Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Public Safety

Breach intelligence, attack campaigns, and threat reports targeting the Public Safety sector.

34 threat reports
Page 1 of 3
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Public Safety Threat Reports

Showing 1–12 / 34 reports
Gorbag's Infostealer Playbook: How a Russia-Aligned Group Is Harvesting Ukrainian Defense Secrets with WinRAR Exploits
Gorbag's Infostealer Playbook: How a Russia-Aligned Group Is Harvesting Ukrainian Defense Secrets with WinRAR Exploits
Government Administration5 days ago

Gorbag's Infostealer Playbook: How a Russia-Aligned Group Is Harvesting Ukrainian Defense Secrets with WinRAR Exploits

Since at least February 2025, a Russia-aligned threat actor designated Gorbag (also tracked as UAC-0226 and SHADOW-EARTH-066) has conducted targeted cyber-espionage campaigns against Ukrainian law enforcement, local administrations near the front line, and defense-sector organizations. The group delivers infostealers—primarily GIFTEDCROOK and BeautyStealer—via spear-phishing emails carrying macro-enabled Excel attachments or by exploiting a now-patched WinRAR vulnerability (CVE-2025-8088) to trigger DLL sideloading. Stolen data, including browser credentials, cookies, VPN configurations, and sensitive documents, is exfiltrated to attacker-controlled Telegram chats or FastAPI-based C2 servers before the malware self-deletes, leaving minimal forensic trace. Gorbag's operations illustrate a broader 2025–2026 trend of state-aligned actors prioritizing lightweight, purpose-built infostealers over complex implants to reduce detection risk. The group's potential role as an initial access broker—harvesting VPN credentials that enable downstream intrusions—signals compounding risk for organizations that have not enforced egress controls, segmented internal traffic, or encrypted data in transit.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
SMS of Death: How CVE-2026-58882 Lets Attackers Remotely Crash Android Phones with a Single Text
SMS of Death: How CVE-2026-58882 Lets Attackers Remotely Crash Android Phones with a Single Text
Telecommunications1 week ago

SMS of Death: How CVE-2026-58882 Lets Attackers Remotely Crash Android Phones with a Single Text

In October 2026, security researcher Mark Blah disclosed CVE-2026-58882, a zero-click denial-of-service vulnerability in Android's WapPushOverSms.decodeWapPdu function, dubbed 'SMS of Death.' By sending a specially crafted eight-byte WAP Push message to port 2948, an unauthenticated remote attacker can trigger a NegativeArraySizeException that crashes the com.android.phone process, severing cellular connectivity, dropping active calls—including emergency 911 calls—and potentially forcing devices into persistent reboot loops requiring factory resets. Google silently patched Android 14–17 in its October 2026 security bulletin, but Android 12 and 13 devices remain unpatched and exposed. A public proof-of-concept exploit is now available on GitHub, dramatically lowering the barrier to weaponization. The public release of a working PoC elevates this from theoretical risk to active threat. With hundreds of millions of Android 12/13 devices still in circulation globally, enterprises relying on mobile endpoints for authentication, operations, or emergency communications face immediate exposure. The incident highlights the enduring fragility of the Android patch ecosystem, where carrier and OEM delays routinely leave critical vulnerabilities open long after upstream fixes are available.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Unauthenticated Endpoint Puts Millions of Intelbras Surveillance Cameras at Risk of Denial-of-Service
Computer/Network Security1 week ago

Unauthenticated Endpoint Puts Millions of Intelbras Surveillance Cameras at Risk of Denial-of-Service

In 2024–2025, Kaspersky researchers discovered a denial-of-service vulnerability (CAN-2026-2035970, CVSS 4.0 score 5.1) in Intelbras IP camera firmware affecting models including the iM3B-C, iMX C, iM4 C, iM5 SC, iME 360 C, and iM7+ FC. The flaw resided in an unauthenticated firmware upgrade endpoint (/firmwareUpgrade_service/Demo) that accepted any HTTP POST request—regardless of payload validity—and forced the device into a reboot cycle, rendering it offline indefinitely when requests were repeated. With over 4 million downloads of the companion Mibo Smart app across Latin America, the attack surface was substantial. Intelbras patched the issue in firmware R.260804 following responsible disclosure. This incident underscores the persistent risk of unauthenticated management endpoints in IoT and embedded devices deployed at scale. As surveillance infrastructure becomes more deeply integrated into enterprise and critical-facility security postures, availability-disrupting vulnerabilities in these devices carry operational consequences far beyond a simple device reboot, including blind spots in physical security and compliance gaps under frameworks requiring continuous monitoring.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Operation CameraSwarm: How Attackers Hijacked 14,500 Dahua Cameras in Ukraine Using P2P Exploits and Years-Old CVEs
Operation CameraSwarm: How Attackers Hijacked 14,500 Dahua Cameras in Ukraine Using P2P Exploits and Years-Old CVEs
Government Administration1 week ago

Operation CameraSwarm: How Attackers Hijacked 14,500 Dahua Cameras in Ukraine Using P2P Exploits and Years-Old CVEs

Between June and October 2026, threat actors—including a suspected Russian-speaking operator and a lone actor behind Operation CameraSwarm—compromised thousands of Dahua IP cameras across Ukraine and Europe by exploiting predictable P2P serial numbers, authentication bypass vulnerabilities (CVE-2021-33044, CVE-2021-33045), and weak credentials. Over 14,530 cameras were breached, with nearly 2,000 implanted with a persistent backdoor account surviving factory resets. Attackers leveraged Dahua's own Easy4IP cloud relay to access devices behind NATs without direct internet exposure, enabling video stream interception and military intelligence collection on NATO and Ukrainian logistics. This campaign reflects an accelerating pattern of nation-state actors weaponizing consumer and industrial IoT devices as persistent surveillance infrastructure. With Dutch and Ukrainian intelligence confirming Russian use of IP camera footage to track military convoys and weapon deliveries, the incident underscores how unmanaged IoT endpoints have become frontline intelligence assets in active conflict zones—and a systemic risk for any organization operating OT or IoT at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover
Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover
Public Safety1 month ago

Critical VIVOTEK Camera Vulnerability Exposes Infrastructure to Remote Takeover

A critical command injection vulnerability (CVE-2026-22755) with a CVSS score of 10.0 has been discovered in VIVOTEK camera firmware affecting 38+ camera models across V Series, C Series, S Series, Dome, Panoramic, and Bullet product lines. The vulnerability allows remote attackers to achieve command execution with root privileges on affected devices without authentication, leading to complete system compromise. CISA published this advisory after discovering a public proof of concept exploit, indicating the vulnerability is actively exploitable in the wild. VIVOTEK has released firmware updates to address the issue and recommends immediate patching of all affected camera systems. This vulnerability affects critical infrastructure sectors including government facilities, transportation systems, energy, and financial services deployed worldwide, with VIVOTEK being a Taiwan-based manufacturer of network surveillance equipment.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Flock Safety Camera Breach Exposes Critical Flaws in Smart City Surveillance Security
Flock Safety Camera Breach Exposes Critical Flaws in Smart City Surveillance Security
Law Enforcement1 month ago

Flock Safety Camera Breach Exposes Critical Flaws in Smart City Surveillance Security

In 2026, security researchers successfully reverse-engineered Flock Safety's automatic license plate reader (ALPR) cameras, exposing critical security vulnerabilities in the widely-deployed surveillance infrastructure. The analysis revealed that while most sensitive data remained encrypted, poor security architecture left encryption keys stored on unencrypted partitions, allowing researchers to access extensive surveillance logs containing over one million captured images. The investigation uncovered that the cameras' computer vision software actively detects and catalogs people, vehicles, bicycles, and even specific details like bumper stickers and patches, generating dozens of images per passing vehicle. This breach of a major surveillance technology provider highlights significant privacy and security concerns in municipal and law enforcement surveillance systems. This incident demonstrates the growing vulnerability of IoT surveillance infrastructure as researchers and malicious actors increasingly target physical devices that municipalities and businesses rely on for security operations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Conti Ransomware Developer Gets 4-Year Prison Sentence in Landmark Prosecution
Conti Ransomware Developer Gets 4-Year Prison Sentence in Landmark Prosecution
Government Administration1 month ago

Conti Ransomware Developer Gets 4-Year Prison Sentence in Landmark Prosecution

Ukrainian national Oleksii Lytvynenko was sentenced to four years in prison for his role in the Conti ransomware group, which attacked over 1,000 organizations globally before disbanding in 2022. Lytvynenko joined the prolific cybercrime operation in September 2021, developing malware and holding data from 12 victims including eight U.S.-based organizations. The group extorted approximately $634,000 in Bitcoin from victims in Tennessee, including a government entity that resulted in compromised sheriff's department, emergency medical services, and police department systems. This sentencing represents continued law enforcement efforts to prosecute ransomware operators despite their overseas operations, as Conti members have since rebranded under multiple successor groups including Black Basta, Royal, and BlackSuit, maintaining the threat landscape's evolution and persistence of ransomware-as-a-service operations.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
July 2024 Water Utility Attacks Expose Critical Infrastructure Blind Spots
July 2024 Water Utility Attacks Expose Critical Infrastructure Blind Spots
Utilities2 months ago

July 2024 Water Utility Attacks Expose Critical Infrastructure Blind Spots

In July 2024, over 100 water and wastewater treatment systems across multiple states were compromised through vulnerable industrial controllers connected directly to public cellular networks. CISA identified the widespread campaign targeting Rockwell Allen-Bradley, Schneider Electric, and Siemens equipment, with attackers gaining operational control and causing service disruptions including pump station failures and boil-water advisories. The incidents exposed critical infrastructure gaps where operational technology exists outside traditional IT security boundaries, with many systems invisible to network scans but trackable through carrier invoices. This campaign highlights the urgent need for comprehensive network visibility and microsegmentation in critical infrastructure, as traditional network perimeter defenses fail to protect cellular-connected industrial control systems that operate independently of municipal IT networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Federal Whistleblower Exposes Critical Security Flaws in USPS Election Systems
Government Administration2 months ago

Federal Whistleblower Exposes Critical Security Flaws in USPS Election Systems

A federal whistleblower has exposed critical security and operational flaws in the U.S. Postal Service's rushed deployment of three new IT systems designed to control mail-in ballot processing for the 2026 midterm elections. The complaint reveals that USPS bypassed standard software development practices, including pre-release testing and security validation, to implement systems that could reject entire batches of ballots based on single scanning errors. The Federal Ballot Mail Portal and associated verification systems were developed in a matter of weeks rather than months, creating significant risks to election integrity and voter disenfranchisement. This incident highlights the growing intersection of cybersecurity vulnerabilities and critical infrastructure, particularly as election systems become increasingly digitized without proper security oversight. The rushed deployment of untested systems in mission-critical environments reflects broader challenges organizations face when political pressure overrides established security protocols and development best practices.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Berlin Government Falls Victim to Rhysida Ransomware: 5.79TB of Critical Data Stolen
Government Administration2 months ago

Berlin Government Falls Victim to Rhysida Ransomware: 5.79TB of Critical Data Stolen

In August 2026, the Rhysida ransomware gang successfully breached Berlin's city administration network, exfiltrating 5.79 TB of sensitive government data comprising 1.44 million files. The attack, discovered in mid-August and publicly claimed on August 28, targeted multiple Senate departments including Mobility, Transport, Climate Protection and Environment. The stolen data includes government records, personnel files, plaintext credentials, banking information, classified documents, and critical infrastructure assessments of Berlin's water supply. Berlin's Mayor Kai Wergner confirmed the city will not pay the ransom, while federal security agencies investigate the incident. This attack highlights the escalating threat of ransomware groups targeting critical government infrastructure and the increasing sophistication of data exfiltration campaigns. With Rhysida leveraging GDPR violations as additional pressure tactics, the incident demonstrates how modern ransomware operators are weaponizing regulatory frameworks to maximize extortion potential against public sector entities.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical ZoneMinder Vulnerability Exposes Video Surveillance Infrastructure to Remote Code Execution
Computer/Network Security2 months ago

Critical ZoneMinder Vulnerability Exposes Video Surveillance Infrastructure to Remote Code Execution

ZoneMinder, a widely-deployed open-source video surveillance software, disclosed a critical OS command injection vulnerability (CVE-2026-76060) affecting versions 1.37.48 and 1.38.3. The vulnerability allows authenticated users with 'View Events' permissions to execute arbitrary operating system commands through unsanitized input in the exportFile parameter during event export operations. With a CVSS score of 8.8, successful exploitation grants full remote code execution as the web server user, potentially compromising entire surveillance infrastructure installations. This incident highlights the growing trend of supply chain vulnerabilities in critical infrastructure software, particularly as organizations increasingly rely on open-source solutions for security monitoring. The vulnerability's discovery through a public proof-of-concept demonstrates the escalating risk of weaponized research and the need for proactive vulnerability management in surveillance systems that often operate with elevated privileges across enterprise networks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Operation CameraSwarm: Massive Compromise of Dahua Devices
Computer/Network Security2 months ago

Operation CameraSwarm: Massive Compromise of Dahua Devices

Between June 17 and July 22, 2026, cybersecurity researchers at Hunt.io identified a campaign, dubbed Operation CameraSwarm, that compromised over 14,530 Dahua devices. Attackers employed credential attacks, exploited authentication-bypass vulnerabilities (CVE-2021-33044 and CVE-2021-33045), and utilized a peer-to-peer (P2P) relay technique to gain unauthorized access. The breaches were predominantly concentrated in Ukraine and Russia, with 1,923 cameras configured with persistent accounts and 283 accessed via the P2P method. This incident underscores the critical need for organizations to promptly apply security patches, disable unnecessary P2P features, and regularly update device firmware to mitigate potential vulnerabilities. ([labs.itresit.es](https://labs.itresit.es/2025/10/29/dahua-beyond-cve-2025-31702-p2p-relay-exposure/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports