✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
New 2025 Guidance: Securing Microsoft Exchange Servers from Infrastructure Vulnerabilities
In October 2025, cybersecurity authorities including CISA and the NSA released urgent best practices following persistent threats targeting on-premises Microsoft Exchange servers. Despite patch releases and increased awareness, many organizations continued running outdated or misconfigured Exchange environments, leaving them vulnerable to exploitation. Attackers leveraged these weaknesses to gain unauthorized access, often leading to lateral movement, data exfiltration, and in some cases, ransomware incidents. The culmination of such ongoing attacks prompted renewed guidance emphasizing strong authentication, rigorous encryption, and decommissioning of unsupported hybrid Exchange servers to minimize operational risk. This incident underscores the ongoing trend of adversaries exploiting infrastructure vulnerabilities, especially in legacy and hybrid setups. With continued attacker innovation and regulatory scrutiny, organizations must adopt zero trust principles, prioritize patch cycles, and upgrade legacy systems to mitigate evolving threats.
6 months ago
Kill Chain
CISA Highlights Active Exploitation of XWiki & VMware Vulnerabilities in 2025 KEV Catalog Update
In October 2025, CISA added two actively exploited vulnerabilities—CVE-2025-24893 in XWiki Platform (Eval Injection) and CVE-2025-41244 in Broadcom VMware Aria Operations and VMware Tools (Privilege Defined with Unsafe Actions)—to its Known Exploited Vulnerabilities (KEV) Catalog. These flaws enable remote attackers to inject malicious code or escalate privileges, presenting substantial risks for the federal enterprise and beyond. The inclusion in the KEV Catalog signals confirmed in-the-wild exploitation and compels agencies to expedite remediation measures under Binding Operational Directive 22-01 to protect critical federal infrastructure networks. This incident underscores the persistent trend of attackers rapidly leveraging new or previously overlooked vulnerabilities with real-world consequences. As the speed of exploitation shortens and attack surfaces broaden, timely vulnerability management, zero trust practices, and proactive monitoring remain vital to reducing enterprise cyber risk.
6 months ago
Kill Chain
PhantomRaven’s Malicious npm Packages: 2024 Supply-Chain Risk with Invisible Dependencies
In early 2024, the "PhantomRaven" campaign targeted the open-source software ecosystem by distributing 126 malicious npm packages containing concealed, 'invisible' dependencies. These packages, published over several months, bypassed detection mechanisms and were downloaded over 86,000 times by unsuspecting developers. Threat actors leveraged these supply chain attacks to potentially exfiltrate sensitive data, propagate malware, or serve as initial entry points for deeper compromises in downstream applications and organizations dependent on these packages. The campaign highlighted significant vulnerabilities in supply-chain security and the risks associated with open-source package management. This incident is part of a rising trend of sophisticated supply-chain attacks leveraging trusted developer tools and repositories. With increasing regulatory scrutiny and mounting pressure to harden software dependencies, organizations must assess their exposure and implement robust controls to thwart similar attacks in the future.
6 months ago
Kill Chain
L3Harris Insider Breach: Zero-Day Exploits Sold to Russian Broker in 2024
In 2024, a former executive at defense contractor L3Harris, Peter Williams, pleaded guilty to stealing and selling eight zero-day cyber exploits to a Russian broker linked to Operation Zero. Williams exploited privileged access at Trenchant, an L3Harris subsidiary, to covertly extract software developed for the U.S. government. He sold these sensitive trade secrets between 2022 and 2024 for several million dollars in cryptocurrency, hiding the transactions through encrypted communications. The sale of these advanced cyber capabilities to an entity catering to Russian state clients exposed L3Harris to estimated damages of $35 million and raised concerns about offensive tools in adversarial hands. This case highlights the increasing risks posed by insider threats exploiting specialized knowledge in the cyber-arms marketplace. Recent trends show threat actors—often with national ties—actively pursuing zero-day exploits via brokers, making supply chain trust and internal controls critical concerns for organizations managing sensitive cyber assets.
6 months ago
Kill Chain
PhantomRaven Floods npm with Malicious Credential-Stealing Packages
In April 2024, the 'PhantomRaven' threat campaign targeted the JavaScript software ecosystem by flooding the npm package repository with dozens of malicious packages. These packages, aimed at developers and CI/CD environments, were crafted to harvest authentication tokens, CI/CD secrets, and GitHub credentials when installed. Attackers employed typosquatting and deceptive package naming techniques to trick developers into integrating the compromised code into their applications, thereby enabling broad access to source code and sensitive internal systems. The attack underscores the growing risk posed by software supply chain compromises, impacting thousands of potential downstream applications and organizations. This incident highlights an ongoing surge in supply chain attacks leveraging public code repositories, targeting both individual developers and enterprise development pipelines. Attackers are increasingly employing credential harvesting via trusted open-source channels, intensifying regulatory scrutiny and driving immediate needs for enhanced software integrity controls and threat detection across development workflows.
6 months ago
Kill Chain
Microsoft 2024 DNS Outage Paralyzes Azure & Microsoft 365 Globally
On June 20, 2024, Microsoft experienced a global DNS outage that disrupted access to Azure and Microsoft 365 services for customers worldwide. The outage was triggered by an internal DNS configuration issue that affected service resolution and authentication to corporate networks. Users reported being unable to access several core Microsoft services, including email, cloud storage, and collaboration tools. Microsoft’s engineering teams identified the root cause and began remediation, but the incident resulted in widespread operational downtime lasting several hours and affected businesses dependent on Microsoft’s cloud infrastructure. This incident highlights the increasing business impact of cloud infrastructure dependencies and emphasizes the importance of resilient and redundant DNS architectures. Service disruptions of this magnitude reinforce regulatory and customer scrutiny regarding cloud service reliability and prompt renewed attention to business continuity, availability controls, and third-party risk management.
6 months ago
Kill Chain
Malicious npm Package Attack Exposes Software Supply Chain Risks in 2024
In June 2024, security researchers identified a supply chain attack involving at least ten malicious npm packages uploaded to the public registry. Masquerading as legitimate software components, these packages were designed to infect developer environments across Windows, Linux, and macOS. Once installed, they downloaded and executed an information-stealing payload capable of harvesting sensitive data such as credentials and environment variables, potentially enabling lateral movement or further breaches within affected organizations. The attack leveraged trusted software distribution channels to bypass traditional defenses and amplify impact among open-source users. This incident underlines escalating risks in the software supply chain, highlighting how open-source package ecosystems have become prime targets for attackers. The trend represents a growing challenge for organizations relying on third-party code, driving new urgency around vetting procedures, continuous monitoring, and enforcing granular security controls in developer pipelines.
6 months ago
Kill Chain
WordPress Plugin Flaw Exposes Sensitive Data to Subscribers in 2024
In June 2024, a critical vulnerability was disclosed in the widely used WordPress 'Anti-Malware Security and Brute-Force Firewall' plugin, which is active on over 100,000 websites. The flaw enables authenticated subscriber-level users to exploit improperly validated file access mechanisms, granting them read access to arbitrary files stored on the web server. This could allow the exposure of sensitive configuration files, credentials, or proprietary business data, significantly undermining site security and user privacy. Plugin maintainers were alerted, and a patched version was released to mitigate the issue. This incident emphasizes the risks posed by third-party plugin vulnerabilities within content management platforms, which remain a persistent attack vector as organizations contend with rapid plugin adoption and reliance on open-source tools.
6 months ago
Kill Chain
10 Malicious npm Packages Expose Global Supply Chain Risks in 2025 Credential Stealer Attack
In October 2025, security researchers uncovered a coordinated supply chain attack targeting the npm ecosystem. Ten malicious npm packages, collectively downloaded over 5,000 times, were found to contain sophisticated multi-platform information stealers. These packages, distributed via the npm registry and impersonating legitimate developer tools, leveraged obfuscated code to deploy a payload capable of extracting sensitive credentials and environment data from Windows, macOS, and Linux developer workstations. The malware used deceptive tactics like a fake CAPTCHA screen and fingerprinted victims prior to exfiltrating stolen data to attacker-controlled infrastructure. This incident underscores the growing trend of software supply chain attacks, as developer tool ecosystems like npm remain high-value targets for both financially motivated cybercriminals and state-sponsored groups. The event has fueled concerns about package registry hygiene, developer workstation security, and the need for stronger zero trust and anomaly detection controls across the software development lifecycle.
6 months ago
Kill Chain
Identity Chaos: 2026 Breach Highlights Risks of Ghost Accounts & AI Agents
In mid-2026, a coordinated cyberattack leveraged unmanaged 'ghost' identities and dormant privileged accounts in a multinational enterprise's cloud environment. Advanced threat actors combined long-standing identity debt from old breaches with modern, AI-powered autonomous agents to hijack internal east-west traffic and exfiltrate sensitive data using encrypted channels. The attackers discreetly escalated privileges through unused accounts, bypassed segmentation controls, and evaded legacy monitoring through encrypted, high-speed service-to-service traffic. This led to a multi-week data theft and operational disruption across cloud, on-premises, and hybrid infrastructure, impacting customer trust and critical regulatory compliance. This incident highlights the urgent need for advanced identity governance and zero trust segmentation as adversaries exploit both inherited identity risks and cutting-edge automation. With ransomware and shadow AI toolchains on the rise, organizations face increasing regulatory scrutiny and evolving attack surfaces that obsolete traditional perimeter-based defenses.
6 months ago
Kill Chain
Cloaking Attack Against AI Crawlers Uncovers New Context Poisoning Risks
In October 2025, cybersecurity researchers uncovered a sophisticated cloaking attack that targets AI-driven web crawlers used by popular agentic browsers such as OpenAI ChatGPT Atlas and Perplexity. Threat actors deployed malicious websites capable of serving misleading or false content only to AIbots, while displaying legitimate information to typical users. This context poisoning technique allows harmful actors to manipulate AI models at scale, tricking them into citing fabricated facts as verified information, and undermines AI trustworthiness with widespread downstream effects on automated decision-making and knowledge dissemination. This incident highlights the mounting risks from adversarial attacks targeting AI supply chains. As AI systems increasingly rely on real-time internet data, attackers are innovating new manipulation tactics to poison context and subvert trust. The surge in such TTPs coincides with tighter regulations and industry push towards Responsible AI frameworks.
6 months ago
Kill Chain
Automated Botnet Attacks Surge Against PHP Servers and IoT Devices in 2025
In October 2025, cybersecurity experts reported a significant escalation in automated botnet attacks against PHP servers and IoT devices. Threat actors behind botnets like Mirai, Gafgyt, and Mozi orchestrated large-scale campaigns by exploiting known CVEs and exploiting misconfigured cloud and edge systems. The attacks enabled adversaries to gain unauthorized entry, rapidly compromise vulnerable assets, and expand their botnet infrastructure for malicious activities such as DDoS, credential theft, and lateral movement across network environments. Organizations with exposed PHP servers or poorly secured IoT endpoints experienced elevated risks of disruption and reputational impact. This surge in automated exploitation highlights the persistent evolution of botnet tactics targeting unpatched, internet-facing workloads. As attackers automate vulnerability scanning and weaponize scalable malware, the need for proactive threat detection, segmentation, and rapid response has never been more critical for organizations in all sectors.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports