Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Law Enforcement

Breach intelligence, attack campaigns, and threat reports targeting the Law Enforcement sector.

182 threat reports
Page 14 of 16
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Law Enforcement Threat Reports

Showing 157–168 / 182 reports
Crisis24 Shuts Down CodeRED Emergency System Following Ransomware Breach
Government Administration10 months ago

Crisis24 Shuts Down CodeRED Emergency System Following Ransomware Breach

In early June 2024, Crisis24 permanently shut down its OnSolve CodeRED emergency notification system after a ransomware attack severely damaged the platform's environment. The incident, attributed to the INC ransomware group, involved unauthorized access to and exfiltration of user data, including names, addresses, email addresses, phone numbers, and passwords. Forensic analysis indicated the attack was contained within the legacy CodeRED environment. The shutdown left dozens of municipalities and law enforcement agencies temporarily without emergency notification services, though the U.S. government's Emergency Alert System was unaffected. Crisis24 accelerated rollout of its new platform, conducted a security audit, and notified law enforcement. This breach underscores the increasing risk posed by ransomware groups targeting public safety infrastructure. With attackers leaking sensitive personal data and causing operational disruptions, organizations face mounting pressure to modernize legacy systems and enhance both incident response and segmentation controls in light of sophisticated, persistent threats.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How the OnSolve CodeRED Cyberattack Disrupted America’s Emergency Alert Infrastructure
Government Administration10 months ago

How the OnSolve CodeRED Cyberattack Disrupted America’s Emergency Alert Infrastructure

In June 2024, Crisis24 confirmed that its OnSolve CodeRED platform—used by state and local governments, police, and firefighting agencies—suffered a cyberattack disrupting emergency notification systems nationwide. Attackers gained unauthorized access to critical infrastructure, resulting in outages that hindered the timely dissemination of emergency alerts and public safety updates. While the investigation is ongoing, the breach demonstrates significant operational risks associated with service provider platforms in the public safety sector, impacting communities’ emergency preparedness and response effectiveness. This incident underscores growing threats targeting third-party vendors in critical sectors, where cyberattacks exploit platform dependencies to cause widespread and immediate disruption. With increasing regulatory scrutiny and a surge in ransomware and extortion campaigns against essential services, organizations must reassess supply chain, segmentation, and incident response controls to maintain operational and compliance resilience.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
NSO Group Faces 2024 Injunction Over WhatsApp Targeting—Legal and Compliance Impacts Revealed
Government Administration10 months ago

NSO Group Faces 2024 Injunction Over WhatsApp Targeting—Legal and Compliance Impacts Revealed

In early 2024, NSO Group—the Israeli surveillance technology vendor behind Pegasus spyware—faced a permanent injunction from a U.S. federal court barring it from targeting WhatsApp with its tools. The injunction, part of a high-profile legal battle stemming from NSO's alleged exploitation of WhatsApp vulnerabilities to surveil users, forces NSO to halt, destroy, or refrain from deploying code that interacts with the messaging platform. NSO's defense highlights the existential threat to their business as they appeal, arguing that this could irreparably harm the company and restrict potential U.S. government usage of Pegasus for authorized investigations. This case underscores ongoing global debates around the regulation of commercial spyware, lawful intercept technologies, and privacy rights. With increased legislative and compliance scrutiny, and rising governmental and private sector concerns about surveillance abuse, the outcome may set significant legal and operational precedents for the global spyware ecosystem.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Operation Endgame 2025: Law Enforcement Disrupts Rhadamanthys, Venom RAT, and Elysium Botnet
Banking/Mortgage10 months ago

Operation Endgame 2025: Law Enforcement Disrupts Rhadamanthys, Venom RAT, and Elysium Botnet

Between November 10 and 13, 2025, international law enforcement agencies led by Europol and Eurojust conducted Operation Endgame, a sweeping crackdown targeting malicious cyber infrastructures. The operation succeeded in dismantling key components of the Rhadamanthys Stealer, Venom RAT, and Elysium botnet, disrupting networks that facilitated global credential theft, remote access, and command-and-control activities. The coordinated seizures involved simultaneous server takedowns across multiple countries and the arrest of key individuals behind these malware operations, significantly diminishing the power and reach of these cybercriminal networks. This incident highlights an increasing trend of robust international cooperation in targeting advanced malware and botnet ecosystems. The disruption of these criminal infrastructures sends a strong message to threat actors, demonstrating both the technical capabilities and resolve of law enforcement to combat cybercrime at scale.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
European Crypto Fraud Ring Dismantled in €600M Money Laundering Bust (2024)
Financial Services10 months ago

European Crypto Fraud Ring Dismantled in €600M Money Laundering Bust (2024)

In early 2024, European law enforcement agencies dismantled a sophisticated cryptocurrency fraud ring responsible for laundering over €600 million across multiple countries. Nine suspects were arrested as part of coordinated raids targeting a network that deceived victims via fake crypto investment platforms. The ring used professional call centers and complex money laundering techniques, including anonymized cryptocurrency transfers and shell companies, to obfuscate financial trails. Victims were drawn in via social engineering and manipulated into making significant deposits, resulting in substantial financial losses for businesses and individuals. This incident highlights the escalation of large-scale crypto-based fraud and the growing cross-border collaboration required to counter such threats. The bust underlines the increased scrutiny and regulation of digital asset markets, as attackers adapt fraud and laundering methods to evade detection.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Survision LPR Cameras: Unauthenticated Access Vulnerability (CVE-2025-12108)
Government Administration10 months ago

Survision LPR Cameras: Unauthenticated Access Vulnerability (CVE-2025-12108)

In November 2025, a critical vulnerability (CVE-2025-12108) was disclosed in Survision License Plate Recognition (LPR) cameras, affecting all product versions globally. The flaw stems from missing authentication safeguards, allowing threat actors to remotely access device configuration wizards without credentials. This enables full system compromise—enabling attackers to alter settings, exfiltrate data, or use compromised cameras as entry points for broader attacks on commercial infrastructure. Researchers at Microsec identified the issue and notified stakeholders, prompting immediate remediation efforts and a firmware update (v3.5) from Survision. No confirmed active exploitation has been reported so far. With physical security increasingly integrated with digital management systems, unauthenticated access to surveillance infrastructure exposes environments to cyber-physical risks. The urgency of this disclosure reflects a broader industry trend: attackers actively seek exposed IoT and operational tech lacking basic authentication, prompting rising regulatory scrutiny and heightened compliance mandates.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
UNC6384 Strikes: Diplomatic Espionage Campaign Hits Europe via Windows Exploits
Government Administration10 months ago

UNC6384 Strikes: Diplomatic Espionage Campaign Hits Europe via Windows Exploits

In early 2024, advanced persistent threat group UNC6384 targeted multiple European diplomatic entities in a sophisticated cyber-espionage campaign. By leveraging highly convincing spear-phishing emails themed around the European Commission and NATO, attackers tricked foreign affairs officials into clicking malicious links crafted to exploit Windows vulnerabilities. Once compromised, victims' systems allowed for persistent access, resulting in unauthorized data exfiltration and significant risks to sensitive diplomatic communications. The attack underscores the vulnerability of trusted organizations to nation-state tactics and the dangers posed by zero-day Windows exploits in high-value targets. The incident highlights a growing trend of targeted attacks against governmental organizations, coinciding with increased geopolitical tension in Europe. As cyber threat actors continue to exploit social engineering and sophisticated malware, organizations must prioritize endpoint security, staff awareness, and aggressive detection measures to thwart emerging espionage campaigns.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
Arrest of 764 Group Leader Signals Crackdown on Online Child Exploitation and Extremism
Computer/Network Security10 months ago

Arrest of 764 Group Leader Signals Crackdown on Online Child Exploitation and Extremism

In December 2023, Baron Cain Martin, alleged leader of the violent extremist group 764, was arrested in Tucson, Arizona, following an extensive federal investigation. Unsealed in June 2024, the indictment charges Martin with 29 counts, including producing and distributing child sexual abuse material (CSAM), cyberstalking, conspiracy to commit wire fraud, animal cruelty, and providing material support to terrorists. Federal law enforcement alleges that Martin not only led the illicit collective but also created detailed guides for grooming and exploiting minors. The operation exploited online anonymity, targeting vulnerable young individuals across the globe. At least nine victims, primarily minors, have been identified, with the group's activities linked to broader networks such as The Com. The Martin case spotlights alarming trends in cyber-enabled abuse and violent extremism, highlighting law enforcement’s ongoing efforts to dismantle depraved online collectives. The prosecution’s severity underscores rising societal and regulatory pressure to address digital child exploitation, encrypted criminal coordination, and psychologically manipulative methods used by such groups.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Operation ForumTroll: How Memento Labs Used a Chrome Zero-Day for Global Spyware Attacks in 2024
Government Administration10 months ago

Operation ForumTroll: How Memento Labs Used a Chrome Zero-Day for Global Spyware Attacks in 2024

In early 2024, a sophisticated cyber campaign, identified as Operation ForumTroll, exploited a Google Chrome zero-day vulnerability to deploy spyware linked to Memento Labs, an Italian commercial surveillance vendor. Attackers leveraged previously unknown browser flaws to quietly infect targets’ systems, enabling unauthorized espionage and data exfiltration. The malware was distributed through malicious websites and fully bypassed standard security defenses. This campaign has drawn special attention due to Memento Labs’ history—emerging from the notorious Hacking Team’s acquisition by IntheCyber Group—and its potential targeting of high-value individuals and organizations. This incident underscores the persistent threat of zero-day attacks sponsored by private spyware vendors, and signals an ongoing trend in commoditized surveillance. The rise of commercial spyware and browser-based exploits increases regulatory scrutiny and highlights gaps in enterprise endpoint and data-in-transit security.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
First Wap's SS7 Exploit: How Altamides Changed Global Surveillance in 2025
Telecommunications10 months ago

First Wap's SS7 Exploit: How Altamides Changed Global Surveillance in 2025

In 2025, surveillance-technology firm First Wap, based in Jakarta, was revealed to have quietly built and operated the 'Altamides' system, a covert platform leveraging SS7 telecom vulnerabilities for global phone tracking. Unlike conventional spyware, Altamides enabled real-time location tracking of mobile devices across regions—from the Vatican to Silicon Valley—without requiring user interaction, installation, or leaving traces on targeted phones. The technology exploited legacy telecom protocols to access cell tower information, bypassing most modern mobile security defenses. As a result, sensitive locations and communications were exposed to persistent surveillance risk, with broad geopolitical and privacy implications. This incident underscores a worrying rise in the commercial proliferation of offensive surveillance tools exploiting underprotected telecom infrastructure. It highlights the urgent need for stronger regulatory action and zero trust defenses, as targeted espionage techniques move further away from traditional malware and towards systemic protocol abuse.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Former L3Harris Executive Charged with Selling Cyber Trade Secrets to Russia
Defense/Space10 months ago

Former L3Harris Executive Charged with Selling Cyber Trade Secrets to Russia

In August 2025, U.S. federal prosecutors charged Peter Williams, a former executive at L3Harris Technologies’ cyber division, with stealing and selling sensitive trade secrets to an undisclosed Russian buyer. Williams, the former general manager of specialized hacking group Trenchant, allegedly misappropriated eight proprietary technologies from two companies between April 2022 and August 2025, totaling $1.3 million in illicit gains. The Department of Justice seeks forfeiture of assets derived from the scheme. Neither L3Harris nor Trenchant is accused of direct wrongdoing. This incident underscores the growing threat posed by insiders with privileged access to highly sensitive cyber capabilities. As governments and critical industries bolster defenses, advanced techniques to detect, monitor, and mitigate insider risk are essential to prevent breaches that could have national security consequences.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Smishing Triad: Inside 2024's Massive Chinese-Run SMS Phishing Surge
Financial Services10 months ago

Smishing Triad: Inside 2024's Massive Chinese-Run SMS Phishing Surge

In 2024, security researchers tracked a surge in activity from a sophisticated smishing (SMS phishing) group known as Smishing Triad, a decentralized operation managed in Chinese, leveraging a network of over 195,000 malicious domains to steal sensitive information globally. Domains impersonated critical sectors—including U.S. postal services, financial firms, healthcare, e-commerce, and government agencies—with the majority hosted in the U.S., China, and Singapore. Cross-functional threat actors orchestrated attacks via mobile messaging and Telegram forums, evolving tactics to avoid detection; most domains were short-lived, amplifying evasion and operational scale. This incident stands out for its scale, rapid infrastructure cycling, and global targeting, highlighting rising threats from organized smishing groups. The continued proliferation of phishing-as-a-service operations, increasing attacker collaboration, and adoption of short-lived domain infrastructures demonstrate the urgent need for improved east-west security controls, rapid detection, and stronger identity-based segmentation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports