The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Insider Threat: Ransomware Negotiator's Guilty Plea in BlackCat Scheme
In April 2026, Angelo Martino, a former ransomware negotiator at DigitalMint, pleaded guilty to conspiring with the BlackCat/ALPHV ransomware group to extort U.S. companies in 2023. Martino exploited his position by providing BlackCat with confidential information about his clients' insurance policy limits and negotiation strategies, enabling the attackers to maximize ransom demands. Alongside co-conspirators Ryan Goldberg and Kevin Martin, Martino participated in deploying ransomware attacks, resulting in at least $1.2 million in Bitcoin payments from a single victim. Law enforcement has seized approximately $10 million in assets from Martino, including digital currency and luxury items. This case underscores the critical risk posed by insider threats within cybersecurity roles. The incident highlights the evolving tactics of ransomware groups and the importance of stringent internal controls to prevent insider collusion. Organizations must reassess their security protocols and ensure clear separation of duties to mitigate such risks.
5 months ago
Kill Chain
DPRK's 'Contagious Interview' Campaign: A New Era of Supply Chain Attacks
In April 2026, North Korean threat actors, identified as Void Dokkaebi, escalated their 'Contagious Interview' campaign by compromising developers' repositories to disseminate remote access Trojans (RATs) and other malware. By posing as recruiters, they lured developers into cloning malicious code repositories during fake job interviews. These repositories contained Visual Studio Code tasks that, upon execution, installed malware capable of stealing credentials and propagating further infections. This method transformed individual developer systems into vectors for widespread supply chain attacks, affecting numerous organizations and open-source projects. This incident underscores a significant evolution in cyberattack strategies, highlighting the increasing sophistication of supply chain attacks. The use of trusted development tools and platforms to distribute malware emphasizes the need for heightened vigilance among developers and organizations. As threat actors continue to refine their tactics, the cybersecurity community must adapt by implementing robust security measures and promoting awareness to mitigate such risks.
5 months ago
Kill Chain
Critical Vulnerability in Cohere AI's Terrarium: CVE-2026-5752
In April 2026, a critical vulnerability (CVE-2026-5752) was identified in Cohere AI's Terrarium, a Python-based sandbox environment. This flaw allows attackers to execute arbitrary code with root privileges on the host process by exploiting JavaScript prototype chain traversal. The vulnerability has a CVSS score of 9.3, indicating its severity. ([thehackernews.com](https://thehackernews.com/2026/04/cohere-ai-terrarium-sandbox-flaw.html?utm_source=openai)) The discovery underscores the risks associated with sandbox environments, especially those handling untrusted code. Organizations utilizing Terrarium should assess their deployments and implement recommended mitigations to prevent potential exploits. ([thehackernews.com](https://thehackernews.com/2026/04/cohere-ai-terrarium-sandbox-flaw.html?utm_source=openai))
5 months ago
Kill Chain
Mustang Panda's LOTUSLITE Variant Targets Indian Banks and South Korean Policy Circles
In April 2026, cybersecurity researchers identified a new variant of the LOTUSLITE malware, attributed to the Chinese state-sponsored group Mustang Panda. This variant targeted India's banking sector and South Korean policy circles. The attack began with spear-phishing emails containing Compiled HTML (CHM) files that, when executed, deployed a backdoor communicating with a dynamic DNS-based command-and-control server over HTTPS. This backdoor facilitated remote shell access, file operations, and session management, indicating espionage-focused objectives rather than financial gain. The malware was disguised as legitimate banking software, notably referencing HDFC Bank, to deceive victims. This incident underscores the evolving tactics of nation-state actors like Mustang Panda, who are expanding their targets beyond traditional government entities to include financial institutions and policy organizations. The use of familiar yet effective techniques, such as DLL side-loading and spear-phishing, highlights the persistent threat posed by such groups and the need for organizations to remain vigilant against sophisticated cyber espionage campaigns.
5 months ago
Kill Chain
Microsoft Releases Critical Patch for ASP.NET Core Vulnerability CVE-2026-40372
On April 21, 2026, Microsoft released an out-of-band security update to address a critical vulnerability in ASP.NET Core, identified as CVE-2026-40372. This flaw, stemming from improper verification of cryptographic signatures, allows unauthorized attackers to escalate privileges over a network. Rated with a CVSS score of 9.1, the vulnerability affects ASP.NET Core versions prior to 10.0.7. Exploitation could lead to unauthorized access and control over application components or data. The release of this patch underscores the importance of timely software updates, especially in widely used frameworks like ASP.NET Core. Organizations are urged to apply the update promptly to mitigate potential risks associated with this vulnerability.
5 months ago
Kill Chain
Moltbook's 2026 Security Breach: A Wake-Up Call for AI Platform Security
In late January 2026, Moltbook, a social network designed exclusively for AI agents, suffered a significant security breach due to an exposed Supabase API key embedded in client-side JavaScript. This vulnerability allowed unauthorized access to the platform's production database, exposing 1.5 million API tokens, 35,000 email addresses, and private messages between agents. The breach was promptly identified and reported by cybersecurity firm Wiz, leading to a swift response from Moltbook to patch the vulnerability and reset all agent API keys. ([techradar.com](https://www.techradar.com/pro/security/ai-agent-social-media-network-moltbook-is-a-security-disaster-millions-of-credentials-and-other-details-left-unsecured?utm_source=openai)) This incident underscores the critical importance of implementing robust security measures, especially in rapidly developed AI-driven platforms. The exposure of sensitive data not only compromises user privacy but also highlights the potential risks associated with 'vibe coding'—developing applications with AI assistance without thorough security oversight. Organizations must prioritize security protocols to prevent similar breaches in the future. ([trustfinance.com](https://www.trustfinance.com/en-US/blog/wiz-finds-major-data-leak-in-moltbook-ai-social-network?utm_source=openai))
5 months ago
Kill Chain
Harvester's Linux GoGra Backdoor: A New Threat in South Asia
In April 2026, the Harvester threat actor deployed a new Linux variant of its GoGra backdoor targeting entities in South Asia. The malware utilizes the Microsoft Graph API and Outlook mailboxes as covert command-and-control channels, enabling it to bypass traditional network defenses. Initial access is achieved through social engineering tactics, tricking victims into executing ELF binaries disguised as PDF documents. Once installed, the backdoor communicates with a specific Outlook mailbox folder named "Zomato Pizza," executing commands received via emails with subjects starting with "Input" and sending execution results back with the subject "Output." ([thehackernews.com](https://thehackernews.com/2026/04/harvester-deploys-linux-gogra-backdoor.html?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors like Harvester, who are expanding their toolsets to include cross-platform capabilities and leveraging legitimate cloud services to evade detection. The use of Microsoft's cloud infrastructure for command-and-control highlights the need for organizations to monitor and secure their cloud environments against such sophisticated threats.
5 months ago
Kill Chain
Telegram 'tdata' Folder Exploited in Credential Harvesting Attack - April 2026
In April 2026, a sophisticated cyberattack was observed targeting Telegram Desktop users through the exploitation of the 'tdata' folder, which stores session data. Attackers gained initial access via weak SSH credentials, conducted system reconnaissance, and specifically sought out the 'tdata' directory to harvest Telegram session tokens. This method allowed them to bypass two-factor authentication and gain unauthorized access to users' Telegram accounts, leading to potential data exfiltration and account misuse. The incident underscores the evolving tactics of threat actors who are now combining resource hijacking with credential harvesting to establish persistent access and exploit digital identities. This trend highlights the critical need for robust SSH configurations, vigilant monitoring of sensitive directories, and comprehensive session management practices to mitigate such multifaceted threats.
5 months ago
Kill Chain
Detection Strategies Against Infiltrating IT Workers
In April 2026, Microsoft reported that the North Korean state-sponsored group Jasper Sleet exploited remote work trends by posing as legitimate IT hires using fabricated identities and AI-assisted deception. These operatives infiltrated organizations to gain trusted access, leading to data theft, extortion, and potential follow-on compromises. The attackers systematically surveyed job postings, crafted convincing applications, and, once hired, accessed sensitive company resources. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/21/detection-strategies-cloud-identities-against-infiltrating-it-workers/?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors leveraging AI to enhance social engineering attacks, highlighting the urgent need for organizations to strengthen identity verification processes and monitor for anomalous behaviors during recruitment and onboarding phases. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/21/detection-strategies-cloud-identities-against-infiltrating-it-workers/?utm_source=openai))
5 months ago
Kill Chain
Unveiling Critical APT Exploit Chains: A 2026 Analysis
In April 2026, Praetorian's analysis revealed that out of 500,000 vulnerability findings, only 14 endpoints were susceptible to critical exploit chains capable of full host compromise. These chains combined multiple vulnerabilities, including CVE-2025-4918 and CVE-2025-2857, to enable zero-click attacks through browser exploits. Notably, one chain was actively exploited by the Russian-aligned APT group RomCom, targeting sectors such as government, defense, and energy across Europe and North America. This incident underscores the necessity for organizations to move beyond traditional CVSS-based vulnerability assessments and adopt exploit chain analysis to identify and mitigate real-world attack paths effectively. The increasing sophistication of APT groups in leveraging complex exploit chains highlights the urgent need for enhanced threat intelligence integration and proactive security measures to protect critical infrastructure and sensitive data.
5 months ago
Kill Chain
NGate Malware Variant Exploits HandyPay App to Steal NFC Data
In November 2025, ESET researchers identified a new variant of the NGate malware family targeting Android users in Brazil. This variant exploits a legitimate NFC payment application called HandyPay by embedding malicious code, likely generated with the assistance of AI. The malware captures NFC data and payment card PINs from victims, enabling attackers to perform unauthorized contactless ATM withdrawals and payments. Distribution methods include fake lottery websites and counterfeit Google Play pages, indicating a coordinated effort by a single threat actor. This incident underscores the evolving sophistication of cyber threats, particularly the integration of AI in malware development. The use of legitimate applications as vectors for malware distribution highlights the need for heightened vigilance and robust security measures to protect sensitive financial information.
5 months ago
Kill Chain
DigitalMint Negotiator's Betrayal: A Stark Warning for Cybersecurity
In April 2026, Angelo Martino, a former ransomware negotiator at DigitalMint, pleaded guilty to conspiring with the BlackCat (ALPHV) ransomware group to extort five U.S. companies. Martino exploited his position by sharing confidential information, including victims' insurance policy limits and negotiation strategies, with the attackers. This collaboration led to ransom payments totaling approximately $75.3 million from sectors such as nonprofit, hospitality, financial services, retail, and medical industries. Martino faces up to 20 years in federal prison, with sentencing scheduled for July 9, 2026. This case underscores the critical need for stringent vetting and oversight of cybersecurity professionals, as insider threats can significantly amplify the impact of cyberattacks. The incident also highlights the evolving tactics of ransomware groups, emphasizing the importance of comprehensive security measures and employee integrity in safeguarding organizational assets.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports