Public administration is a persistent target because government systems hold sensitive records—HR, payroll, correspondence, and administrative data—and disruption carries public consequences. This quarter, public administration organizations named on data-leak sites rose 65% to 117, and that exposure spread across a wider, more fragmented set of ransomware operators.
What shifted most was the path in. Phishing kept the top spot, but its combined share fell from 48% to 40%, while Password Spraying moved into the top tier and Credential Stuffing, Password Guessing, and Account Access Removal all gained ground. Attackers leaned less on email-only access and more on scalable login abuse, and credential exposure became the fastest-growing digital risk alert for the sector. At the same time, nation-state espionage intensified, with actors targeting government mailboxes, documents, and administrative systems for long-term access.
There is no time for slow defense when a single valid login can reach sensitive government data.
Four Ways Teams in the Public Administration Sector Can Act Now
1. Shut down scalable credential abuse. The quarter’s clearest shift ran from email-only access to login abuse. Enforce phishing-resistant MFA on VPN and admin portals, rate-limit and alert on authentication patterns that signal spraying and stuffing—high-volume failures, impossible travel, logins from new infrastructure—and watch for unauthorized Account Access Removal that can lock out legitimate admins mid-intrusion.
2. Harden the internet edge, including flaws without a fix. New vulnerabilities seen in active exploitation rose 76% to 109, with 59 weaponized within 5 days of disclosure and same-day exploitation doubling to 32, driven by rapid weaponization of internet-facing flaws in Ivanti Connect Secure and Microsoft SharePoint. Patch known-exploited perimeter flaws quickly, disable PsExec where it isn’t needed, and block “Rclone” with application allowlisting to cut off exfiltration. CVE-2026-76504, a CVSS 9.8 authentication bypass in Cisco Catalyst SD-WAN Manager, is being exploited in the wild with no patch yet available, and compromise could expose network management and disrupt branch connectivity. Until Cisco releases a fix, restrict Manager internet exposure, limit management access to trusted IPs or VPN, and monitor admin API activity.
3. Hunt for the persistence espionage actors rely on. Public administration drew heavy nation-state attention this quarter. “Laundry Bear” exploited an Outlook Web Access flaw to retain mailbox access after a single viewed email; “Lazarus Group” used a Windows zero-day for SYSTEM access with rootkit evasion; “Nimbus Manticore” deployed a reverse SSH tunneler for long-term access; and “Kimsuky” used AI to sharpen phishing and speed payload changes. These actors want durable, quiet access to government correspondence and records, and Internal Spearphishing edged up as trusted internal communications were abused. Hunt for the persistence these campaigns depend on—unexpected SSH tunnels, malicious mailbox rules, and living-off-the-land use of legitimate admin tools—and correlate those signals across identity, endpoint, and email.
4. Automate containment when timelines slip. Sector mean time to contain (MTTC) rose from 34 minutes to 39 minutes this period. A single-period change tied to incident complexity doesn’t make a trend, but it does underline that manual containment can’t keep pace with attacker speed. Public administration organizations using Automated Response Playbooks contained threats in an average of 5 minutes this quarter. Known-malicious behavior—validated command-and-control, confirmed credential abuse, or ransomware tooling—should trigger immediate response through approved playbooks, where the risk of waiting outweighs the risk of acting.
What Agentic Defense Looks Like for Public Administration
Government security teams cannot accept a black box making response decisions across sensitive and regulated systems. They need AI that is governed, explainable, and directed by their own team.
GreyMatter is built for that operating model. The platform decomposes investigations into single-task agents across identity, endpoint, network, cloud, and email, and routes each task through the AI Model Broker, which selects the best model for the job by cost, speed, and accuracy—without the customer managing models or usage costs. It normalizes telemetry across an agency’s existing tools with its Universal Translator, running detection at source, at storage, or in transit so threats are caught before data has to centralize.
For public administration, that means catching credential abuse before a valid login turns into espionage access—alerting on password spraying and exposed credentials, containing identity intrusions in under 5 minutes, and monitoring the open, deep, and dark web for impersonating domains and leaked government data. In a sector where attackers aim to stay hidden for months, speed and accuracy decide how much they reach.
