Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 208 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2485–2496 / 4903 reports
LiteLLM CVE-2026-42208: Rapid Exploitation of Critical SQL Injection Vulnerability
Computer Software/Engineering6 months ago

LiteLLM CVE-2026-42208: Rapid Exploitation of Critical SQL Injection Vulnerability

In April 2026, a critical SQL injection vulnerability (CVE-2026-42208) was discovered in BerriAI's LiteLLM Python package, a widely used AI gateway. This flaw allowed unauthenticated attackers to execute arbitrary SQL commands against the proxy's database, potentially leading to unauthorized access and modification of sensitive data. The vulnerability affected versions >=1.81.16 and <1.83.7. Despite a patch being released on April 19, 2026, exploitation attempts were observed within 36 hours of public disclosure, indicating rapid weaponization by threat actors. ([thehackernews.com](https://thehackernews.com/2026/04/litellm-cve-2026-42208-sql-injection.html?utm_source=openai)) This incident underscores the increasing speed at which cyber adversaries exploit newly disclosed vulnerabilities, particularly in widely adopted open-source software. Organizations relying on such tools must prioritize timely patching and implement robust monitoring to detect and mitigate exploitation attempts promptly.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Massive Roblox Account Hijacking Scheme Disrupted by Ukrainian Authorities
Computer Games6 months ago

Massive Roblox Account Hijacking Scheme Disrupted by Ukrainian Authorities

In April 2026, Ukrainian authorities arrested three individuals aged 19, 21, and 22 for compromising over 610,000 Roblox accounts between October 2025 and January 2026. The group distributed malware disguised as game-enhancing tools to steal login credentials, targeting high-value accounts with substantial in-game assets and currency. These accounts were then sold on Russian websites and closed online communities, generating approximately $225,000 in illicit profits. The suspects face charges under articles 185 and 361 of the Ukrainian Criminal Code, with potential sentences of up to 15 years in prison. This incident underscores the growing trend of cybercriminals targeting gaming platforms due to the real-world value of virtual assets. It highlights the importance of robust cybersecurity measures and user education to prevent such breaches, as well as the need for international cooperation in combating cybercrime.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
SAP npm Packages Compromised in 'Mini Shai-Hulud' Supply Chain Attack
Computer Software/Engineering6 months ago

SAP npm Packages Compromised in 'Mini Shai-Hulud' Supply Chain Attack

On April 29, 2026, a sophisticated supply chain attack targeted SAP's JavaScript and cloud application development ecosystem by compromising several npm packages, including mbt@1.2.48, @cap-js/db-service@2.10.1, @cap-js/postgres@2.2.2, and @cap-js/sqlite@2.2.2. The attackers introduced a preinstall script that downloaded and executed a malicious payload via the Bun JavaScript runtime, enabling the theft of developer credentials, GitHub and npm tokens, and cloud service secrets. The stolen data was exfiltrated to public GitHub repositories created on the victims' accounts, labeled with the description 'A Mini Shai-Hulud has Appeared.' ([thehackernews.com](https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks targeting development environments, particularly within widely-used frameworks like SAP's CAP model. The attack's sophistication, including its ability to propagate through developer workflows and exploit AI coding agent configurations, highlights the need for enhanced security measures in software development pipelines. ([thehackernews.com](https://thehackernews.com/2026/04/sap-npm-packages-compromised-by-mini.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV
Information Technology/IT6 months ago

CISA Adds Actively Exploited ConnectWise and Windows Flaws to KEV

In April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2024-1708, a path traversal flaw in ConnectWise ScreenConnect, and CVE-2026-32202, a protection mechanism failure in Microsoft Windows Shell. CVE-2024-1708 allows remote code execution or unauthorized access to sensitive data, while CVE-2026-32202 enables network-based spoofing attacks. Both vulnerabilities have been actively exploited by threat actors, including the China-based group Storm-1175 deploying Medusa ransomware and the Russian APT28 targeting Ukraine and EU countries. Federal agencies are mandated to remediate these vulnerabilities by May 12, 2026. ([thehackernews.com](https://thehackernews.com/2026/04/cisa-adds-actively-exploited.html?utm_source=openai)) The inclusion of these vulnerabilities in the KEV catalog underscores the persistent threat posed by state-sponsored actors exploiting known flaws. Organizations must prioritize patching and enhance monitoring to mitigate risks associated with these and similar vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Credential-Stealing Malware Found in Official SAP npm Packages
Computer Software/Engineering6 months ago

Credential-Stealing Malware Found in Official SAP npm Packages

In April 2026, a sophisticated supply chain attack targeted SAP's Cloud Application Programming Model (CAP) by compromising four official npm packages: @cap-js/sqlite v2.2.2, @cap-js/postgres v2.2.2, @cap-js/db-service v2.10.1, and mbt v1.2.48. The attackers, identified as TeamPCP, injected malicious 'preinstall' scripts into these packages, which, upon installation, executed a multi-stage payload designed to steal a wide array of credentials from developers' systems and CI/CD environments. The stolen data included npm and GitHub authentication tokens, SSH keys, and cloud credentials for AWS, Azure, and Google Cloud. The malware also attempted to extract secrets directly from the CI runner's memory, bypassing standard log masking mechanisms. The exfiltrated data was encrypted and uploaded to public GitHub repositories under the victim's account, with descriptions indicating the presence of 'A Mini Shai-Hulud.' This incident underscores the escalating threat of supply chain attacks targeting widely-used development tools and the necessity for robust security measures in software development pipelines.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Vidar Infostealer 2026 Breach: A Wake-Up Call for Enhanced Security Measures
Financial Services6 months ago

Vidar Infostealer 2026 Breach: A Wake-Up Call for Enhanced Security Measures

In early 2026, the Vidar infostealer malware emerged as a dominant threat in the cybercriminal ecosystem, exploiting the void left by the takedowns of Lumma and Rhadamanthys. Vidar's operators released significant upgrades and expanded distribution channels, leading to widespread infections across various sectors. The malware targets sensitive data, including credentials, cookies, and cryptocurrency wallets, facilitating unauthorized access and potential financial losses. Organizations such as Pickett & Associates, Deloitte, KPMG, and Samsung were among those compromised due to inadequate multi-factor authentication (MFA) enforcement, resulting in the exfiltration of substantial volumes of sensitive data. ([techradar.com](https://www.techradar.com/pro/security/dozens-of-organizations-fall-victim-to-infostealers-after-failing-to-enforce-mfa?utm_source=openai)) This incident underscores the critical importance of implementing robust security measures, particularly MFA, to protect against credential theft. The rapid evolution and distribution of infostealer malware like Vidar highlight the need for continuous vigilance and proactive defense strategies to mitigate emerging cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Ransomware Rivalry: 0APT and KryBit Expose Each Other's Operations
Computer/Network Security6 months ago

Ransomware Rivalry: 0APT and KryBit Expose Each Other's Operations

In April 2026, a rare conflict erupted between two emerging ransomware-as-a-service (RaaS) groups, 0APT and KryBit. 0APT, initially known for fabricating victim claims, targeted rival ransomware operators, including KryBit, by leaking their operational data. This exposure revealed KryBit's infrastructure, personnel details, and victim negotiations. In retaliation, KryBit breached 0APT's systems, exposing fabricated victim lists and defacing 0APT's leak site. This mutual exposure has significantly disrupted both groups' operations, necessitating infrastructure rebuilding and rebranding efforts. This incident underscores the volatile nature of cybercriminal alliances and the potential for internal conflicts to disrupt malicious operations. For defenders, such feuds provide valuable insights into ransomware tactics, techniques, and procedures, enhancing preparedness against future attacks.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
BlueNoroff's AI-Driven Fake Zoom Attacks on Crypto Executives
Capital Markets/Hedge Fund/Private Equity6 months ago

BlueNoroff's AI-Driven Fake Zoom Attacks on Crypto Executives

In April 2026, the North Korean state-sponsored hacking group BlueNoroff launched a sophisticated campaign targeting cryptocurrency executives. The attackers impersonated trusted contacts to schedule fake Zoom meetings, utilizing AI-generated avatars and stolen video footage to create convincing virtual environments. During these meetings, victims were prompted to install malicious software under the guise of resolving technical issues, leading to the installation of malware designed for credential theft, persistent access, and cryptocurrency wallet exfiltration. This campaign underscores the evolving threat landscape where attackers leverage advanced social engineering techniques and AI to enhance the credibility of their schemes. Organizations, especially in the cryptocurrency sector, must remain vigilant against such deceptive tactics and implement robust security measures to protect against these sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical cPanel Authentication Vulnerability: Immediate Action Required
Information Technology/IT6 months ago

Critical cPanel Authentication Vulnerability: Immediate Action Required

In April 2026, cPanel identified a critical authentication vulnerability affecting all supported versions of its software, potentially allowing unauthorized access to control panel interfaces. The issue was addressed with patches released on April 28, 2026, for versions 11.110.0.97, 11.118.0.63, 11.126.0.54, 11.132.0.29, 11.136.0.5, and 11.134.0.20. Organizations were urged to update their systems promptly to mitigate the risk of exploitation. ([thehackernews.com](https://thehackernews.com/2026/04/critical-cpanel-authentication.html?utm_source=openai)) This incident underscores the importance of timely patch management and proactive security measures, as attackers were reportedly exploiting the vulnerability before the patch was available. ([cyberkendra.com](https://www.cyberkendra.com/2026/04/cpanel-authentication-bypass-was.html?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog
Government Administration6 months ago

CISA Adds Two Critical Vulnerabilities to Known Exploited Vulnerabilities Catalog

On April 28, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added two vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog: CVE-2024-1708, a path traversal vulnerability in ConnectWise ScreenConnect versions 23.9.7 and prior, and CVE-2026-32202, a Windows Shell protection mechanism failure. CVE-2024-1708 allows attackers to execute remote code or access sensitive data by exploiting improper path handling, while CVE-2026-32202 enables attackers to steal NTLMv2 hashes without user interaction, leading to potential unauthorized access. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2024-1708/?utm_source=openai)) The inclusion of these vulnerabilities in the KEV Catalog underscores the ongoing threat posed by actively exploited security flaws. Organizations are urged to prioritize patching these vulnerabilities to mitigate risks associated with remote code execution and unauthorized data access, which can lead to significant operational disruptions and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
DPRK-Linked Supply Chain Attack on Axios npm Package in 2026
Computer Software/Engineering6 months ago

DPRK-Linked Supply Chain Attack on Axios npm Package in 2026

In March 2026, North Korean state-sponsored hackers, identified as UNC1069, executed a sophisticated supply chain attack by compromising the widely-used JavaScript library Axios. The attackers gained access to the maintainer's npm account and published malicious versions 1.14.1 and 0.30.4, which included a remote access trojan (RAT). This malware granted the attackers control over infected systems, potentially leading to credential theft and persistent access. The malicious versions were available for approximately three hours before detection and removal, during which time they were downloaded millions of times, posing a significant risk to developers and organizations worldwide. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The rapid deployment and widespread use of compromised packages highlight the need for enhanced security measures in software development pipelines. Organizations must implement stringent monitoring and verification processes to safeguard against such vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Understanding and Mitigating AI-Driven Cyberattacks
Financial Services6 months ago

Understanding and Mitigating AI-Driven Cyberattacks

In February 2026, cybersecurity researchers identified a significant evolution in attack methodologies: threat actors are now leveraging custom AI systems to automate and expedite the cyber kill chain. This advancement enables attackers to autonomously map Active Directory structures and obtain Domain Admin credentials within minutes, drastically reducing the time required for system compromise. The integration of AI into cyberattacks has rendered traditional defensive workflows insufficient, as these automated systems can adapt and execute complex attacks with unprecedented speed and precision. This development underscores a critical shift in the cybersecurity landscape, where AI-enhanced attacks are no longer theoretical but a present reality. Organizations must recognize the urgency of adapting their security strategies to counteract these sophisticated threats. The rapid adoption of AI by malicious actors necessitates a reevaluation of existing defenses to ensure they are capable of mitigating the risks posed by autonomous cyberattacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports