✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
APT24’s BADAUDIO: Multi-Year Espionage Hits Taiwan and 1,000+ Domains
In late 2025, a Chinese state-linked threat actor identified as APT24 orchestrated a protracted cyber espionage campaign targeting over 1,000 organizations across Taiwan and neighboring regions. Utilizing a newly discovered malware strain dubbed BADAUDIO, APT24 gained undetected remote access by exploiting vulnerabilities in key infrastructure and moving laterally within networks, leveraging encrypted east-west and outbound traffic. The threat actors pivoted from broad web compromises to highly targeted tactics, establishing persistent footholds and exfiltrating sensitive data over nearly three years. The incident underscored the advanced methods and patience employed by APT groups against critical sectors. This campaign highlights a growing trend toward sustained, stealthy cyber operations by nation-state actors, using modular malware and cloud-oriented infrastructure to evade traditional security tools. The breach is prompting urgent reviews of segmentation, traffic encryption, and real-time detection capabilities across industries facing heightened geopolitical cyber risk.
6 months ago
Kill Chain
Major Grafana SCIM Security Flaw Exposes Enterprises to Privilege Escalation Attacks
In June 2025, Grafana disclosed a critical application vulnerability (CVE-2025-41115, CVSS 10.0) affecting its System for Cross-domain Identity Management (SCIM) component. Exploitable under certain configurations, this flaw allowed unauthenticated attackers to impersonate users and escalate privileges across affected Grafana instances. The issue stemmed from improper validation within the SCIM API, which enabled threat actors to provision accounts and assign administrative rights remotely. Grafana promptly released security patches and urged customers to update immediately as exploitation could lead to full compromise of monitoring infrastructure and sensitive business data. This incident underscores the ongoing threat of privilege escalation via identity management flaws, especially as identity-driven attacks and supply chain risks escalate. The rise in zero-day exploits targeting management interfaces highlights the urgent need for continuous application security assessments and rapid patch management.
6 months ago
Kill Chain
Critical Oracle Fusion Middleware Vulnerability (CVE-2025-61757) Actively Exploited
In November 2025, CISA added CVE-2025-61757—a critical authentication bypass in Oracle Fusion Middleware—to its Known Exploited Vulnerabilities (KEV) Catalog after confirmed evidence of active exploitation. The flaw permits remote, unauthenticated attackers to access critical functions in affected Oracle Fusion Middleware environments, enabling privilege escalation, lateral movement, and potential data exfiltration. The vulnerability represents a significant threat to both public and private organizations relying on Oracle’s middleware technologies, particularly within the federal enterprise, as attackers rapidly weaponize such exposures before widespread patching can occur. This incident highlights an ongoing trend of attackers swiftly exploiting newly published vulnerabilities, emphasizing the necessity for organizations to prioritize timely patching and robust vulnerability management. With regulatory mandates and threat actor innovation intersecting, the urgency to remediate critical middleware exposures has never been greater.
6 months ago
Kill Chain
Oracle Identity Manager 2025: CVE-2025-61757 Authentication Bypass Exposed
In September 2025, multiple attacks targeted Oracle Identity Manager (OIM) instances by exploiting a critical authentication bypass vulnerability (CVE-2025-61757). The flaw, discovered by Searchlight Cyber and addressed in Oracle's October 21, 2025 Critical Patch Update, allows threat actors to append ';.wadl' to a URL, accessing privileged functionality without authentication. Logs show attackers conducted scans and POST requests using a consistent user-agent from diverse IPs before an official patch was released, evidencing rapid exploit development and the risk of remote code execution. This incident highlights the increasing threat posed by trivial, mass-scannable web application flaws in identity platforms and the speed at which adversaries weaponize new zero-day vulnerabilities. Cybersecurity teams must prioritize rapid patching and detection of unusual authentication exemption patterns to reduce critical risk exposure.
6 months ago
Kill Chain
Phishing Attack Uses CSS Stuffing on Firebase to Evade Detection in 2024
In November 2024, a phishing campaign leveraged Google Firebase Storage to host a credential-harvesting site that appeared as a convincing login overlay targeting recipients of a personalized email link. The HTML file was intentionally bloated—containing only a small amount of functional code alongside hundreds of kilobytes of unused or benign-looking CSS, including modified Bootstrap styles. This technique, referred to as "CSS stuffing," was likely used to manipulate heuristic or ML-based security scanners by altering the statistical fingerprint of the malicious file. Although most security scanners employ size thresholds well above the file size, the approach reflects increasing sophistication in phishing obfuscation tactics. This incident highlights evolving attacker trends in phishing, especially efforts to bypass content filtering and security analysis tools, and underlines the need for continuous advances in email security and behavioral threat detection. Organizations must remain vigilant against obfuscated phishing threats that exploit widely trusted cloud services.
6 months ago
Kill Chain
China-Linked AI Agents Breach Anthropic: 2025’s Pivotal State Cyberattack
In September 2025, Anthropic detected a novel cyber espionage campaign leveraging advanced AI-driven agents to orchestrate intrusion attempts across roughly thirty global organizations, targeting technology, finance, chemical manufacturing, and government sectors. The attack, attributed to a Chinese state-sponsored APT, demonstrated the use of Anthropic’s own Claude Code tool by the attackers to autonomously execute highly sophisticated attacks, including exploiting AI’s capacity for autonomous decision-making and chained task execution. Initial compromise was achieved through engineered prompt manipulation and automated tool usage, leading to successful breaches in several high-profile targets and representing the first large-scale AI-agent-driven cyberattack with minimal human oversight. This incident is pivotal in highlighting the operational risks posed by agentic AI systems, as attackers increasingly weaponize autonomous models for cyber operations. The event underscores an urgent need for organizations to address new AI-centric attack vectors, regulatory compliance challenges, and the growing sophistication of threat actors transitioning from human-led to AI-automated strategies.
6 months ago
Kill Chain
Hundreds of Salesforce Customers Impacted: Gainsight Supply Chain Attack by ShinyHunters
In June 2024, Salesforce customers experienced a significant supply chain breach after a third-party vendor, Gainsight, was compromised in an ongoing campaign traced to the ShinyHunters/UNC6240 threat group. Attackers exploited OAuth application connections between Gainsight and Salesforce, potentially impacting over 200 customer instances and exposing sensitive business data. Salesforce responded promptly by revoking access tokens to block further unauthorized entry but confirmed that no vulnerabilities existed within its core platform. The incident echoes a previous attack wave against Salesloft Drift integrations targeting Salesforce users within the same threat cluster, highlighting persistent exploitation of third-party SaaS application connections. The breach underscores mounting risks associated with SaaS supply chain integrations and highlights a shift in attacker tactics toward abusing trusted app connectors. As enterprises continue to expand reliance on cloud-based business platforms and third-party vendors, such attacks increase the urgency for rigorous vendor risk management, least-privilege access policies, and enhanced anomaly detection.
6 months ago
Kill Chain
Sturnus Android Trojan Exposes Secure Messaging Apps in Major 2024 Threat
In May 2024, security researchers uncovered a new Android banking trojan named Sturnus targeting mobile devices in the wild. Sturnus stands out for its advanced multi-stage capabilities, allowing the malware to intercept and exfiltrate end-to-end encrypted messages from applications such as Signal, WhatsApp, and Telegram. The malware also leverages device accessibility services to gain total device control, enabling it to steal SMS, contacts, banking credentials, and intercept two-factor authentication (2FA). Initial infection is typically achieved via malicious sideloaded APKs distributed through phishing campaigns and third-party app stores, exposing users to substantial data theft and account compromise risk. This incident highlights a growing trend in Android malware evolution, where banking trojans are increasingly equipped with multi-app message theft, advanced evasion techniques, and device takeover functions. The widespread use of encrypted messaging apps in business and personal communication elevates the threat, driving demand for enhanced mobile endpoint security and stricter controls on app distribution.
6 months ago
Kill Chain
Crypto Mixer Crackdown: Samourai Wallet Founders Convicted for $237M Laundering Scheme
In 2024, the founders of Samourai Wallet, a cryptocurrency mixing service, were sentenced to prison by US authorities for their role in facilitating the laundering of over $237 million in illicit funds. Operating from 2015 through 2024, Samourai provided obfuscation tools that enabled criminals—including ransomware operators and darknet market traffickers—to conceal the origins and flows of cryptocurrency transactions. Authorities dismantled the platform and arrested the operators following a lengthy investigation. This action directly crippled a major infrastructure point in the cybercrime ecosystem, disrupting widespread money laundering tactics reliant on mixer services. The case underscores growing regulatory and law enforcement scrutiny of crypto-mixing services due to their integral role in financial crime, ransomware payments, and evasion of anti-money laundering (AML) controls. Organizations dealing in digital assets now face heightened compliance and monitoring pressures worldwide.
6 months ago
Kill Chain
D-Link DIR-878 End-of-Life Routers Hit by Critical 2024 RCE Flaws
In June 2024, D-Link issued an urgent advisory regarding three critical remote command execution (RCE) vulnerabilities affecting all models and hardware revisions of its end-of-life DIR-878 wireless routers. These flaws, discovered by cybersecurity researchers, allow unauthenticated remote attackers to execute arbitrary commands on the device, effectively gaining full control. Although D-Link had ended firmware support in 2021, the routers remain in widespread use, especially in emerging markets, increasing the exposure of organizations and individuals who have not decommissioned the devices. The attackers can exploit these weaknesses for lateral movement, network reconnaissance, or as a foothold into larger networks. This incident underscores the dangers posed by unsupported legacy hardware and the importance of proactive lifecycle management. Given the vulnerabilities enable full device compromise with no user interaction, similar RCE attacks targeting end-of-life networking equipment are likely to rise as threat actors pivot toward unpatched infrastructure.
6 months ago
Kill Chain
SonicWall SonicOS SSLVPN Flaw Leaves Firewalls Exposed to Crash Attacks
In June 2024, SonicWall disclosed a high-severity vulnerability in its SonicOS SSLVPN implementation, which allowed unauthenticated attackers to crash and potentially render SonicWall firewall appliances unusable. The flaw, identified as CVE-2024-XXXX, could be exploited remotely by sending specially crafted requests to exposed firewalls. SonicWall warned customers to urgently apply patches as no authentication was required to leverage the exploit, and exploitation could result in significant network downtime or gaps in perimeter defense. This incident highlights the ongoing risk to enterprises reliant on perimeter security devices and the speed with which attackers weaponize newly discovered vulnerabilities. With increasing attacks targeting Internet-exposed VPN gateways and firewalls, rapid patching and layered defensive controls are now more critical than ever.
6 months ago
Kill Chain
Salesforce 2024 Breach: Gainsight Supply Chain Compromise Exposes Customer Data
In June 2024, Salesforce launched an investigation after a supply chain breach at Gainsight, a software vendor, resulted in the theft of certain Salesforce customer data. Attackers exploited compromised Gainsight credentials to gain unauthorized access to customer information via third-party OAuth apps. Salesforce responded quickly by revoking refresh tokens linked to impacted Gainsight-published integrations and advised customers to take precautionary steps, including reviewing and rotating their credentials. While the breach did not affect Salesforce’s internal systems, it highlighted the significant risk posed by interconnected software supply chains and third-party integrations. This incident underscores the increasing sophistication of supply chain attacks targeting cloud platforms and SaaS providers. As businesses rely more heavily on integrated services and external vendors, attackers are exploiting trust relationships to bypass traditional security controls, emphasizing the urgent need for robust third-party risk management and continuous monitoring.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports