✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
CISA Flags Active Exploitation of 2025 Gladinet CentreStack, Triofox, and CWP Control Web Panel Flaws
In November 2025, the Cybersecurity and Infrastructure Security Agency (CISA) identified and announced active exploitation of two critical vulnerabilities: CVE-2025-11371 in Gladinet CentreStack and Triofox (files or directories exposed to external parties), and CVE-2025-48703 in CWP Control Web Panel (an OS command injection flaw). Threat actors are leveraging these weaknesses to gain unauthorized file access or execute malicious code within affected environments, targeting organizations across sectors. The vulnerabilities enable lateral movement, data exfiltration, and potentially full compromise, with significant risk to sensitive data, business operations, and regulatory posture for organizations running vulnerable systems. This announcement underscores a broader trend of attackers exploiting unpatched software vulnerabilities in common enterprise tools. With automatic exploitation kits and a growing focus on file-sharing and web panel infrastructure, organizations face urgent pressure to accelerate vulnerability management and adopt Zero Trust practices to contain and monitor internal threats.
6 months ago
Kill Chain
SesameOp: AI API Abused as C2 in Advanced Malware Attack (2024)
In early 2024, cybersecurity researchers uncovered a sophisticated malware campaign involving the "SesameOp" backdoor, which leveraged OpenAI's API as a covert Command and Control (C2) channel. Threat actors behind this attack established persistence within targeted organizations using a custom Linux backdoor, routing communications through encrypted API calls to OpenAI infrastructure, thus evading traditional detection methods. The malware's use of legitimate AI service channels enabled threat actors to obfuscate malicious activity, complicating incident response and extending dwell time inside compromised environments. The incident underscored the rapid innovation of attacker tactics and the challenges enterprises face as generative AI ecosystems become embedded in critical workflows. This breach exemplifies a wider, emerging risk: attackers abusing popular cloud-based and AI-driven services for lateral movement, data exfiltration, and stealthy C2 operations. With AI adoption accelerating across industries, security teams must urgently reassess control frameworks, enhance anomaly detection, and enforce visibility on legitimate platforms often overlooked in legacy monitoring.
6 months ago
Kill Chain
Android BankBot-YNRK: 2024 Indonesian Mobile Wallets Targeted by Muting Malware
In 2024, a variant of the Android/BankBot malware known as YNRK targeted mobile users in Indonesia by disguising itself as legitimate applications, often distributed via third-party app stores or phishing campaigns. Once installed, the malware muted system alerts and abused accessibility services to perform unauthorized actions, including theft of credentials and the draining of cryptocurrency and mobile banking wallets. The attack leveraged overlays to capture user inputs and bypassed security mechanisms, resulting in significant financial losses for affected users, with widespread impacts across consumer mobile banking apps in the country. This incident highlights the ongoing evolution and sophistication of mobile banking malware, which increasingly targets emerging markets and exploits weak security controls on non-official app stores. The rapid adoption of mobile wallets and cryptocurrency platforms has made these attacks more lucrative and frequent, intensifying the need for proactive mobile security, user awareness, and regulatory oversight.
6 months ago
Kill Chain
Apple Patches 110 Vulnerabilities in Massive 2024 Security Update
In early November 2024, Apple released urgently needed security updates for its operating systems, patching 110 vulnerabilities across iOS, macOS, iPadOS, watchOS, tvOS, visionOS, Safari, and Xcode. Key vulnerabilities included memory corruption flaws in ImageIO and WebKit, with previous instances of such bugs leading to remote code execution. Several vulnerabilities could allow unauthorized access to sensitive user data or privilege escalation, and most major Apple product families were impacted. No active exploitation was reported, but these vulnerabilities posed significant risks, especially if exploited in the wild. This incident underscores the importance of timely patching for organizations leveraging Apple hardware, amid escalating regulatory expectations and sophisticated exploit development targeting zero-day vulnerabilities. With Apple devices often pivotal in hybrid and remote work environments, large-scale multi-platform vulnerabilities present an attack surface of interest to both cybercriminals and nation-state actors.
6 months ago
Kill Chain
SnakeStealer: 2024's Most Prolific Infostealer and Its Impact on Data Security
In early 2024, cybersecurity researchers identified a widespread surge in SnakeStealer malware infections targeting individuals and organizations across multiple sectors. This sophisticated infostealer penetrates devices through malicious attachments and compromised software, rapidly harvesting valuable personal and corporate information including browser credentials, cryptocurrency wallets, and sensitive documents. Once data is collected, it is exfiltrated to attacker-controlled servers, fueling cybercrime operations and secondary attacks. The rapid spread and effectiveness of SnakeStealer has led to significant business and operational risks, such as unauthorized access, data breaches, and identity theft. This incident highlights the escalating threat posed by modern infostealers, which continue to evolve their techniques to bypass security controls and evade detection. The sustained activity of SnakeStealer, coupled with copycat variants, underscores a trend of increasingly sophisticated, financially motivated cybercrime targeting both enterprise and individual data at scale.
6 months ago
Kill Chain
North Korean Operatives Pose as IT Job Seekers to Infiltrate Western Companies
In 2023, multiple Western technology firms fell victim to a sophisticated insider threat campaign involving North Korean operatives posing as freelance IT job seekers. These actors used false identities and forged CVs to secure remote employment and gain access to sensitive corporate environments. Once inside, they leveraged their positions to siphon proprietary information, commit financial fraud, and, in some cases, facilitate broader cyber-espionage activities by collecting credentials and mapping internal systems. The impact spanned financial loss, reputation damage, and increased exposure to supply chain attacks. This incident highlights the growing trend of well-resourced nation-state actors exploiting remote work arrangements and third-party talent networks. As companies aggressively scale digital transformation and outsourcing, vigilance against social engineering and identity fraud is critical to mitigate the risk of covert infiltration and regulatory non-compliance.
6 months ago
Kill Chain
Pixel KASLR Bypass: Linear Map Non-Randomization Threatens Android Kernel Security
In November 2025, security researchers from Google Project Zero disclosed a significant design flaw in the Linux kernel’s implementation of Kernel Address Space Layout Randomization (KASLR) on modern Android devices, specifically Google Pixel phones. The weakness stems from the lack of randomization in both the linear kernel mapping and the physical memory loading address of the kernel itself. As a result, attackers with an arbitrary read/write primitive could derive static kernel virtual addresses, bypassing KASLR protections without leaks—thereby making exploitation significantly easier and increasing the risk of privilege escalation and persistence. This incident underscores a broader industry challenge where operating system mitigations lag behind evolving attacker techniques. The exposure of predictable kernel virtual addresses on widely deployed Android devices highlights the urgency for stronger kernel randomization and renewed attention to memory safety for mobile platforms.
6 months ago
Kill Chain
How OAuth Device Code Phishing Targets Azure and Google: What CISOs Need to Know in 2024
In 2024, new phishing campaigns emerged that weaponize the OAuth Device Code flow against major cloud platforms, notably Azure and Google. Attackers send users to authentic device code portals, tricking them into entering codes controlled by adversaries. Once codes are entered, threat actors receive valid OAuth tokens granting extensive access to cloud services, often bypassing multi-factor authentication. Researchers noted that Azure’s device flow presented a larger attack surface than Google’s, making it a high-value target for phishing and account compromise. The result is unauthorized access to sensitive email, data, and other cloud resources, with potential for lateral movement and persistent compromise. This breach showcases a rapidly escalating attack vector exploiting weaknesses in cloud identity flows. The rise in device code phishing reflects a broader shift by threat actors toward abusing legitimate authentication processes, especially as organizations depend more heavily on cloud services and OAuth-based SSO.
6 months ago
Kill Chain
Microsoft's WSUS Security Patch Disrupts Windows Server 2025 Hotpatching
In June 2024, Microsoft released an out-of-band (OOB) security update to address an actively exploited vulnerability within Windows Server Update Services (WSUS). While the patch mitigates a critical security risk, it has inadvertently broken hotpatching functionality on certain Windows Server 2025 systems. Hotpatching allows for critical updates without rebooting servers, so this unintended consequence impacts business continuity and planned maintenance windows, affecting organizations relying on continuous operation. This incident highlights the ongoing challenges of patch management, especially when rapid updates for zero-day vulnerabilities disrupt core services. As threat actors increasingly target software supply chains and patch-delivery mechanisms, IT teams face growing pressure to balance security and operational stability.
6 months ago
Kill Chain
Microsoft 2024: SesameOp Backdoor Hides in OpenAI Assistants API Traffic
In early 2024, Microsoft researchers identified a sophisticated cyberattack campaign leveraging the new SesameOp backdoor malware. This threat exploits the OpenAI Assistants API as a covert command-and-control (C2) channel, enabling attackers to execute commands, exfiltrate data, and maintain persistence within compromised environments while masquerading as legitimate AI-driven traffic. The campaign targets organizations by bypassing traditional detection methods, using this unique abuse of generative AI services to hide communications and evade security controls. The operational impact is significant, posing increased risk for data loss, lateral movement, and regulatory exposure due to the highly obfuscated methodology. This incident underscores a rapid evolution in attacker tradecraft, with adversaries now weaponizing mainstream AI APIs for malicious infrastructure. As organizations accelerate adoption of AI technologies, this event highlights the urgency to address emerging risks of shadow AI and sophisticated backdoors, making robust east-west traffic inspection and AI-risk governance more important than ever.
6 months ago
Kill Chain
Insiders Indicted: BlackCat Ransomware Attacks Orchestrated by US Cybersecurity Experts (2023)
Between May and November 2023, three former employees of DigitalMint and Sygnia—both incident response firms—were indicted following allegations that they leveraged insider knowledge to facilitate BlackCat (ALPHV) ransomware attacks on five U.S. companies. These individuals reportedly gained unauthorized access to sensitive networks, deployed BlackCat ransomware, and demanded significant payouts, resulting in operational disruptions, data encryption, and potential data exposure for affected organizations. The attackers’ technical expertise made detection difficult, and their actions exploited gaps in internal network security, east-west monitoring, and threat detection protocols. This incident highlights the evolving threat posed by malicious insiders and the intersection of human risk with sophisticated ransomware-as-a-service operations. The case underscores the urgency for organizations to enhance identity-based segmentation, rigorous monitoring of internal activity, and to adapt cybersecurity policies to counter both external and internal threats.
6 months ago
Kill Chain
Balancer DeFi Protocol Hit by $128M Crypto Heist: How the 2023 Breach Happened
In August 2023, the Balancer DeFi protocol suffered a sophisticated cyberattack when unidentified hackers exploited vulnerabilities in its v2 pools’ smart contract logic. By manipulating pool configurations and utilizing flash loans, attackers drained over $128 million worth of cryptocurrency assets. Balancer immediately paused affected pools, notified users, and worked to contain losses. The exploit drew industry-wide concern due to the depth and speed of the attack, which bypassed several security checks and resulted in substantial losses for protocol users and liquidity providers. This incident underscores the growing security challenges facing decentralized finance platforms, as attackers increasingly target smart contracts and protocol logic. The Balancer breach highlights the need for advanced anomaly detection, smart contract auditing, and zero trust security controls in Web3 environments as DeFi adoption accelerates.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports