✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Salesforce 2024 Breach: Gainsight Supply Chain Compromise Exposes Customer Data
In June 2024, Salesforce launched an investigation after a supply chain breach at Gainsight, a software vendor, resulted in the theft of certain Salesforce customer data. Attackers exploited compromised Gainsight credentials to gain unauthorized access to customer information via third-party OAuth apps. Salesforce responded quickly by revoking refresh tokens linked to impacted Gainsight-published integrations and advised customers to take precautionary steps, including reviewing and rotating their credentials. While the breach did not affect Salesforce’s internal systems, it highlighted the significant risk posed by interconnected software supply chains and third-party integrations. This incident underscores the increasing sophistication of supply chain attacks targeting cloud platforms and SaaS providers. As businesses rely more heavily on integrated services and external vendors, attackers are exploiting trust relationships to bypass traditional security controls, emphasizing the urgent need for robust third-party risk management and continuous monitoring.
6 months ago
Kill Chain
GlobalProtect VPN Portals Probed by 2.3 Million Malicious Scan Sessions
Beginning on November 14, 2025, cybersecurity researchers detected an unprecedented surge in malicious scanning activity targeting Palo Alto Networks GlobalProtect VPN portals worldwide. Over 2.3 million scan sessions were recorded within days, emanating from a diverse array of global IP addresses and employing automated tools to probe for vulnerabilities and gather intelligence on remote-access infrastructure. While no large-scale exploitations or breaches have yet been confirmed, the scanning phase indicates advanced reconnaissance tactics that precede exploitation, raising significant concern for organizations relying on GlobalProtect for secure remote access. This event highlights a sharp escalation in mass automated reconnaissance against widely deployed VPN systems, following recent critical vulnerabilities in VPN technologies and a growing attacker focus on initial access vectors. The trend reinforces the urgency for improved monitoring, swift patching, and modern segmentation controls in remote-access environments.
6 months ago
Kill Chain
Google Uncovers BadAudio Malware in Chinese APT24 Espionage Campaign
In early 2024, Google’s Threat Analysis Group uncovered a sophisticated, years-long cyber espionage campaign orchestrated by the China-linked APT24 threat group. The attackers leveraged a newly discovered malware dubbed BadAudio to infiltrate government agencies, research institutions, and select private organizations. Initial access was obtained via spear-phishing campaigns, progressing to persistent lateral movement within compromised environments. BadAudio’s deployment enabled covert data exfiltration over encrypted channels, evading standard security controls and providing unmatched visibility and persistence for the attackers. The incident highlights the advanced tradecraft and evolving toolsets in use by nation-state threat actors, with business impacts centered on the loss of sensitive data and the undermining of critical organizational trust. The exposure of BadAudio signals a notable escalation in cyber espionage tactics, utilizing bespoke malware and encrypted traffic to circumvent modern defenses. Organizations across sectors are at risk as threat groups adopt similar methods, prompting increased scrutiny from regulators and heightened awareness around securing east-west traffic and anomaly detection.
6 months ago
Kill Chain
TamperedChef Malware: Fake Software Installers Fuel a Global Attack Wave
In late 2025, a widespread malvertising campaign dubbed 'TamperedChef' was uncovered by Acronis Threat Research Unit. Threat actors distributed fake installers of popular software through fraudulent ads and compromised websites to trick users into deploying malicious payloads. Once installed, the malware established persistence, deployed JavaScript-based remote access tools, and enabled lateral movement within enterprise and individual networks. The campaign demonstrated sophisticated social engineering tactics and leveraged encrypted command-and-control channels to evade traditional detection mechanisms, resulting in compromise of endpoints across multiple countries. This incident highlights a surge in supply chain and software installer threats, with attackers exploiting user trust and sophisticated malvertising techniques. As ransomware groups and financially motivated actors increasingly target software distribution vectors, organizations face mounting regulatory scrutiny and operational risk without multilayered defenses and advanced endpoint monitoring.
6 months ago
Kill Chain
Tsundere Botnet: How Blockchain-Powered Node.js Malware Threatened Global Supply Chains in 2025
In mid-2025, the Tsundere botnet, attributed to a Russian-speaking threat actor known as "koneko," emerged as a new and flexible malware campaign. It primarily targeted Windows users by disguising itself as installers for popular games or using Remote Monitoring and Management (RMM) tools to deliver its payload. The malware leveraged MSI and PowerShell-based installers to deploy malicious Node.js scripts, establishing persistence and communicating with its command-and-control (C2) infrastructure by dynamically retrieving C2 addresses from Ethereum blockchain smart contracts. This adaptive technique, along with a marketplace-enabled control panel, facilitated operational resilience and monetization among cybercriminals. This incident is significant due to the combination of modern supply chain manipulation, blockchain-based C2 address obfuscation, and pay-per-build business models. Tsundere highlights a trend toward malware leveraging decentralized platforms for better survivability against take-downs and rapid evolution, posing ongoing challenges for traditional defenses and compliance frameworks.
6 months ago
Kill Chain
Sturnus: New Android Trojan Hijacks Devices & Captures Encrypted Chats
In late 2025, cybersecurity researchers discovered a sophisticated Android banking trojan dubbed Sturnus, which enables credential theft and full device takeover for financial fraud. Sturnus stands out by bypassing encrypted messaging protections, capturing decrypted content directly from the device screen to monitor sensitive apps and intercept confidential chats. Threat actors leveraged phishing campaigns and malicious app distribution to compromise victims, ultimately gaining unauthorized access to financial information and conducting unauthorized transactions. The attack demonstrates the growing ingenuity of malware targeting mobile banking and highlights the challenges of relying solely on network-level encryption. This incident is especially timely due to the rapid evolution of mobile banking threats and attackers' increasing focus on defeating application-layer defenses. Sturnus's capability to monitor encrypted communications at the device level sets a worrying new precedent in malware TTPs, urging organizations to reassess endpoint and messaging security controls.
6 months ago
Kill Chain
Global WhatsApp Hack: CTM360 Exposes HackOnChat Social Engineering Campaign
In late 2025, cybersecurity firm CTM360 revealed 'HackOnChat,' a sophisticated, large-scale social engineering campaign targeting WhatsApp users globally. Threat actors orchestrated the attack via fake authentication portals and impersonation webpages, tricking victims into divulging credentials that enabled account hijacking. The operation weaponized WhatsApp's familiar interface, leveraging psychological manipulation and deception, and resulted in thousands of compromised accounts and malicious URLs. Disruption of user communications and risk of further abuse (such as account-based impersonation or fraud) were observed. This breach underscores the accelerating use of social engineering tactics in messaging platforms, reflecting a surge in identity-based attacks that exploit user trust in familiar interfaces. Security teams are increasingly alert to evolving credential-phishing methods that bypass traditional controls, especially as regulatory scrutiny of digital identity security intensifies.
6 months ago
Kill Chain
ThreatsDay 2025: Multi-Vector Attacks Redefine the Global Breach Landscape
In November 2025, a coordinated wave of multi-vector cyberattacks swept across organizations worldwide, leveraging zero-day exploits, LinkedIn spear-phishing, cryptocurrency theft, and vulnerabilities in IoT devices. Attackers exploited both east-west and egress traffic to evade detection, compromise sensitive data in transit, and establish persistent remote access. Prominent threat groups utilized unencrypted and encrypted traffic, weaponized browser extensions, and abused legitimate remote monitoring tools like AnyDesk. The result was disruption to business operations, regulatory investigations, and an uptick in ransomware and crypto-related financial crimes traced to state-sponsored and criminal actors. This incident underscores the escalating risk posed by attackers who blend diverse TTPs across cloud, hybrid, and enterprise networks. The convergence of espionage motives, cybercrime, and advanced ransomware strains highlights the need for real-time visibility, layered segmentation, and updated anomaly detection strategies.
6 months ago
Kill Chain
ShadowRay 2.0 Turns Ray AI Framework Flaw into GPU-Powered Cryptomining Botnet
In November 2025, the 'ShadowRay 2.0' campaign was uncovered actively exploiting an unpatched, two-year-old vulnerability in the Ray open-source AI framework. Threat actors leveraged this flaw to compromise cloud-hosted and on-premises Ray clusters equipped with NVIDIA GPUs, deploying a self-spreading botnet targeting large-scale cryptomining. The attackers automated lateral movement within cloud environments and data centers, rapidly enrolling new nodes into the botnet, and using high-performance GPUs for illicit cryptocurrency mining, resulting in significant resource abuse, potential data exposure, and increased operational costs for targets. ShadowRay 2.0 highlights the rising trend of adversaries abusing vulnerable AI/ML infrastructure for financially motivated campaigns. The incident underlines the security risks facing organizations using open-source workloads, as attackers increasingly automate botnet propagation, and reinforces the urgency of addressing software supply chain and east-west traffic security gaps.
6 months ago
Kill Chain
JustAskJacky 2025: AI/ML Exploitation Drives Major User Data Exposure
In November 2025, the AI-driven platform JustAskJacky was compromised, exposing sensitive user prompts and data after adversaries exploited weaknesses in encrypted traffic controls and inadequate egress security. Attackers orchestrated lateral movements across internal AI/ML workloads, leveraging insufficient segmentation and lack of effective visibility to siphon proprietary inputs and outputs through encrypted but poorly-monitored channels. The breach remained undetected for weeks, putting affected businesses and consumers at risk of prompt leakage, IP loss, and possible regulatory infractions in industries reliant on AI automation. This incident underscores a surge in sophisticated AI/ML exploitation techniques and highlights systemic gaps in east-west traffic security, zero trust segmentation, and anomaly detection across multicloud and hybrid environments. As organizations accelerate their adoption of AI-powered platforms, the need for robust compliance and zero trust frameworks has reached critical urgency.
6 months ago
Kill Chain
Tsundere Botnet: How Blockchain-Powered C2 Supercharged Windows-Based Attacks in 2025
In mid-2025, researchers identified a rapidly expanding botnet dubbed "Tsundere" specifically targeting Windows users. This malware, active since at least June 2025, leverages game-themed lures to infect systems, enabling attackers to execute arbitrary JavaScript code via a sophisticated command-and-control (C2) infrastructure built on the Ethereum blockchain for resilient communications. Tsundere’s propagation tactics remain opaque, but evidence indicates an advanced, multi-functional platform designed to maintain persistence, evade detection, and potentially facilitate lateral movement within victim networks. The business impact includes increased exposure to data theft, possible ransomware deployment, and widespread compromise of user endpoints. The Tsundere botnet exemplifies the rising trend of attackers exploiting blockchain technology for C2 communications, making conventional takedown efforts far more difficult. This incident underscores the urgency for organizations to enhance east-west threat visibility, strengthen endpoint defenses, and adopt zero-trust policies as botnets grow more evasive and robust.
6 months ago
Kill Chain
Matrix Push: How Browser Notifications Became a C2 Weapon in 2024
In early 2024, cybersecurity researchers reported that a threat actor group leveraged a new Command and Control tool—dubbed 'Matrix Push'—to hijack web browser notifications as an innovative phishing and persistence mechanism. Attackers delivered malicious payloads through deceptive websites, tricking users into allowing browser notifications. These notifications were abused to send phishing lures and exfiltrate user information, evading traditional network monitoring tools by using trusted browser channels. The campaign allowed remote control and persistent access to compromised endpoints, highlighting a shift toward social engineering at the browser level. Organizations targeted included enterprises in technology, finance, and professional services sectors, resulting in elevated risks of credential theft and lateral movement. This incident is especially notable for exploiting a trusted browser feature in new ways, bypassing established email and endpoint filtering controls. As browser notification-based attacks surge, security teams face increased pressure to adapt controls. The tactics highlight the urgent need for enhanced user awareness and modern segmentation/visibility solutions that can identify and mitigate covert browser-based C2 channels.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports