CYFIRMA Report Finds Sustained Cyber Threats Across Government and Civic Organizations
Summary
CYFIRMA’s Q2 2026 government and civic report finds broad, sustained threats, including 55 APT campaign updates, 78 reported incidents, rising RCE vulnerability mentions, persistent dark-web chatter, and 142 ransomware victims.
Key points
- Government and civic organizations appeared in 55 of 130 campaign updates, up from 11 in the previous period; MISSION2074, Lazarus Group, and FIN7 led.
- Campaigns targeted web applications, VPNs, edge appliances, and enterprise software; PowerShell, WMI, SMB, SSH, and RDP activity indicated post-compromise operations.
- The report recorded 78 incidents, including Iranian-linked PLC exploitation associated with disruption to water utilities across a dozen US states.
- Of 116 industry-linked vulnerability mentions, remote and arbitrary code execution dominated the final period; the report highlights patch delays and unsupported legacy systems as exposure factors.
- Government and civic organizations generated 5,011 dark-web mentions, with breach and leak discussion rising steadily across the reporting periods.
- The report counted 142 ransomware victims, down 3.4% quarter-on-quarter; municipal governments and NGOs accounted for close to half.
Article Details
- Publisher
- CYFIRMA
- Report Period
- Q2 2026; the analysis covers the past 90 days
- Scope
- Global government and civic external threats: APT campaigns, reported incidents, underground and dark web chatter, vulnerabilities, and ransomware.
- Sample Size
- The report analyzes 130 campaign activity updates, 674 publicly reported incidents, 46,365 industry-linked chatter mentions from 300,000+ posts, 2,632 industry-linked vulnerability mentions across 10,000+ reported or updated CVEs, and 2,669 ransomware victims.
- Key Statistics
- Government and civic organizations appeared in 55 of 130 campaign activity updates (42%), up from 11 of 24 in the previous period.
- The report identified 78 government and civic incidents; industry was identified for 501 of 674 reported incidents, and the sector accounted for 15.57% of those 501.
- Government and civic organizations accounted for 5,011 of 46,365 industry-linked chatter mentions (10.80%) over 90 days.
- The report recorded 116 government and civic vulnerability mentions, 4.41% of 2,632 industry-linked mentions; remote and arbitrary code execution made up roughly four-fifths of final-period volume.
- There were 142 verified government and civic ransomware victims, down from 147 (-3.4%); the sector's share fell from 6.44% to 5.32%, and victims were recorded in 38 countries.
- Recommendations
- Prioritize TTP-based detection over actor-specific IOC tracking, given the breadth of actor representation and overlap in targeted edge infrastructure.
- Address unpatched perimeter appliances and exposed directory services as immediate risks.
- Extend detection beyond perimeter exploitation to cover hands-on post-exploitation activity.
Threat Actors
APT27Listed among China-aligned actors represented in observed APT campaigns.Earth EstriesListed among China-aligned actors represented in observed APT campaigns.Emissary PandaListed among China-aligned actors represented in observed APT campaigns.emperadorRansomware group recording its first government-sector victims in August.ExfilSquadRansomware group recorded government and civic victims, concentrated in July.FIN11Financially motivated actor recorded in government and civic APT campaigns.FIN7Financially motivated actor ranked third in observed government and civic APT campaigns.Fox KittenIran-linked actor recorded in government and civic APT campaigns.GamaredonRussia-linked actor recorded in government and civic APT campaigns.HafniumListed among China-aligned actors represented in observed APT campaigns.JewelbugChinese cluster described as conducting espionage and cryptocurrency theft.KairosRansomware group; 28.6% of its reported victims were in the government and civic sector.L GroupRansomware group recording its first government-sector victims in August.Lazarus GroupNorth Korea-associated actor; recorded one of the highest government and civic APT campaign counts.LeviathanListed among China-aligned actors represented in observed APT campaigns.LynxRansomware group; 33.3% of its reported victims were in the government and civic sector.MedusaLockerRansomware group recorded government and civic victims, concentrated in July.MISSION2074China-linked actor; recorded the highest government and civic APT campaign count.MuddyWaterIran-linked actor recorded in government and civic APT campaigns.Mustang PandaListed among China-aligned actors represented in observed APT campaigns.NasirsecurityRansomware group; 75% of its reported victims were in the government and civic sector.OilRigIran-linked actor recorded in government and civic APT campaigns.OrovaRansomware group recording its first government-sector victims in August.PanzerRansomware group recording its first government-sector victims in August.QilinRansomware group whose claims preceded a confirmed incident at a US federal firearms agency; also recorded government-sector victims.RhysidaRansomware group reported to have attacked Berlin.Salt TyphoonListed among China-aligned actors represented in observed APT campaigns.ShinyHuntersDescribed as a financially motivated actor responsible for mass credential extortion across sectors.SilkParasiteChinese cluster noted for AI-assisted malware activity.Stone PandaListed among China-aligned actors represented in observed APT campaigns.TA505Financially motivated actor recorded in government and civic APT campaigns.The GentlemenRansomware group that, together with Qilin, accounted for roughly a third of government and civic victims.Transparent TribePakistan-linked actor recorded in government and civic APT campaigns.Volt TyphoonListed among China-aligned actors represented in observed APT campaigns.WallstreetRansomware group; 26.7% of its reported victims were in the government and civic sector.
Vendors
AtlassianMicrosoft Exchange Server, VMware vCenter Server, Atlassian Confluence, and Apache Log4j also feature, reflecting exploitation of widely deployed enterprise software with known vulnerability histories.CitrixTwo Ivanti, two Citrix NetScaler and three Fortinet products among targeted technologies.CYFIRMAThe CYFIRMA Industry Report delivers original cybersecurity insights and telemetry-driven statistics of global industries, covering one sector each week for a quarter.FortinetTwo Ivanti, two Citrix NetScaler and three Fortinet products among targeted technologies.IvantiTwo Ivanti, two Citrix NetScaler and three Fortinet products among targeted technologies.MicrosoftMicrosoft Exchange Server, VMware vCenter Server, Atlassian Confluence, and Apache Log4j also feature, reflecting exploitation of widely deployed enterprise software with known vulnerability histories.VMwareMicrosoft Exchange Server, VMware vCenter Server, Atlassian Confluence, and Apache Log4j also feature, reflecting exploitation of widely deployed enterprise software with known vulnerability histories.
Products
Active DirectoryVPN solutions, routers, and network monitoring tools feature across multiple campaigns, alongside Active Directory and database management software, pointing to a targeting pattern focused on perimeter access followedApache Log4jMicrosoft Exchange Server, VMware vCenter Server, Atlassian Confluence, and Apache Log4j also feature, reflecting exploitation of widely deployed enterprise software with known vulnerability histories.Atlassian ConfluenceMicrosoft Exchange Server, VMware vCenter Server, Atlassian Confluence, and Apache Log4j also feature, reflecting exploitation of widely deployed enterprise software with known vulnerability histories.Citrix NetScalerTwo Ivanti, two Citrix NetScaler and three Fortinet products among targeted technologies.DeCYFIRCYFIRMA delivers pre-emptive cybersecurity, cyber threat intelligence, and external threat landscape management through its platforms, DeCYFIR and DeTCT.DeTCTCYFIRMA delivers pre-emptive cybersecurity, cyber threat intelligence, and external threat landscape management through its platforms, DeCYFIR and DeTCT.Microsoft Exchange ServerMicrosoft Exchange Server, VMware vCenter Server, Atlassian Confluence, and Apache Log4j also feature, reflecting exploitation of widely deployed enterprise software with known vulnerability histories.PowerShellPowerShell, WMI, SMB, SSH and RDP in the data indicate campaigns progressing into hands-on post-exploitation.VMware vCenter ServerMicrosoft Exchange Server, VMware vCenter Server, Atlassian Confluence, and Apache Log4j also feature, reflecting exploitation of widely deployed enterprise software with known vulnerability histories.ZimbraEdge infrastructure remained the preferred route in, most visibly through the Zimbra zero-click campaign and mass credential exposure on internet-facing firewalls that was later converted into ransomware access.
Countries
ArgentinaGermany and Argentina recorded the highest elevations in the last 90 days, followed by Spain, the Czech Republic, Italy, and the Philippines.AustraliaThe United States, Japan, and the United Kingdom record the highest victim counts by a wide margin, followed by South Korea, Australia, India, and Taiwan.AustriaEuropean representation is broad, covering Germany, France, Ukraine, Spain, Italy, Hungary, the Netherlands, Belgium, Switzerland, Austria, Norway, and Portugal.BahrainMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.BelgiumEuropean representation is broad, covering Germany, France, Ukraine, Spain, Italy, Hungary, the Netherlands, Belgium, Switzerland, Austria, Norway, and Portugal.CambodiaSoutheast Asian representation covers Thailand, the Philippines, Vietnam, Malaysia, Indonesia, Singapore, and Cambodia.ChinaChina-linked MISSION2074 records the highest campaign count, followed closely by the North Korea-associated Lazarus Group.Czech RepublicGermany and Argentina recorded the highest elevations in the last 90 days, followed by Spain, the Czech Republic, Italy, and the Philippines.FranceGermany and Thailand lead the next tier, with Saudi Arabia, France, and the Philippines also recording significant counts.GermanyGermany and Thailand lead the next tier, with Saudi Arabia, France, and the Philippines also recording significant counts.HungaryEuropean representation is broad, covering Germany, France, Ukraine, Spain, Italy, Hungary, the Netherlands, Belgium, Switzerland, Austria, Norway, and Portugal.IndiaThe United States, Japan, and the United Kingdom record the highest victim counts by a wide margin, followed by South Korea, Australia, India, and Taiwan.IndonesiaSoutheast Asian representation covers Thailand, the Philippines, Vietnam, Malaysia, Indonesia, Singapore, and Cambodia.IranIran-linked Fox Kitten, OilRig, and MuddyWater all appear.IraqMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.IsraelMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.ItalyEuropean representation is broad, covering Germany, France, Ukraine, Spain, Italy, Hungary, the Netherlands, Belgium, Switzerland, Austria, Norway, and Portugal.JapanThe United States, Japan, and the United Kingdom record the highest victim counts by a wide margin, followed by South Korea, Australia, India, and Taiwan.JordanMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.KuwaitMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.LatviaBerlin, a US federal firearms agency, multiple US state and local governments, Romania’s land registry, and Latvia all confirmed ransomware incidents within the period.LebanonMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.MalaysiaSoutheast Asian representation covers Thailand, the Philippines, Vietnam, Malaysia, Indonesia, Singapore, and Cambodia.NetherlandsEuropean representation is broad, covering Germany, France, Ukraine, Spain, Italy, Hungary, the Netherlands, Belgium, Switzerland, Austria, Norway, and Portugal.North KoreaChina-linked MISSION2074 records the highest campaign count, followed closely by the North Korea-associated Lazarus Group.NorwayEuropean representation is broad, covering Germany, France, Ukraine, Spain, Italy, Hungary, the Netherlands, Belgium, Switzerland, Austria, Norway, and Portugal.OmanMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.PakistanRussia-linked Gamaredon records a high campaign count, with Pakistan-linked Transparent Tribe also prominent.PhilippinesGermany and Thailand lead the next tier, with Saudi Arabia, France, and the Philippines also recording significant counts.PortugalEuropean representation is broad, covering Germany, France, Ukraine, Spain, Italy, Hungary, the Netherlands, Belgium, Switzerland, Austria, Norway, and Portugal.QatarMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.RomaniaRansomware hit municipal, national and federal bodies, with Romania’s land registry stalling a property market and a Latvian breach prompting ministerial resignations.RussiaRussia-linked Gamaredon records a high campaign count, with Pakistan-linked Transparent Tribe also prominent.Saudi ArabiaGermany and Thailand lead the next tier, with Saudi Arabia, France, and the Philippines also recording significant counts.SerbiaSingaporeSoutheast Asian representation covers Thailand, the Philippines, Vietnam, Malaysia, Indonesia, Singapore, and Cambodia.South AfricaBelgium, Indonesia, and South Africa saw the largest declines.South KoreaThe United States, Japan, and the United Kingdom record the highest victim counts by a wide margin, followed by South Korea, Australia, India, and Taiwan.SpainEuropean representation is broad, covering Germany, France, Ukraine, Spain, Italy, Hungary, the Netherlands, Belgium, Switzerland, Austria, Norway, and Portugal.SwitzerlandEuropean representation is broad, covering Germany, France, Ukraine, Spain, Italy, Hungary, the Netherlands, Belgium, Switzerland, Austria, Norway, and Portugal.SyriaMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.TaiwanThe United States, Japan, and the United Kingdom record the highest victim counts by a wide margin, followed by South Korea, Australia, India, and Taiwan.ThailandGermany and Thailand lead the next tier, with Saudi Arabia, France, and the Philippines also recording significant counts.UAEMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.UkraineEuropean representation is broad, covering Germany, France, Ukraine, Spain, Italy, Hungary, the Netherlands, Belgium, Switzerland, Austria, Norway, and Portugal.United KingdomThe United States, Japan, and the United Kingdom record the highest victim counts by a wide margin, followed by South Korea, Australia, India, and Taiwan.United StatesThe United States, Japan, and the United Kingdom record the highest victim counts by a wide margin, followed by South Korea, Australia, India, and Taiwan.VietnamSoutheast Asian representation covers Thailand, the Philippines, Vietnam, Malaysia, Indonesia, Singapore, and Cambodia.YemenMiddle Eastern presence is unusually wide, spanning Saudi Arabia, the UAE, Israel, Oman, Qatar, Bahrain, Kuwait, Jordan, Lebanon, Iran, Iraq, Syria, and Yemen.
Industries
Advocacy & Civil Society OrganizationsNational Government & Executive Bodies and Advocacy & Civil Society Organizations formed a substantial second tier, with law enforcement and cultural institutions also recording meaningful activity.Energyprogrammable logic controllers in US critical infrastructure and Russian targeting of communications and energy providers through edge devices.Government & civicGOVERNMENT & CIVIC Q2 I 2026 : INDUSTRY REPORTLaw enforcementNational Government & Executive Bodies and Advocacy & Civil Society Organizations formed a substantial second tier, with law enforcement and cultural institutions also recording meaningful activity.Municipal & Local GovernmentsMunicipal & Local Governments and NGOs account for close to half of victims.National Government & Executive BodiesNational Government & Executive Bodies and Advocacy & Civil Society Organizations formed a substantial second tier, with law enforcement and cultural institutions also recording meaningful activity.Nonprofit Social Services & NGOsMunicipal & Local Governments and Nonprofit Social Services & NGOs accounted for the largest share of victims by a wide margin, together representing close to half of all sector victims.TransportationWater utilitiesfrom CISA, the FBI and the EPA over ongoing exploitation of programmable logic controllers, with water utilities the visible consequence: coordinated disruption across dozens of Minnesota systems spread to