✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Critical Gogs Zero-Day Exploited in Ongoing Supply-Chain Attacks
In early 2024, security researchers revealed that attackers had actively exploited a zero-day vulnerability in Gogs, a popular self-hosted Git service, for several months. The flaw, which allowed remote code execution (RCE), bypassed a previously disclosed patch, enabling unauthorized actors to compromise software supply chains by injecting code and potentially exfiltrating sensitive repositories. This sustained exploitation remained undetected until a disclosure by Wiz, highlighting that a patch was still unavailable at the time of reporting, therefore leaving many self-hosted Gogs deployments exposed and at risk. This incident underscores the increasingly sophisticated nature of supply-chain attacks and the challenges organizations face in managing security across open-source dependencies. With the rapid rise in software supply-chain exploits targeting CI/CD platforms, organizations are under mounting pressure to adopt stringent internal controls and layered defenses.
6 months ago
Kill Chain
2025 Surge in Supply Chain Attacks Hits GitHub Actions: What Every DevSecOps Leader Must Know
In 2025, a surge in supply chain attacks targeted GitHub Actions, leveraging insecure workflows and misconfigured secrets to inject malicious code into the software development pipeline. Attackers exploited open source dependencies and automation gaps, enabling lateral movement and data theft across multiple organizations using compromised CI/CD environments. The incident, revealed through coordinated research at Black Hat Europe, highlighted how adversaries can escalate privileges and bypass traditional defenses by targeting both public and private repositories, resulting in widespread risk for organizations with weak DevSecOps controls. This incident underscores a pronounced trend: attackers are increasingly focusing on automated development environments and supply chains, not just production workloads. With more organizations adopting GitHub Actions and similar platforms, visibility, zero trust segmentation, and secure automation practices are now critical to thwart sophisticated threat actors targeting the software supply chain.
6 months ago
Kill Chain
How Salt Typhoon Infiltrated US Telecoms: Lessons from the 2024 Nation-State Attack
In early 2024, multiple major US telecommunications providers were targeted in a sophisticated nation-state attack attributed to Salt Typhoon, a Chinese-affiliated APT group. The attackers exploited unencrypted and east-west traffic flows within provider networks, bypassing conventional perimeter defenses to gain persistent access to sensitive infrastructure and intercept data in transit. Salt Typhoon leveraged advanced lateral movement and covert exfiltration techniques, enabling them to collect confidential communications and network architecture details. The incident led to significant operational risks, regulatory scrutiny, and concern within the telecom and national security sectors. This breach highlights a surge in highly targeted attacks on critical infrastructure, as nation-state actors exploit unencrypted traffic and insufficient internal segmentation. Current attacks reflect a broader strategic trend, with organizations facing pressure to modernize controls to address evolving threat vectors and international cyber-risk dynamics.
6 months ago
Kill Chain
Malware’s New Trick: Abusing the DLL EntryPoint in Windows (2024)
In December 2024, security researchers identified a Windows malware technique that leverages the DLL entry point (DllMain) to execute malicious code automatically upon DLL loading, even if no exported function is invoked. By embedding harmful operations—such as launching other processes—directly within DllMain, threat actors can evade typical detection methods that focus primarily on analyzing exported functions. This technique often harnesses trusted Windows utilities, like rundll32.exe or regsvr32.exe, as the initial execution vectors, making attacks stealthy and difficult to detect. The result is an elevated risk for lateral movement within environments and increased potential for undetected code execution. This method highlights a broader trend in which attackers abuse overlooked aspects of Windows internals to persist and evade controls. As adversaries continue to evolve, the need for better anomaly detection, code inspection, and zero trust segmentation becomes ever more critical for organizations defending against sophisticated malware delivery approaches.
6 months ago
Kill Chain
LockBit Ransomware: Why Reputation Now Drives RaaS Attacks and Ransom Payments (2025 Analysis)
In early 2025, research into the LockBit ransomware-as-a-service (RaaS) gang revealed the pivotal role of reputation in both attacker and victim circles. At its peak, LockBit utilized a vast network of nearly 200 affiliates to gain initial access, exfiltrate sensitive data, and negotiate ransoms, with over half achieving payout settlements after system encryption and data theft. The incident highlights the attackers’ emphasis on trust during ransom negotiations and the widespread operational and financial disruptions suffered by targeted organizations, including critical recovery costs, business downtime, and severe reputational impact stemming from media coverage. The increasing maturity and professionalization of RaaS operations, typified by LockBit, have made sophisticated extortion tactics more common. As law enforcement and insurers adapt, companies face heightened risk not just from technical compromise, but from strategic reconnaissance that monetizes cyber insurance intelligence, further escalating the urgency for advanced protection and segmentation of sensitive data.
6 months ago
Kill Chain
AI-Powered Attacks Break Smart Contracts: A 2025 Blockchain Breach Analysis
In late 2025, advanced AI models including Anthropic's Claude Opus 4.5, Claude Sonnet 4.5, and OpenAI's GPT-5 autonomously exploited vulnerabilities across a new smart contract benchmark (SCONE-bench) comprising 405 blockchain contracts. These AIs collectively discovered and weaponized vulnerabilities leading to $4.6 million in simulated or actual economic loss, proving AI-driven cyber capabilities have reached critical new thresholds. Further, simulations against nearly 2,850 newly deployed smart contracts with no previously known vulnerabilities resulted in successful zero-day discoveries and profitable exploits, despite only modest operational costs for the threat actors. This fundamentally changed the risk calculus for decentralized finance and blockchain-based businesses. These findings underscore a turning point, where the integration of conversational and agentic AI with offensive security tools directly translates to scalable, profitable cyberattacks. The incident highlights an urgent risk landscape: AI-driven exploitation is no longer theoretical, driving increased pressure for automated AI defensive strategies and regulatory focus in sectors reliant on smart contracts.
6 months ago
Kill Chain
Eighth Chrome Zero-Day of 2025: Google Issues Emergency Patch Amid Active Exploitation
In early 2025, Google addressed its eighth actively exploited zero-day vulnerability in Chrome within the year, releasing an emergency update after threat actors leveraged the flaw to bypass browser security and execute malicious code. Attackers exploited a use-after-free bug to achieve remote code execution, targeting Chrome users worldwide. Quick detection and response by Google limited the potential damage, but the repeated appearance of critical zero-days raised new concerns among IT teams and users regarding browser safety and patch timeliness. The frequency and sophistication of recent browser-based zero-days reflect an upward trend in targeted attacks against mainstream software. As Chrome remains the dominant browser for consumers and enterprises alike, effective patch management and browser security have become business-critical to defend against rapid exploit deployment and reduce organizational risk.
6 months ago
Kill Chain
Google Ads Push MacOS AMOS Infostealer via ChatGPT & Grok AI Guides in 2024
In early June 2024, a threat campaign leveraged Google search advertisements to promote fraudulent ChatGPT and Grok chatbot guides targeting macOS users. Victims who clicked on these ads were redirected to malicious sites and deceived into downloading the AMOS (Atomic) infostealer malware, which harvested sensitive credentials, cryptocurrency wallets, and other private data. The campaign exemplifies the use of topical lures—capitalizing on the mainstream popularity of AI chat platforms—to facilitate widespread malware distribution, bypassing native macOS security. Attackers used SEO poisoning and social engineering tactics, making detection and attribution challenging, while infostealer payloads exfiltrated key business and personal data. This incident underscores a rising trend: infostealer campaigns exploiting interest in emerging AI technologies, with search engine ads and convincing guides serving as the primary attack vector. As macOS adoption grows in enterprises and AI tools become mainstream, businesses face escalating risks from social engineering, supply chain misuse, and evolving malware techniques exploiting trusted sites and brand searches.
6 months ago
Kill Chain
Gogs Zero-Day RCE Exploited: Hundreds of Git Servers Breached in 2024
In early June 2024, a critical and unpatched zero-day vulnerability in Gogs—an open-source, self-hosted Git service—was exploited by unnamed threat actors to achieve remote code execution on over 700 publicly accessible servers. Attackers leveraged a flaw in Gogs' authentication mechanism to gain administrative access, subsequently deploying malicious payloads and establishing persistent control over compromised systems. The campaign, detected by threat intelligence researchers, resulted in unauthorized access to sensitive development infrastructure, disruption of software delivery pipelines, and potential exposure of intellectual property and credentials. This incident underscores the escalating pace at which threat actors exploit zero-day vulnerabilities, particularly in widely adopted developer tools. The wave of attacks against Gogs highlights the urgent need for organizations to maintain up-to-date security controls and implement zero trust segmentation to limit lateral movement in cloud-native environments.
6 months ago
Kill Chain
ConsentFix: How a Clever OAuth Attack Took Over Microsoft Accounts via Azure CLI in 2024
In June 2024, a new variation of the previously-identified ClickFix attack emerged—dubbed 'ConsentFix'—targeting organizations using Microsoft Azure. Threat actors leveraged social engineering to manipulate users into granting malicious OAuth permissions via the Azure CLI tool, resulting in full account compromise without requiring user passwords or bypassing multi-factor authentication (MFA). By tricking victims into executing crafted Azure CLI commands, attackers could hijack Microsoft accounts, potentially leading to widespread access to sensitive data, misconfiguration, or further lateral movement within affected cloud environments. This attack highlights the growing sophistication of consent phishing and the increased abuse of cloud automation tools, stressing the urgent need for organizations to review OAuth permission flows and harden identity-driven security controls. Rapid evolution in attacker tactics underscores critical risks within cloud access management and the threat landscape.
6 months ago
Kill Chain
Active Exploits Target Gladinet CentreStack and Triofox Using Hard-Coded Keys
In December 2025, Gladinet's CentreStack and Triofox platforms were found to contain a critical vulnerability (CVE-2025-14611) arising from hard-coded cryptographic keys. Threat actors exploited this flaw by crafting malicious access tickets, allowing them to decrypt sensitive files—including the web.config file—and ultimately achieve remote code execution through ViewState deserialization. At least nine organizations across healthcare and technology were compromised, with attackers chaining this vulnerability with previously known flaws for greater impact. The attack flow highlights attackers' in-depth knowledge of Gladinet’s codebase and past vulnerabilities. This incident underscores the growing risks from supply chain software flaws and repeated exploitation of insecure cryptography in enterprise products. The rapid addition of this CVE to CISA’s Known Exploited Vulnerabilities catalog reflects intensifying regulatory scrutiny and a pressing need for organizations to identify and remediate insecure authentication mechanisms promptly.
6 months ago
Kill Chain
UK Slaps LastPass with £1.2M Fine for 2022 Data Breach Exposing Encrypted Vaults
In August 2022, password management provider LastPass suffered a sophisticated data breach in which attackers exploited a compromised developer account. The breach led to the exfiltration of source code, proprietary data, and encrypted password vaults for approximately 1.6 million UK users. Investigation revealed gaps in LastPass’s internal security controls and multi-factor authentication implementation, enabling lateral movement and access to critical storage environments storing user vault backups. The breach resulted in substantial reputational and regulatory consequences for LastPass, including a £1.2 million fine from the UK Information Commissioner’s Office (ICO). This incident remains significant as it highlights persistent weaknesses in cloud application security, data vault encryption, and the growing focus of regulators on consumer data privacy practices. Increased cybercriminal targeting of password management services underscores an urgent need for robust internal segmentation and encryption at all stages.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports