium under implosion conditions. This strategic interference aimed to produce flawed simulation results, potentially derailing nuclear weapons development programs. The discovery of fast16 highlights the longstanding use of cyber tools for industrial sabotage by nation-state actors. Its sophisticated design and targeted approach underscore the critical need for robust cybersecurity measures in protecting sensitive research and development activities, especially those related to national security.
4 months ago
Kill Chain
MiniPlasma Zero-Day: A Critical Threat to Windows 11 Security
In May 2026, security researcher Chaotic Eclipse disclosed a critical zero-day vulnerability in Microsoft Windows, codenamed MiniPlasma. This flaw affects the Windows Cloud Files Mini Filter Driver (cldflt.sys) and allows attackers to escalate privileges to SYSTEM level on fully patched Windows 11 systems. The vulnerability was initially reported to Microsoft in September 2020 and was believed to have been patched in December 2020 as CVE-2020-17103. However, recent findings indicate that the issue remains unpatched, posing significant security risks. The public release of the MiniPlasma exploit underscores ongoing challenges in Windows security, particularly concerning privilege escalation vulnerabilities. Organizations must reassess their security postures and implement additional measures to mitigate the risks associated with this unpatched flaw.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports