The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
LMDeploy CVE-2026-33626: A Case Study in Rapid Vulnerability Exploitation
A high-severity Server-Side Request Forgery (SSRF) vulnerability, identified as CVE-2026-33626 with a CVSS score of 7.5, was discovered in LMDeploy, an open-source toolkit for compressing, deploying, and serving large language models (LLMs). This flaw resides in the vision-language module's `load_image()` function, which fetches arbitrary URLs without validating internal or private IP addresses, potentially allowing attackers to access cloud metadata services, internal networks, and sensitive resources. The vulnerability affects all versions up to 0.12.2 and was patched in version 0.12.3. Notably, within 13 hours of its public disclosure, the vulnerability was actively exploited in the wild, with attackers targeting AWS Instance Metadata Service (IMDS) and Redis instances, testing egress with out-of-band DNS callbacks, and performing port scans on the loopback interface. This rapid exploitation underscores the critical need for prompt vulnerability management and patching practices. The incident highlights a concerning trend where threat actors swiftly weaponize newly disclosed vulnerabilities, particularly in AI infrastructure components, emphasizing the importance of proactive security measures and continuous monitoring to mitigate potential risks.
5 months ago
Kill Chain
Lazarus Group's 'ClickFix' Campaign: A Wake-Up Call for macOS Security
In April 2026, North Korea's Lazarus Group initiated a cyberattack campaign targeting macOS users in the fintech and cryptocurrency sectors. Utilizing a social engineering technique known as 'ClickFix,' attackers impersonated trusted contacts to send fake online meeting invitations via platforms like Telegram. Victims were deceived into executing malicious commands in their macOS Terminal, leading to the installation of a malware toolkit named 'Mach-O Man.' This malware facilitated credential theft, system profiling, and data exfiltration, compromising corporate systems and financial resources. This incident underscores the evolving sophistication of state-sponsored cyber threats, particularly against macOS platforms previously considered less vulnerable. The use of social engineering tactics like ClickFix highlights the critical need for organizations to enhance user awareness and implement robust security measures to mitigate such deceptive attack vectors.
5 months ago
Kill Chain
Project Glasswing: AI's Role in Transforming Cybersecurity
In April 2026, Anthropic launched Project Glasswing, an initiative leveraging its advanced AI model, Claude Mythos Preview, to identify and remediate critical software vulnerabilities. Collaborating with major tech companies like AWS, Apple, Cisco, CrowdStrike, Google, Microsoft, and Palo Alto Networks, the project uncovered thousands of zero-day vulnerabilities across major operating systems and browsers, including a 27-year-old OpenBSD flaw and a 16-year-old FFmpeg bug. This initiative underscores the shift from traditional enumeration-based security tools to AI-driven analysis capable of understanding code intent and relationships, thereby identifying flaws that eluded conventional methods. The significance of Project Glasswing lies in its demonstration of AI's potential to revolutionize cybersecurity by proactively detecting and addressing vulnerabilities before they can be exploited. This proactive approach is crucial in an era where attackers increasingly leverage sophisticated tools, including AI, to identify and exploit security weaknesses. Organizations must adapt to this evolving threat landscape by integrating AI-driven security solutions to enhance their defensive capabilities.
5 months ago
Kill Chain
AI-Powered Phishing Attacks Surge in 2026
In the first quarter of 2026, AI-powered phishing attacks have surged, becoming the primary method for initial access in cyber incidents. According to Cisco Talos' "IR Trends Q1 2026" report, over 35% of compromises investigated were initiated through sophisticated phishing campaigns. These attacks often employ AI tools like SoftrAI to create convincing credential harvesting pages targeting Microsoft Exchange and Outlook Web Access accounts. The public administration and healthcare sectors have been particularly affected, each accounting for 24% of the targeted incidents. ([blog.talosintelligence.com](https://blog.talosintelligence.com/ir-trends-q1-2026/?utm_source=openai)) This trend underscores the evolving threat landscape where cybercriminals leverage AI to enhance the effectiveness and scale of their phishing campaigns. Organizations must adapt by implementing robust multi-factor authentication, enhancing employee training to recognize advanced phishing attempts, and deploying AI-driven security solutions to detect and mitigate these sophisticated attacks.
5 months ago
Kill Chain
Unveiling Fast16: The 2005 Cyber Sabotage Framework
In April 2026, SentinelOne researchers uncovered 'fast16,' a sophisticated malware framework dating back to 2005, predating the infamous Stuxnet by five years. Designed for industrial sabotage, fast16 targeted high-precision engineering and physics simulation software, subtly corrupting mathematical calculations to induce errors in critical applications. The malware's discovery reveals an early instance of state-sponsored cyber sabotage aimed at undermining scientific and engineering outputs without immediate detection. ([wired.com](https://www.wired.com/story/fast16-malware-stuxnet-precursor-iran-nuclear-attack/?utm_source=openai)) The revelation of fast16 underscores the long-standing and evolving nature of cyber threats targeting critical infrastructure. It highlights the necessity for organizations to continuously assess and fortify their cybersecurity measures against both historical and emerging threats, emphasizing the importance of vigilance in protecting sensitive computational processes.
5 months ago
Kill Chain
China-Backed Hackers Industrialize Botnets: A 2026 Cybersecurity Threat
In April 2026, cybersecurity agencies from the UK, US, and other nations issued a joint advisory highlighting the strategic use of botnets by China-backed threat actors, notably groups like Flax Typhoon and Volt Typhoon. These actors have been systematically compromising small office and home office (SOHO) routers, IoT devices, and other edge technologies to create extensive covert networks. These botnets are utilized for reconnaissance, malware delivery, data exfiltration, and to obfuscate the origin of cyber operations, thereby enhancing the attackers' deniability. The scale and sophistication of these operations represent a significant escalation in state-sponsored cyber activities. ([darkreading.com](https://www.darkreading.com/cyber-risk/china-hackers-industrializing-botnets?utm_source=openai)) This development underscores a broader trend of nation-state actors leveraging compromised consumer devices to build resilient and anonymous attack infrastructures. The industrialization of botnets by state-sponsored groups poses a heightened threat to global cybersecurity, necessitating enhanced defensive measures and international cooperation to mitigate these risks.
5 months ago
Kill Chain
FIRESTARTER Backdoor: A Persistent Threat to Cisco Firepower Devices
In September 2025, a U.S. federal civilian agency's Cisco Firepower device running Adaptive Security Appliance (ASA) software was compromised by the FIRESTARTER backdoor. This malware exploited vulnerabilities CVE-2025-20333 and CVE-2025-20362 to gain initial access, allowing threat actors to maintain persistent control over the device. Notably, FIRESTARTER's persistence mechanism enabled it to survive firmware updates and device reboots, rendering standard patching ineffective. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/firestarter-malware-survives-cisco-firewall-updates-security-patches/?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats targeting critical infrastructure. The ability of malware like FIRESTARTER to persist post-patching highlights the necessity for organizations to implement comprehensive security measures beyond regular updates, including continuous monitoring and advanced threat detection capabilities.
5 months ago
Kill Chain
Firestarter Malware: A Persistent Threat to Cisco Firewalls in 2026
In April 2026, cybersecurity agencies in the U.S. and U.K. identified a persistent malware named Firestarter targeting Cisco Firepower and Secure Firewall devices running Adaptive Security Appliance (ASA) or Firepower Threat Defense (FTD) software. The threat actor, tracked as UAT-4356, exploited vulnerabilities CVE-2025-20333 and CVE-2025-20362 to gain initial access, deploying the Line Viper malware followed by Firestarter to maintain access even after patches were applied. Firestarter achieves persistence by integrating into the core Cisco ASA process, LINA, and survives reboots, firmware updates, and security patches. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/firestarter-malware-survives-cisco-firewall-updates-security-patches/?utm_source=openai)) This incident underscores the evolving sophistication of cyber threats targeting critical infrastructure. Organizations must prioritize timely patching, implement robust monitoring, and adopt comprehensive security measures to mitigate such persistent threats.
5 months ago
Kill Chain
BlackFile Extortion Group's Vishing Attacks on Retail and Hospitality
In February 2026, the BlackFile extortion group initiated a series of data theft and extortion attacks targeting retail and hospitality organizations. Employing voice phishing (vishing) tactics, they impersonated corporate IT helpdesk staff to deceive employees into divulging credentials. With these credentials, the attackers accessed systems like Salesforce and SharePoint, exfiltrated sensitive data, and demanded seven-figure ransoms. The group also engaged in swatting to pressure victims further. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-blackfile-extortion-gang-targets-retail-and-hospitality-orgs/?utm_source=openai)) This incident underscores the evolving sophistication of social engineering attacks, particularly vishing, in the retail and hospitality sectors. The BlackFile group's methods highlight the critical need for organizations to enhance their security awareness training and implement robust authentication measures to mitigate such threats.
5 months ago
Kill Chain
Zimbra CVE-2025-48700 XSS Vulnerability Exploitation in 2026
In April 2026, over 10,000 Zimbra Collaboration Suite (ZCS) servers were found vulnerable to active exploitation of a cross-site scripting (XSS) flaw, identified as CVE-2025-48700. This vulnerability allows unauthenticated attackers to execute arbitrary JavaScript within a user's session by sending crafted emails, potentially leading to unauthorized access to sensitive information. Despite patches released in June 2025, a significant number of servers remained unpatched, exposing organizations to ongoing attacks. The continued exploitation of CVE-2025-48700 underscores the critical importance of timely patch management and vigilance against XSS vulnerabilities. Organizations must prioritize updating their systems and implementing robust security measures to mitigate such risks.
5 months ago
Kill Chain
TGR-STA-1030's 2026 Cyber Espionage Surge in Central and South America
In early 2026, the state-aligned cyber espionage group TGR-STA-1030 intensified its operations, targeting government and critical infrastructure entities across Central and South America. Utilizing tactics such as phishing emails and exploiting known software vulnerabilities, the group infiltrated networks to exfiltrate sensitive data, including financial negotiations, contracts, and military operational updates. This campaign underscores the group's persistent and evolving threat to national security and key services in the region. The recent focus on Central and South America highlights a strategic shift in TGR-STA-1030's operations, emphasizing the need for heightened vigilance and robust cybersecurity measures among governmental and critical infrastructure organizations in these regions.
5 months ago
Kill Chain
In-Depth Analysis of the 2026 Axios npm Supply Chain Attack
In March 2026, attackers compromised the npm account of a lead maintainer of Axios, a widely-used JavaScript HTTP client library with over 100 million weekly downloads. They released two malicious versions of the package—axios@1.14.1 and axios@0.30.4—which included a trojan-laden dependency named 'plain-crypto-js'. This rogue package executed a post-installation script that downloaded and installed a cross-platform Remote Access Trojan (RAT) targeting macOS, Windows, and Linux systems. The malware connected to a command-and-control server, deployed system-specific payloads, and erased its tracks to evade detection. The malicious versions were available for approximately two to three hours before being removed from the npm registry. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/axios-npm-package-compromised-in-supply-chain-attack-that-deployed-a-cross-platform-rat?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within the open-source ecosystem. The rapid deployment and widespread use of compromised packages highlight the need for enhanced security measures in software development pipelines. Organizations are urged to implement stringent access controls, conduct regular audits of dependencies, and monitor for unusual activity to mitigate the risks associated with such attacks.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports