Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 160 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1909–1920 / 4893 reports
Critical Vulnerability in Ivanti Sentry: CVE-2026-10520
Information Technology/IT4 months ago

Critical Vulnerability in Ivanti Sentry: CVE-2026-10520

In June 2026, a critical OS command injection vulnerability, CVE-2026-10520, was identified in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1. This flaw allows remote, unauthenticated attackers to execute arbitrary code with root privileges. Within 24 hours of disclosure, attackers exploited this vulnerability to backdoor exposed Ivanti Sentry appliances, compromising enterprise mobile gateways. ([techtimes.com](https://www.techtimes.com/articles/318221/20260611/ivanti-sentry-actively-exploited-cvss-100-flaw-backdoors-enterprise-mobile-gateways.htm?utm_source=openai)) The rapid exploitation underscores the urgency for organizations to promptly apply security patches. The availability of a public proof-of-concept exploit increases the risk of widespread attacks, emphasizing the need for immediate remediation. ([noise.getoto.net](https://noise.getoto.net/2026/06/10/cve-2026-10520-cve-2026-10523-multiple-critical-vulnerabilities-affecting-ivanti-sentry/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Anthropic's Claude Fable 5: Balancing Advanced AI Capabilities with Security
Computer Software/Engineering4 months ago

Anthropic's Claude Fable 5: Balancing Advanced AI Capabilities with Security

In June 2026, Anthropic released Claude Fable 5, a public version of its advanced AI model, Claude Mythos 5, which was previously restricted due to security concerns. Fable 5 is designed to perform complex tasks autonomously, including software development and research. To mitigate potential misuse in sensitive areas like cybersecurity and biology, Anthropic implemented safeguards that redirect high-risk queries to a less capable model, Claude Opus 4.8. This approach aims to balance the model's powerful capabilities with safety considerations. The release of Claude Fable 5 underscores the ongoing challenge of deploying advanced AI systems responsibly. As AI models become more capable, ensuring they are used ethically and securely remains a critical concern for developers and users alike.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Phishing Attacks Decline 20% in 2026, But AI Enhances Threats
Financial Services4 months ago

Phishing Attacks Decline 20% in 2026, But AI Enhances Threats

In 2026, phishing attack volumes decreased by 20% for the second consecutive year. However, the sophistication and effectiveness of these attacks have significantly increased, largely due to the integration of artificial intelligence (AI) by cybercriminals. AI tools enable attackers to craft highly convincing phishing lures and automate the creation of fraudulent websites, leading to more targeted and successful campaigns. ([zscaler.com](https://www.zscaler.com/blogs/security-research/one-click-compromise-threatlabz-2026-phishing-and-initial-access-report?utm_source=openai)) This trend underscores a shift in cybercriminal strategies from mass, indiscriminate attacks to focused, high-yield operations. Organizations must recognize that while the quantity of phishing attempts has declined, the quality and potential impact of these attacks have escalated, necessitating enhanced vigilance and advanced security measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Europol Dismantles 'AudiA6' Crypto Laundering Service Used by Ransomware Gangs
Banking/Mortgage4 months ago

Europol Dismantles 'AudiA6' Crypto Laundering Service Used by Ransomware Gangs

In June 2026, an international law enforcement operation led by Europol dismantled 'AudiA6,' a cryptocurrency laundering service that processed over €336 million for ransomware gangs and cybercriminal networks between 2022 and 2025. The operation resulted in the arrest of two alleged administrators in Georgia, the seizure of more than 30 servers, 25 domains, over 80 vehicles, multiple properties, and the freezing of approximately €692,000 in cryptocurrency assets. 'AudiA6' was linked to over 15 international cybercrime investigations and was also associated with the dark web forum 'Dark2Web,' which facilitated illicit services and connections among cybercriminals. ([fdicoig.gov](https://www.fdicoig.gov/news/investigations-press-releases/ransomware-gangs-cut-eur-336-million-audia6-crypto-laundering?utm_source=openai)) This takedown underscores the growing industrialization of cryptocurrency laundering services that support the global cybercrime economy. The operation highlights the increasing reliance of ransomware groups on sophisticated laundering platforms to obscure illicit proceeds, emphasizing the need for enhanced international cooperation and advanced forensic capabilities to combat such threats. ([dig.watch](https://dig.watch/updates/europol-audia6-crypto-laundering-network?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Critical RCE Vulnerability in LangGraph: Immediate Action Required
Computer Software/Engineering4 months ago

Critical RCE Vulnerability in LangGraph: Immediate Action Required

In February 2026, a critical remote code execution (RCE) vulnerability, identified as CVE-2026-27794, was discovered in LangGraph's caching layer. This flaw allowed attackers with write access to the cache backend to inject malicious serialized objects, leading to arbitrary code execution upon deserialization by the LangGraph process. The vulnerability affected versions of langgraph-checkpoint prior to 4.0.0 and was particularly concerning for applications utilizing cache backends inheriting from BaseCache with nodes opted into caching via CachePolicy. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-27794/?utm_source=openai)) This incident underscores the persistent risks associated with deserialization of untrusted data, especially in AI frameworks. Organizations leveraging LangGraph for AI agent orchestration must ensure they have updated to version 4.0.0 or later to mitigate this vulnerability. The event highlights the critical need for secure coding practices and regular security assessments in AI development environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Adds CVE-2026-10520 to Known Exploited Vulnerabilities Catalog
Government Administration4 months ago

CISA Adds CVE-2026-10520 to Known Exploited Vulnerabilities Catalog

In June 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-10520 to its Known Exploited Vulnerabilities (KEV) Catalog. This critical OS Command Injection vulnerability in Ivanti Sentry versions prior to R10.5.2, R10.6.2, and R10.7.1 allows remote unauthenticated attackers to execute code with root privileges. The flaw poses significant risks to federal enterprises and has been actively exploited in the wild. Organizations are urged to update to the patched versions immediately to mitigate potential threats. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2026-10520?utm_source=openai)) The inclusion of CVE-2026-10520 in the KEV Catalog underscores the ongoing threat posed by command injection vulnerabilities. This incident highlights the importance of timely patch management and proactive vulnerability assessments to prevent unauthorized access and potential data breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Security Flaws Discovered in Brickcom Cameras
Security/Investigations4 months ago

Critical Security Flaws Discovered in Brickcom Cameras

In June 2026, critical vulnerabilities were identified in Brickcom cameras, specifically models Cube, Dome, Bullet, and Box version 3.2.3.5.6. These flaws, cataloged as CVE-2026-50245 and CVE-2026-50005, allow unauthenticated remote attackers to access live video feeds and still images via the /ONVIF endpoint without requiring authentication. Additionally, the use of default credentials enables silent access to camera feeds, compromising sensitive visual information and potentially granting administrative control over the devices. The exploitation of these vulnerabilities poses significant risks to sectors such as Commercial Facilities, Critical Manufacturing, Financial Services, and Healthcare, where surveillance systems are integral to security operations. The absence of authentication mechanisms in these cameras underscores the critical need for robust access controls and regular security assessments to prevent unauthorized access and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Agentjacking: Exploiting AI Coding Agents via Sentry Vulnerability
Computer Software/Engineering4 months ago

Agentjacking: Exploiting AI Coding Agents via Sentry Vulnerability

In June 2026, Tenet Security identified a novel attack method termed 'Agentjacking,' which exploits AI coding agents by injecting malicious code through manipulated error reports in Sentry, an open-source error-tracking platform. Attackers can send crafted error events to Sentry using publicly accessible Data Source Names (DSNs), embedding commands that AI agents interpret and execute as legitimate diagnostic steps. This technique allows unauthorized code execution on developer machines, potentially exposing sensitive data such as environment variables, Git credentials, and private repository URLs. The Agentjacking attack underscores the growing security risks associated with integrating AI coding agents into development workflows. As these agents gain broader access to codebases and tools, they become attractive targets for exploitation. This incident highlights the urgent need for robust security measures and governance frameworks to manage the deployment and operation of AI agents, ensuring they do not inadvertently become vectors for cyberattacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
CompleteFTP 'Short-Sleeve' RSA and DSA Key Vulnerability Exposed
Financial Services4 months ago

CompleteFTP 'Short-Sleeve' RSA and DSA Key Vulnerability Exposed

In June 2026, researchers identified a vulnerability in RSA and DSA key generation within the CompleteFTP software, leading to the creation of 'short-sleeve' keys with predictable zero-bit patterns. This flaw, stemming from a type mismatch in big-integer code, resulted in the generation of weak cryptographic keys that could be easily factored, compromising the security of encrypted communications. The issue affected CompleteFTP versions 10.0.0 through 23.0.4, spanning from December 2016 to December 2023. EnterpriseDT, the developers of CompleteFTP, promptly released version 26.1.0 on May 8, 2026, which includes a tool to detect and regenerate vulnerable keys. ([enterprisedt.jp](https://www.enterprisedt.jp/doc23/html/howtoserverkeys.html?utm_source=openai)) This incident underscores the critical importance of rigorous code review and adherence to cryptographic standards in software development. It also highlights the necessity for organizations to regularly audit their cryptographic implementations to identify and mitigate potential vulnerabilities that could be exploited by attackers.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Urgent: Ivanti Sentry Vulnerability Exploited – Immediate Action Required
Government Administration5 months ago

Urgent: Ivanti Sentry Vulnerability Exploited – Immediate Action Required

In June 2026, a critical OS command injection vulnerability (CVE-2026-10520) was discovered in Ivanti Sentry, formerly known as MobileIron Sentry. This flaw allows remote, unauthenticated attackers to execute arbitrary commands with root privileges on affected devices. Ivanti released patches on June 9, 2026, addressing the issue in versions R10.5.2, R10.6.2, and R10.7.1. However, within 24 hours, reports emerged of active exploitation, with attackers backdooring exposed Sentry gateways. The Shadowserver Foundation identified multiple compromised instances, indicating widespread exploitation. Organizations using Ivanti Sentry are urged to apply the patches immediately to mitigate the risk of unauthorized access and potential data breaches. This incident underscores the critical importance of timely patch management and proactive vulnerability assessments to safeguard enterprise networks against rapidly evolving threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Coupang Data Breach 2025: A Wake-Up Call for E-Commerce Security
Retail Industry5 months ago

Coupang Data Breach 2025: A Wake-Up Call for E-Commerce Security

In June 2025, Coupang, South Korea's leading e-commerce platform, experienced a significant data breach that went undetected until November 2025. The breach compromised personal information of approximately 37.55 million customers, including names, email addresses, phone numbers, delivery addresses, and order histories. Investigations revealed that the breach resulted from inadequate security practices, such as poor authentication key management and insufficient access controls. This incident underscores the critical importance of robust cybersecurity measures in protecting sensitive customer data. The substantial fine imposed by South Korean authorities highlights the growing regulatory focus on data protection and the severe consequences of security lapses for organizations handling large volumes of personal information.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
International Authorities Dismantle 'AudiA6' Cryptocurrency Laundering Service
Financial Services5 months ago

International Authorities Dismantle 'AudiA6' Cryptocurrency Laundering Service

In June 2026, an international law enforcement operation dismantled 'AudiA6,' a cryptocurrency laundering service that allegedly processed over $389 million in illicit funds between 2022 and 2025. The service facilitated the laundering of proceeds from ransomware attacks and other cybercrimes by obfuscating transaction origins through complex routes, returning 'cleaned' funds to users for a commission. The operation led to the arrest of two individuals in Georgia, the seizure of 25 domains, 80 vehicles and properties, and the freezing of approximately $897,000 in cryptocurrency assets. This takedown underscores the growing global collaboration in combating cyber-enabled financial crimes and highlights the increasing scrutiny on cryptocurrency platforms used for illicit activities. Organizations are urged to enhance their monitoring of cryptocurrency transactions and implement robust compliance measures to detect and prevent money laundering activities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports