✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
China-Linked Hackers Achieve VMware ESXi VM Escape with Zero-Days (2025)
In December 2025, security researchers discovered a sophisticated cyberattack attributed to Chinese-speaking threat actors who exploited three zero-day vulnerabilities in VMware ESXi (CVE-2025-22224, CVE-2025-22225, CVE-2025-22226). The attackers gained initial access via a compromised SonicWall VPN appliance, followed by deploying a custom exploit toolkit designed to escape virtual machine isolation and compromise the hypervisor itself. Exploiting the flaws allowed attackers to run arbitrary code on the ESXi host, install persistent backdoors (via VSOCKpuppet), and potentially pave the way for ransomware or advanced persistent remote access, posing direct risks to organizations’ virtual infrastructure integrity. This incident highlights the increased sophistication of state-linked APT actors in targeting virtualization platforms using zero-day techniques and bypassing traditional detection methods. As organizations continue to rely on virtualization and hybrid cloud environments, vigilance around hypervisor and access point security is paramount in defending against similar high-impact threats.
6 months ago
Kill Chain
ChatGPT's 2026 ZombieAgent Attack: Persistent Prompt Injection Exploits AI Memory
In January 2026, researchers at Radware disclosed a critical vulnerability in OpenAI's ChatGPT platform, exploiting its new memory and connector features via indirect prompt injection (IPI). The exploit, dubbed "ZombieAgent," allowed attackers to persistently implant malicious prompts within ChatGPT's memory using innocuous-looking emails or document attachments. Once infected, the AI could automatically extract and exfiltrate sensitive information through obfuscated URL requests whenever the user interacted with the compromised bot, bypassing existing controls and traditional user awareness. The attack method leverages ChatGPT integrations with email and third-party applications, increasing the risk of wide propagation and persistence. This incident underscores the rapidly evolving threat landscape in AI/ML security, where feature enhancements such as memory and connectivity can be leveraged by attackers for new classes of attacks. The ZombieAgent case highlights the urgent need for robust prompt source attribution, intent verification, and granular trust boundaries in AI agents as attackers adapt known abuse techniques to advanced AI capabilities.
6 months ago
Kill Chain
Fake AI Chrome Extensions Expose Sensitive Data of 900,000 Users
In January 2026, security researchers disclosed a major data breach in which two malicious Google Chrome extensions, posing as legitimate AI-powered tools for ChatGPT and DeepSeek, surreptitiously harvested sensitive information from over 900,000 users. These fake extensions, mimicking the functionality and branding of a trusted vendor, exfiltrated entire LLM chat conversations, browsing histories, confidential corporate URLs, internal credentials, and other proprietary data to an external command-and-control server. The scope of the incident included the exposure of intellectual property, business strategies, source code, and user credentials, highlighting significant risks for individuals and organizations whose employees utilized these tools in their workflows. With generative AI increasingly adopted for business and development tasks, this breach is a stark demonstration of the risks posed by third-party browser extensions—particularly those that intercept AI-driven sessions. It underscores the urgent need for stricter vetting controls, robust application security for browser add-ons, and user education in an environment where threat actors leverage AI both as target and tool.
6 months ago
Kill Chain
HPE OneView Critical Zero-Day Exploited for Remote Access in 2025
In June 2025, a critical vulnerability (CVE-2025-37164), was discovered and exploited in the wild against HPE OneView, the company’s IT infrastructure management platform. Attackers leveraged the flaw to achieve remote code execution without authentication, enabling full access to core infrastructure resources. Reported incidents indicate that threat actors used this vulnerability for initial access, privilege escalation, and potentially data exfiltration or ransomware deployment, threatening operational continuity for affected enterprises. HPE acted swiftly to release security advisories and patches, but exploitation occurred before widespread remediation could be implemented. This incident highlights the persistent targeting of critical infrastructure management tools and the increasing sophistication and speed with which attackers weaponize disclosed zero-day vulnerabilities. Organizations must prioritize patch management and vigilant monitoring to prevent compromise in an evolving landscape of high-consequence supply chain and platform attacks.
6 months ago
Kill Chain
Fancy Bear’s 2024 Credential Attacks: The Global Secrets Heist Reinvented
In early 2024, the Russian state-sponsored threat group APT28 (also known as Fancy Bear) intensified credential-harvesting campaigns targeting global governmental and enterprise networks. Leveraging basic techniques such as phishing and exploitation of unencrypted or weakly protected authentication channels, the attackers maintained persistent access and exfiltrated sensitive secrets across multiple sectors. The operations demonstrated a preference for cost-effective methods, including the abuse of stolen credentials, rather than relying on advanced custom malware—resulting in widespread data exposure and persistent breaches with significant geopolitical ramifications. This incident highlights the increasing sophistication of threat actors’ social engineering and credential-focused tactics, signaling a shift in espionage campaigns worldwide. As traditional perimeter defenses become less effective against targeted, credential-driven attacks, organizations face renewed urgency to adopt zero trust models, strong encryption, and robust monitoring to combat these persistent threats.
6 months ago
Kill Chain
How Attackers Manipulate Windows Process Environment Blocks for Evasion (2024 Analysis)
In January 2024, security researchers highlighted a process manipulation technique in Windows environments that allows attackers to modify the Process Environment Block (PEB) of malicious or legitimate processes. By leveraging the CREATE_SUSPENDED flag and directly editing the PEB structure, adversaries can spoof or hide command-line arguments of spawned processes. This method can be further extended to already-running processes, making detection through simple process inspection more challenging. The primary risk lies in attackers masking their operational activities to evade security controls and digital forensics investigation. This incident underscores the evolving sophistication of post-exploitation tactics aimed at defense evasion. Process hollowing, command-line spoofing, and direct PEB tampering are increasingly used in targeted attacks and commodity malware alike, highlighting the critical need for visibility, anomaly detection, and strong endpoint security strategies.
6 months ago
Kill Chain
CISA Flags Critical HPE OneView Vulnerability as Actively Exploited in 2026
In January 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) flagged a critical vulnerability (CVE-2025-37164) in HPE OneView infrastructure management software as being actively exploited in the wild. This flaw, present in versions prior to 11.00, allows unauthenticated attackers to execute low-complexity code-injection attacks, gaining remote code execution on unpatched systems. HPE issued security updates in December 2025, but as no mitigations or workarounds exist, organizations using legacy versions remain exposed. The exploitation of this vulnerability poses significant risks to IT infrastructure due to OneView’s widespread enterprise adoption, which includes the Fortune 500. The prominence of this threat highlights a growing trend in attacks targeting centralized infrastructure management platforms, often leading to widespread lateral movement and potential operational disruption. Regulatory agencies and security teams are increasingly prioritizing rapid patching and zero trust segmentation to address these critical exposures.
6 months ago
Kill Chain
Cisco 2026 ISE Vulnerability: How Public Exploits Undermine Zero Trust
In January 2026, Cisco disclosed a critical vulnerability (CVE-2026-20029) affecting its widely used Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC). The flaw, caused by improper XML parsing in the web-based management interface, allows attackers with valid administrative credentials to upload a malicious file and access otherwise restricted files on the underlying operating system. While Cisco has not identified any active exploitation in the wild, proof-of-concept exploit code is publicly available and even privileged enterprise environments are exposed until patched. Administrators manage authentication, access, and segmentation policies through ISE, so exploitation could grant attackers access to highly sensitive network information or credentials, potentially undermining zero trust controls and compliance postures. This incident is particularly relevant as it highlights the ongoing risk posed by public exploit code, privilege escalation bugs, and gaps in patch hygiene for critical access-management tools. Increased regulatory scrutiny and the sophistication of attackers targeting identity and segmentation controls mean organizations cannot delay patching or segmentation efforts, especially as similar vulnerabilities continue to be a primary vector for advanced threats.
6 months ago
Kill Chain
Global Cisco Switch Reboot Outage: DNS Client Vulnerability Hits Network Operations
In January 2026, numerous Cisco network switches globally experienced widespread, persistent reboot loops due to a software vulnerability in their DNS client service. Beginning around 2 AM UTC, administrators observed affected Cisco models—including CBS250, CBS350, SG350, SG350X, SG550X, and Catalyst C1200—entering repeated crashes when DNS queries for core domains (such as www.cisco.com or NTP servers) failed. The root trigger appears to be a firmware bug in the DNSC task, causing the switch OS to log a critical error and initiate an immediate reboot, with impacts observed across multiple organizations and networks worldwide. Temporary mitigations, such as disabling DNS or SNTP features, helped restore partial stability until Cisco and upstream CDN providers reverted the changes. The incident highlights the ongoing risk that latent software vulnerabilities in ubiquitous infrastructure devices pose to business continuity. As device automation and remote management expand, similar vulnerabilities can cause cascading operational outages across sectors, underscoring the need for robust patching, rigorous QA in embedded systems, and improved visibility over east-west traffic disruptions.
6 months ago
Kill Chain
Chinese APT Exploits VMware ESXi Zero-Days in Stealth Hypervisor Attacks (2025)
In late 2025, threat researchers identified a series of intrusions targeting VMware ESXi hypervisors via a zero-day toolkit attributed to a Chinese-speaking advanced persistent threat group. The attackers initially gained access by compromising a SonicWall VPN device and pivoted through privileged domain accounts, leveraging sophisticated VM escape exploits that chained three ESXi zero-day vulnerabilities (CVE-2025-22226, CVE-2025-22224, and CVE-2025-22225) developed more than a year before disclosure. The exploit chain enabled lateral movement, data staging for exfiltration, and installation of stealth persistence backdoors, placing numerous enterprise virtualization environments at sustained risk for data breach and operational disruption. This incident exemplifies the escalating sophistication of APT operations, underlining the risks posed by supply chain weaknesses, late vulnerability reporting, and the ability of attackers to evade common monitoring. The case also highlights growing regulatory scrutiny on zero-day management and east-west traffic visibility within critical infrastructure.
6 months ago
Kill Chain
CISA Sounds Alarm on Exploited Microsoft Office & HPE OneView Vulnerabilities (2026)
In January 2026, CISA added critical vulnerabilities affecting Microsoft Office (CVE-2009-0556) and HPE OneView (CVE-2025-37164) to its Known Exploited Vulnerabilities catalog after credible reports of active exploitation. CVE-2009-0556, a code injection flaw in PowerPoint, allows remote code execution via memory corruption, while CVE-2025-37164 enables unauthenticated remote code execution against all affected HPE OneView versions prior to 11.00. eSentire reported public proof-of-concept exploit code for the HPE flaw, further increasing organizational risk. Both vulnerabilities pose severe security threats, prompting urgent remediation directives across Federal Civilian Executive Branch networks. This incident underscores the rising urgency of rapid patch management as threat actors increasingly exploit published vulnerabilities and proof-of-concept exploits. The swift addition to CISA’s catalog highlights regulatory pressure and the need for proactive controls as organizations face growing risks from unpatched enterprise software.
6 months ago
Kill Chain
NodeCordRAT Trojan Exposed in npm Bitcoin-Themed Packages (2026)
In November 2025, cybersecurity researchers uncovered a sophisticated supply chain attack involving malicious npm packages—'bitcoin-main-lib', 'bitcoin-lib-js', and 'bip40'—that distributed the remote access trojan NodeCordRAT. Uploaded by the threat actor 'wenmoonx', these packages mimicked legitimate BitcoinJS repositories, leveraging npm’s postinstall scripts to deliver malware hidden in 'bip40'. NodeCordRAT enabled attackers to exfiltrate Chrome credentials, cryptocurrency wallet seed phrases, and sensitive files to Discord-controlled servers, using Discord’s API for covert communication and command execution. This multi-OS campaign potentially impacted thousands of developers before takedown. The incident stands out for its abuse of trusted open-source components, increasing concern across the software supply chain. Its methodology highlights the growing sophistication of attacker tradecraft leveraging developer ecosystems and API-based covert channels, making such threats relevant for all organizations relying on open-source dependencies.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports