✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
AWS Data Centers in Middle East Targeted by Drone Strikes in 2026
In early March 2026, Iranian drone strikes targeted Amazon Web Services (AWS) data centers in the United Arab Emirates (UAE) and Bahrain, causing significant structural damage and service disruptions. Two facilities in the UAE were directly hit, while a third in Bahrain sustained damage from a nearby strike. These attacks led to outages across multiple AWS services, including EC2, S3, and RDS, affecting businesses, financial institutions, and government entities in the region. AWS reported that recovery efforts would be prolonged due to the extent of the physical damage. ([thenationalnews.com](https://www.thenationalnews.com/business/2026/03/03/drone-strikes-damage-amazon-data-centres-in-uae-and-bahrain-disrupting-services/?utm_source=openai)) This incident underscores the vulnerability of cloud infrastructure to physical attacks, especially in geopolitically volatile regions. Organizations relying on cloud services must reassess their disaster recovery and data sovereignty strategies to ensure resilience against both cyber and kinetic threats. ([apnews.com](https://apnews.com/article/71066b0a822c4cfd88b61e3fe79af917?utm_source=openai))
4 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Zero-Days
In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Among these, eight were rated as critical, and two vulnerabilities—CVE-2026-26127 and CVE-2026-21262—were publicly disclosed prior to patch release, though neither had been exploited in the wild. CVE-2026-21536, a remote code execution flaw in Microsoft's Devices Pricing Program, received the highest severity rating with a CVSS score of 9.8. Microsoft has proactively mitigated this issue within its cloud infrastructure, requiring no customer action. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) This update marks the first Patch Tuesday in six months without any actively exploited zero-day vulnerabilities. The absence of active exploitation provides organizations a crucial window to apply patches without the immediate pressure of ongoing attacks. However, the disclosure of vulnerabilities like CVE-2026-26127 and CVE-2026-21262 underscores the importance of timely patch management to preempt potential exploitation. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-march-2026/?utm_source=openai))
4 months ago
Kill Chain
Unveiling Critical Reverse Proxy Header Vulnerabilities in 2025
In 2025, critical vulnerabilities were identified in reverse proxy applications, notably Fabio and OAuth2-Proxy, exposing significant security risks. CVE-2025-48865 in Fabio allowed attackers to manipulate or remove security-critical headers like X-Forwarded-Host and X-Real-IP by exploiting the HTTP Connection header, potentially leading to access control bypasses. Similarly, CVE-2025-64484 in OAuth2-Proxy enabled authenticated users to inject underscore variants of X-Forwarded-* headers, bypassing the proxy's filtering logic and potentially escalating privileges in upstream applications. These vulnerabilities underscore the importance of stringent header validation and normalization practices in reverse proxy configurations. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-48865?utm_source=openai)) The discovery of these vulnerabilities highlights a systemic issue in how reverse proxies handle HTTP headers, emphasizing the need for organizations to reassess and fortify their security measures to prevent similar exploits.
4 months ago
Kill Chain
SolarWinds Web Help Desk 2025 AjaxProxy RCE Vulnerability
In September 2025, a critical vulnerability (CVE-2025-26399) was identified in SolarWinds Web Help Desk, allowing unauthenticated remote attackers to execute arbitrary code on affected systems. This flaw, rooted in insecure deserialization within the AjaxProxy component, enables attackers to run commands on the host machine without authentication. Despite previous patches for related vulnerabilities (CVE-2024-28986 and CVE-2024-28988), this issue persisted, leading to active exploitation in the wild. Organizations using versions up to 12.8.7 are at significant risk and should apply the latest hotfix immediately. The recurrence of such vulnerabilities underscores the importance of comprehensive security reviews and prompt patch management. As attackers increasingly exploit deserialization flaws, organizations must prioritize securing their software supply chains and implementing robust monitoring to detect and respond to such threats promptly.
4 months ago
Kill Chain
UniPass Wallet's 2023 Account Abstraction Vulnerability: A Critical Security Lesson
In October 2023, Fireblocks researchers identified a critical vulnerability in UniPass's ERC-4337 smart contract wallets, allowing attackers to take full control by replacing the trusted EntryPoint. This flaw exposed hundreds of wallets to potential fund drainage. The UniPass team promptly executed a white-hat operation to secure all affected wallets and implemented necessary fixes to prevent future exploits. This incident underscores the importance of rigorous security audits in the rapidly evolving landscape of smart contract wallets. As account abstraction gains traction, ensuring the integrity of foundational components like EntryPoint is paramount to safeguard user assets.
4 months ago
Kill Chain
Critical Authentication Bypass Vulnerability Discovered in pac4j-jwt Java Library
In March 2026, a critical authentication bypass vulnerability (CVE-2026-29000) was discovered in the pac4j-jwt Java library, affecting versions prior to 4.5.9, 5.7.9, and 6.3.3. This flaw allows remote attackers to forge authentication tokens by exploiting improper verification of cryptographic signatures in the JwtAuthenticator component when processing encrypted JSON Web Tokens (JWTs). By crafting a JWE-wrapped PlainJWT with arbitrary subject and role claims, attackers can bypass signature verification and authenticate as any user, including administrators. ([arcticwolf.com](https://arcticwolf.com/resources/blog/cve-2026-29000/?utm_source=openai)) The vulnerability poses a significant risk due to the widespread use of pac4j-jwt in various Java applications and frameworks. Organizations utilizing affected versions are urged to upgrade to the latest fixed releases immediately to mitigate potential exploitation. ([arcticwolf.com](https://arcticwolf.com/resources/blog/cve-2026-29000/?utm_source=openai))
4 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Publicly Disclosed Zero-Days
In March 2026, Microsoft released its Patch Tuesday updates, addressing 83 vulnerabilities across its software portfolio, including Windows, Office, SQL Server, Azure, and .NET. Notably, this release included two publicly disclosed zero-day vulnerabilities: CVE-2026-21262, an elevation of privilege flaw in Microsoft SQL Server, and CVE-2026-26127, a denial-of-service vulnerability in .NET. Additionally, six vulnerabilities were identified as more likely to be exploited, emphasizing the importance of timely patch application. This update marks the first in six months without any actively exploited zero-day vulnerabilities, indicating a positive trend in Microsoft's vulnerability management efforts. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-march-2026/?utm_source=openai)) The absence of actively exploited zero-day vulnerabilities in this release suggests improved security measures and proactive patching strategies. However, the presence of publicly disclosed vulnerabilities underscores the need for organizations to remain vigilant and prioritize the deployment of these updates to mitigate potential risks.
4 months ago
Kill Chain
Critical Ivanti EPM Vulnerability Exploited: Immediate Action Required
In February 2026, a critical authentication bypass vulnerability (CVE-2026-1603) was identified in Ivanti Endpoint Manager (EPM) versions prior to 2024 SU5. This flaw allows remote, unauthenticated attackers to access stored credential data by exploiting improper authentication mechanisms, specifically through malformed header concatenation in the WSAuth.dll component. Successful exploitation enables attackers to retrieve encrypted credential blobs for high-privilege accounts, potentially compromising the entire endpoint management trust model and facilitating lateral movement within networks. ([dbugs.ptsecurity.com](https://dbugs.ptsecurity.com/vulnerability/CVE-2026-1603?utm_source=openai)) The Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-1603 to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation in the wild. Organizations are urged to upgrade to Ivanti EPM 2024 SU5 immediately to mitigate this risk. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-recently-patched-ivanti-epm-flaw-now-actively-exploited/?utm_source=openai))
4 months ago
Kill Chain
Understanding LummaC2: The 2025 Advanced Evasion Malware
In 2025, LummaC2 emerged as a highly sophisticated information-stealing malware targeting Windows systems. Distributed through phishing emails, malicious advertisements, and compromised software, LummaC2 exfiltrated sensitive data, including browser credentials and cryptocurrency wallets. Notably, its v4.0 introduced advanced evasion techniques, such as trigonometry-based anti-sandbox mechanisms that detect human-like mouse movements to avoid detection. This evolution underscores a significant shift towards stealthy, persistent cyber threats that can bypass traditional security measures. The rise of LummaC2 highlights the increasing sophistication of malware-as-a-service platforms, enabling even low-skilled threat actors to deploy advanced attacks. Organizations must enhance their security postures by adopting proactive threat detection and response strategies to mitigate such evolving threats.
4 months ago
Kill Chain
KadNap Botnet: A New Threat Targeting ASUS Routers in 2026
In August 2025, cybersecurity researchers identified a new malware strain named KadNap, which primarily targets ASUS routers and other edge networking devices. The malware infiltrates these devices, transforming them into nodes within a botnet that proxies malicious traffic. KadNap employs a customized version of the Kademlia Distributed Hash Table (DHT) protocol, enabling decentralized communication and complicating efforts to detect and disrupt its command-and-control (C2) infrastructure. By March 2026, the botnet had expanded to over 14,000 infected devices, with approximately 60% located in the United States. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-kadnap-botnet-hijacks-asus-routers-to-fuel-cybercrime-proxy-network/?utm_source=openai)) The emergence of KadNap underscores a growing trend of sophisticated malware leveraging decentralized protocols to enhance resilience against traditional network monitoring and takedown efforts. This incident highlights the critical need for robust security measures in consumer-grade networking equipment, as such devices are increasingly exploited to facilitate large-scale cybercriminal operations.
4 months ago
Kill Chain
Microsoft's March 2026 Patch Tuesday: Addressing Critical Zero-Day Vulnerabilities
In March 2026, Microsoft released its Patch Tuesday updates, addressing 79 vulnerabilities across various products, including Windows, Office, Azure, SQL Server, and .NET. Notably, two zero-day vulnerabilities were publicly disclosed prior to the release: CVE-2026-21262, an elevation of privilege flaw in SQL Server, and CVE-2026-26127, a denial-of-service vulnerability in .NET. While these vulnerabilities were publicly known, there was no evidence of active exploitation at the time of the update. Organizations are advised to prioritize patching these vulnerabilities to mitigate potential risks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/microsoft/microsoft-march-2026-patch-tuesday-fixes-2-zero-days-79-flaws/?utm_source=openai)) The disclosure of these zero-day vulnerabilities underscores the critical importance of timely patch management. Even in the absence of active exploitation, publicly known vulnerabilities can quickly become targets for cybercriminals. This incident highlights the need for organizations to maintain robust vulnerability management practices to protect their systems and data.
4 months ago
Kill Chain
CISA Adds SolarWinds, Ivanti, and Workspace One Vulnerabilities to KEV Catalog
In March 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added three vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation. These include CVE-2021-22054, a server-side request forgery in Omnissa Workspace One UEM; CVE-2025-26399, a deserialization flaw in SolarWinds Web Help Desk; and CVE-2026-1603, an authentication bypass in Ivanti Endpoint Manager. Exploitation of these vulnerabilities allows unauthorized access to sensitive information and remote code execution on affected systems. ([thehackernews.com](https://thehackernews.com/2026/03/cisa-flags-solarwinds-ivanti-and.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by unpatched software flaws. Organizations are urged to apply the necessary patches promptly to mitigate potential risks associated with these actively exploited vulnerabilities.
4 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports