✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
CISA Adds Four Vulnerabilities to KEV Catalog - January 2026
In January 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog, citing active exploitation evidence. The vulnerabilities include CVE-2025-68645 affecting Synacor Zimbra Collaboration Suite, CVE-2025-34026 in Versa Concerto SD-WAN platform, CVE-2025-31125 in Vite Vitejs, and CVE-2025-54313 in eslint-config-prettier. These flaws span email platforms, SD-WAN infrastructure, development tools, and package managers, posing significant risks across various sectors. ([isec.news](https://www.isec.news/2026/01/24/cisa-adds-four-vulnerabilities-to-kev-catalog-and-sets-federal-patch-deadline/?utm_source=openai)) The inclusion of these vulnerabilities underscores the escalating threat landscape, with attackers increasingly targeting diverse software components. Organizations are urged to prioritize patching by the February 12, 2026 deadline to mitigate potential breaches and maintain operational security. ([cyberpress.org](https://cyberpress.org/cisa-adds-four-critical-vulnerabilities-to-kev-catalog-following-active-exploitation/?utm_source=openai))
5 months ago
Kill Chain
Notepad++ 2025 Supply Chain Attack: A Deep Dive into the Lotus Panda Breach
Between June and December 2025, the popular text editor Notepad++ experienced a significant supply chain attack. State-sponsored actors, identified as the Chinese group Lotus Panda, compromised the software's update infrastructure by infiltrating its shared hosting provider. This breach allowed them to intercept and redirect update requests, delivering malicious installers to targeted users. The attackers employed sophisticated techniques, including DLL side-loading and the deployment of a custom backdoor named Chrysalis, to gain unauthorized access to systems. The campaign was highly selective, focusing on organizations in sectors such as telecommunications, finance, and government across regions including East Asia, the Philippines, and Vietnam. ([kaspersky.com](https://www.kaspersky.com/about/press-releases/kaspersky-great-uncovers-hidden-attack-chains-in-notepad-supply-chain-compromise?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks, where trusted software distribution channels are exploited to infiltrate systems. The Notepad++ compromise highlights the necessity for organizations to implement stringent software update verification processes and to remain vigilant against potential vulnerabilities in third-party software components.
5 months ago
Kill Chain
AI Assistants: The New Frontier for Stealthy Malware Communication
In February 2026, cybersecurity researchers from Check Point Research identified a novel method by which AI assistants with web browsing capabilities, such as Microsoft Copilot and xAI's Grok, can be exploited to facilitate covert command-and-control (C2) communications for malware. By manipulating these AI platforms to fetch attacker-controlled URLs, threat actors can establish stealthy communication channels that blend seamlessly into legitimate enterprise traffic, thereby evading traditional detection mechanisms. This technique underscores the evolving landscape of cyber threats, where everyday AI tools are repurposed for malicious activities. The discovery highlights a significant shift in cyberattack methodologies, emphasizing the need for organizations to reassess their security postures in the context of AI integration. As AI assistants become more prevalent in enterprise environments, the potential for their misuse in cyberattacks increases, necessitating enhanced monitoring and adaptive defense strategies to mitigate such risks.
5 months ago
Kill Chain
Dell RecoverPoint Zero-Day Exploited by UNC6201
In mid-2024, a critical zero-day vulnerability (CVE-2026-22769) in Dell's RecoverPoint for Virtual Machines was exploited by the China-linked cyberespionage group UNC6201. This flaw, involving hardcoded credentials, allowed unauthenticated remote attackers to gain root-level access, facilitating lateral movement, persistent access, and deployment of malware such as BRICKSTORM and the newer GRIMBOLT backdoor. The attackers also employed 'ghost NICs' to stealthily pivot within virtualized environments, complicating detection and response efforts. The exploitation of this vulnerability underscores the persistent threat posed by state-sponsored actors targeting critical infrastructure. Organizations are urged to apply Dell's remediation measures promptly to mitigate potential risks associated with this exploit.
5 months ago
Kill Chain
Critical Flaws in Popular VS Code Extensions Put Millions at Risk
In February 2026, critical vulnerabilities were discovered in four widely used Visual Studio Code (VS Code) extensions—Live Server, Code Runner, Markdown Preview Enhanced, and Microsoft Live Preview—collectively installed over 125 million times. These flaws could allow attackers to steal local files and execute remote code by exploiting weaknesses in the extensions' handling of web content and local server configurations. Notably, CVE-2025-65717 in Live Server enables file exfiltration via malicious websites, while CVE-2025-65716 in Markdown Preview Enhanced permits arbitrary code execution through crafted markdown files. Despite disclosure in June 2025, three of these vulnerabilities remained unpatched as of February 2026, leaving developers exposed to significant security risks. ([thehackernews.com](https://thehackernews.com/2026/02/critical-flaws-found-in-four-vs-code.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting development environments. The exploitation of trusted tools like VS Code extensions highlights the need for developers to exercise caution when installing and updating extensions, and for maintainers to prioritize timely security patches to mitigate potential compromises.
5 months ago
Kill Chain
Critical Vulnerability in Grandstream GXP1600 VoIP Phones: CVE-2026-2329
In February 2026, a critical vulnerability (CVE-2026-2329) was discovered in Grandstream's GXP1600 series VoIP phones, affecting models GXP1610, GXP1615, GXP1620, GXP1625, GXP1628, and GXP1630. This unauthenticated stack-based buffer overflow in the HTTP API endpoint "/cgi-bin/api.values.get" allows remote attackers to execute arbitrary code with root privileges. Exploitation could lead to unauthorized access, interception of VoIP communications, and potential eavesdropping on sensitive conversations. ([rapid7.com](https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed/?utm_source=openai)) The incident underscores the importance of promptly applying security patches and monitoring VoIP infrastructure for vulnerabilities. Organizations using these devices should update to firmware version 1.0.7.81 to mitigate the risk. ([rapid7.com](https://www.rapid7.com/blog/post/ve-cve-2026-2329-critical-unauthenticated-stack-buffer-overflow-in-grandstream-gxp1600-voip-phones-fixed/?utm_source=openai))
5 months ago
Kill Chain
KongTuke's CrashFix Campaign: Exploiting DNS to Deliver ModeloRAT
In early 2026, the threat actor known as KongTuke launched an evolved ClickFix campaign, dubbed 'CrashFix,' targeting corporate environments. The attack began with users installing a malicious Chrome extension named NexShield, masquerading as a legitimate ad blocker. After a delay, the extension deliberately crashed the browser, displaying a fake 'CrashFix' security warning. This prompt instructed users to run a command that executed a custom DNS lookup, leading to the download and execution of ModeloRAT, a Python-based remote access trojan. This sophisticated social engineering tactic exploited user trust and system utilities to gain unauthorized access to corporate systems. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/05/clickfix-variant-crashfix-deploying-python-rat-trojan/?utm_source=openai)) This incident underscores a growing trend of attackers leveraging social engineering combined with native system tools to bypass traditional security measures. The use of DNS queries for payload delivery highlights the need for enhanced monitoring of network traffic and user education to recognize and resist such deceptive tactics.
5 months ago
Kill Chain
The Rise of RMM Tool Exploitation in Cyber Attacks
In early 2025, cybersecurity researchers observed a significant increase in cyberattacks leveraging legitimate Remote Monitoring and Management (RMM) tools such as AnyDesk, ScreenConnect, and SimpleHelp. Threat actors exploited these tools to gain unauthorized access to systems, maintain persistence, and execute malicious activities without deploying traditional malware. This method allowed attackers to blend seamlessly into normal IT operations, making detection challenging. The impact was widespread, affecting various sectors including healthcare, finance, and education, leading to data breaches, financial losses, and operational disruptions. This trend underscores a shift in cybercriminal tactics towards 'Living-off-the-Land' techniques, where adversaries misuse trusted tools to evade detection. The rise in RMM abuse highlights the need for organizations to enhance monitoring of legitimate software usage and implement stringent access controls to mitigate such threats.
5 months ago
Kill Chain
Microsoft Office Equation Editor Exploit: A 2026 Malware Campaign
In February 2026, a sophisticated malware campaign exploited the Microsoft Office Equation Editor vulnerability (CVE-2017-11882) to deliver malicious payloads. Attackers distributed emails with attachments that, when opened, triggered the exploit, leading to the download and execution of harmful scripts and DLLs. Notably, the campaign reused a JPEG image embedding the final payload, a technique observed in previous attacks, indicating a pattern of leveraging known vulnerabilities and methods. This incident underscores the persistent threat posed by unpatched vulnerabilities and the reuse of attack techniques. Organizations must prioritize timely patching and remain vigilant against evolving malware delivery methods to mitigate such risks.
5 months ago
Kill Chain
Critical Vulnerability in Cryptographic Libraries Exposes Sensitive Data
In February 2026, a critical vulnerability was identified in widely-used JavaScript and Python cryptographic libraries, aes-js and pyaes, respectively. These libraries defaulted to a static initialization vector (IV) in AES-CTR mode, leading to predictable encryption patterns. This flaw exposed numerous applications to potential data breaches, as attackers could exploit the deterministic IV to decrypt sensitive information. The issue was notably present in strongMan VPN Manager, which utilized pyaes for encrypting private keys and certificates, thereby compromising user credentials and network security. This incident underscores the importance of secure cryptographic practices, particularly the necessity of using unique, random IVs for each encryption operation. The widespread adoption of these libraries amplifies the risk, highlighting the need for developers to audit and update their cryptographic implementations to prevent similar vulnerabilities.
5 months ago
Kill Chain
Anthropic's Git MCP Server Vulnerabilities: A Wake-Up Call for AI Security
In January 2026, Anthropic addressed critical vulnerabilities in its Git MCP server, a key component of the Model Context Protocol enabling AI tools to interact with code repositories. Security researchers identified three significant flaws: a path validation bypass (CVE-2025-68145), an unrestricted git_init issue (CVE-2025-68143), and an argument injection flaw in git_diff (CVE-2025-68144). These vulnerabilities, particularly when combined with the Filesystem MCP server, could allow remote code execution or file tampering via prompt injection. Reported in June 2025, these issues were patched by Anthropic in December 2025 with version 2025.12.18. While no active exploitation has been confirmed, this incident highlights the growing risks associated with integrating complex AI systems, where safe components may become vulnerable when used together. The event also references a prior incident from November 2025, where Anthropic's Claude AI was manipulated in a cyberespionage campaign targeting major global entities, underscoring the broader cybersecurity challenges linked to rapid AI adoption.
5 months ago
Kill Chain
AI Discovers Critical OpenSSL Vulnerabilities in 2026
In January 2026, the AI-assisted cybersecurity firm Aisle identified twelve previously undisclosed vulnerabilities in OpenSSL, a widely used cryptographic library essential for secure internet communications. These vulnerabilities, some dating back to 1998, included critical issues like CVE-2025-15467, a stack buffer overflow in CMS message parsing that could lead to remote code execution. OpenSSL rated this vulnerability as HIGH severity, with a CVSS v3 score of 9.8 out of 10. The discovery underscores the potential of AI in enhancing cybersecurity measures by identifying complex vulnerabilities that have eluded traditional detection methods. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/ai-assisted-cybersecurity-team-discovers-12-openssl-vulnerabilities-claims-humans-are-the-limiting-factor-some-vulnerabilities-have-been-around-for-decades?utm_source=openai)) The findings highlight the evolving landscape of cybersecurity, where AI tools are becoming instrumental in proactively identifying and mitigating risks. This shift emphasizes the need for organizations to integrate AI-driven solutions into their security protocols to stay ahead of sophisticated cyber threats.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports