Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Law Enforcement

Breach intelligence, attack campaigns, and threat reports targeting the Law Enforcement sector.

182 threat reports
Page 1 of 16
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Law Enforcement Threat Reports

Showing 1–12 / 182 reports
How an AI-Augmented MITM Attack Exposed Every Chainalysis Customer's Credentials
Financial Services2 days ago

How an AI-Augmented MITM Attack Exposed Every Chainalysis Customer's Credentials

In late October 2026, blockchain intelligence firm Chainalysis suffered a multi-stage breach that escalated from limited identity metadata exposure to a full-scope credential compromise affecting all customers. Attackers initially leveraged offensive agentic AI techniques to harvest names, email addresses, user IDs, and role labels. A subsequent on-path (MITM) attack then exposed usernames, password hashes, and live session tokens for the entire customer base—which includes law enforcement agencies, financial institutions, and crypto businesses globally. Chainalysis took its login portal, Reactor, Data Solutions, KYT UI, and address-screening APIs offline while forcing password resets and API key rotations. This incident underscores an accelerating trend of AI-augmented offensive techniques combined with classic network interception attacks targeting high-value SaaS platforms. As threat actors increasingly weaponize agentic AI to automate reconnaissance and credential harvesting at scale, organizations that rely on these platforms for regulatory compliance and financial crime investigation face compounding operational and legal exposure.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Gorbag: The Russia-Aligned APT Quietly Draining Ukrainian VPN Credentials One Pass at a Time
Gorbag: The Russia-Aligned APT Quietly Draining Ukrainian VPN Credentials One Pass at a Time
Government Administration4 days ago

Gorbag: The Russia-Aligned APT Quietly Draining Ukrainian VPN Credentials One Pass at a Time

Beginning in February 2025, a Russia-aligned threat actor tracked as Gorbag launched a highly targeted espionage campaign against Ukrainian law enforcement, local administrations near the front line, and defense-sector entities. The group delivered its custom C++ infostealer, BeautyStealer, via spearphishing emails carrying malicious Excel macros, and later via weaponized RAR archives exploiting CVE-2025-8088, a WinRAR path traversal zero-day. BeautyStealer harvested browser credentials, OpenVPN configurations, and sensitive documents in a single pass before self-deleting, with stolen data exfiltrated over Telegram or a FastAPI-backed C2 server. Gorbag's tradecraft suggests it may function as an initial access broker feeding credentials to downstream Russia-aligned actors. Gorbag illustrates a growing pattern of lean, single-pass infostealers designed for rapid intelligence collection rather than persistent implantation. The exploitation of a freshly disclosed WinRAR zero-day underscores how quickly Russia-aligned groups weaponize new CVEs, and the campaign's focus on VPN credentials and electronic signature keys signals a deliberate effort to enable follow-on network intrusions at scale.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Gorbag's Infostealer Playbook: How a Russia-Aligned Group Is Harvesting Ukrainian Defense Secrets with WinRAR Exploits
Gorbag's Infostealer Playbook: How a Russia-Aligned Group Is Harvesting Ukrainian Defense Secrets with WinRAR Exploits
Government Administration5 days ago

Gorbag's Infostealer Playbook: How a Russia-Aligned Group Is Harvesting Ukrainian Defense Secrets with WinRAR Exploits

Since at least February 2025, a Russia-aligned threat actor designated Gorbag (also tracked as UAC-0226 and SHADOW-EARTH-066) has conducted targeted cyber-espionage campaigns against Ukrainian law enforcement, local administrations near the front line, and defense-sector organizations. The group delivers infostealers—primarily GIFTEDCROOK and BeautyStealer—via spear-phishing emails carrying macro-enabled Excel attachments or by exploiting a now-patched WinRAR vulnerability (CVE-2025-8088) to trigger DLL sideloading. Stolen data, including browser credentials, cookies, VPN configurations, and sensitive documents, is exfiltrated to attacker-controlled Telegram chats or FastAPI-based C2 servers before the malware self-deletes, leaving minimal forensic trace. Gorbag's operations illustrate a broader 2025–2026 trend of state-aligned actors prioritizing lightweight, purpose-built infostealers over complex implants to reduce detection risk. The group's potential role as an initial access broker—harvesting VPN credentials that enable downstream intrusions—signals compounding risk for organizations that have not enforced egress controls, segmented internal traffic, or encrypted data in transit.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
41,000 DHS Employees Exposed: How Hacktivists Turned an Okta SSO Into a National Security Leak
41,000 DHS Employees Exposed: How Hacktivists Turned an Okta SSO Into a National Security Leak
Government Administration1 week ago

41,000 DHS Employees Exposed: How Hacktivists Turned an Okta SSO Into a National Security Leak

In late October 2026, a hacktivist group calling itself the Department of Peace exfiltrated a database containing personal and organizational records on more than 41,000 Department of Homeland Security employees and contractors, subsequently sharing it with transparency nonprofit Distributed Denial of Secrets. The attackers claimed to have obtained the dataset by compromising an Okta single sign-on service used internally by DHS, though Okta denied any evidence of system compromise. The leaked data exposed names, email addresses, phone numbers, and internal organizational structures across DHS components including CISA and ICE, with records dating back several years. The incident follows a pattern of prior DHS breaches in 2014 and 2018 and a 2025 GitHub credential exposure affecting CISA systems. This breach underscores the persistent vulnerability of identity and access management infrastructure at federal agencies. Hacktivist-motivated intrusions leveraging SSO credential theft are accelerating, and the exposure of government organizational charts, contact details, and operational personnel represents a compounding national security and counterintelligence risk that aligns with growing regulatory pressure around zero-trust adoption in federal environments.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Russian GRU's APT28 Breaches NATO Defense Firms: What the Hookedge Backdoor Campaign Reveals About Modern Espionage
Russian GRU's APT28 Breaches NATO Defense Firms: What the Hookedge Backdoor Campaign Reveals About Modern Espionage
Defense/Space2 weeks ago

Russian GRU's APT28 Breaches NATO Defense Firms: What the Hookedge Backdoor Campaign Reveals About Modern Espionage

Russian GRU-linked threat actor APT28 (also known as Fancy Bear, Swallowtail, and Forest Blizzard) conducted a targeted espionage campaign against at least three NATO-affiliated organizations: a naval shipbuilder, a military aircraft engine manufacturer, and a law enforcement agency. Symantec researchers identified the intrusions, which involved hands-on-keyboard activity, repeated access to compromised hosts over the span of a week, and credential theft. The attackers deployed the Hookedge backdoor and a previously undocumented in-memory loader (ld.exe) that decrypts its payload only with a runtime key, making forensic recovery impossible without both components. The campaign is assessed as intelligence collection targeting European defense and government entities, potentially linked to Russia's ongoing war against Ukraine. This incident underscores the sustained sophistication of state-sponsored APT operations against defense industrial base targets. APT28's use of novel, memory-resident loaders and dedicated command-and-control infrastructure signals an evolution in operational security tradecraft, making detection and attribution increasingly difficult for defenders relying on static signatures or perimeter-only controls.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
APT28's NATO Naval Shipbuilder Breach: Inside the Reflective Loader, HOOKEDGE Backdoor, and Persistent SSH Tunnel Campaign
APT28's NATO Naval Shipbuilder Breach: Inside the Reflective Loader, HOOKEDGE Backdoor, and Persistent SSH Tunnel Campaign
Shipbuilding2 weeks ago

APT28's NATO Naval Shipbuilder Breach: Inside the Reflective Loader, HOOKEDGE Backdoor, and Persistent SSH Tunnel Campaign

In late July 2026, Russian state-sponsored threat actor APT28 (Fancy Bear / Forest Blizzard) compromised a NATO-member naval shipbuilder, a law enforcement agency, and a military aircraft engine manufacturer. Operating under the Symantec-designated cluster 'Swallowtail,' attackers delivered the HOOKEDGE backdoor via macro-enabled Word documents, then conducted hands-on-keyboard activity over multiple days. They stole credentials via dual techniques—an SSH tunnel for persistent internal network access and a loopback NTLM-capture PowerShell script—and deployed a previously undocumented reflective loader ('ld.exe') to execute an encrypted in-memory payload, with activity confirmed as recently as September 24, 2026. This campaign reflects APT28's accelerating operational tempo against NATO defense-industrial targets in 2026, combining proven spear-phishing lures with novel in-memory execution techniques that evade traditional endpoint detection. The parallel exploitation of CVE-2026-21509 and CVE-2026-8496 against Ukrainian entities confirms the group's simultaneous multi-front offensive, raising urgent concerns for any organization in the defense, government, or critical-infrastructure supply chain.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Cellebrite's Wireless iPhone Zero-Day: What the Advanced Unlocks Leak Means for Enterprise Security
Cellebrite's Wireless iPhone Zero-Day: What the Advanced Unlocks Leak Means for Enterprise Security
Law Enforcement2 weeks ago

Cellebrite's Wireless iPhone Zero-Day: What the Advanced Unlocks Leak Means for Enterprise Security

In October 2026, a leaked confidential Cellebrite document revealed a new forensic extraction capability called Advanced Unlocks (AU), described as a next-generation After First Unlock (AFU) vector engineered to survive Apple OS hardening updates. Unlike prior Cellebrite tools, AU operates wirelessly via a dedicated appliance with an effective range of approximately eight meters, bypassing Stolen Device Protection and its associated USB restrictions without requiring physical cable connection. The capability represents a significant escalation in law enforcement and adversarial forensic tooling, enabling covert device compromise in proximity-based scenarios with no direct physical contact required. This disclosure arrives amid growing concern over the proliferation of commercial spyware and exploit tooling beyond controlled government use. The wireless, proximity-based nature of AU blurs the line between lawful forensic access and covert surveillance, intensifying regulatory scrutiny and prompting urgent reassessment of mobile device security posture across enterprise and government environments alike.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
ShinyHunters Breach FBI Systems: A Counterintelligence Disaster Analysis
ShinyHunters Breach FBI Systems: A Counterintelligence Disaster Analysis
Law Enforcement3 weeks ago

ShinyHunters Breach FBI Systems: A Counterintelligence Disaster Analysis

In September 2026, the cybercriminal group ShinyHunters successfully breached FBI systems and exfiltrated a trove of sensitive data containing detailed information about FBI agents and their intelligence roles. The attackers announced their breach publicly, revealing they had obtained personnel records, operational details, and potentially classified information that could compromise ongoing investigations and agent safety. The FBI arrested a suspect associated with the breach in October 2026, but the damage to national security and counterintelligence operations had already been done. This incident highlights the escalating threat landscape where nation-state and criminal actors increasingly target government agencies and law enforcement. With rising geopolitical tensions and sophisticated attack techniques, even premier security organizations face significant cybersecurity challenges that require enhanced zero trust architectures and comprehensive data protection strategies.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
FBI Targets Ransomware Negotiation Industry: Edward Dubrovsky Arrest Signals New Enforcement Era
FBI Targets Ransomware Negotiation Industry: Edward Dubrovsky Arrest Signals New Enforcement Era
Insurance4 weeks ago

FBI Targets Ransomware Negotiation Industry: Edward Dubrovsky Arrest Signals New Enforcement Era

In October 2026, the FBI arrested Edward Dubrovsky, a Canadian cybersecurity executive specializing in ransomware negotiations, at a cyber insurance conference in Pennsylvania. Dubrovsky, associated with firms Cypfer and CyberSteward, was charged with cyber extortion and conspiracy in connection with the ShinyHunters cybercrime group. ShinyHunters had recently breached FBI systems, stealing sensitive data on thousands of agents including medical records and operational details. The group has extorted over $70 million in 2026 through phishing attacks and data theft from SaaS platforms. This incident highlights the growing concern over the blurred lines between legitimate ransomware negotiation services and criminal facilitation. With ransomware attacks reaching record levels and negotiations becoming increasingly sophisticated, law enforcement is scrutinizing the entire ecosystem of ransomware response services, signaling a potential shift in how cybercrime enablement is prosecuted.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Cybersecurity Executive Arrested: The Dark Side of Ransomware Negotiations
Cybersecurity Executive Arrested: The Dark Side of Ransomware Negotiations
Computer/Network Security4 weeks ago

Cybersecurity Executive Arrested: The Dark Side of Ransomware Negotiations

Edward Dubrovsky, a 54-year-old Canadian cybersecurity executive and founder of CYPFER, was arrested by federal authorities in Pennsylvania on charges of conspiracy and extortion. Dubrovsky's firm specializes in helping organizations negotiate with ransomware operators, but he now faces charges of conspiring to threaten information confidentiality for extortion and Hobbs Act violations. The arrest appears connected to the ShinyHunters ransomware group's attack on FBI IT systems, which exposed personal data of thousands of bureau employees. The breach originated from an unpatched third-party contractor system managed by Accenture. This incident highlights the growing complexity of ransomware negotiations and the blurred lines between legitimate cybersecurity consulting and criminal conspiracy. As ransomware attacks continue to surge and regulatory scrutiny intensifies, organizations must carefully vet their incident response partners and ensure compliance with evolving legal frameworks around ransom payments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
FBI Arrests Another ShinyHunters Member After Massive Agency Breach Exposes Employee Data
FBI Arrests Another ShinyHunters Member After Massive Agency Breach Exposes Employee Data
Government Administration1 month ago

FBI Arrests Another ShinyHunters Member After Massive Agency Breach Exposes Employee Data

The FBI arrested another suspected ShinyHunters member in October 2026 following the group's breach of FBI systems through an Oracle PeopleSoft zero-day vulnerability. The attack, which occurred in September 2026, compromised FBI-managed AWS GovCloud infrastructure and resulted in the theft of 2-3TB of sensitive data including employee records, Social Security numbers, medical information, and family member details affecting all FBI personnel. This represents the fourth arrest in recent weeks as law enforcement dismantles the notorious data extortion group. This incident highlights the escalating threat landscape where even premier law enforcement agencies fall victim to sophisticated threat actors exploiting zero-day vulnerabilities and cloud infrastructure weaknesses, demonstrating the urgent need for enhanced cloud security postures across all sectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
ShinyHunters FBI Breach: How Contractor Failures Led to Massive Government Data Theft
ShinyHunters FBI Breach: How Contractor Failures Led to Massive Government Data Theft
Law Enforcement1 month ago

ShinyHunters FBI Breach: How Contractor Failures Led to Massive Government Data Theft

In September 2026, the ShinyHunters extortion group breached the FBI's jobs portal (FBIjobs.gov) and stole sensitive data on nearly all FBI agents and job applicants. The breach resulted from a security failure when an Accenture contractor failed to implement a critical security patch on Oracle's PeopleSoft HR platform. The stolen data included extensive personal information, details of sensitive job roles, and psychiatric and medical records of FBI personnel. The FBI has arrested three suspected co-conspirators across multiple countries, including a 24-year-old in the Netherlands, a suspect in Jordan who is cooperating with authorities, and most recently a Canadian citizen arrested in Pennsylvania. This incident highlights the growing sophistication of extortion groups targeting high-profile government agencies and the critical risks posed by third-party contractor vulnerabilities in managing sensitive federal systems and data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports