Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 216 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2581–2592 / 4903 reports
Moltbook's 2026 Security Breach: A Wake-Up Call for AI Platform Security
Computer Software/Engineering6 months ago

Moltbook's 2026 Security Breach: A Wake-Up Call for AI Platform Security

In late January 2026, Moltbook, a social network designed exclusively for AI agents, suffered a significant security breach due to an exposed Supabase API key embedded in client-side JavaScript. This vulnerability allowed unauthorized access to the platform's production database, exposing 1.5 million API tokens, 35,000 email addresses, and private messages between agents. The breach was promptly identified and reported by cybersecurity firm Wiz, leading to a swift response from Moltbook to patch the vulnerability and reset all agent API keys. ([techradar.com](https://www.techradar.com/pro/security/ai-agent-social-media-network-moltbook-is-a-security-disaster-millions-of-credentials-and-other-details-left-unsecured?utm_source=openai)) This incident underscores the critical importance of implementing robust security measures, especially in rapidly developed AI-driven platforms. The exposure of sensitive data not only compromises user privacy but also highlights the potential risks associated with 'vibe coding'—developing applications with AI assistance without thorough security oversight. Organizations must prioritize security protocols to prevent similar breaches in the future. ([trustfinance.com](https://www.trustfinance.com/en-US/blog/wiz-finds-major-data-leak-in-moltbook-ai-social-network?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Harvester's Linux GoGra Backdoor: A New Threat in South Asia
Government Administration6 months ago

Harvester's Linux GoGra Backdoor: A New Threat in South Asia

In April 2026, the Harvester threat actor deployed a new Linux variant of its GoGra backdoor targeting entities in South Asia. The malware utilizes the Microsoft Graph API and Outlook mailboxes as covert command-and-control channels, enabling it to bypass traditional network defenses. Initial access is achieved through social engineering tactics, tricking victims into executing ELF binaries disguised as PDF documents. Once installed, the backdoor communicates with a specific Outlook mailbox folder named "Zomato Pizza," executing commands received via emails with subjects starting with "Input" and sending execution results back with the subject "Output." ([thehackernews.com](https://thehackernews.com/2026/04/harvester-deploys-linux-gogra-backdoor.html?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors like Harvester, who are expanding their toolsets to include cross-platform capabilities and leveraging legitimate cloud services to evade detection. The use of Microsoft's cloud infrastructure for command-and-control highlights the need for organizations to monitor and secure their cloud environments against such sophisticated threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Telegram 'tdata' Folder Exploited in Credential Harvesting Attack - April 2026
Information Technology/IT6 months ago

Telegram 'tdata' Folder Exploited in Credential Harvesting Attack - April 2026

In April 2026, a sophisticated cyberattack was observed targeting Telegram Desktop users through the exploitation of the 'tdata' folder, which stores session data. Attackers gained initial access via weak SSH credentials, conducted system reconnaissance, and specifically sought out the 'tdata' directory to harvest Telegram session tokens. This method allowed them to bypass two-factor authentication and gain unauthorized access to users' Telegram accounts, leading to potential data exfiltration and account misuse. The incident underscores the evolving tactics of threat actors who are now combining resource hijacking with credential harvesting to establish persistent access and exploit digital identities. This trend highlights the critical need for robust SSH configurations, vigilant monitoring of sensitive directories, and comprehensive session management practices to mitigate such multifaceted threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Detection Strategies Against Infiltrating IT Workers
Information Technology/IT6 months ago

Detection Strategies Against Infiltrating IT Workers

In April 2026, Microsoft reported that the North Korean state-sponsored group Jasper Sleet exploited remote work trends by posing as legitimate IT hires using fabricated identities and AI-assisted deception. These operatives infiltrated organizations to gain trusted access, leading to data theft, extortion, and potential follow-on compromises. The attackers systematically surveyed job postings, crafted convincing applications, and, once hired, accessed sensitive company resources. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/21/detection-strategies-cloud-identities-against-infiltrating-it-workers/?utm_source=openai)) This incident underscores the evolving tactics of nation-state actors leveraging AI to enhance social engineering attacks, highlighting the urgent need for organizations to strengthen identity verification processes and monitor for anomalous behaviors during recruitment and onboarding phases. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/21/detection-strategies-cloud-identities-against-infiltrating-it-workers/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling Critical APT Exploit Chains: A 2026 Analysis
Computer Software/Engineering6 months ago

Unveiling Critical APT Exploit Chains: A 2026 Analysis

In April 2026, Praetorian's analysis revealed that out of 500,000 vulnerability findings, only 14 endpoints were susceptible to critical exploit chains capable of full host compromise. These chains combined multiple vulnerabilities, including CVE-2025-4918 and CVE-2025-2857, to enable zero-click attacks through browser exploits. Notably, one chain was actively exploited by the Russian-aligned APT group RomCom, targeting sectors such as government, defense, and energy across Europe and North America. This incident underscores the necessity for organizations to move beyond traditional CVSS-based vulnerability assessments and adopt exploit chain analysis to identify and mitigate real-world attack paths effectively. The increasing sophistication of APT groups in leveraging complex exploit chains highlights the urgent need for enhanced threat intelligence integration and proactive security measures to protect critical infrastructure and sensitive data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
NGate Malware Variant Exploits HandyPay App to Steal NFC Data
Financial Services6 months ago

NGate Malware Variant Exploits HandyPay App to Steal NFC Data

In November 2025, ESET researchers identified a new variant of the NGate malware family targeting Android users in Brazil. This variant exploits a legitimate NFC payment application called HandyPay by embedding malicious code, likely generated with the assistance of AI. The malware captures NFC data and payment card PINs from victims, enabling attackers to perform unauthorized contactless ATM withdrawals and payments. Distribution methods include fake lottery websites and counterfeit Google Play pages, indicating a coordinated effort by a single threat actor. This incident underscores the evolving sophistication of cyber threats, particularly the integration of AI in malware development. The use of legitimate applications as vectors for malware distribution highlights the need for heightened vigilance and robust security measures to protect sensitive financial information.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
DigitalMint Negotiator's Betrayal: A Stark Warning for Cybersecurity
Financial Services6 months ago

DigitalMint Negotiator's Betrayal: A Stark Warning for Cybersecurity

In April 2026, Angelo Martino, a former ransomware negotiator at DigitalMint, pleaded guilty to conspiring with the BlackCat (ALPHV) ransomware group to extort five U.S. companies. Martino exploited his position by sharing confidential information, including victims' insurance policy limits and negotiation strategies, with the attackers. This collaboration led to ransom payments totaling approximately $75.3 million from sectors such as nonprofit, hospitality, financial services, retail, and medical industries. Martino faces up to 20 years in federal prison, with sentencing scheduled for July 9, 2026. This case underscores the critical need for stringent vetting and oversight of cybersecurity professionals, as insider threats can significantly amplify the impact of cyberattacks. The incident also highlights the evolving tactics of ransomware groups, emphasizing the importance of comprehensive security measures and employee integrity in safeguarding organizational assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Insider Threats in Cybersecurity: Lessons from the BlackCat Ransomware Case
Financial Services6 months ago

Insider Threats in Cybersecurity: Lessons from the BlackCat Ransomware Case

In April 2026, Angelo Martino, a former ransomware negotiator at DigitalMint, pleaded guilty to collaborating with the BlackCat (ALPHV) ransomware group in 2023. Martino, along with accomplices Ryan Goldberg and Kevin Martin, exploited their insider positions to share confidential negotiation details with BlackCat operators, facilitating the extortion of higher ransom payments from U.S. organizations. Their victims included financial services firms, nonprofits, law firms, school districts, and medical facilities, with ransom payments exceeding $50 million. The trio operated as BlackCat affiliates, paying the ransomware administrators a 20% share of the proceeds. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/former-ransomware-negotiator-pleads-guilty-to-blackcat-attacks/?utm_source=openai)) This case underscores the critical need for stringent internal controls and trust verification within cybersecurity firms. The involvement of trusted insiders in cybercriminal activities highlights the evolving tactics of ransomware groups and the importance of comprehensive security measures to protect sensitive information and maintain organizational integrity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
NGate Malware Exploits HandyPay App to Steal NFC Payment Data
Financial Services6 months ago

NGate Malware Exploits HandyPay App to Steal NFC Payment Data

In April 2026, ESET researchers identified a new variant of the NGate malware targeting Android users in Brazil. This malware is embedded within a trojanized version of HandyPay, a legitimate NFC payment application. Once installed, the malicious app prompts users to set it as the default NFC payment application, requests their card PIN, and instructs them to tap their card on the device. The malware then captures and transmits the NFC payment data and PIN to attackers, enabling unauthorized transactions and ATM withdrawals. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ngate-android-malware-uses-handypay-nfc-app-to-steal-card-data/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who exploit trusted applications to distribute malware, highlighting the need for heightened vigilance among Android users regarding app sources and permissions. The use of generative AI in developing such malware indicates a concerning trend towards more sophisticated and accessible cyber threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ngate-android-malware-uses-handypay-nfc-app-to-steal-card-data/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Urgent Alert: Active Exploitation of Cisco SD-WAN Vulnerability CVE-2026-20133
Government Administration6 months ago

Urgent Alert: Active Exploitation of Cisco SD-WAN Vulnerability CVE-2026-20133

In April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) identified active exploitation of a critical vulnerability (CVE-2026-20133) in Cisco Catalyst SD-WAN Manager. This flaw, stemming from insufficient file system access restrictions, allows unauthenticated remote attackers to access sensitive information on affected systems. Cisco had patched this vulnerability in February 2026, but unpatched systems remain at risk. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-flags-new-sd-wan-flaw-as-actively-exploited-in-attacks/?utm_source=openai)) The exploitation of CVE-2026-20133 underscores the persistent threat posed by unpatched vulnerabilities in critical network infrastructure. Organizations are urged to prioritize timely patching and adhere to CISA's directives to mitigate potential breaches and safeguard sensitive data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Apache ActiveMQ Vulnerability (CVE-2026-34197) Under Active Exploitation
Financial Services6 months ago

Critical Apache ActiveMQ Vulnerability (CVE-2026-34197) Under Active Exploitation

In April 2026, a critical remote code execution vulnerability (CVE-2026-34197) was discovered in Apache ActiveMQ, an open-source message broker widely used for asynchronous communication between Java applications. This flaw, stemming from improper input validation in the Jolokia JMX-HTTP bridge, allows authenticated attackers to execute arbitrary code on unpatched systems. Despite a patch being released on March 30, 2026, over 6,400 ActiveMQ servers remain exposed and vulnerable to ongoing attacks, with the majority located in Asia, North America, and Europe. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has confirmed active exploitation of this vulnerability and has urged organizations to secure their servers by April 30, 2026. The active exploitation of CVE-2026-34197 underscores the persistent threat posed by unpatched vulnerabilities in widely used software. Organizations must prioritize timely patching and robust security measures to mitigate the risks associated with such vulnerabilities, especially given the widespread use of Apache ActiveMQ in critical systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SystemBC C2 Server Unveils Extensive Botnet Linked to The Gentlemen Ransomware
Financial Services6 months ago

SystemBC C2 Server Unveils Extensive Botnet Linked to The Gentlemen Ransomware

In April 2026, cybersecurity researchers uncovered that The Gentlemen ransomware-as-a-service (RaaS) operation had deployed SystemBC proxy malware, leading to the discovery of a botnet comprising over 1,570 victims. SystemBC establishes SOCKS5 network tunnels within compromised environments, facilitating covert communication and the deployment of additional malware payloads. The Gentlemen group, active since mid-2025, has targeted Windows, Linux, NAS, and BSD systems, employing sophisticated tactics such as abusing Group Policy Objects for domain-wide compromise. The group's rapid expansion and technical capabilities underscore the evolving threat landscape posed by RaaS operations. This incident highlights the increasing sophistication and scale of ransomware operations, emphasizing the need for organizations to enhance their cybersecurity defenses. The use of proxy malware like SystemBC for covert operations and the targeting of diverse systems indicate a shift towards more versatile and resilient attack strategies by cybercriminal groups.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports