Ministries, federal and municipal bodies, diplomatic targets — the core hunting ground of state-sponsored espionage.
Deterministic keyword + taxonomy matches over the live threat graph — a daily sweep, not analyst attribution. Zero LLM. Last rebuilt 2026-10-16.
Actors whose feed descriptions reference this sector, ranked by graph connectivity.
| Actor | What the feeds say | Graph links |
|---|---|---|
| Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think ta… | 478 |
| MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).(Citation: CYBERCOM Iranian Intel Cyber January 2022) Since at le… | 384 |
| Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) is a China-based cyber espionage threat actor that has been conducting operations since at least 2012. [Mustang Panda](https://attack.mitre.org/groups/G0129) has been known to use tailo… | 358 |
| LAPSUS$ | [LAPSUS$](https://attack.mitre.org/groups/G1004) is cyber criminal threat group that has been active since at least mid-2021. [LAPSUS$](https://attack.mitre.org/groups/G1004) specializes in large-scale social engineering and extortion opera… | 351 |
| APT32 | [APT32](https://attack.mitre.org/groups/G0050) is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and jou… | 346 |
| APT3 | [APT3](https://attack.mitre.org/groups/G0022) is a China-based threat group that researchers have attributed to China's Ministry of State Security.(Citation: FireEye Clandestine Wolf)(Citation: Recorded Future APT3 May 2017) This group is r… | 335 |
| APT29 | [APT29](https://attack.mitre.org/groups/G0016) is threat group that has been attributed to Russia's Foreign Intelligence Service (SVR).(Citation: White House Imposing Costs RU Gov April 2021)(Citation: UK Gov Malign RIS Activity April 2021)… | 305 |
| OilRig | [OilRig](https://attack.mitre.org/groups/G0049) is a suspected Iranian threat group that has targeted Middle Eastern and international victims since at least 2014. The group has targeted a variety of sectors, including financial, government… | 292 |
| APT-C-36 | [APT-C-36](https://attack.mitre.org/groups/G0099) is a suspected South American threat group that has engaged in espionage and financially motivated operations since at least 2018. [APT-C-36](https://attack.mitre.org/groups/G0099) has targe… | 269 |
| AppleJeus | [AppleJeus](https://attack.mitre.org/groups/G1049) is a North Korean state-sponsored threat group attributed to the Reconnaissance General Bureau. Associated with the broader [Lazarus Group](https://attack.mitre.org/groups/G0032) umbrella o… | 268 |
| DarkHydrus | [DarkHydrus](https://attack.mitre.org/groups/G0079) is a threat group that has targeted government agencies and educational institutions in the Middle East since at least 2016. The group heavily leverages open-source tools and custom payloa… | 250 |
| LuminousMoth | [LuminousMoth](https://attack.mitre.org/groups/G1014) is a Chinese-speaking cyber espionage group that has been active since at least October 2020. [LuminousMoth](https://attack.mitre.org/groups/G1014) has targeted high-profile organization… | 246 |
| IndigoZebra | [IndigoZebra](https://attack.mitre.org/groups/G0136) is a suspected Chinese cyber espionage group that has been targeting Central Asian governments since at least 2014.(Citation: HackerNews IndigoZebra July 2021)(Citation: Checkpoint Indigo… | 235 |
| Aquatic Panda | [Aquatic Panda](https://attack.mitre.org/groups/G0143) is a suspected China-based threat group with a dual mission of intelligence collection and industrial espionage. Active since at least May 2020, [Aquatic Panda](https://attack.mitre.org… | 232 |
| MoustachedBouncer | [MoustachedBouncer](https://attack.mitre.org/groups/G1019) is a cyberespionage group that has been active since at least 2014 targeting foreign embassies in Belarus.(Citation: MoustachedBouncer ESET August 2023)… | 232 |
Campaigns and intel pulses mentioning this sector, most recent first.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Operation Ghost | [Operation Ghost](https://attack.mitre.org/campaigns/C0023) was an [APT29](https://attack.mitre.org/groups/G0016) campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. em… | APT29 | — |
| Operation Dream Job | [Operation Dream Job](https://attack.mitre.org/campaigns/C0022) was a cyber espionage operation likely conducted by [Lazarus Group](https://attack.mitre.org/groups/G0032) that targeted the defense, aerospace, government, and other sectors i… | Lazarus Group | — |
| Operation Dust Storm | [Operation Dust Storm](https://attack.mitre.org/campaigns/C0016) was a long-standing persistent cyber espionage campaign that targeted multiple industries in Japan, South Korea, the United States, Europe, and several Southeast Asian countri… | — | — |
| HomeLand Justice | [HomeLand Justice](https://attack.mitre.org/campaigns/C0038) was a disruptive cyber campaign conducted by Iranian state-affiliated actors against Albanian government networks in July and September 2022. The activity combined ransomware, wip… | VOID MANTICORE, HEXANE | — |
| C0011 | [C0011](https://attack.mitre.org/campaigns/C0011) was a suspected cyber espionage campaign conducted by [Transparent Tribe](https://attack.mitre.org/groups/G0134) that targeted students at universities and colleges in India. Security resear… | Transparent Tribe | — |
| FrostyGoop Incident | [FrostyGoop Incident](https://attack.mitre.org/campaigns/C0041) took place in January 2024 against a municipal district heating company in Ukraine. Following initial access via likely exploitation of external facing services, [FrostyGoop](h… | — | — |
| C0017 | [C0017](https://attack.mitre.org/campaigns/C0017) was an [APT41](https://attack.mitre.org/groups/G0096) campaign conducted between May 2021 and February 2022 that successfully compromised at least six U.S. state government networks through … | APT41 | — |
| 2025 Poland Wiper Attacks | [2025 Poland Wiper Attacks](https://attack.mitre.org/campaigns/C0063) is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind an… | — | — |
| FunnyDream | [FunnyDream](https://attack.mitre.org/campaigns/C0007) was a suspected Chinese cyber espionage campaign that targeted government and foreign organizations in Malaysia, the Philippines, Taiwan, Vietnam, and other parts of Southeast Asia. Sec… | — | — |
| C0021 | [C0021](https://attack.mitre.org/campaigns/C0021) was a spearphishing campaign conducted in November 2018 that targeted public sector institutions, non-governmental organizations (NGOs), educational institutions, and private-sector corporat… | — | — |
| C0010 | [C0010](https://attack.mitre.org/campaigns/C0010) was a cyber espionage campaign conducted by UNC3890 that targeted Israeli shipping, government, aviation, energy, and healthcare organizations. Security researcher assess UNC3890 conducts op… | — | — |
| Anthropic AI-orchestrated Campaign | The [Anthropic AI-orchestrated Campaign](https://attack.mitre.org/campaigns/C0062) was conducted in September 2025 by a likely China nexus espionage actor identified as GTG-1002. The [Anthropic AI-orchestrated Campaign](https://attack.mitre… | — | — |
| ArcaneDoor | [ArcaneDoor](https://attack.mitre.org/campaigns/C0046) is a campaign targeting networking devices from Cisco and other vendors between July 2023 and April 2024, primarily focused on government and critical infrastructure networks. [ArcaneDo… | — | — |
| AI-Assisted Breach of Mexico's Government Infrastructure | The [AI-Assisted Breach of Mexico's Government Infrastructure](https://attack.mitre.org/campaigns/C0064) is a campaign where human operators used Claude Code AI and OpenAI GPT GPT-4.1 AI to perform reconnaissance, vulnerability exploitation… | — | — |
| Operation Sharpshooter | [Operation Sharpshooter](https://attack.mitre.org/campaigns/C0013) was a global cyber espionage campaign that targeted nuclear, defense, government, energy, and financial companies, with many located in Germany, Turkey, the United Kingdom, … | — | — |
Techniques used by the actors above — what to detect for, ranked by how many of them use it.
| Technique | ATT&CK | Used by | Actors |
|---|---|---|---|
| Ingress Tool Transfer | T1105 | LuminousMoth, Elderwood, WIRTE | 40 |
| Malicious File | T1204.002 | Elderwood, WIRTE, Dragonfly | 37 |
| PowerShell | T1059.001 | WIRTE, Dragonfly, OilRig | 36 |
| Spearphishing Attachment | T1566.001 | Elderwood, WIRTE, Dragonfly | 34 |
| Tool | T1588.002 | LuminousMoth, WIRTE, Dragonfly | 33 |
| Windows Command Shell | T1059.003 | WIRTE, Dragonfly, OilRig | 28 |
| Data from Local System | T1005 | LuminousMoth, Dragonfly, OilRig | 27 |
| Exploitation for Client Execution | T1203 | Elderwood, Dragonfly, OilRig | 27 |
| Match Legitimate Resource Name or Location | T1036.005 | LuminousMoth, WIRTE, OilRig | 27 |
| Scheduled Task | T1053.005 | LuminousMoth, Dragonfly, OilRig | 27 |
| File and Directory Discovery | T1083 | LuminousMoth, Dragonfly, Fox Kitten | 25 |
| Registry Run Keys / Startup Folder | T1547.001 | LuminousMoth, Dragonfly, Inception | 25 |
| Malicious Link | T1204.001 | LuminousMoth, Elderwood, WIRTE | 24 |
| Web Protocols | T1071.001 | LuminousMoth, WIRTE, OilRig | 24 |
| Exploit Public-Facing Application | T1190 | Dragonfly, Fox Kitten, Earth Lusca | 22 |
CISA KEV entries whose vendor, product or description matches this sector — 0 total, latest below.
No known-exploited CVEs currently surfaced in the graph for this sector. That's the honest reading — we report what the feeds show, not what would fill a table.
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2026-47754 | 9.3 | Metacat is data repository software that helps researchers preserve, share, and discover data. Versions 2.x through 2.19.1 and all 1.x versions contain an unauthenticated path traversal in the `archiveEntryName` paramete… | |
| CVE-2026-62476 | 8.8 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low… | |
| CVE-2026-60924 | 8.8 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows low… | |
| CVE-2026-62478 | 8.8 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows … | |
| CVE-2026-61319 | 8.8 | Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows l… | |
| CVE-2026-60982 | 8.1 | Vulnerability in the Oracle US Federal Human Resources product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allow… | |
| CVE-2026-49464 | 8.1 | NL Portal Backend Libraries provide backend components for Dutch government portals that interact with residents, customers, suppliers, and partner organizations. The `nl.nl-portal:taak` package from version 1.5.0 throug… | |
| CVE-2026-60686 | 8.1 | Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows l… | |
| CVE-2026-60966 | 8.1 | Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability all… | |
| CVE-2026-46923 | 8.0 | Vulnerability in the Oracle Public Sector Financials (International) product of Oracle E-Business Suite (component: Authorization). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerabi… | |
| CVE-2026-60926 | 7.2 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows hig… | |
| CVE-2026-60925 | 7.2 | Vulnerability in the Oracle Public Sector Payroll product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.4-12.2.15. Easily exploitable vulnerability allows hig… | |
| CVE-2026-60687 | 6.8 | Vulnerability in the Oracle U.S. Federal Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Difficult to exploit vulnerability allows… | |
| CVE-2026-62480 | 6.5 | Vulnerability in the Oracle Public Sector Financials product of Oracle E-Business Suite (component: Internal Operations). Supported versions that are affected are 12.2.3-12.2.15. Easily exploitable vulnerability allows … | |
| CVE-2026-16999 | 6.3 | Improper restriction of XML external entity reference vulnerability in Ministry of Justice UYAP Document Editor allows Serialized Data External Linking. This issue affects UYAP Document Editor: from 4.5.17 before 5.4.17… |
Named leak-site victims classified into this sector (ransomware.live taxonomy), most recent first.
| Victim | Crew | Discovered |
|---|---|---|
| Shield Wall Systems of Florida | qilin | 2026-10-15 |
| Commune Du Tampon | qilin | 2026-10-15 |
| Ecuador police headquarters | HYFLOCK | 2026-10-13 |
| CNESTEN | qilin | 2026-10-11 |
| Royal Thai Air Force | thegentlemen | 2026-10-10 |
| Secretaría de Modernización e Innovación del Municipio | qilin | 2026-10-10 |
| Anne Arundel County | rhysida | 2026-10-09 |
| Saskatoon Tribal Council | thegentlemen | 2026-10-09 |
| Mandurah State Emergency Service | thegentlemen | 2026-10-03 |
| FUNAP - Fundação "Prof. Dr. Manoel Pedro Pimentel" | Booba Project | 2026-10-01 |
| Defencebit | thegentlemen | 2026-09-30 |
| Juntadeandalucia | medusalocker | 2026-09-28 |
| nsbsd.org | incransom | 2026-09-28 |
| Italy | ImNotAVillain | 2026-09-24 |
| The Merrimack County | Booba Project | 2026-09-23 |
Get a daily email when something new touches government — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.