✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
China-Nexus Threat Actors Weaponize 'Nezha' RAT for Stealthy Campaigns in 2024
In early 2024, cybersecurity researchers uncovered a new campaign by China-nexus threat actors leveraging the open source "Nezha" remote access tool (RAT) to facilitate covert network access and persistence. Unlike traditional RMM (Remote Monitoring and Management) abuse, the adversaries deployed Nezha across multiple victim environments to enable encrypted traffic tunneling, conduct command-and-control operations, and bypass security controls. Targeting enterprises in various sectors, the attackers exploited weak access controls and east-west network traffic to establish lateral movement pathways, with the operation resulting in significant risks to sensitive data and business continuity. This incident highlights an accelerating trend in the use of open source, commodity tools by nation-state-aligned actors to evade detection and complicate attribution. The campaign reflects shifting threat dynamics, as attackers weaponize cloud-native techniques and legitimate tools to target organizations seeking to modernize security controls and comply with frameworks such as NIST and PCI DSS.
6 months ago
Kill Chain
LockBit, Qilin & DragonForce Forge Ransomware Cartel in 2024
In early 2024, notorious ransomware groups LockBit, Qilin, and DragonForce announced a strategic partnership, effectively forming a collaborative ransomware 'cartel.' This alliance has seen these gangs pooling resources, intelligence, and attack methods, shortly after the release of LockBit 5.0. By inviting other e-crime affiliates, they have expanded their operational reach and attack surface across multiple industries. The cartel model increases both the speed and sophistication of attacks, complicating defenders' response and extending the lifecycle of compromised environments for criminal profit. The incident is particularly relevant as it signals a new phase in ransomware operations, with threat actors adopting formal, syndicate-like coordination. It highlights escalating risks for enterprises, as collective intelligence sharing among attackers can quickly disrupt even mature security postures.
6 months ago
Kill Chain
Vampire Bot: Infostealer Malware Drains Job Hunters in BatShadow’s 2024 Campaign
In early June 2024, security researchers uncovered a widespread infostealer campaign targeting global job seekers through malicious job postings across popular employment platforms. The attack, orchestrated by the Vietnamese cybercriminal group BatShadow, involved the sophisticated Vampire Bot malware, which was delivered via phishing emails and deceptive job application portals. Once installed, Vampire Bot silently harvested sensitive personal data, login credentials, and browser-stored financial information, enabling unauthorized access to victims' accounts. Numerous job seekers reported financial losses and identity theft, highlighting the campaign's destructive business and personal impacts. This incident underscores a growing trend of cybercriminal groups exploiting economic anxieties and job market vulnerabilities to launch tailored infostealer attacks. The operation signals a broader shift towards targeted social engineering and the increasing professionalization of threat actors in Southeast Asia.
6 months ago
Kill Chain
Chaos Ransomware's C++ Upgrade: The 2024 Threat Every Enterprise Must Face
In early 2024, the Chaos Ransomware-as-a-Service operation unleashed a potent new C++ variant, featuring advanced encryption, wiper functionalities, and cryptocurrency-stealing modules. This evolution targets a broad array of victims by leveraging aggressive lateral movement across networks, rapid data encryption, and selective data destruction to intensify pressure on organizations. The threat actors deploy sophisticated evasion tactics and can pivot across cloud and hybrid infrastructures, resulting in operational disruptions and financial losses, especially in environments lacking east-west traffic controls and advanced detection capabilities. The Chaos ransomware upgrade exemplifies a broader trend of rapidly advancing ransomware toolkits integrating destructive and extortion-focused modules. With a spike in cross-industry ransomware incidents and escalating regulatory pressure to remediate compliance gaps, organizations must urgently reevaluate defenses, with emphasis on segmentation, visibility, and high-speed encrypted traffic controls.
6 months ago
Kill Chain
SonicWall 2024: Every Cloud Firewall Backup Breached in Major Supply Chain Attack
In June 2024, SonicWall confirmed that the previously disclosed breach of its cloud backup service was far more extensive than initially announced. The attack resulted in unauthorized access to firewall configuration backups for 100% of customers using SonicWall's cloud backup platform, rather than the 5% originally estimated. The compromise exposed sensitive customer network data, including credentials and VPN configurations, after attackers exploited vulnerabilities in SonicWall’s systems. This breach underscores significant supply chain risks, as attackers targeted third-party-managed infrastructure to circumvent perimeter defenses. This incident highlights the rising threat of supply chain attacks targeting security vendors themselves, which can expose downstream customer environments. With increasing regulatory scrutiny and heightened awareness of lateral movement risks across managed services, organizations must revisit both technical and vendor controls to ensure comprehensive zero trust segmentation and backup protection.
6 months ago
Kill Chain
GitHub Copilot CamoLeak: AI Attack Demonstrates Exfiltration Risk in 2024
In early 2024, cybersecurity researchers disclosed a proof-of-concept (PoC) called 'CamoLeak' demonstrating a novel attack vector exploiting GitHub Copilot’s AI code completion capability for data exfiltration. The PoC showed how sensitive code snippets and secrets could be extracted from Copilot instances by crafting malicious prompts that trick the AI into leaking previously seen proprietary content. While GitHub employs robust internal mitigations, the research exposes significant risks for organizations integrating generative AI tools into development workflows, particularly where prompt and response data may be inadequately secured. This incident underscores the rapid evolution of attack techniques targeting GenAI platforms and highlights emergent threats of data leakage through AI-driven automation. As enterprises increasingly leverage AI coding assistants, understanding and mitigating AI-enabled exfiltration vectors is key to upholding governance, compliance, and intellectual property security.
6 months ago
Kill Chain
Nation-State Ransomware: Storm-2603 Exploits Velociraptor in 2024 Attacks
In early 2024, the Storm-2603 threat group, attributed to Chinese nation-state actors, conducted a series of ransomware campaigns leveraging the legitimate Velociraptor digital forensics and incident response (DFIR) tool. By abusing Velociraptor, the attackers achieved persistent access, lateral movement, and stealthy data collection within targeted corporate environments. The group exploited weaknesses in east-west traffic security and endpoint controls, using legitimate tooling to evade detection and deploy ransomware payloads, leading to operational disruption and potential data exfiltration for multiple organizations. This incident highlights an escalation in adversaries’ use of legitimate IT and forensics tools for malicious purposes, complicating detection strategies. It exemplifies the growing threat of "living-off-the-land" tactics, where attackers blend in with standard operations, underscoring the need for improved anomaly detection, zero trust segmentation, and lateral movement controls.
6 months ago
Kill Chain
Feds Dismantle ShinyHunters' Salesforce Extortion Hub: Lessons for Cloud Security
In June 2024, U.S. federal authorities dismantled an extortion portal run by the notorious ShinyHunters group, which was used to threaten Salesforce victims after a reported compromise. ShinyHunters is known for data theft and double-extortion tactics, leveraging public leaks and ransom demands to extort organizations. Despite law enforcement takedown efforts, the group's threats remain active, targeting businesses that rely on Salesforce for their customer and operational data. The attack highlights risks surrounding third-party SaaS platforms and sophisticated cybercriminal techniques that exploit sensitive, cloud-based systems for extortion. This event underscores the accelerating landscape of data extortion and the persistent threat from established ransomware and data-leak actors. As organizations increasingly depend on SaaS providers, regulators and enterprises are intensifying focus on zero trust access, east-west traffic security, and layered controls to contain lateral movement and prevent sensitive data exposure.
6 months ago
Kill Chain
RondoDox Botnet Unleashes 'Exploit Shotgun' on Edge Devices
In early 2024, cybersecurity researchers uncovered the RondoDox Botnet, a rapidly evolving threat that leverages an 'exploit shotgun' methodology to compromise a wide range of consumer edge devices worldwide. The botnet scans for and exploits multiple zero-day and known vulnerabilities across routers and IoT devices, often gaining initial access through unpatched firmware or exposed management interfaces. Once inside, RondoDox deploys malware that enables remote control, data exfiltration, and lateral movement, allowing attackers to build a resilient, distributed botnet infrastructure which has been used for DDoS attacks and potentially other malicious activities. The decentralized campaign demonstrates sophisticated automation, making incident response and containment significantly more difficult for defenders. This incident is highly relevant as it highlights the surge in automated botnet attacks targeting unmanaged edge devices, a trend driven by increasing adoption of IoT and remote work infrastructure. The RondoDox tactics underscore the urgency for organizations to address lateral movement, patch management, and zero trust segmentation, especially as regulatory scrutiny on device and network security continues to intensify.
6 months ago
Kill Chain
Pixnapping Attack: How Android 2FA Was Bypassed in 2024
In early 2024, researchers discovered a novel mobile vulnerability known as the 'Pixnapping' attack, which targeted Android applications to circumvent two-factor authentication (2FA) mechanisms. The attack leverages cleverly crafted overlays to capture sensitive information directly from protected apps such as Gmail, Google Accounts, Google Authenticator, Google Maps, Signal, and Venmo. While there is no evidence of widespread exploitation, the proof-of-concept demonstrates that malicious apps with appropriate permissions could bypass Android security boundaries, enabling attackers to steal both credentials and 2FA tokens, thereby jeopardizing highly sensitive user data on compromised devices. This incident underscores the urgent need for stronger in-app security controls and constant vigilance regarding permission granularity on mobile platforms. As more threat actors focus on mobile endpoints and multi-factor authentication, organizations and users must adapt their defenses to counter increasingly sophisticated and evasive attack methods.
6 months ago
Kill Chain
Microsoft's October 2025 Zero-Day Storm: What the Massive Patch Update Means for Your Business
In October 2025, Microsoft released a massive Patch Tuesday security update addressing over 100 vulnerabilities across its product suite, including multiple actively exploited zero-days and several high-severity privilege escalation flaws. Threat actors leveraged some of these unpatched vulnerabilities to gain elevated access to enterprise and government systems, exploiting both on-premises and cloud workloads. The update also marked the final round of Windows 10 security patches, raising urgency for legacy system owners to upgrade in order to remain protected. The overall business impact included increased risk of lateral movement, data exfiltration, service disruptions, and heightened remediation costs for organizations slow to patch. This incident underscores an ongoing trend of attackers rapidly weaponizing newly disclosed vulnerabilities, as well as the growing threat facing organizations who rely on end-of-life software. The scale and speed of exploit adoption highlight the critical importance of vulnerability management and proactive patching as top security priorities.
6 months ago
Kill Chain
F5 BIG-IP Breach 2024: Nation-State Attackers Exploit Zero-Day Flaws
In June 2024, F5 Networks disclosed a significant security breach impacting its BIG-IP application delivery products. The incident involved a nation-state threat actor exploiting previously unknown (zero-day) vulnerabilities to gain unauthorized access to F5’s internal systems. Attackers reportedly obtained proprietary source code and, in some cases, limited customer information. Sophisticated post-exploitation techniques were used to move laterally and exfiltrate sensitive data, highlighting the attacker’s expertise and persistence. The breach raises concerns around the supply-chain risk for organizations deploying F5 BIG-IP solutions, as exploitation of this trusted infrastructure could jeopardize downstream customer networks. This incident underscores the escalating trend of nation-state actors targeting critical infrastructure and supply-chain vendors through advanced, stealthy attack methods. Given the widespread use of F5 products in enterprise and government IT environments, the breach has heightened industry awareness around zero-day vulnerabilities and supply-chain security best practices.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports