Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 153 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1825–1836 / 4893 reports
Fortinet Credential Exposure 2026: Massive 'FortiBleed' Campaign
Government Administration4 months ago

Fortinet Credential Exposure 2026: Massive 'FortiBleed' Campaign

In June 2026, a significant cybersecurity incident known as 'FortiBleed' exposed credentials associated with approximately 74,000 Fortinet devices, including firewalls and VPN gateways. Security researchers discovered a massive archive containing FortiGate firewall URLs, usernames, emails, and plaintext passwords from major corporations such as Chevron, Samsung, Foxconn, and Toyota. The attackers, reportedly Russian-speaking, executed over 1.1 billion credential attempts against 320,000 FortiGate VPN instances, leading to the compromise of Active Directory environments and, in some cases, the exfiltration of classified documents. Fortinet responded by emphasizing best practices like regular credential updates and enabling multi-factor authentication (MFA) to mitigate risks. This incident underscores the critical importance of robust credential management and the implementation of MFA, especially for internet-facing systems. The scale and sophistication of the 'FortiBleed' campaign highlight the evolving tactics of cyber adversaries and the necessity for organizations to proactively secure their network infrastructures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Belgian Bank Customers Targeted in Sophisticated Phishing Attack Using IPv4-Mapped IPv6 Addresses
Banking/Mortgage4 months ago

Belgian Bank Customers Targeted in Sophisticated Phishing Attack Using IPv4-Mapped IPv6 Addresses

In June 2026, a phishing campaign targeted customers of a major Belgian bank by exploiting IPv4-mapped IPv6 addresses to obfuscate malicious URLs. The attackers sent emails containing links formatted as IPv6 literals, such as 'hxxp://[::ffff:5511:74be]/kWC5PHA1', which, when decoded, resolved to an IPv4 address hosting the phishing content. This technique aimed to bypass security controls that rely on detecting suspicious domain names or IP addresses. Upon clicking the link, victims were redirected to a fraudulent website designed to harvest sensitive banking credentials. The campaign underscores the evolving tactics of cybercriminals in leveraging less commonly monitored aspects of internet protocols to evade detection. ([isc.sans.edu](https://isc.sans.edu/diary/32804?utm_source=openai)) The use of IPv4-mapped IPv6 addresses in phishing attacks highlights a growing trend where attackers exploit the complexities of IPv6 to conceal malicious activities. As IPv6 adoption increases, security systems must adapt to recognize and mitigate threats that utilize these advanced obfuscation methods. Organizations are urged to enhance their monitoring capabilities to detect such techniques and educate users about the risks associated with unfamiliar URL formats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
Anthropic's Fable 5 AI Model Suspended Amid National Security Concerns
Computer Software/Engineering4 months ago

Anthropic's Fable 5 AI Model Suspended Amid National Security Concerns

In June 2026, Anthropic released its advanced AI model, Fable 5, designed to autonomously identify and exploit software vulnerabilities. Shortly after its release, the U.S. government classified Fable 5 as a potential national security threat, citing concerns over its capability to be 'jailbroken' and misused by malicious actors. Consequently, Anthropic was ordered to suspend access to the model for all foreign nationals, leading the company to disable Fable 5 entirely due to the inability to selectively restrict access. This abrupt shutdown has sparked significant debate within the cybersecurity community, with experts arguing that such restrictions may hinder defensive research more than deter malicious use. The incident underscores the challenges in balancing AI innovation with national security and the need for clear regulatory frameworks to manage the dual-use nature of advanced AI technologies.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TeamPCP's Supply Chain Attacks: A Wake-Up Call for Open-Source Security
Computer Software/Engineering4 months ago

TeamPCP's Supply Chain Attacks: A Wake-Up Call for Open-Source Security

Between February and June 2026, the cybercriminal group TeamPCP executed a series of supply chain attacks, compromising over 1,000 open-source software packages. By infiltrating widely used tools such as Trivy, Checkmarx KICS, LiteLLM, and the Telnyx Python SDK, TeamPCP exploited vulnerabilities in CI/CD pipelines and AI development tools to inject malicious code, leading to the exfiltration of sensitive data and credentials. This campaign underscored the critical weaknesses in the software supply chain, particularly the reliance on unverified code dependencies and the lack of rigorous security checks in automated deployment systems. The incident highlights the urgent need for organizations to reassess their software development practices, emphasizing the importance of verifying the integrity of open-source components and implementing robust security measures within CI/CD pipelines. As supply chain attacks become more prevalent, the industry must prioritize security to prevent similar large-scale compromises in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Global Operation Dismantles SocGholish Botnet Linked to Evil Corp
Restaurants4 months ago

Global Operation Dismantles SocGholish Botnet Linked to Evil Corp

In June 2026, an international law enforcement operation, including agencies from the United States, Canada, Germany, the Netherlands, and Europol, successfully disrupted the SocGholish botnet, a malware framework linked to the Russian cybercriminal group Evil Corp. The coordinated effort led to the takedown of 106 servers and the remediation of nearly 15,000 infected websites, primarily hosted on WordPress platforms. SocGholish, active since 2017, compromised legitimate websites to redirect users to malicious traffic distribution systems, facilitating further malware infections and enabling ransomware campaigns and espionage activities. This operation significantly impaired Evil Corp's ability to exploit these compromised sites for malicious purposes. The takedown of the SocGholish botnet underscores the persistent threat posed by sophisticated cybercriminal organizations like Evil Corp. Despite this disruption, the group's leaders remain at large, and similar malware campaigns continue to evolve. Organizations must remain vigilant, implementing robust cybersecurity measures to protect against such threats and staying informed about emerging attack vectors. ([moncloa.com](https://www.moncloa.com/2026/06/18/desmantelamiento-evil-corp-2026-3386510/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Critical NGINX Vulnerabilities CVE-2026-42530 and CVE-2026-42055 Disclosed by F5
Financial Services4 months ago

Critical NGINX Vulnerabilities CVE-2026-42530 and CVE-2026-42055 Disclosed by F5

In June 2026, F5 disclosed two critical vulnerabilities in NGINX, identified as CVE-2026-42530 and CVE-2026-42055. These flaws reside in the ngx_http_v3_module and the ngx_http_proxy_v2_module/ngx_http_grpc_module, respectively. Unauthenticated remote attackers can exploit these vulnerabilities to cause denial-of-service conditions or execute arbitrary code on systems with non-default configurations. Exploitation leads to use-after-free or heap-based buffer overflow in the NGINX worker process, potentially resulting in system crashes or code execution, especially on systems where Address Space Layout Randomization (ASLR) is disabled or bypassed. The disclosure underscores the persistent risk posed by vulnerabilities in widely used web server software. Organizations relying on NGINX should promptly apply the provided security patches or implement recommended mitigations to prevent potential exploitation. This incident highlights the importance of regular security assessments and timely updates to maintain system integrity.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
International Crackdown Dismantles SocGholish Botnet Tied to Evil Corp
Computer Software/Engineering4 months ago

International Crackdown Dismantles SocGholish Botnet Tied to Evil Corp

In June 2026, international law enforcement agencies, including Europol and Eurojust, executed Operation Endgame, targeting the SocGholish botnet linked to the Russian cybercrime group Evil Corp. This coordinated effort resulted in the cleansing of nearly 15,000 malware-infected WordPress websites and the dismantling of over 100 associated servers. SocGholish, active since at least 2017, operates by injecting malicious JavaScript into legitimate websites, tricking visitors into downloading fake browser updates that install malware, thereby granting attackers access to infected systems. The operation significantly disrupted Evil Corp's infrastructure, mitigating further cyber threats posed by this group. The success of Operation Endgame underscores the effectiveness of international collaboration in combating sophisticated cybercriminal networks. It highlights the critical need for organizations to maintain robust cybersecurity practices, including regular software updates, vigilant monitoring of web assets, and user education to recognize and avoid social engineering tactics employed by malware like SocGholish.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
USB Worm Targets Cryptocurrency Wallets via Windows Shortcut Files
Financial Services4 months ago

USB Worm Targets Cryptocurrency Wallets via Windows Shortcut Files

In June 2026, a sophisticated USB worm emerged, targeting cryptocurrency wallets by distributing clipboard-stealing malware through Windows shortcut (LNK) files on USB drives. Upon execution, the malware scans the system for document files, hides the originals, and replaces them with malicious shortcuts. It monitors clipboard activity to detect and replace cryptocurrency wallet addresses with those controlled by the attacker, captures screenshots, and exfiltrates data via the Tor network. The worm also propagates by copying itself to newly connected USB devices, facilitating further spread. This incident underscores the evolving tactics of threat actors leveraging removable media to infiltrate systems, emphasizing the need for heightened vigilance and robust security measures to protect sensitive financial information.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
F5 Releases Patches for Critical NGINX Vulnerabilities CVE-2026-42530 and CVE-2026-42055
Internet4 months ago

F5 Releases Patches for Critical NGINX Vulnerabilities CVE-2026-42530 and CVE-2026-42055

In June 2026, F5 disclosed two critical vulnerabilities in NGINX Open Source: CVE-2026-42530 and CVE-2026-42055, both with a CVSS v4 score of 9.2. CVE-2026-42530 is a use-after-free flaw in the ngx_http_v3_module, exploitable when NGINX is configured with the HTTP/3 QUIC module, potentially allowing remote code execution if Address Space Layout Randomization (ASLR) is disabled or bypassed. CVE-2026-42055 is a heap-based buffer overflow in the ngx_http_proxy_v2_module and ngx_http_grpc_module, triggered under specific configurations involving HTTP/2 proxying, which could also lead to remote code execution under similar conditions. F5 has released patches to address these vulnerabilities and recommends disabling HTTP/3 and adjusting configuration directives as interim mitigations. The discovery of these vulnerabilities underscores the persistent risks associated with widely used open-source software components. Organizations relying on NGINX should promptly apply the provided patches and review their configurations to mitigate potential exploitation. This incident highlights the importance of continuous monitoring and timely updates to maintain the security of critical infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Gentlemen Ransomware's Advanced EDR Killers: A 2026 Threat Analysis
Financial Services4 months ago

Gentlemen Ransomware's Advanced EDR Killers: A 2026 Threat Analysis

In June 2026, the Gentlemen ransomware-as-a-service (RaaS) operation was observed actively developing and deploying a suite of endpoint detection and response (EDR) killer tools to evade detection during attacks. The primary tool, dubbed 'GentleKiller,' has at least eight variants that impersonate legitimate security products such as Kaspersky, Valorant, Javelin, and WatchDog. These tools utilize the 'bring your own vulnerable driver' (BYOVD) technique to gain kernel-level privileges and disable security processes, targeting over 400 processes associated with approximately 48 security vendors, including Microsoft, CrowdStrike, and SentinelOne. The binaries are protected using commercial packers like Enigma and Themida, and some variants employ stolen digital signatures to further obfuscate their malicious activities. This development underscores a growing trend among ransomware operators to enhance their evasion capabilities by systematically disabling security defenses, thereby increasing the success rate of their attacks. Organizations must remain vigilant and adopt comprehensive security measures to detect and mitigate such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Kali365: The Emerging Threat Bypassing MFA in Microsoft 365
Financial Services4 months ago

Kali365: The Emerging Threat Bypassing MFA in Microsoft 365

In April 2026, a new Phishing-as-a-Service (PhaaS) platform named Kali365 emerged, enabling cybercriminals to hijack Microsoft 365 accounts by exploiting the OAuth device code flow. This method allows attackers to bypass multi-factor authentication (MFA) by tricking users into entering device codes on legitimate Microsoft verification pages, thereby granting unauthorized access to services like Outlook, OneDrive, and Teams. The FBI issued a public service announcement in May 2026, highlighting the widespread distribution of Kali365 via Telegram and its use in numerous attacks across various sectors, including manufacturing, education, government, financial services, and healthcare. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai)) The significance of this incident lies in its demonstration of how attackers can circumvent traditional security measures, such as MFA, by exploiting legitimate authentication processes. The accessibility of Kali365 through subscription services lowers the barrier for less-skilled attackers to conduct sophisticated phishing campaigns, posing a substantial threat to organizations relying on Microsoft 365. ([ic3.gov](https://www.ic3.gov/PSA/2026/PSA260521?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Unveiling the 2025 AWS Cryptomining Security Breach
Financial Services4 months ago

Unveiling the 2025 AWS Cryptomining Security Breach

In November 2025, Amazon Web Services (AWS) identified a sophisticated cryptocurrency mining campaign targeting Amazon EC2 and Amazon ECS services. Threat actors utilized compromised AWS Identity and Access Management (IAM) credentials to deploy mining operations rapidly, often within minutes of gaining access. They employed advanced persistence techniques, such as modifying instance attributes to disable termination, complicating incident response efforts. This campaign underscores the critical importance of securing IAM credentials and monitoring for unauthorized activities within cloud environments. The incident highlights a growing trend of attackers leveraging legitimate credentials to exploit cloud resources for illicit purposes. Organizations must prioritize robust access controls, implement multi-factor authentication, and continuously monitor for anomalous behaviors to mitigate such threats effectively.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports