Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Government Administration

Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.

3243 threat reports
Page 9 of 271
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Government Administration Threat Reports

Showing 97–108 / 3243 reports
CVE-2026-80097: How a Zero-Permission Android App Could Steal Your Corporate Microsoft Tokens
CVE-2026-80097: How a Zero-Permission Android App Could Steal Your Corporate Microsoft Tokens
Information Technology/IT1 week ago

CVE-2026-80097: How a Zero-Permission Android App Could Steal Your Corporate Microsoft Tokens

In October 2026, security researcher Ofek Levin of Enclave disclosed CVE-2026-80097, an 8.6 CVSS-rated flaw in Microsoft Authenticator for Android that allowed any unprivileged app to impersonate trusted Microsoft applications such as Teams and harvest OAuth tokens for a victim's work account. The vulnerability resided in the publicly accessible AccountChooserActivity component, which accepted attacker-supplied identity claims and performed a flawed signature check that could be bypassed because the legitimate target app was genuinely installed on the device. Tokens returned in testing granted read/write access to corporate email, files, and calendars. Microsoft patched the flaw in Authenticator version 6.2606.4246 as part of September 2026 Patch Tuesday. This incident illustrates the continued risk of over-privileged mobile authentication brokers and weak inter-app trust validation. As enterprises expand mobile-first workforce strategies, OAuth token theft via mobile app impersonation is emerging as a high-value, low-noise vector that bypasses traditional perimeter defenses and directly compromises identity infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
When the Sensor Goes Dark: Warlock Ransomware and the Kill-Before-Encrypt Playbook
When the Sensor Goes Dark: Warlock Ransomware and the Kill-Before-Encrypt Playbook
Utilities1 week ago

When the Sensor Goes Dark: Warlock Ransomware and the Kill-Before-Encrypt Playbook

Between July and October 2025, the China-linked threat actor Storm-2603 deployed Warlock ransomware against at least four organizations—including a water utility, a telecom provider, a regional government body, and a university—across Portuguese- and Spanish-speaking countries in Europe, Africa, and Latin America. The attackers exploited unpatched on-premises Microsoft SharePoint vulnerabilities, including flaws disclosed and patched in July 2025, to plant web shells and spend nine days establishing persistence, mapping the domain, creating rogue service accounts, and staging lateral movement. In the final phase, a purpose-built tool disabled endpoint security software across roughly 40 hosts within two hours, after which Warlock ransomware was deployed via SYSVOL replication to at least 33 domain-joined hosts. This incident exposes a systemic assumption embedded in most security budgets: that detection and response tools will be operational when an attack arrives. Storm-2603's deliberate kill-before-encrypt playbook invalidates that assumption, demanding a shift toward network-layer and memory-resident controls that act before an adversary accumulates the privileges needed to silence sensors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
When IT Support Becomes the Threat: How Attackers Weaponized Microsoft Teams to Deploy Chaos Ransomware
When IT Support Becomes the Threat: How Attackers Weaponized Microsoft Teams to Deploy Chaos Ransomware
Information Technology/IT1 week ago

When IT Support Becomes the Threat: How Attackers Weaponized Microsoft Teams to Deploy Chaos Ransomware

Beginning in 2026, threat actors exploiting Microsoft Teams' external chat feature launched a sophisticated social engineering campaign impersonating IT support personnel to deliver malware and ransomware across hundreds of organizations. Attackers established fraudulent Microsoft 365 tenants using IT-themed onmicrosoft.com and paid top-level domains, preceded attacks with email bombing to create urgency, then used vishing to gain remote access via tools such as AnyDesk, Quick Assist, and Atera. Once inside, they conducted Active Directory reconnaissance via LDAP queries, deployed the GoGRPC backdoor, moved laterally to domain controllers, and dropped Chaos ransomware while exfiltrating sensitive data. This campaign underscores a critical shift in attacker tradecraft: rather than exploiting software vulnerabilities, adversaries are weaponizing trusted collaboration platforms and legitimate remote management tools. The STAC4749 threat cluster's repeated use of this pattern—across cloud tenants, RMM tooling, and ransomware payloads—signals a durable, scalable playbook that security teams must treat as an ongoing threat to enterprise communication infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
PHP2Shell Zero-Day Meets Agentic AI: How Lazarus-Linked Actors Breached a Government in Under Two Hours
PHP2Shell Zero-Day Meets Agentic AI: How Lazarus-Linked Actors Breached a Government in Under Two Hours
Government Administration2 weeks ago

PHP2Shell Zero-Day Meets Agentic AI: How Lazarus-Linked Actors Breached a Government in Under Two Hours

In October 2026, threat actors exploited critical PHP vulnerabilities CVE-2026-109618 and CVE-2026-109619 (collectively dubbed PHP2Shell) to compromise a European government entity. Within two hours of initial exploitation, attackers accessed password hashes, MFA secrets, and established an NTLM-relay tunnel into Active Directory, attempting Domain Admin privilege escalation. Behavioral markers—including structured shell output delimiters designed for machine parsing—strongly indicate the use of agentic AI tooling for post-exploitation automation. Concurrently, CYFIRMA attributed a parallel low-and-slow scanning campaign across 216 unpatched global hosts to a suspected Lazarus Group affiliate, coordinated via a covert I2P channel with Korean-language indicators consistent with North Korean operators. This incident represents a convergence of two accelerating threat trends: the mass exploitation of critical runtime vulnerabilities affecting tens of millions of internet-facing PHP systems, and the operational deployment of agentic AI by nation-state actors to accelerate post-breach reconnaissance and lateral movement. With nearly 37 million PHP-exposed systems globally and Cloudflare reporting millions of exploitation attempts post-disclosure, organizations across government, finance, and critical infrastructure face an elevated and time-sensitive attack surface.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
BlackX UEFI Bootkit: How APT41 Turned an Unfinished Patch Into a Nation-State Espionage Campaign
BlackX UEFI Bootkit: How APT41 Turned an Unfinished Patch Into a Nation-State Espionage Campaign
Government Administration2 weeks ago

BlackX UEFI Bootkit: How APT41 Turned an Unfinished Patch Into a Nation-State Espionage Campaign

In early 2026, a Chinese state-sponsored threat actor attributed with medium confidence to APT41 (also known as Brass Typhoon) deployed a novel UEFI bootkit called BlackX against diplomatic agencies in Central Asia, specifically in Tajikistan, Uzbekistan, and Turkmenistan. BlackX exploited the long-known Baton Drop vulnerability (CVE-2022-21894) to bypass Secure Boot by enrolling custom Machine Owner Keys, then loaded a kernel driver signed with a revoked certificate to disable Kaspersky and Avast security processes, tamper with Event Tracing for Windows, and deploy a cloud-hosted RAT using Google Drive, OneDrive, and Yandex.Disk for command-and-control alongside the obfuscated OxiDLLRunner payload framework. BlackX highlights a persistent and dangerous gap in enterprise patching hygiene: Microsoft's fix for CVE-2022-21894 requires administrators to manually trigger Secure Boot revocations after patch installation—a step nearly universally skipped. With APT41 actively weaponizing firmware-level persistence and the October 2026 expiration of the Windows Production PCA 2011 certificate not automatically blocking vulnerable binaries, organizations face renewed urgency to audit bootloader revocation status across their fleets.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PHP2Shell: How Two Critical PHP RCE Bugs Sent the Security Industry Into Red-Alert Mode
PHP2Shell: How Two Critical PHP RCE Bugs Sent the Security Industry Into Red-Alert Mode
Computer/Network Security2 weeks ago

PHP2Shell: How Two Critical PHP RCE Bugs Sent the Security Industry Into Red-Alert Mode

In October 2026, two critical remote code execution vulnerabilities in PHP—CVE-2026-109618 and CVE-2026-109619, collectively dubbed 'PHP2Shell'—were disclosed with a CVSS v4.0 score of 9.2. Discovered by infosec firm Calif and analyzed by WatchTowr, both flaws allow unauthenticated attackers to execute arbitrary code on web servers simply by reaching them over the network. An embargo break led to early publication of a proof-of-concept tool, accelerating attacker reconnaissance while defenders scrambled to patch or mitigate across Apache mod_php, PHP-FPM, php-cgi, FrankenPHP, and LiteSpeed deployments. Active exploitation attempts were observed in the wild within hours of disclosure. The PHP2Shell incident echoes Log4Shell in scope and urgency, underscoring the fragility of open source supply chains and the disproportionate risk carried by under-resourced organizations—schools, municipalities, and nonprofits—that lack dedicated security staff but run PHP-based infrastructure extensively exposed to the internet.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
ARTEX Agentic AI Weaponized in ConnectWise Supply Chain Attack — And PHP2Shell Was Exploited Before a Patch Existed
ARTEX Agentic AI Weaponized in ConnectWise Supply Chain Attack — And PHP2Shell Was Exploited Before a Patch Existed
Financial Services2 weeks ago

ARTEX Agentic AI Weaponized in ConnectWise Supply Chain Attack — And PHP2Shell Was Exploited Before a Patch Existed

During the week of October 13–21, 2026, a suspected Chinese state-aligned threat actor deployed ARTEX, a Go-based multi-agent LLM penetration testing framework, to execute an automated supply chain compromise against ConnectWise Cloud Backup, generating over 151,000 failed logon events and breaching hundreds of global organizations across aerospace, defense, energy, and financial services in under three hours per target. Simultaneously, the PHP security team issued emergency patches for CVE-2026-109618 and CVE-2026-109619 — dubbed PHP2Shell — rated CVSS 9.2, after exploitation probes hit honeypots four days before coordinated disclosure, exposing enterprises running Apache mod_php, PHP-FPM, and LiteSpeed to unauthenticated remote code execution. These incidents mark a pivotal escalation: agentic AI is no longer a theoretical offensive capability but an operationalized weapon enabling machine-speed cloud identity compromise, while pre-patch exploitation of embargoed vulnerabilities signals an intelligence pipeline that outpaces traditional disclosure timelines, compressing enterprise response windows to days or hours.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Adds Collabora Online RCE and Arista VeloCloud SQL Injection to KEV: What Network Security Teams Must Do Now
CISA Adds Collabora Online RCE and Arista VeloCloud SQL Injection to KEV: What Network Security Teams Must Do Now
Information Technology/IT2 weeks ago

CISA Adds Collabora Online RCE and Arista VeloCloud SQL Injection to KEV: What Network Security Teams Must Do Now

In October 2026, CISA added two critical vulnerabilities to its Known Exploited Vulnerabilities catalog: CVE-2026-110447 (CVSS 9.2), an OS command injection flaw in Collabora Online's Built-in CODE Server enabling remote code execution via proxy.php on Nextcloud platforms, and CVE-2026-114625 (CVSS 9.9), an SQL injection vulnerability in Arista VeloCloud Orchestrator allowing remote attackers with only read-only access to reach privileged internal functionality. Active exploitation of CVE-2026-110447 involved web shell implantation on Nextcloud servers followed by credential harvesting, while CVE-2026-114625 exploitation was traced to two IP addresses geolocated to Japan, marking the third VeloCloud vulnerability weaponized since July 2026. This incident underscores an accelerating pattern of critical infrastructure and SD-WAN orchestration platforms being targeted through high-CVSS injection vulnerabilities. With three VeloCloud flaws actively exploited within a four-month window, attackers are systematically probing network management planes—raising the stakes significantly for organizations relying on these platforms for hybrid and multi-cloud connectivity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Operation IXIM: How an Abandoned Popcorn Time Updater Nearly Became the World's Largest Accidental Botnet
Operation IXIM: How an Abandoned Popcorn Time Updater Nearly Became the World's Largest Accidental Botnet
Government Administration2 weeks ago

Operation IXIM: How an Abandoned Popcorn Time Updater Nearly Became the World's Largest Accidental Botnet

Between November 2025 and March 2026, Dutch firm Eye Security discovered that the abandoned Time4Popcorn application—a legacy fork of the popular piracy client Popcorn Time—contained a background updater (CVE-2026-30612, CVSS 9.8) that phoned home over unencrypted HTTP to unregistered domains, installed payloads at SYSTEM/root privilege without signature verification, and exposed an estimated 2.5–3 million Windows machines and up to 350,000 Macs to silent takeover. Eye registered the abandoned domains, confirmed inbound traffic from government, military, and corporate networks, and—finding no vendor to patch the software—pushed over 2 million benign disabling updates under Operation IXIM, reducing active call-home traffic by 98 percent before transferring domain custody to Shadowserver in March 2026. This incident illustrates a growing supply-chain blind spot: software that organizations never formally adopted—installed by employees on personal or corporate devices—can harbor persistent, privileged execution channels years after the original vendor disappears, creating botnet-ready infrastructure at scale without any malicious actor needing to write a single line of exploit code.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
CVE-2026-30612: How an Abandoned App's Expired Domain Put 3 Million Devices at Risk of RCE
Government Administration2 weeks ago

CVE-2026-30612: How an Abandoned App's Expired Domain Put 3 Million Devices at Risk of RCE

A critical remote code execution vulnerability (CVE-2026-30612) was discovered in Time4Popcorn, an abandoned fork of the Popcorn Time BitTorrent client, affecting an estimated 3 million Windows and 350,000 macOS devices. The flaw resided in the app's auto-updater, which contacted an expired domain over unencrypted HTTP and accepted unsigned executables—enabling anyone who registered the domain to push arbitrary code with SYSTEM-level or root privileges. Researchers at Eye Security registered the abandoned update domain and 14 related domains, then used the same vulnerable mechanism to deploy remediation payloads that disabled the updater across approximately 2 million devices between November 2025 and March 2026. Connections originated not only from residential ISPs but also from corporate, government, and military networks, amplifying the potential blast radius significantly. This incident exemplifies the growing threat of abandoned-software supply-chain attacks, where unpatched updaters tied to expired domains become persistent, low-cost entry points. As organizations accumulate shadow IT and forgotten consumer applications on managed endpoints, adversaries increasingly scout lapsed domains as cheap vectors for mass exploitation—making software lifecycle governance and egress traffic enforcement critical defensive priorities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
BlackX UEFI Bootkit: How APT41 Exploits a 'Patched' Windows Flaw to Own Diplomatic Networks
BlackX UEFI Bootkit: How APT41 Exploits a 'Patched' Windows Flaw to Own Diplomatic Networks
Government Administration2 weeks ago

BlackX UEFI Bootkit: How APT41 Exploits a 'Patched' Windows Flaw to Own Diplomatic Networks

In early 2026, APT41-affiliated threat actors deployed a sophisticated UEFI bootkit dubbed BlackX against diplomatic organizations in Tajikistan, Uzbekistan, and Turkmenistan. Derived from the notorious BlackLotus bootkit, BlackX exploits CVE-2022-21894 (Baton Drop) to bypass Secure Boot on fully patched Windows systems where administrators failed to apply mandatory manual revocation steps—specifically blocklisting the 'Windows Production PCA 2011' certificate in the UEFI DBX. After gaining administrator privileges through an undisclosed initial access vector, attackers installed a kernel-level driver, a RAT using Google Drive and OneDrive for C2, and the OxiDLLRunner DLL sideloader, achieving persistent, covert espionage access across high-value government networks. This incident underscores a growing APT trend of repurposing commercial crimeware tooling—bridging cybercrime and state-sponsored espionage—to maintain firmware-level persistence that survives OS reinstalls and endpoint detection. As UEFI-based implants proliferate among nation-state actors, organizations face pressure to close patch-management gaps that go beyond standard Windows Update cycles and require manual firmware-layer hardening.

Medium impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Ruby's Regex Engine Had Three Bugs. GitLab Got Four Critical RCEs—Two Rated CVSS 10.0.
Ruby's Regex Engine Had Three Bugs. GitLab Got Four Critical RCEs—Two Rated CVSS 10.0.
Computer Software/Engineering2 weeks ago

Ruby's Regex Engine Had Three Bugs. GitLab Got Four Critical RCEs—Two Rated CVSS 10.0.

In October 2026, Ruby disclosed three critical bugs in Onigmo, its built-in regular expression engine, that collectively enabled four remote code execution vulnerabilities in GitLab—two rated CVSS 9.9 and two rated a perfect 10.0. GitLab compiles user-supplied regex patterns in features such as CI/CD configuration, and a specially crafted pattern could corrupt memory during compilation, granting an unauthenticated attacker full code execution on GitLab's servers. The unauthenticated flaws, CVE-2026-97229 and CVE-2026-110264, affect every GitLab version from 7.0 onward. Patched Ruby builds (4.0.9, 3.4.12, 3.3.13) and corresponding GitLab releases (19.5.1 down to 18.11.13) were shipped between September 23 and October 21, 2026. This incident highlights a systemic supply-chain risk: a single language-level regex engine flaw propagated into multiple critical application CVEs. As DevSecOps pipelines rely heavily on Ruby-based tooling and GitLab-hosted workflows, organizations must treat upstream language runtime patches with the same urgency as direct application patches, and implement inline traffic inspection to detect exploitation attempts before patches can be applied.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports