The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Aeternum C2 Botnet: A New Era of Blockchain-Based Cyber Threats
In February 2026, cybersecurity researchers uncovered the Aeternum C2 botnet, developed by the threat actor known as LenAI. This botnet distinguishes itself by utilizing the Polygon blockchain to store encrypted command-and-control (C2) instructions, thereby circumventing traditional takedown methods that target centralized servers. Infected machines retrieve commands from smart contracts on the blockchain, making the botnet's infrastructure highly resilient and challenging to disrupt. ([thehackernews.com](https://thehackernews.com/2026/02/aeternum-c2-botnet-stores-encrypted.html?utm_source=openai)) The emergence of Aeternum C2 underscores a significant shift in cybercriminal tactics, leveraging decentralized technologies to enhance the persistence and stealth of malicious operations. This development highlights the need for adaptive cybersecurity strategies to address the evolving threat landscape posed by blockchain-based malware. ([infosecurity-magazine.com](https://www.infosecurity-magazine.com/news/aeternum-botnet-c2-polygon/?utm_source=openai))
6 months ago
Kill Chain
Recorded Future and CYBERA Join Forces to Tackle Escalating Money Mule Fraud
In February 2026, Recorded Future announced an expansion of its payment fraud prevention capabilities through a partnership with CYBERA, a leader in detecting and verifying data on scam-linked bank accounts. This collaboration introduces Money Mule Intelligence, a tool designed to help fraud teams identify accounts used by criminals to extract and move stolen funds. The initiative addresses the escalating threat of Authorized Push Payment (APP) fraud, which is projected to reach nearly $15 billion in the U.S. by 2028, up from $8.3 billion in 2024. The rise in APP fraud is driven by factors such as AI-generated deepfakes, personalized scam scripts, and instant payment systems that outpace traditional fraud controls. Money mule accounts serve as critical infrastructure for these scams, enabling the conversion of stolen payments into untraceable cash or cryptocurrency. The sophistication of mule operations has increased, with criminals employing 'mule herders' who manage numerous accounts and use AI to simulate normal transaction behavior, making detection challenging. Regulators are responding by shifting liability to banks, emphasizing the need for proactive detection and disruption of mule accounts to prevent fraud and comply with emerging reimbursement requirements.
6 months ago
Kill Chain
Anthropic's Claude Code Vulnerabilities Expose Developers to Security Risks
In late 2025, security researchers identified critical vulnerabilities in Anthropic's AI-powered development tool, Claude Code. These flaws, specifically CVE-2025-59536 and CVE-2026-21852, allowed attackers to execute arbitrary code and steal API keys by exploiting project configuration files. By manipulating these files, malicious actors could trigger unauthorized actions when developers opened compromised repositories, potentially compromising developer machines and enterprise resources. Anthropic promptly addressed these issues by releasing patches to mitigate the risks. This incident underscores the evolving threat landscape as AI tools become integral to software development workflows. The exploitation of AI-driven tools for supply chain attacks highlights the need for enhanced security measures and vigilance in managing development environments. Organizations must adapt their security protocols to address the unique challenges posed by AI integration in their software supply chains.
6 months ago
Kill Chain
FBI Seizes RAMP Cybercrime Forum, Disrupting Ransomware Operations
In January 2026, the FBI, in coordination with the U.S. Attorney’s Office for the Southern District of Florida and the Department of Justice’s Computer Crime and Intellectual Property Section, seized the RAMP cybercrime forum. Established in July 2021, RAMP was a Russian-language platform that openly permitted ransomware-as-a-service (RaaS) operations, serving as a hub for ransomware groups like LockBit, ALPHV/BlackCat, and RansomHub. The forum facilitated the promotion of RaaS activities, recruitment of affiliates, and trading of initial network access. The seizure disrupted a significant coordination point for ransomware operators, potentially leading to a short-term decline in ransomware attacks. However, the long-term impact remains uncertain as cybercriminals may migrate to alternative platforms or establish new forums. Law enforcement's access to RAMP's user data could lead to further investigations and arrests, underscoring the ongoing efforts to combat cybercrime.
6 months ago
Kill Chain
Critical Cisco Catalyst SD-WAN Vulnerability Exploited in the Wild
In February 2026, a critical vulnerability (CVE-2026-20127) was discovered in Cisco Catalyst SD-WAN Controller and Manager, allowing unauthenticated remote attackers to bypass authentication and gain administrative privileges. Exploitation involves sending crafted requests to the affected systems, enabling attackers to manipulate network configurations via NETCONF. This vulnerability has been actively exploited since at least 2023 by a sophisticated threat actor identified as UAT-8616. ([socradar.io](https://socradar.io/blog/cve-2026-20127-cisco-catalyst-sd-wan-auth-bypass/?utm_source=openai)) The incident underscores the persistent threat posed by vulnerabilities in widely used network infrastructure. Organizations must prioritize timely patching and implement robust access controls to mitigate such risks. ([fortra.com](https://www.fortra.com/security/emerging-threats/critical-vulnerability-affecting-cisco-catalyst-sd-wan?utm_source=openai))
6 months ago
Kill Chain
Cisco 2026 Zero-Day Exploitation by UAT-8616
In February 2026, authorities disclosed that since 2023, attackers have been exploiting two zero-day vulnerabilities in Cisco's network edge software. The threat actor, identified as UAT-8616, utilized CVE-2026-20127 to bypass authentication and subsequently downgraded the software to exploit CVE-2022-20775, achieving root access. This sophisticated campaign targeted critical infrastructure sectors, establishing persistent footholds without detection. This incident underscores a growing trend of targeting network edge devices to gain long-term access to high-value organizations. The prolonged undetected exploitation highlights the need for enhanced monitoring and rapid response mechanisms to address emerging threats.
6 months ago
Kill Chain
Diesel Vortex Phishing Attack Targets Freight and Logistics Sector in 2025
In late 2025, a cybercriminal group known as 'Diesel Vortex' orchestrated a sophisticated phishing campaign targeting freight and logistics companies across the United States and Europe. Utilizing 52 deceptive domains, the attackers impersonated legitimate platforms such as DAT Truckstop, TIMOCOM, and Penske Logistics to harvest credentials from industry professionals. The campaign led to the compromise of 1,649 unique accounts, facilitating unauthorized access to critical systems and enabling fraudulent activities, including cargo theft and financial fraud. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/phishing-campaign-targets-freight-and-logistics-orgs-in-the-us-europe/?utm_source=openai)) This incident underscores a growing trend of targeted cyberattacks within the logistics sector, highlighting the urgent need for enhanced security measures and employee training to mitigate the risks associated with phishing and credential theft. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/phishing-campaign-targets-freight-and-logistics-orgs-in-the-us-europe/?utm_source=openai))
6 months ago
Kill Chain
U.S. Sanctions Russian Exploit Broker for Stolen Cyber Tools
In February 2026, the U.S. Department of the Treasury sanctioned Russian exploit broker Operation Zero and its owner, Sergey Zelenyuk, for acquiring and distributing cyber tools harmful to U.S. national security. These tools, including at least eight proprietary cyber exploits stolen from U.S. defense contractor L3Harris by former employee Peter Williams, were sold to unauthorized users. Williams pleaded guilty to theft of trade secrets in October 2025 and was sentenced to over seven years in prison. The sanctions also targeted associated individuals and entities, including UAE-based Special Technology Services LLC FZ, for their roles in the illicit trade of these cyber tools. This incident underscores the persistent threat posed by the illicit trade of zero-day exploits and the involvement of insiders in compromising sensitive information. It highlights the need for robust internal security measures and vigilant monitoring to prevent unauthorized access and distribution of critical cyber tools.
6 months ago
Kill Chain
Critical Zyxel Router Vulnerability (CVE-2025-13942) Exposes Networks to Remote Attacks
In February 2026, Zyxel identified a critical command injection vulnerability (CVE-2025-13942) in the UPnP function of several router models, including 4G LTE/5G NR CPE, DSL/Ethernet CPE, Fiber ONTs, and wireless extenders. This flaw allows unauthenticated remote attackers to execute operating system commands on affected devices by sending specially crafted UPnP SOAP requests. While the vulnerability has a CVSS score of 9.8, its exploitation is contingent upon both UPnP and WAN access being enabled, with the latter disabled by default. Zyxel has released security patches to address this issue and strongly advises users to update their firmware promptly. The significance of this vulnerability is underscored by the widespread deployment of Zyxel devices, often provided by internet service providers as default equipment. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) is monitoring multiple Zyxel vulnerabilities, highlighting the ongoing risk to network security.
6 months ago
Kill Chain
Marquis Software Solutions Ransomware Attack: A Supply Chain Vulnerability Exposed
In August 2025, Marquis Software Solutions, a Texas-based fintech firm serving over 700 financial institutions, experienced a ransomware attack that compromised sensitive data of more than 780,000 individuals across at least 80 banks and credit unions. The attackers exploited a vulnerability in SonicWall's firewall backup service, gaining unauthorized access to Marquis's network and exfiltrating personal information, including names, addresses, Social Security numbers, and financial account details. This breach underscores the critical importance of securing third-party services and the potential cascading effects of supply chain vulnerabilities. The incident highlights the growing trend of cybercriminals targeting supply chain weaknesses to infiltrate organizations, emphasizing the need for comprehensive security assessments and robust vendor management practices to mitigate such risks.
6 months ago
Kill Chain
OpenClaw Supply Chain Attack 2026: Lessons Learned
In February 2026, the OpenClaw AI assistant platform faced a significant supply chain attack. Malicious actors uploaded over 230 compromised 'skills' to ClawHub, OpenClaw's skill repository, between January 27 and 29. These skills, often disguised as crypto trading tools, were designed to exfiltrate sensitive user data, including cryptocurrency wallets and browser information. The attack exploited OpenClaw's extensive system permissions, allowing unauthorized access to users' local files and networks. Additionally, a vulnerability in the Cline CLI tool led to the unintended installation of OpenClaw on approximately 4,000 developer systems, further expanding the attack's reach. ([cyware.com](https://www.cyware.com/resources/threat-briefings/daily-threat-briefing/cyware-daily-threat-intelligence-february-03-2026?utm_source=openai)) This incident underscores the escalating risks associated with AI-powered automation tools and their plugin ecosystems. The rapid adoption of such platforms, combined with insufficient security vetting of third-party extensions, has created new avenues for supply chain attacks. Organizations must prioritize stringent security measures, including thorough code reviews and robust authentication protocols, to mitigate these emerging threats.
6 months ago
Kill Chain
Critical FileZen Vulnerability Exploited: Immediate Action Required
In February 2026, a critical OS command injection vulnerability (CVE-2026-25108) was identified in Soliton Systems' FileZen, a secure file transfer solution. This flaw allows authenticated users to execute arbitrary commands via specially crafted HTTP requests when the Antivirus Check Option is enabled. Exploitation requires valid user credentials, potentially obtained through phishing or credential stuffing. The vulnerability affects FileZen versions 4.2.1 to 4.2.8 and 5.0.0 to 5.0.10. Soliton Systems has released version 5.0.11 to address this issue. Organizations are urged to update immediately and review logs for unauthorized access. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/25/cve-2026-25108-filezen-vulnerability-exploited/?utm_source=openai)) The active exploitation of this vulnerability underscores the persistent threat posed by command injection flaws, emphasizing the need for robust input validation and timely patch management. The incident highlights the importance of monitoring for unauthorized access and maintaining strict access controls to mitigate potential breaches.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports