Government & Public Sector — Cyber Threat Activity
Government and public sector is the widest threat surface in this dataset, attacked by criminals for disruption and by states for intelligence. Our log records more than 650 incidents across 80 countries, over 150 in the trailing 180 days, with 62 groups attributed at least one claim: Qilin (78), LockBit (67), INC Ransom (57), RansomHub (51), Medusa (30) and Rhysida (30) lead. Municipalities, school districts, courts and emergency services absorb most of that volume, because they hold citizen data and deliver services that cannot stop, while running on budgets that treat security as a capital project rather than an operating cost. Above that criminal layer sits the largest state-sponsored graph we hold: 398 groups are associated with the sector once profile-level research is counted, and hundreds of malware families are linked through those actors. State interest in government targets is durable rather than opportunistic, and the tradecraft reflects it. Operators have compromised cloud identity infrastructure to read government mailboxes directly, and Chinese state actors have been assessed by CISA, NSA and FBI as pre-positioning inside critical networks using living-off-the-land techniques, holding access for years without deploying malware that would give them away. That objective is optionality in a future crisis, not theft today, and it produces almost no incident-log signal, which is exactly why the measured count below understates the sector. Recorded geography is United States-led at 358 claims, then the United Kingdom, Canada, France, Brazil and Israel. Ransomware claims here are attacker assertions; the espionage activity that matters most to a national government rarely appears in any public dataset at all.
- Recorded incidents: 841
- Incidents, trailing 180 days: 180
- Tracked threat actors: 421
- Malware families: 592
Recent incidents
- Tribunal de Justica do Estado de Minas Gerais 2026-11-07
- ar500armor.com 2026-11-06
- Secretaria de Estado de Saúde 2026-11-05
- Customs Support 2026-11-05
- City of Edgewater 2026-11-03
- Svedala Kommun 2026-10-31
- Ined 2026-10-31
- SALEG (Sachsen-Anhaltische Landesentwicklungsgesellschaft mbH) 2026-10-31
- South Weber City 2026-10-29
- Circleville Police Department 2026-10-29
- Terrebonne Parish Government 2026-10-29
- City of Columbia, SC 2026-10-29
- City of Big Spring 2026-10-27
- Charter Township of Commerce 2026-10-27
- Bristol City Council 2026-10-27
- Partido Liberal 2026-10-25
- A-RMS 2026-10-25
- Heber City, UT 2026-10-24
- Rajasthan Police 2026-10-21
- City of Mt. Angel, Oregon 2026-10-20
Threat actors targeting Government & Public Sector
- Qilin 100 incidents
- LockBit 70 incidents
- INC Ransom 67 incidents
- RansomHub 52 incidents
- The Gentlemen 37 incidents
- Rhysida 33 incidents
- Medusa Ransomware 32 incidents
- SafePay 26 incidents
- FunkSec 25 incidents
- BlackSuit 21 incidents
- RansomHouse 19 incidents
- Lynx Ransomware 16 incidents
- Stormous 15 incidents
- KillSec 14 incidents
- Handala 14 incidents
- APT73 14 incidents
- Hunters International 14 incidents
- DragonForce 12 incidents
- NightSpire 11 incidents
- Booba Project 11 incidents
- Fog Ransomware 11 incidents
- Meow 10 incidents
- Nova 9 incidents
- Akira 8 incidents
Where these victims are
- United States 411
- France 31
- United Kingdom 31
- Canada 30
- Brazil 20
- Germany 18
- Israel 13
- Spain 12
- Argentina 10
- India 10
- Czech Republic 9
- Indonesia 9
Malware used against Government & Public Sector
Families used by the threat actors that target this sector, derived from actor tooling rather than observed in these incidents directly.
- Akira Malware
- Black Basta Malware
- BlackCat Malware
- Clop Malware
- Cobalt Strike Malware
- Conti Malware
- Emotet Malware
- Impacket Tool
- Lumma Stealer Malware
- Metasploit Tool
- Mimikatz Tool
- NotPetya Malware
Coverage. 92.8% of incidents in our log carry a sector classification; the remainder name a victim we have not placed in an industry. Counts here are a floor, not a total, and are not comparable between sectors of different sizes.