✨ No need to do from scratch. Deploy a Validated Containment Architecture built for your AI platform. →Deploy a Validated Containment Architecture for your AI platform. →A Validated Containment Architecture for your AI platform. →Validated Containment Architectures are here. →Contain Threats NowExplore✨
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Exploited Zero-Day in Gladinet CentreStack: Rapid RCE and the Need for Zero Trust
In October 2025, Gladinet patched a critical zero-day vulnerability (CVE-2025-11371) in its CentreStack file-sharing software, which had been exploited by threat actors since late September. The attackers leveraged a local file inclusion flaw to access the application's Web.config file and extract the machine key, subsequently exploiting a chained deserialization vulnerability (CVE-2025-30406) to achieve unauthenticated remote code execution. The service's SYSTEM-level privileges enabled lateral movement and sensitive file access. Gladinet released mitigations and a full patch, urging immediate client upgrades to prevent further compromise of business environments. This incident highlights a continuing trend in targeting widely used business collaboration platforms via sophisticated vulnerability chaining, often bypassing previous mitigations. The exploitation’s speed and public proof-of-concept release underscore the growing urgency for rapid patch management and proactive threat detection across enterprise SaaS deployments.
6 months ago
Kill Chain
Microsoft Disrupts 2025 Ransomware Campaign Using Fake Teams Installers
In October 2025, Microsoft successfully disrupted a ransomware campaign orchestrated by the threat group Vanilla Tempest (also known as Vice Society/VICE SPIDER) targeting Microsoft Teams users. Attackers used malvertising and SEO poisoning to promote websites impersonating the official Teams download page, tricking users into downloading malicious installers. These fake installers delivered the Oyster backdoor, granting attackers remote access for data theft, command execution, and the deployment of Rhysida ransomware. Microsoft responded by revoking over 200 abused code-signing certificates used to legitimize the malicious payloads, effectively hampering the campaign. This attack underscores the growing risk of supply chain compromise via trusted application installers and increasingly sophisticated social engineering techniques. The resurgence of ransomware-as-a-service operators leveraging signed malware highlights the urgent need for identity-driven defenses, vigilant certificate monitoring, and robust endpoint security measures.
6 months ago
Kill Chain
Prosper 2024 Data Breach: What Happened and What's Next for Financial Data Security
In early 2024, Prosper, a leading US-based financial services platform, suffered a significant data breach that compromised the personal information of over 17.6 million users. Attackers reportedly exploited vulnerabilities in Prosper's online systems, gaining unauthorized access to names, addresses, dates of birth, phone numbers, and bank account details. The breach was confirmed after the stolen data appeared in cybercrime forums and data breach repositories, prompting Prosper to notify affected users and regulatory bodies. Although no evidence of financial fraud was immediately reported, the exposed data increases risks such as identity theft and targeted social engineering. This incident underscores the pressing need for robust data protection in the financial sector due to the continued targeting of financial institutions by cybercriminals. It highlights industry-wide challenges with sensitive data security and the growing regulatory focus on rapid breach disclosure and consumer protection.
6 months ago
Kill Chain
Sotheby's 2025 Data Breach: When Sensitive Customer Information Goes Public
In July 2025, Sotheby's, a leading global auction house, suffered a significant data breach in which threat actors exfiltrated sensitive customer data. Discovered on July 24, the breach resulted in the exposure of customers' full names, Social Security numbers, and financial account information. An internal investigation spanned two months, determining the scale and nature of the data affected and the impacted individuals, which included Maine and Rhode Island residents. While the number of victims remains undisclosed, Sotheby's began notifying those affected and offered complimentary identity protection and credit monitoring. No ransomware group has publicly claimed responsibility, and the attack’s vector remains unknown, but similar institutions have faced ransomware- and data-theft-related intrusions in recent years. This incident underscores the rising frequency and impact of data breaches targeting well-known, high-value companies, particularly those handling sensitive customer and financial information. It highlights pressing concerns around regulatory compliance, the need for comprehensive incident detection and response, and growing regulatory scrutiny of data protection practices in sectors beyond traditional financial services.
6 months ago
Kill Chain
Nation-State Breach of F5 Sparks CISA Emergency Directive for Federal Agencies
In mid-2024, F5 Networks disclosed that a sophisticated nation-state attacker gained prolonged, unauthorized access to its internal systems, compromising BIG-IP source code and undisclosed vulnerability details. The breach, detected in August, prompted the US Cybersecurity and Infrastructure Security Agency (CISA) to issue an emergency directive compelling federal agencies to immediately identify, patch, or disconnect thousands of F5 products in their environments. While no direct federal compromises have been reported yet, the theft of sensitive product and security information could facilitate widespread exploitation across both federal agencies and private organizations relying on F5 systems. This incident underscores heightened risks to supply chain integrity and critical infrastructure posed by persistent nation-state campaigns. With attackers targeting widely deployed technology vendors, government and industry face urgent pressure to enhance monitoring, rapid patching, and zero trust defenses to mitigate risks from downstream exploitation of software supply chains.
6 months ago
Kill Chain
Microsoft Windows Server 2025 Update Breaks Active Directory Sync
In September 2025, Microsoft’s security updates for Windows Server 2025 triggered Active Directory (AD) Domain Services synchronization issues, specifically affecting environments with large AD security groups exceeding 10,000 members. The incident, stemming from update KB5065426, disrupted vital processes like Microsoft Entra Connect Sync, resulting in incomplete directory synchronization. Microsoft quickly acknowledged the bug, issued a temporary registry-based workaround, and warned that improper registry modifications carried significant risks. The root cause is connected to directory synchronization controls that do not yet officially support Windows Server 2025. This event highlights the increasing operational risk organizations face from software update regressions affecting core identity infrastructure. In an era of widespread cloud adoption and hybrid identity services, such failures can severely impact business continuity and compliance, amplifying the urgency for robust change management and pre-deployment validation.
6 months ago
Kill Chain
F5 2025 Supply Chain Breach: BIG-IP Vulnerabilities Exposed by State Hackers
In August 2025, cybersecurity company F5 detected a sophisticated supply chain attack resulting in the theft of source code and undisclosed vulnerabilities affecting its flagship BIG-IP products. The breach, attributed to state-sponsored hackers, did not lead to immediate exploitation but exposed potentially critical flaws. F5 responded by rapidly developing and releasing security patches for 44 vulnerabilities, proactively urging its global clientele—including many Fortune 500 companies and federal agencies—to update systems and implement enhanced monitoring. No evidence was found of modifications to the supply chain or active use of the stolen information as of disclosure. This incident highlights mounting concerns around supply chain security and zero-day vulnerability exposure, particularly within critical infrastructure and cloud environments. The breach also triggered regulatory intervention, with CISA issuing emergency directives for federal agencies, underscoring rising government attention to third-party risks and broader cybersecurity resilience in the face of advanced persistent threats.
6 months ago
Kill Chain
Fake LastPass & Bitwarden Breach Alerts: Phishing Attack Delivers Malware (2024)
In early June 2024, a sophisticated phishing campaign targeted users of password managers LastPass and Bitwarden. Attackers sent convincing emails, falsely claiming that the services had suffered security breaches and instructing recipients to download a new, supposedly more secure, desktop version. The malicious download actually installed malware, enabling attackers to hijack compromised PCs and potentially steal credentials or other sensitive data. Victims who downloaded the fake app were exposed to significant risks, including credential theft and remote control of their systems. This incident highlights escalating use of credible brand impersonation and urgent alert tactics by cybercriminals. The campaign underscores the vulnerabilities associated with password manager users and demonstrates the growing threat landscape for identity-driven and social engineering attacks.
6 months ago
Kill Chain
Capita Hit by Black Basta Ransomware: 6.6 Million Impacted in 2023 Breach
In March 2023, UK outsourcing giant Capita suffered a major data breach after an employee downloaded a malicious file, giving threat actors access to internal systems. The Black Basta ransomware gang exploited delayed response and weak access controls to maintain persistence for 58 hours, move laterally, and exfiltrate nearly a terabyte of sensitive data covering 6.6 million individuals, including customers of over 325 pension providers. The attackers deployed ransomware, resetting passwords and disrupting access, forcing Capita to take some systems offline and ultimately resulting in a £14 million regulatory fine after failing to meet key security requirements. This breach highlights the growing menace of ransomware operations targeting supply chain and service providers, with regulatory authorities emphasizing rapid response, robust access controls, and continuous security testing. Organizations face increased scrutiny to maintain strong cybersecurity baselines as attackers evolve tactics and exploit internal weaknesses.
6 months ago
Kill Chain
Maverick: How WhatsApp Became the Gateway for Brazil’s Biggest Banking Trojan in 2024
In October 2024, a sophisticated banking Trojan dubbed Maverick was detected actively targeting Brazilian users. The malware was delivered via malicious ZIP files sent through WhatsApp, bypassing platform detection. Victims executed an LNK file that triggered a fully fileless, multi-stage infection chain, utilizing PowerShell, .NET, and encrypted shellcode. Maverick, which shares code similarities with the Coyote Trojan, leverages locale checks to target only Brazilians and uses WPPConnect to automate the spread through hijacked WhatsApp accounts. Once established, the Trojan provides attackers full remote access, including keylogging, screen control, and phishing overlays to harvest banking and cryptocurrency credentials. This incident is notable for its complex multi-stage deployment, worm-like propagation, and use of AI-aided code, reflecting a new evolution in financially motivated malware. The attack demonstrates the increasing convergence of social engineering, sophisticated fileless techniques, and abuse of popular messaging platforms, signaling urgent challenges for both enterprises and end users.
6 months ago
Kill Chain
How Adversaries Used AI CLI Tools for Command & Control in 2024
In early 2024, security researchers identified a new wave of cyber intrusions involving adversaries weaponizing AI-enabled command-line tools to facilitate command and control activities within targeted business environments. Attackers leveraged popular AI code-assistants such as Claude Code, integrating them into CLI workflows to generate and execute malicious payloads, exfiltrate credentials, and bypass conventional security controls. The attack chain typically relied on legitimate processes, enabling lateral movement and credential theft while avoiding detection by traditional endpoint defenses. Unauthorized east-west traffic and encrypted exfiltration allowed threat actors to maintain persistence and evade standard monitoring solutions, impacting both operational continuity and sensitive business data. The incident underscores a rapidly evolving threat landscape where generative AI and shell automation converge, accelerating the sophistication and speed of adversary tactics. As enterprises adopt AI-driven DevOps and operational tooling, the risk of shadow AI and undetected rogue automation increases, compelling a shift towards advanced visibility, zero trust segmentation, and policy enforcement across hybrid environments.
6 months ago
Kill Chain
Microsoft Patch Tuesday Ring-fences 172 Flaws and Ends Windows 10 Support
In October 2025, Microsoft’s Patch Tuesday delivered critical security updates addressing 172 vulnerabilities in Windows operating systems, including two zero-days actively exploited in the wild. The first, CVE-2025-24990, is a flaw in the long-bundled Agere Modem driver exploited by attackers and removed entirely by Microsoft. The second, CVE-2025-59230, impacted Windows Remote Access Connection Manager (RasMan), risking privilege escalation through compromised VPN and remote access services. Remote code execution bugs in Office Preview Pane and a critical risk to Windows Server Update Services (WSUS) put both endpoints and patching infrastructure at significant risk. This large wave of vulnerabilities coincided with the end of official support for Windows 10, Exchange Server 2016, and other Microsoft products. The combination of zero-day exploitation and the end-of-life for popular products highlights the urgent need for proactive vulnerability management and secure migration paths as cybercriminals increasingly exploit outdated software.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports