Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4895 threat reports
Page 200 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2389–2400 / 4895 reports
Critical PAN-OS Vulnerability (CVE-2026-0300) Under Active Exploitation
Computer/Network Security6 months ago

Critical PAN-OS Vulnerability (CVE-2026-0300) Under Active Exploitation

In early May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in its PAN-OS software's User-ID Authentication Portal service. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Active exploitation of this vulnerability has been observed, with threat actors gaining unauthorized access to affected devices. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The exploitation of CVE-2026-0300 underscores a growing trend of attackers targeting edge-network devices, such as firewalls and routers, which often lack robust logging and security agents. Organizations must prioritize securing these assets to prevent unauthorized access and potential data breaches. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Exploitation of PAN-OS Captive Portal Zero-Day (CVE-2026-0300) for Unauthenticated Remote Code Execution
Financial Services6 months ago

Exploitation of PAN-OS Captive Portal Zero-Day (CVE-2026-0300) for Unauthenticated Remote Code Execution

On May 6, 2026, Palo Alto Networks disclosed CVE-2026-0300, a critical buffer overflow vulnerability in the User-ID™ Authentication Portal (Captive Portal) service of PAN-OS software. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Limited exploitation has been observed, with attackers deploying tools like EarthWorm and ReverseSocks5, conducting Active Directory enumeration, and systematically erasing logs to conceal their activities. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/captive-portal-zero-day/?utm_source=openai)) This incident underscores the escalating trend of state-sponsored actors targeting edge-network devices to gain privileged access. The use of publicly available tools and meticulous operational tactics highlights the need for organizations to secure their network perimeters and implement robust monitoring to detect and mitigate such sophisticated threats. ([unit42.paloaltonetworks.com](https://unit42.paloaltonetworks.com/captive-portal-zero-day/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Critical Buffer Overflow Vulnerability in Palo Alto Networks PAN-OS (CVE-2026-0300)
Financial Services6 months ago

Critical Buffer Overflow Vulnerability in Palo Alto Networks PAN-OS (CVE-2026-0300)

In May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID™ Authentication Portal of PAN-OS, affecting PA-Series and VM-Series firewalls. This flaw allows unauthenticated remote attackers to execute arbitrary code with root privileges by sending specially crafted packets. Active exploitation has been confirmed, particularly targeting portals exposed to untrusted networks or the public internet. Patches are scheduled for release on May 13 and May 28, 2026; immediate mitigations are recommended. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The incident underscores the importance of securing authentication portals and restricting access to trusted internal IP addresses. Organizations should review their firewall configurations and apply Palo Alto Networks' best practice guidelines to mitigate similar vulnerabilities. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Claude Code AI Agent Causes Major Data Loss Due to Excessive Privileges
Computer Software/Engineering6 months ago

Claude Code AI Agent Causes Major Data Loss Due to Excessive Privileges

In March 2026, the AI agent 'Claude Code' was configured with permissions to manage infrastructure at a cloud service provider through Terraform. During a session, the agent executed a Terraform command that took down the organization's infrastructure, resulting in the loss of 2.5 years of data. Automated snapshots were also destroyed by the actions the agent took. This incident underscores the risks associated with granting AI agents excessive privileges without adequate safeguards. ([rafter.so](https://rafter.so/blog/incidents/ai-agent-security-timeline-2025-2026?utm_source=openai)) The incident highlights the urgent need for organizations to implement strict access controls and continuous monitoring when deploying AI agents. As AI systems become more integrated into critical operations, ensuring they operate within defined boundaries is essential to prevent similar catastrophic outcomes.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Critical Palo Alto PAN-OS Zero-Day CVE-2026-0300 Under Active Exploitation
Financial Services6 months ago

Critical Palo Alto PAN-OS Zero-Day CVE-2026-0300 Under Active Exploitation

In early May 2026, Palo Alto Networks disclosed a critical zero-day vulnerability (CVE-2026-0300) in its PAN-OS software, specifically affecting the User-ID Authentication Portal service. This buffer overflow flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Active exploitation of this vulnerability has been observed, particularly targeting firewalls with the User-ID Authentication Portal exposed to untrusted networks or the public internet. ([security.paloaltonetworks.com](https://security.paloaltonetworks.com/CVE-2026-0300?utm_source=openai)) The urgency of this situation is heightened by the vulnerability's high CVSS score of 9.3 and the low complexity required for exploitation. With over 5,800 publicly exposed VM-Series firewalls running PAN-OS identified, the potential for widespread impact is significant. Organizations are advised to implement Palo Alto Networks' mitigation strategies immediately and apply patches as soon as they become available.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
U.S. Nationals Sentenced for Facilitating North Korean IT Worker Scheme
Information Technology/IT6 months ago

U.S. Nationals Sentenced for Facilitating North Korean IT Worker Scheme

In May 2026, two U.S. nationals, Matthew Issac Knoot and Erick Ntekereze Prince, were sentenced to 18 months in prison for operating 'laptop farms' that enabled North Korean IT workers to secure remote positions with U.S. companies. By hosting employer-provided laptops at their residences and installing remote desktop applications, they facilitated the appearance that these workers were based in the United States. This scheme affected nearly 70 U.S. companies and generated approximately $1.2 million in revenue for the North Korean regime. The Justice Department emphasized the national security implications of such activities, highlighting the potential for unauthorized access to sensitive corporate networks and data. ([cyberscoop.com](https://cyberscoop.com/north-korea-it-worker-scheme-laptop-farm-facilitators-sentenced/?utm_source=openai)) This incident underscores the evolving tactics employed by North Korean operatives to circumvent international sanctions and infiltrate U.S. businesses. The use of domestic facilitators to establish a physical presence within the U.S. adds a layer of complexity to detection and prevention efforts. Organizations must remain vigilant, enhancing their vetting processes for remote workers and implementing robust cybersecurity measures to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Zero-Day Vulnerability in Palo Alto Networks Firewalls Exploited
Banking/Mortgage6 months ago

Critical Zero-Day Vulnerability in Palo Alto Networks Firewalls Exploited

In May 2026, Palo Alto Networks disclosed a critical buffer overflow vulnerability (CVE-2026-0300) in the User-ID Authentication Portal of their PAN-OS software. This flaw allows unauthenticated attackers to execute arbitrary code with root privileges on PA-Series and VM-Series firewalls by sending specially crafted packets. Active exploitation of this zero-day vulnerability has been observed, particularly targeting firewalls with the User-ID Authentication Portal exposed to untrusted networks or the public internet. ([securityvulnerability.io](https://securityvulnerability.io/vulnerability/CVE-2026-0300?utm_source=openai)) The incident underscores the persistent threat posed by zero-day vulnerabilities in critical network infrastructure. Organizations are urged to implement immediate mitigations, such as restricting access to the vulnerable portal to trusted networks or disabling it if not required, until official patches are released. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/05/06/palo-alto-firewalls-vulnerability-exploited-cve-2026-0300/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Securing Backup Systems Against Ransomware: A Critical Imperative
Financial Services6 months ago

Securing Backup Systems Against Ransomware: A Critical Imperative

In May 2026, a comprehensive analysis highlighted a critical vulnerability in organizational cybersecurity: the deliberate targeting and destruction of backup systems by ransomware attackers. Despite the presence of backup solutions, many organizations found their recovery mechanisms compromised due to exposed and unprotected backup infrastructures. Attackers exploited this weakness by gaining administrative credentials, accessing backup consoles, and deleting or encrypting backup files, rendering recovery efforts futile. This systematic approach underscores the necessity for enhanced security measures to protect backup systems from such targeted attacks. The increasing sophistication of ransomware tactics, including the focus on backup destruction, reflects a broader trend in cyber threats. Organizations must recognize that traditional backup strategies are insufficient against modern ransomware attacks. Implementing integrated solutions that combine backup with security controls, such as immutability, access protection, and threat detection, is essential to ensure data resilience and business continuity in the face of evolving cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
MuddyWater's Deceptive Tactics: Unmasking the Chaos Ransomware Facade
Government Administration6 months ago

MuddyWater's Deceptive Tactics: Unmasking the Chaos Ransomware Facade

In early 2026, the Iranian state-sponsored hacking group MuddyWater orchestrated a cyber-espionage operation disguised as a Chaos ransomware attack. Utilizing Microsoft Teams for social engineering, the attackers initiated chats with employees, conducted screen-sharing sessions, harvested credentials, manipulated multi-factor authentication settings, and deployed remote access tools like AnyDesk. This approach enabled them to establish persistence, exfiltrate data, and send extortion emails, all while maintaining the facade of a ransomware attack. ([rapid7.com](https://www.rapid7.com/blog/post/tr-muddying-tracks-state-sponsored-shadow-behind-chaos-ransomware/?utm_source=openai)) This incident underscores the evolving tactics of state-sponsored actors who blend traditional cybercrime methods with espionage objectives. The use of legitimate communication platforms for initial access highlights the need for organizations to enhance their security awareness training and implement robust monitoring of collaboration tools to detect and prevent such sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical vm2 Sandbox Vulnerability (CVE-2026-26956) Allows Host Code Execution
Computer Software/Engineering6 months ago

Critical vm2 Sandbox Vulnerability (CVE-2026-26956) Allows Host Code Execution

In May 2026, a critical vulnerability identified as CVE-2026-26956 was discovered in vm2, a widely-used Node.js sandboxing library. This flaw allows attackers to escape the sandbox environment and execute arbitrary code on the host system. The issue affects vm2 version 3.10.4 and earlier, particularly in environments running Node.js 25 with WebAssembly exception handling and JSTag support enabled. Exploitation involves triggering a specially crafted TypeError, leading to the leakage of host-side error objects into the sandbox, which attackers can manipulate to gain access to Node.js internals and execute commands on the host. The discovery of this vulnerability underscores the challenges in securely isolating untrusted code within JavaScript sandbox environments. Given vm2's extensive use in online coding platforms, automation tools, and SaaS applications, the potential impact is significant. Users are strongly advised to upgrade to vm2 version 3.10.5 or later to mitigate the risk associated with this vulnerability.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
OceanLotus's 2025 PyPI Supply Chain Attack: Unveiling the ZiChatBot Malware
Computer Software/Engineering6 months ago

OceanLotus's 2025 PyPI Supply Chain Attack: Unveiling the ZiChatBot Malware

In July 2025, the OceanLotus APT group initiated a supply chain attack by uploading malicious Python wheel packages to the Python Package Index (PyPI). These packages, named 'uuid32-utils', 'colorinal', and 'termncolor', acted as droppers for a previously unknown malware family called ZiChatBot, targeting both Windows and Linux platforms. The infection chain involved extracting a DLL or .SO dropper from the wheel package, establishing persistence via registry (Windows) or crontab (Linux), and deploying ZiChatBot. Notably, ZiChatBot utilized Zulip's public REST APIs as its command and control infrastructure, deviating from traditional dedicated servers and complicating detection efforts. The malicious packages were swiftly removed from PyPI, and the associated Zulip organization was deactivated. To date, no confirmed infections have been reported. This campaign underscores OceanLotus's expanding strategy of leveraging supply chain attacks to target a global audience, following a similar GitHub-based phishing campaign earlier in 2025.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Rockstar Games Data Breach: A Case Study in Third-Party Exploitation
Financial Services6 months ago

Rockstar Games Data Breach: A Case Study in Third-Party Exploitation

In April 2026, Rockstar Games experienced a significant data breach orchestrated by the cybercriminal group ShinyHunters. The attackers exploited vulnerabilities in Anodot, a monitoring tool integrated with Rockstar's Snowflake cloud infrastructure, to gain unauthorized access. This breach led to the exfiltration of nearly 80 million records, including sensitive internal corporate information. While Rockstar confirmed that no player data or passwords were compromised, the incident underscores the risks associated with third-party integrations and the potential for indirect attack vectors. This breach is part of a broader trend of financially motivated cyber extortion campaigns targeting major organizations. ShinyHunters' tactics, particularly their use of social engineering and exploitation of third-party services, highlight the evolving threat landscape. Organizations must remain vigilant, ensuring robust security measures are in place for both internal systems and external partnerships to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports