Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Banking/Mortgage

Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.

625 threat reports
Page 4 of 53
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Banking/Mortgage Threat Reports

Showing 37–48 / 625 reports
Deepfake Voice Attacks Target Executive Impersonation: Your 2026 Defense Strategy
Deepfake Voice Attacks Target Executive Impersonation: Your 2026 Defense Strategy
Financial Services3 weeks ago

Deepfake Voice Attacks Target Executive Impersonation: Your 2026 Defense Strategy

Deepfake voice cloning attacks have escalated dramatically, with 62% of cybersecurity leaders reporting incidents in 2025 according to Gartner research. Threat actors now leverage AI-generated voice synthesis to impersonate executives, requesting fraudulent wire transfers, MFA resets, and privileged access modifications. These sophisticated social engineering campaigns bypass traditional detection methods, exploiting trust relationships and organizational hierarchies. The FBI warned that cloned voices can sound nearly identical to targets, making detection extremely difficult. Organizations report successful deepfake incidents targeting finance teams, help desks, and identity administrators, with some attacks remaining undetected for months. The surge in deepfake attacks coincides with increasingly accessible AI voice generation tools and growing remote work dependencies on voice communications. Traditional security awareness training proves insufficient against high-fidelity voice synthesis, requiring process-based verification controls rather than relying on human detection capabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
How Poor Third-Party VPN Configuration Led to Months-Long Bank Infiltration
How Poor Third-Party VPN Configuration Led to Months-Long Bank Infiltration
Banking/Mortgage3 weeks ago

How Poor Third-Party VPN Configuration Led to Months-Long Bank Infiltration

In 2026, a European bank experienced a months-long credential-based intrusion through a misconfigured third-party managed VPN gateway that lacked proper authentication controls. The opportunistic threat actor conducted extensive network reconnaissance, brute-force authentication attempts against administrator accounts, and systematic data scraping from internal documentation systems. The attack culminated in an attempt to exploit a Windows Server Update Services vulnerability for persistence, which was successfully contained by Cortex XDR before lateral movement could occur. Unit 42's investigation confirmed no persistent backdoors were established, and the incident was fully remediated through credential rotation and security control improvements. This incident highlights the growing trend of opportunistic threat actors exploiting basic security hygiene gaps rather than sophisticated zero-day techniques, emphasizing the critical importance of foundational controls like multi-factor authentication and timely patching in an era where third-party risk management has become a primary attack vector.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Sophisticated Spy Chip Implants Compromise Ledger Hardware Wallets in Supply Chain Attack
Sophisticated Spy Chip Implants Compromise Ledger Hardware Wallets in Supply Chain Attack
Financial Services3 weeks ago

Sophisticated Spy Chip Implants Compromise Ledger Hardware Wallets in Supply Chain Attack

In October 2026, Ledger confirmed that hardware wallets distributed through Southeast Asian reseller CryptoBilis contained malicious spy chip implants designed to steal cryptocurrency. The sophisticated supply chain attack involved physically modifying Ledger Nano X devices with custom PCB implants that captured seed phrases through display output and button press monitoring, then transmitted the data via embedded eSIM and LTE connectivity. Researchers identified two variants of the implant, with the more advanced version fitting into the original form factor without obvious external indicators. The compromised devices were sold at discounted prices across Malaysia and other Southeast Asian markets, resulting in confirmed fund drains from affected users' wallets. This incident highlights the growing sophistication of hardware supply chain attacks targeting cryptocurrency infrastructure, demonstrating how threat actors are evolving from basic firmware modifications to engineered PCB implants that can bypass traditional security validations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
AWS GuardDuty's Evolution: How Five New Security Indicators Are Transforming Cloud Threat Detection
AWS GuardDuty's Evolution: How Five New Security Indicators Are Transforming Cloud Threat Detection
Banking/Mortgage4 weeks ago

AWS GuardDuty's Evolution: How Five New Security Indicators Are Transforming Cloud Threat Detection

On May 20, 2026, Amazon GuardDuty Extended Threat Detection enhanced its attack sequence correlation capabilities by integrating five new indicator types: MALICIOUS_PACKAGE, MISCONFIGURATION, REACHABILITY, SENSITIVE_DATA, and VULNERABILITY. These indicators leverage data from AWS Security Hub, Amazon Inspector, Amazon VPC Reachability Analyzer, and Amazon Macie to transform previously weak security signals into high-confidence CRITICAL findings. The enhancement addresses customer feedback about noisy runtime findings by correlating multiple weak signals with resource-state context, particularly benefiting Amazon EC2, ECS, and EKS workload monitoring. Initial deployment data showed a substantial increase in actionable attack sequence findings, with roughly one in four runtime-process sequences now surfacing as correlated CRITICAL alerts instead of disconnected low-priority findings. This advancement represents a significant evolution in AWS native threat detection, moving from isolated security events to comprehensive attack narrative reconstruction that provides security teams with immediate remediation context and prioritized response guidance.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
How AI Agents Breached South Korea's Banking Sector: The ARTEX AI Attack Analysis
How AI Agents Breached South Korea's Banking Sector: The ARTEX AI Attack Analysis
Banking/Mortgage4 weeks ago

How AI Agents Breached South Korea's Banking Sector: The ARTEX AI Attack Analysis

In October 2026, a Chinese-speaking threat actor launched sophisticated cyberattacks against major South Korean banks including Shinhan Bank, KB Kookmin Bank, and Hana Bank using the ARTEX AI penetration testing suite and Claude AI agents. The attacker leveraged multiple large language models including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 to automate reconnaissance, exploitation, and data exfiltration, exposing customer personal data and credit card information while causing system outages. CrowdStrike's investigation revealed the attacker's infrastructure containing Claude session histories and configuration files, leading to the identification of a potential 26-year-old Chinese national. This incident represents the first confirmed use of AI-powered autonomous agents in large-scale financial sector attacks, demonstrating how threat actors are weaponizing commercially available AI tools to accelerate and scale traditional attack methodologies with unprecedented efficiency.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
19-Year Money Laundering Empire: How YMCO's 15,000 Mules Enabled Global Cybercrime
19-Year Money Laundering Empire: How YMCO's 15,000 Mules Enabled Global Cybercrime
Banking/Mortgage1 month ago

19-Year Money Laundering Empire: How YMCO's 15,000 Mules Enabled Global Cybercrime

Ukrainian-Russian dual citizen Oleg Korniev pleaded guilty in October 2026 to operating Your Mule Cashout (YMCO), a massive international money laundering operation that recruited over 15,000 money mules across the United States since 2007. The criminal organization processed over $10 million stolen from more than 750 U.S. bank accounts by cybercrime gangs, using sophisticated recruitment tactics that disguised money mules as legitimate remote workers processing payments for fake companies. Stolen funds were systematically transferred through Western Union and MoneyGram to cash-out contractors in Eastern Europe and beyond. This case highlights the critical role of money laundering networks in enabling modern cybercrime ecosystems, particularly as remote work legitimizes financial processing roles and cryptocurrency creates new laundering vectors. The operation's 19-year lifespan demonstrates the persistence and sophistication of financial crime infrastructure that underpins ransomware, banking trojans, and other profit-driven cyber attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Venezuelan Cartel's Cyber Evolution: How Tren de Aragua Weaponized ATM Malware
Venezuelan Cartel's Cyber Evolution: How Tren de Aragua Weaponized ATM Malware
Banking/Mortgage1 month ago

Venezuelan Cartel's Cyber Evolution: How Tren de Aragua Weaponized ATM Malware

In October 2026, US authorities arrested Anibal Alexander Canelon Aguirre, a 50-year-old Venezuelan member of the Tren de Aragua criminal cartel and the first cybercriminal ever placed on the FBI's Ten Most Wanted Fugitives list. Canelon Aguirre, known as "Prometheus" and "The Engineer," was the principal architect of the Ploutus-D malware used in ATM jackpotting schemes that compromised cash machines across Latin and North America. The cartel physically implanted malware into ATMs, allowing remote control to dispense cash to money mules, then laundered over $5.1 million through Venezuelan, Mexican, and Colombian cryptocurrency networks including TRON. This case demonstrates how traditional criminal organizations are increasingly integrating sophisticated cyber capabilities into their operations. The convergence of physical access, custom malware development, and cryptocurrency laundering represents a new evolution in organized crime that bridges cybercrime with terrorist financing and transnational criminal enterprises.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Social Engineering AI Agents: The Evolution of Business Email Compromise
Social Engineering AI Agents: The Evolution of Business Email Compromise
Financial Services1 month ago

Social Engineering AI Agents: The Evolution of Business Email Compromise

As artificial intelligence agents become increasingly integrated into business operations with elevated system privileges, cybercriminals are developing sophisticated social engineering techniques to manipulate these autonomous systems. Unlike traditional business email compromise (BEC) attacks that target human decision-makers, threat actors are now crafting attacks specifically designed to exploit AI agents' logical processes and decision trees. These attacks leverage prompt injection techniques, context manipulation, and adversarial inputs to trick AI systems into executing unauthorized transactions, data transfers, or administrative actions. The financial and operational impact mirrors traditional BEC schemes but with potentially greater scale and automation capabilities. This emerging threat vector represents a critical evolution in social engineering as organizations rapidly deploy AI agents for financial transactions, supply chain management, and customer service operations without adequate security controls.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Citrix NetScaler SAML Vulnerability Exposes Identity Infrastructure to RCE Attacks
Critical Citrix NetScaler SAML Vulnerability Exposes Identity Infrastructure to RCE Attacks
Banking/Mortgage1 month ago

Critical Citrix NetScaler SAML Vulnerability Exposes Identity Infrastructure to RCE Attacks

Citrix disclosed CVE-2026-107406, a critical memory overflow vulnerability in NetScaler ADC and NetScaler Gateway with a CVSS score of 9.5. The flaw affects systems configured as SAML identity providers or service providers, potentially enabling remote code execution or denial-of-service attacks. The vulnerability was discovered by security researchers from JPMorgan Chase and affects multiple NetScaler versions, with patches now available across affected product lines. This incident underscores the ongoing security challenges facing identity infrastructure as organizations increasingly rely on SAML-based authentication systems for cloud and hybrid environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Empire Market Takedown: 40-Year Sentence Marks New Era in Dark Web Enforcement
Empire Market Takedown: 40-Year Sentence Marks New Era in Dark Web Enforcement
Banking/Mortgage1 month ago

Empire Market Takedown: 40-Year Sentence Marks New Era in Dark Web Enforcement

Raheim Hamilton, co-creator of Empire Market, was sentenced to 40 years in prison for operating one of the largest dark web marketplaces from 2017 to 2020. The marketplace facilitated $430 million in illegal transactions, primarily drug sales totaling $375 million, serving 1.68 million users at its peak. Hamilton and co-defendant Thomas Pavey used cryptocurrency, encryption, and Tor networks to help users evade law enforcement detection while laundering proceeds through mixing services. This case highlights the growing sophistication of cybercrime marketplaces and law enforcement's enhanced capabilities to track cryptocurrency transactions and dismantle dark web operations, reflecting the ongoing battle between cybercriminals and authorities in the digital underground economy.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Wazza Phishkit: Advanced Multi-Stage Attack Targets Critical Infrastructure
Wazza Phishkit: Advanced Multi-Stage Attack Targets Critical Infrastructure
Banking/Mortgage1 month ago

Wazza Phishkit: Advanced Multi-Stage Attack Targets Critical Infrastructure

The Wazza phishing kit represents a sophisticated multi-stage attack campaign targeting banking, government, and manufacturing organizations across the United States, Europe, and Australia in 2026. This advanced phishing operation employs a complex routing infrastructure that includes wildcard domains, session tokens, and anti-bot validation to filter victims before delivering Adobe-themed Device Code phishing pages. The campaign demonstrates significant evolution in phishing tactics, moving beyond simple credential harvesting to implement session management, traffic controls, and automated filtering systems that make detection more challenging for security teams. This incident highlights the current trend toward more sophisticated phishing infrastructure as attackers adapt to improved security detection capabilities and automated threat response systems across enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
How AI-Powered ARTEX Tool Compromised South Korean Financial Institutions
How AI-Powered ARTEX Tool Compromised South Korean Financial Institutions
Banking/Mortgage1 month ago

How AI-Powered ARTEX Tool Compromised South Korean Financial Institutions

Between late September and early October 2026, threat actors leveraged ARTEX, an open-source AI-powered penetration testing tool developed in China, to conduct targeted attacks against South Korean financial institutions. The campaign utilized large language models including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 to automate reconnaissance, exploitation, and data exfiltration. CrowdStrike discovered the operation through exposed directories on a Hong Kong-based IP address containing Claude Code session histories and ARTEX configuration files. Evidence suggests Chinese-speaking operators motivated by financial gain, with attackers specifically researching Korean data breach marketplaces and Telegram sales channels. This incident highlights the emerging threat of AI-weaponized attacks where sophisticated language models automate complex multi-stage cyber operations. The misuse prompted ARTEX's developer to immediately transition the tool to closed-source, demonstrating how legitimate security research tools are being rapidly co-opted by malicious actors to enhance attack capabilities at scale.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports