The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Government Relations
Breach intelligence, attack campaigns, and threat reports targeting the Government Relations sector.
Explore Other Sectors
Government Relations Threat Reports
FamousSparrow's SparroWocky Backdoor Targets Latin American Governments
The China-linked espionage group FamousSparrow has been conducting a sustained campaign against government organizations across Latin America using their new SparroWocky backdoor malware. From mid-2025 through 2026, the group targeted organizations in Argentina, Ecuador, Guatemala, Honduras, Panama, Peru, Puerto Rico, and Venezuela, replacing their previous SparrowDoor backdoor with this more advanced C++ malware. SparroWocky features sophisticated anti-analysis capabilities, modular architecture, and comprehensive data collection functions including screenshot capture, file manipulation, and proxy operations. The attacks aimed to gather intelligence on Latin American governments' responses to increasing U.S. pressure on Chinese economic interests, demonstrating China's strategic focus on regional geopolitical intelligence gathering. This campaign highlights the evolution of Chinese state-sponsored cyber espionage capabilities and their expanding focus on Latin American targets amid growing geopolitical tensions. The sophisticated evasion techniques and sustained operations demonstrate the increasing threat posed by well-resourced nation-state actors to regional government infrastructure and diplomatic communications.
1 week ago
Kill Chain
Russian APTs Exploit Messaging App Trust to Compromise EU Government Officials
In 2026, Russian state-sponsored threat actors conducted a sophisticated spear-phishing campaign targeting high-ranking EU government officials through encrypted messaging applications like WhatsApp and Signal. The attackers impersonated platform support teams and used QR code social engineering tactics to compromise accounts, successfully breaching officials including German Bundestag President Julia Klöeckner. Eight significant incidents were documented across EU governments, exposing the vulnerability of consumer messaging platforms used for official communications and prompting several nations to develop sovereign messaging solutions. This incident highlights the critical shift in nation-state attack vectors as threat actors exploit the inherent trust users place in encrypted messaging platforms, moving beyond traditional email-based phishing to leverage communication channels with less security oversight and monitoring capabilities.
4 weeks ago
Kill Chain
Russian Actors Exploit ChatGPT for Sophisticated Influence Operation
In August 2026, OpenAI disrupted a Russian-linked influence operation that used ChatGPT accounts with VPNs to bypass geographic restrictions and generate social media content across multiple platforms. The operation promoted the International Burke Institute (IBI), a fake think tank registered in February 2025, which featured copied academic work, false attributions, and a sovereignty index designed to cast Russia favorably. While the campaign reached relatively small audiences of 10-20,000 followers per channel, it demonstrated sophisticated infrastructure building for long-term influence operations. This incident highlights the emerging threat of AI-powered disinformation campaigns that leverage large language models to create credible-appearing institutions and content at scale, representing a new frontier in state-sponsored information warfare.
4 weeks ago
Kill Chain
CRESCENTHARVEST Malware Campaign Exploits Iran Protests to Target Supporters
In early January 2026, a cyberespionage campaign named CRESCENTHARVEST emerged, targeting individuals supporting Iran's anti-government protests. Attackers distributed malicious archive files containing authentic protest media and Farsi-language reports, alongside disguised Windows shortcut (.LNK) files. When executed, these shortcuts deployed a remote access trojan (RAT) capable of executing commands, logging keystrokes, and exfiltrating sensitive data. The campaign's sophistication suggests alignment with Iranian state interests, aiming for long-term surveillance and information theft. This incident underscores the increasing use of geopolitical events as lures in cyberattacks, highlighting the need for heightened vigilance among activists, journalists, and dissidents. The campaign's reliance on social engineering and legitimate-looking media emphasizes the importance of verifying the authenticity of received files, especially those related to sensitive political contexts.
7 months ago
Kill Chain
LOTUSLITE Backdoor: How Mustang Panda Targeted U.S. Policy Organizations in 2026
In January 2026, researchers revealed a spear phishing campaign targeting US government and policy organizations utilizing geopolitical lures themed around US intervention in Venezuela. Attackers distributed a malicious ZIP archive containing a DLL file using side-loading techniques to deploy the LOTUSLITE backdoor. The campaign, attributed to the Chinese state-linked Mustang Panda group, leveraged reliable execution flows such as DLL sideloading, beaconed over WinHTTP APIs, enabled remote command execution, and exfiltrated data. While the exact scope of any successful compromise remains unclear, the operation demonstrates a focused cyber espionage effort using proven tactics for initial access and persistence. This campaign highlights the ongoing trend where threat actors employ familiar, effective tradecraft combined with timely or provocative lures. It underscores the continued risk posed to policy organizations from geopolitical-themed spear phishing as attackers adapt their delivery but rely on consistent, operationally sound techniques.
8 months ago
Kill Chain
Iranian Nation-State Hackers Target John Bolton’s Email in 2021 Security Breach
In July 2021, former U.S. National Security Adviser John Bolton's personal email account was compromised by cyber actors believed to be linked to the Islamic Republic of Iran. The attackers gained unlawful access, extracted emails containing potentially sensitive information, and leveraged these materials to threaten and attempt to coerce Bolton, including by referencing classified content and threatening public disclosure. The FBI became aware when Bolton’s representative reported the intrusion and subsequent extortion attempts, with the threat actor referencing previous high-profile leaks to amplify pressure. It remains unclear if any sensitive materials were publicly disseminated, but the incident elevated concerns around the exposure of classified or sensitive government information through personal communication channels. This incident highlights a persistent risk from nation-state actors targeting senior government officials, leveraging cyber-intrusions for espionage and psychological operations. With the proliferation of similar tactics against political, governmental, and critical infrastructure targets globally, this attack reflects an urgent need for heightened security controls on personal communications of high-profile public figures.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports