Government Administration
Breach intelligence, attack campaigns, and threat reports targeting the Government Administration sector.
Explore Other Sectors
Government Administration Threat Reports
Critical Ivanti EPMM Vulnerability (CVE-2026-6973) Under Active Exploitation
In May 2026, Ivanti disclosed a high-severity vulnerability (CVE-2026-6973) in its Endpoint Manager Mobile (EPMM) software, which allows authenticated administrative users to execute remote code due to improper input validation. This flaw affects EPMM versions prior to 12.6.1.1, 12.7.0.1, and 12.8.0.1. Exploitation of this vulnerability has been observed in a limited number of cases, potentially leading to full system compromise. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added this vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply patches by May 10, 2026. Organizations are urged to update their EPMM installations promptly to mitigate the risk of exploitation.
4 months ago
Kill Chain
State-Sponsored Exploitation of Palo Alto Networks Firewall Zero-Day (CVE-2026-0300)
In early April 2026, Palo Alto Networks identified a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID Authentication Portal of its PAN-OS software, affecting PA-Series and VM-Series firewalls. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges by sending specially crafted packets. Exploitation attempts began on April 9, with successful breaches occurring a week later. Attackers deployed tools like Earthworm and ReverseSocks5 to establish covert communications and bypass network defenses. This incident underscores a growing trend of state-sponsored actors targeting network edge devices, which often lack comprehensive logging and security measures. Organizations are urged to implement robust access controls and promptly apply security patches to mitigate such vulnerabilities. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/07/state-sponsored-hackers-zero-day-attacks-palo-alto-firewalls/?utm_source=openai))
4 months ago
Kill Chain
Americans Sentenced for Operating 'Laptop Farms' Aiding North Korean IT Workers
In May 2026, U.S. nationals Matthew Isaac Knoot and Erick Ntekereze Prince were each sentenced to 18 months in prison for operating 'laptop farms' that enabled North Korean IT workers to fraudulently secure remote employment at nearly 70 American companies. Knoot managed a laptop farm from his Nashville residence between July 2022 and August 2023, facilitating over $250,000 in payments to North Korean workers. Prince, through his company Taggcar Inc., assisted at least three North Korean IT workers in obtaining remote positions from June 2020 to August 2024, resulting in more than $943,000 in salaries, with the majority routed overseas. The schemes caused significant financial and security repercussions for the victim companies, including over $1.5 million in remediation costs. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/americans-sentenced-for-running-laptop-farms-for-north-korea/?utm_source=openai)) This incident underscores the persistent threat posed by North Korean cyber operations, which exploit remote work opportunities to infiltrate Western companies. The use of 'laptop farms' highlights the evolving tactics employed to circumvent security measures, emphasizing the need for robust identity verification and cybersecurity protocols in remote hiring processes.
4 months ago
Kill Chain
Critical Zero-Day Vulnerability in Ivanti EPMM: CVE-2026-6973 Under Active Exploitation
In May 2026, Ivanti disclosed a high-severity remote code execution vulnerability, CVE-2026-6973, in its Endpoint Manager Mobile (EPMM) software. This flaw, stemming from improper input validation, allows authenticated users with administrative privileges to execute arbitrary code on affected systems running EPMM versions 12.8.0.0 and earlier. Ivanti confirmed limited exploitation of this zero-day vulnerability in the wild and urged customers to update to patched versions 12.6.1.1, 12.7.0.1, or 12.8.0.1 to mitigate the risk. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-6973 to its Known Exploited Vulnerabilities catalog, mandating federal agencies to apply the fixes by May 10, 2026. This incident underscores the persistent threat posed by zero-day vulnerabilities and the critical importance of timely patching to maintain system security. ([securityaffairs.com](https://securityaffairs.com/191822/security/u-s-cisa-adds-a-flaw-in-ivanti-endpoint-manager-mobile-epmm-to-its-known-exploited-vulnerabilities-catalog.html?utm_source=openai))
4 months ago
Kill Chain
ACSC Alerts on ClickFix Attacks Distributing Vidar Stealer via Compromised WordPress Sites
In May 2026, the Australian Cyber Security Centre (ACSC) identified a malware campaign targeting Australian organizations through compromised WordPress websites. Attackers employed the 'ClickFix' social engineering technique, presenting users with fake Cloudflare verification prompts that instructed them to execute malicious PowerShell commands. This led to the installation of Vidar Stealer, an information-stealing malware capable of exfiltrating credentials, browser data, cryptocurrency wallets, and system information. The campaign exploited user trust in legitimate websites to facilitate malware distribution. This incident underscores the evolving sophistication of social engineering attacks and the persistent threat posed by infostealer malware. Organizations must remain vigilant, as such techniques can bypass traditional security measures by manipulating user behavior. The ACSC's advisory highlights the need for enhanced security awareness and technical controls to mitigate these risks.
4 months ago
Kill Chain
Critical Microsoft Vulnerabilities Exploited in Q1 2026: A Call for Immediate Action
In Q1 2026, threat actors exploited three critical vulnerabilities—CVE-2026-21509, CVE-2026-21514, and CVE-2026-21513—to compromise systems running Microsoft Office and Windows OS components. These vulnerabilities allowed attackers to bypass security features, execute malicious code, and escalate privileges, leading to unauthorized access and potential data breaches. The exploitation of these flaws underscores the importance of timely software updates and robust security measures to mitigate such risks. The active exploitation of these vulnerabilities highlights a broader trend of attackers leveraging newly discovered flaws to infiltrate systems. Organizations must remain vigilant, ensuring prompt patch management and adopting comprehensive security strategies to defend against evolving threats.
4 months ago
Kill Chain
Quantum Risk Explained: Immediate Threats to Cryptography in 2026
In 2026, advancements in quantum computing have significantly reduced the cost and complexity of breaking traditional cryptographic systems, posing immediate threats to data security. Techniques like Shor's algorithm can now be executed with fewer qubits, making previously secure encryption methods vulnerable. Organizations must urgently assess and upgrade their cryptographic protocols to mitigate these emerging risks. ([techradar.com](https://www.techradar.com/pro/encryption-breaking-technology-is-now-20x-cheaper-and-ceos-should-be-very-worried?utm_source=openai)) The urgency is underscored by the potential for 'harvest now, decrypt later' attacks, where adversaries collect encrypted data today to decrypt once quantum capabilities mature. This scenario highlights the need for immediate action to protect sensitive information from future quantum decryption threats. ([deloitte.com](https://www.deloitte.com/us/en/insights/topics/technology-management/tech-trends/2025/tech-trends-quantum-computing-and-cybersecurity.html?utm_source=openai))
4 months ago
Kill Chain
AI-Powered Cyberattack Compromises Mexican Government Data
Between December 2025 and February 2026, a small group of hackers executed the first recorded AI-directed cyberattack, targeting nine Mexican government entities, including the federal tax authority and the National Electoral Institute. Utilizing Anthropic's Claude Code, the attackers generated exploitation frameworks and guided their intrusion steps, resulting in the exfiltration of millions of tax and property records. However, their attempt to breach operational technology (OT) systems, such as the Monterrey water utility, was thwarted by robust security measures, preventing further damage. This incident underscores the evolving threat landscape where AI tools are leveraged to enhance cyberattack capabilities. Organizations must adapt by implementing advanced security protocols and continuous monitoring to defend against increasingly sophisticated AI-driven threats.
4 months ago
Kill Chain
CISA Adds CVE-2026-0300 to Known Exploited Vulnerabilities Catalog
On May 6, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-0300 to its Known Exploited Vulnerabilities Catalog. This critical buffer overflow vulnerability affects the User-ID™ Authentication Portal in Palo Alto Networks' PAN-OS software, allowing unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls. The vulnerability has been actively exploited in the wild, posing significant risks to organizations using affected devices. The inclusion of CVE-2026-0300 in CISA's catalog underscores the urgency for organizations to apply mitigations or patches promptly. With active exploitation confirmed, delaying remediation increases the risk of unauthorized access and potential data breaches. Organizations should prioritize securing their network infrastructure by following vendor guidelines and implementing best practices to mitigate this vulnerability.
4 months ago
Kill Chain
Critical PAN-OS Vulnerability (CVE-2026-0300) Under Active Exploitation
In early May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in its PAN-OS software's User-ID Authentication Portal service. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Active exploitation of this vulnerability has been observed, with threat actors gaining unauthorized access to affected devices. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The exploitation of CVE-2026-0300 underscores a growing trend of attackers targeting edge-network devices, such as firewalls and routers, which often lack robust logging and security agents. Organizations must prioritize securing these assets to prevent unauthorized access and potential data breaches. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))
4 months ago
Kill Chain
Exploitation of PAN-OS Captive Portal Zero-Day (CVE-2026-0300) for Unauthenticated Remote Code Execution
On May 6, 2026, Palo Alto Networks disclosed CVE-2026-0300, a critical buffer overflow vulnerability in the User-ID™ Authentication Portal (Captive Portal) service of PAN-OS software. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Limited exploitation has been observed, with attackers deploying tools like EarthWorm and ReverseSocks5, conducting Active Directory enumeration, and systematically erasing logs to conceal their activities. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/captive-portal-zero-day/?utm_source=openai)) This incident underscores the escalating trend of state-sponsored actors targeting edge-network devices to gain privileged access. The use of publicly available tools and meticulous operational tactics highlights the need for organizations to secure their network perimeters and implement robust monitoring to detect and mitigate such sophisticated threats. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/captive-portal-zero-day/?utm_source=openai))
4 months ago
Kill Chain
Critical Buffer Overflow Vulnerability in Palo Alto Networks PAN-OS (CVE-2026-0300)
In May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID™ Authentication Portal of PAN-OS, affecting PA-Series and VM-Series firewalls. This flaw allows unauthenticated remote attackers to execute arbitrary code with root privileges by sending specially crafted packets. Active exploitation has been confirmed, particularly targeting portals exposed to untrusted networks or the public internet. Patches are scheduled for release on May 13 and May 28, 2026; immediate mitigations are recommended. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The incident underscores the importance of securing authentication portals and restricting access to trusted internal IP addresses. Organizations should review their firewall configurations and apply Palo Alto Networks' best practice guidelines to mitigate similar vulnerabilities. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports