Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 218 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2605–2616 / 4903 reports
CISA Adds Eight Exploited Vulnerabilities to KEV Catalog
Government Administration6 months ago

CISA Adds Eight Exploited Vulnerabilities to KEV Catalog

On April 20, 2026, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) Catalog by adding eight new vulnerabilities, citing evidence of active exploitation. These vulnerabilities affect a range of products, including PaperCut NG/MF, JetBrains TeamCity, Kentico Xperience, Quest KACE Systems Management Appliance, Synacor Zimbra Collaboration Suite, and Cisco Catalyst SD-WAN Manager. The inclusion of these vulnerabilities underscores the persistent threat posed by unpatched software flaws, which can serve as entry points for malicious actors to compromise systems and exfiltrate sensitive data. The addition of these vulnerabilities to the KEV Catalog highlights the evolving landscape of cyber threats, where attackers continuously exploit both new and longstanding vulnerabilities. Organizations are urged to prioritize the remediation of these vulnerabilities to mitigate potential risks and enhance their cybersecurity posture.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Emerging Threat: Malware Embedded in WAV Audio Files
Computer Software/Engineering6 months ago

Emerging Threat: Malware Embedded in WAV Audio Files

In April 2026, cybersecurity researchers identified a novel malware delivery method where threat actors embedded malicious payloads within WAV audio files. Unlike traditional steganography, these WAV files contained Base64-encoded malware in place of actual audio data, resulting in files that played as noise. Upon decoding, the payload revealed an XOR-encoded Portable Executable (PE) file, which, once decrypted, executed the malicious code on the victim's system. This technique allowed attackers to bypass conventional security measures by disguising malware within seemingly innocuous audio files. This incident underscores the evolving sophistication of malware delivery methods, highlighting the need for advanced detection mechanisms capable of identifying non-traditional attack vectors. As threat actors continue to exploit unconventional file formats, organizations must enhance their security protocols to detect and mitigate such innovative threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Change Healthcare Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity
Health Care / Life Sciences6 months ago

Change Healthcare Ransomware Attack: A Wake-Up Call for Healthcare Cybersecurity

In February 2024, Change Healthcare, a subsidiary of UnitedHealth Group, suffered a ransomware attack by the ALPHV/BlackCat group. The attackers exploited compromised credentials lacking multi-factor authentication to access the company's systems, exfiltrated sensitive data, and deployed ransomware that severely disrupted operations. This breach halted electronic payments and medical claims processing, forcing patients to pay out-of-pocket for medications and healthcare services. The attack had an unprecedented impact on the U.S. healthcare system, causing widespread disruptions in healthcare delivery. The financial fallout was equally staggering, with UnitedHealth Group incurring approximately $2.87 billion in response costs during 2024. Additionally, the company paid $22 million in ransom to the attackers and provided over $6 billion in assistance to affected healthcare providers. The incident garnered global attention, highlighting the vulnerabilities in healthcare cybersecurity and underscoring the critical need for robust defenses in this sector, where the consequences of cyberattacks extend far beyond financial losses to directly affect patient care and safety. This incident underscores the growing dangers of ransomware attacks targeting healthcare data.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Navigating AI Security: Understanding Threat Modeling Frameworks in 2026
Financial Services6 months ago

Navigating AI Security: Understanding Threat Modeling Frameworks in 2026

In 2026, the evolution of artificial intelligence (AI) systems has necessitated the development of specialized threat modeling frameworks to address unique security challenges. Traditional models like STRIDE have been adapted to consider AI-specific threats, while new frameworks such as MAESTRO and STRIFE have emerged to provide comprehensive analyses of AI systems' vulnerabilities. These frameworks focus on aspects like adversarial attacks, data poisoning, and model manipulation, ensuring a holistic approach to AI security. The increasing deployment of AI in critical sectors underscores the importance of robust threat modeling. Organizations are now integrating AI-native threat modeling tools into their security practices to proactively identify and mitigate potential risks, thereby enhancing the resilience of AI systems against evolving cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Anthropic's Mythos AI Model: A Game-Changer in Vulnerability Discovery
Computer Software/Engineering6 months ago

Anthropic's Mythos AI Model: A Game-Changer in Vulnerability Discovery

In April 2026, Anthropic unveiled its advanced AI model, Claude Mythos, capable of autonomously identifying and exploiting thousands of zero-day vulnerabilities across major operating systems and web browsers. This unprecedented capability has raised significant concerns within the cybersecurity community, as the model's potential misuse could lead to widespread security breaches. To mitigate these risks, Anthropic has restricted access to Mythos, collaborating with select organizations under 'Project Glasswing' to responsibly address and patch the identified vulnerabilities. ([tomshardware.com](https://www.tomshardware.com/tech-industry/artificial-intelligence/anthropics-latest-ai-model-identifies-thousands-of-zero-day-vulnerabilities-in-every-major-operating-system-and-every-major-web-browser-claude-mythos-preview-sparks-race-to-fix-critical-bugs-some-unpatched-for-decades?utm_source=openai)) The emergence of AI models like Mythos signifies a paradigm shift in vulnerability discovery, compressing the time between identification and potential exploitation. This development underscores the urgent need for organizations to reassess their cybersecurity strategies, emphasizing proactive defense mechanisms and rapid response capabilities to address the accelerating pace of AI-driven threats. ([infotech.com](https://www.infotech.com/research/reassess-cybersecurity-exposure-in-the-age-of-ai-driven-vulnerability-discovery?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerability in Google Antigravity IDE Exposes Remote Code Execution Risk
Computer Software/Engineering6 months ago

Critical Vulnerability in Google Antigravity IDE Exposes Remote Code Execution Risk

In January 2026, researchers at Pillar Security identified a critical vulnerability in Google's Antigravity IDE, an AI-powered development environment. The flaw allowed attackers to exploit a prompt injection vulnerability in the 'find_by_name' tool, enabling remote code execution (RCE) by bypassing Antigravity's Secure Mode protections. This vulnerability was reported to Google on January 6, 2026, and a patch was released on February 28, 2026. The incident underscores the risks associated with AI-driven development tools and the necessity for rigorous security measures in their design and implementation. The discovery of this vulnerability highlights the growing trend of attackers targeting AI-powered tools through prompt injection techniques. As AI integration in development environments becomes more prevalent, ensuring the security of these systems is paramount to prevent potential exploitation and maintain trust in AI-driven solutions.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Microsoft Releases Emergency Updates to Resolve Windows Server April 2026 Issues
Information Technology/IT6 months ago

Microsoft Releases Emergency Updates to Resolve Windows Server April 2026 Issues

In April 2026, Microsoft released security updates for Windows Server systems, including KB5082063 for Windows Server 2025. Post-installation, administrators reported installation failures and domain controllers entering restart loops due to Local Security Authority Subsystem Service (LSASS) crashes. These issues disrupted authentication and directory services, potentially rendering domains unavailable. Microsoft responded by releasing out-of-band updates to address these problems across affected Windows Server versions. This incident underscores the critical importance of thorough testing and prompt remediation in software updates. Organizations must remain vigilant, ensuring that security patches do not inadvertently disrupt essential services, and be prepared to implement emergency updates when necessary.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Scattered Spider Leader Pleads Guilty to Multi-Million Dollar Crypto Theft
Financial Services6 months ago

Scattered Spider Leader Pleads Guilty to Multi-Million Dollar Crypto Theft

In April 2026, Tyler Robert Buchanan, a British national and alleged leader of the Scattered Spider cybercrime group, pleaded guilty in the United States to charges of wire fraud and aggravated identity theft. Between September 2021 and April 2023, Buchanan and his co-conspirators executed SMS phishing attacks targeting employees of various companies across industries such as entertainment, telecommunications, and technology. By impersonating legitimate entities, they obtained confidential information, enabling them to hijack email accounts through SIM swapping and steal over $8 million in cryptocurrency. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/british-scattered-spider-hacker-pleads-guilty-to-crypto-theft-charges/?utm_source=openai)) This case underscores the persistent threat posed by sophisticated social engineering tactics employed by cybercriminal groups like Scattered Spider. Organizations must remain vigilant against such methods, as the group's activities have led to significant financial losses and operational disruptions across multiple sectors. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/fbi-shares-tactics-of-notorious-scattered-spider-hacker-collective/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Surge in Microsoft Teams Helpdesk Impersonation Attacks in 2026
Information Technology/IT6 months ago

Surge in Microsoft Teams Helpdesk Impersonation Attacks in 2026

In April 2026, Microsoft reported a surge in cyberattacks where threat actors impersonated IT helpdesk personnel via Microsoft Teams. These attackers initiated cross-tenant chats, convincing employees to grant remote access under the guise of resolving account issues or performing security updates. Utilizing legitimate tools like Quick Assist and Rclone, they conducted reconnaissance, moved laterally across networks, and exfiltrated sensitive data to external cloud storage, effectively blending malicious activities with routine IT operations. This incident underscores a significant shift in cyberattack strategies, highlighting the exploitation of trusted collaboration platforms for social engineering. The increasing sophistication of such attacks necessitates heightened vigilance and robust security measures to protect against unauthorized access and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Gentlemen Ransomware's Strategic Use of SystemBC Botnet in April 2026
Oil/Energy/Solar/Greentech6 months ago

Gentlemen Ransomware's Strategic Use of SystemBC Botnet in April 2026

In April 2026, the Gentlemen ransomware-as-a-service (RaaS) operation was found to be utilizing the SystemBC proxy malware to enhance its attack capabilities. This collaboration led to the creation of a botnet comprising over 1,570 compromised hosts, primarily targeting corporate environments. The attackers gained initial access, escalated privileges to Domain Admin, and deployed Cobalt Strike payloads for lateral movement. They then used SystemBC to establish covert command-and-control channels, facilitating the deployment of ransomware payloads across the network. This sophisticated attack chain resulted in significant operational disruptions and data encryption for the affected organizations. The integration of SystemBC into ransomware operations signifies a concerning evolution in cybercriminal tactics, emphasizing the need for organizations to bolster their defenses against such multifaceted threats. The incident underscores the importance of comprehensive security measures, including network segmentation, regular patching, and advanced threat detection systems, to mitigate the risks posed by increasingly sophisticated ransomware campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
FakeWallet Campaign: Crypto-Stealing Apps Infiltrate China's Apple App Store
Financial Services6 months ago

FakeWallet Campaign: Crypto-Stealing Apps Infiltrate China's Apple App Store

In April 2026, a campaign named 'FakeWallet' was discovered, involving 26 malicious applications on China's Apple App Store that impersonated popular cryptocurrency wallets like Metamask, Coinbase, Trust Wallet, and OneKey. These apps were designed to steal users' recovery or seed phrases, enabling attackers to drain cryptocurrency assets. The threat actors employed typosquatting and fake branding to deceive users into downloading these apps, which were disguised as games or calculator applications to circumvent regional restrictions. Upon installation, the apps redirected users to phishing sites that mimicked legitimate crypto services, prompting them to download trojanized wallet apps via iOS provisioning profiles. These malicious apps intercepted mnemonic phrases during wallet setup or recovery processes, encrypted them, and transmitted the data to the attackers, facilitating unauthorized access to victims' cryptocurrency funds. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/chinas-apple-app-store-infiltrated-by-crypto-stealing-wallet-apps/?utm_source=openai)) This incident underscores a growing trend of sophisticated cyber threats targeting cryptocurrency users through official app stores, highlighting the need for enhanced vigilance and security measures. The use of legitimate enterprise features like iOS provisioning profiles for malicious purposes indicates an evolution in attack vectors, emphasizing the importance of continuous monitoring and user education to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
KelpDAO's $290 Million DeFi Breach: A Wake-Up Call for Cross-Chain Security
Financial Services6 months ago

KelpDAO's $290 Million DeFi Breach: A Wake-Up Call for Cross-Chain Security

In April 2026, KelpDAO, a decentralized finance (DeFi) platform, suffered a significant security breach resulting in the theft of approximately $290 million worth of rsETH tokens. The attackers exploited vulnerabilities in KelpDAO's cross-chain bridge, specifically targeting the verification layer by compromising remote procedure call (RPC) nodes. This manipulation allowed them to forge cross-chain messages and illicitly transfer funds. Preliminary investigations attribute the attack to North Korea's state-sponsored Lazarus Group, known for sophisticated cyber operations targeting financial institutions. This incident underscores the critical importance of robust security configurations in DeFi platforms, particularly concerning cross-chain interoperability. The reliance on a single-verifier setup without redundancy exposed KelpDAO to this exploit. As DeFi continues to evolve, ensuring multi-layered security measures and adhering to best practices in system architecture are imperative to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports