Government threat landscape
Ministries, federal and municipal bodies, diplomatic targets — the core hunting ground of state-sponsored espionage.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 78
- Actively-attacked vulnerabilities (CISA KEV)
- 0
- Ransomware victims, last 90 days
- 78
- Ransomware victims, since 2026-06
- 120
Shared bucket: ransomware.live groups Defense & Aerospace into “Government & Defense” — the ransomware figures on this page are the same victims shown on the Defense & Aerospace page, not additional ones.
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity. Showing 15 of 78.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| Kimsuky | Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think ta… | 485 |
| MuddyWater | MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS). Since at le… | 395 |
| LAPSUS$ | LAPSUS$ is cyber criminal threat group that has been active since at least mid-2021. LAPSUS$ specializes in large-scale social engineering and extortion opera… | 365 |
| Mustang Panda | Mustang Panda is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. Mustang Panda has been known to use tailo… | 365 |
| APT32 | APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and jou… | 350 |
| APT3 | APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security. This group is r… | 337 |
| Scarlet Mimic | Scarlet Mimic is a threat group that has targeted minority rights activists. This group has not been directly linked to a government source, but the group's motivations appear to overlap with those o… | 331 |
| APT29 | APT29 is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).… | 311 |
| OilRig | OilRig is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government… | 293 |
| APT-C-36 | APT-C-36 is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. APT-C-36 has targe… | 275 |
| AppleJeus | AppleJeus is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader Lazarus Group umbrella o… | 271 |
| Sandworm Team | Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.(Ci… | 270 |
| DarkHydrus | DarkHydrus is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloa… | 255 |
| LuminousMoth | LuminousMoth is a Chinese-speaking cyber espionage group that has been active since at least October 2020. LuminousMoth has targeted high-profile organization… | 251 |
| IndigoZebra | IndigoZebra is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.(Citation: Checkpoint Indigo… | 241 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 184.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Operation Dust Storm | Operation Dust Storm was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countri… | — | — |
| Operation Ghost | Operation Ghost was an APT29 campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. em… | APT29 | — |
| Operation Dream Job | Operation Dream Job was a cyber espionage operation likely conducted by Lazarus Group that targeted the defense, aerospace, government, and other sectors i… | Lazarus Group | — |
| C0021 | C0021 was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporat… | — | — |
| FunnyDream | FunnyDream was a suspected Chinese cyber espionage campaign that targeted government and foreign organizations in Malaysia, the Philippines, Taiwan, Vietnam, and other parts of Southeast Asia. Sec… | — | — |
| AI-Assisted Breach of Mexico's Government Infrastructure | The AI-Assisted Breach of Mexico's Government Infrastructure is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation… | — | — |
| HomeLand Justice | HomeLand Justice was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wip… | VOID MANTICORE, HEXANE | — |
| 2025 Poland Wiper Attacks | 2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind an… | — | — |
| C0011 | C0011 was a suspected cyber espionage campaign conducted by Transparent Tribe that targeted students at universities and colleges in India. Security resear… | Transparent Tribe | — |
| C0017 | C0017 was an APT41 campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through… | APT41 | — |
| FrostyGoop Incident | FrostyGoop Incident took place in January 2024 against a municipal district heating company in Ukraine. Following initial access via likely exploitation of external facing services, [FrostyGoop](h… | — | — |
| C0010 | C0010 was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts op… | — | — |
| Anthropic AI-orchestrated Campaign | The Anthropic AI-orchestrated Campaign was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The [Anthropic AI-orchestrated Campaign](https://attack.mitre… | — | — |
| ArcaneDoor | ArcaneDoor is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. [ArcaneDo… | — | — |
| Operation Sharpshooter | Operation Sharpshooter was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom,… | — | — |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 389.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 0 total, latest below.
No known-exploited CVEs currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2026-87165 | 8.8 | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: ECC For Award and IDV). The supported version that is affected is V16. Easily exploitable vulne… | |
| CVE-2026-61319 | 8.8 | Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows l… | |
| CVE-2026-62478 | 8.8 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows … | |
| CVE-2026-60924 | 8.8 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low… | |
| CVE-2026-87162 | 8.8 | Vulnerability in the Oracle Contract Lifecycle Management for Public Sector product of Oracle E-Business Suite (component: Award/PO). Supported versions that are affected are 12.2.13-12.2.15. Easily exploitable vulnerab… | |
| CVE-2026-62476 | 8.8 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low… | |
| CVE-2026-12613 | 8.8 | Deserialization of untrusted data vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and Ministry of Justice General Directorate of Information Te… | |
| CVE-2026-60686 | 8.1 | Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows l… | |
| CVE-2026-60982 | 8.1 | Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allow… | |
| CVE-2026-60966 | 8.1 | Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability all… | |
| CVE-2026-49464 | 8.1 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 throug… | |
| CVE-2026-46923 | 8.0 | Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerabi… | |
| CVE-2026-18390 | 7.8 | Improper neutralization of special elements used in an OS command ('OS command injection') vulnerability in Ministry of Justice General Directorate of Information Technology UYAP Document Editor on Windows and Linux and … | |
| CVE-2026-60925 | 7.2 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows hig… | |
| CVE-2026-60926 | 7.2 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows hig… |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Government & Defense / Government / Public Sector), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| GardaWorld | qilin | 2026-10-19 |
| JJS Justice | thegentlemen | 2026-10-16 |
| Ecuadors National Police | thegentlemen | 2026-10-16 |
| Shield Wall Systems of Florida | qilin | 2026-10-15 |
| Commune Du Tampon | qilin | 2026-10-15 |
| Ecuador police headquarters | HYFLOCK | 2026-10-13 |
| CNESTEN | qilin | 2026-10-11 |
| Royal Thai Air Force | thegentlemen | 2026-10-10 |
| Secretaría de Modernización e Innovación del Municipio | qilin | 2026-10-10 |
| Anne Arundel County | rhysida | 2026-10-09 |
| Saskatoon Tribal Council | thegentlemen | 2026-10-09 |
| Mandurah State Emergency Service | thegentlemen | 2026-10-03 |
| FUNAP - Fundação "Prof. Dr. Manoel Pedro Pimentel" | Booba Project | 2026-10-01 |
| Defencebit | thegentlemen | 2026-09-30 |
| Juntadeandalucia | medusalocker | 2026-09-28 |
Most active crews · since 2026-06
watch this sector
Get a daily email when something new touches government — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.