Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 220 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2629–2640 / 4903 reports
Grinex Exchange Halts Operations After $13.74M Cyberattack
Financial Services6 months ago

Grinex Exchange Halts Operations After $13.74M Cyberattack

In April 2026, Grinex, a Kyrgyzstan-registered cryptocurrency exchange with strong ties to Russia, suspended operations following a cyberattack that resulted in the theft of over $13.74 million (approximately 1 billion rubles) from user funds. The exchange attributed the attack to foreign intelligence agencies, citing the sophisticated nature of the breach. The stolen funds were primarily in USDT, which were swiftly converted to TRX and ETH to evade potential asset freezing by Tether. This incident underscores the vulnerabilities of cryptocurrency exchanges operating in regulatory grey areas and highlights the ongoing geopolitical tensions affecting financial infrastructures. The attack on Grinex is part of a broader trend of state-sponsored cyber operations targeting financial entities, emphasizing the need for enhanced security measures and regulatory oversight in the cryptocurrency sector.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
McGraw-Hill Salesforce Data Breach: A Wake-Up Call for Cloud Security
Computer Software/Engineering6 months ago

McGraw-Hill Salesforce Data Breach: A Wake-Up Call for Cloud Security

In April 2026, McGraw-Hill disclosed a data breach resulting from a misconfiguration in their Salesforce environment, which allowed unauthorized access to internal data hosted on Salesforce web resources. The cybercriminal group ShinyHunters claimed responsibility, alleging possession of up to 45 million records containing personally identifiable information (PII). McGraw-Hill stated that the breach did not impact its Salesforce accounts, customer databases, or internal systems, and described the exposed data as limited and non-sensitive. However, the discrepancy between the company's statement and the attackers' claims has raised concerns about the extent of the data compromised. This incident underscores the critical importance of securing cloud-based platforms and the potential risks associated with misconfigurations. As organizations increasingly rely on SaaS solutions like Salesforce, ensuring proper configuration and access controls is paramount to prevent unauthorized data access and potential breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Analyzing the UNC6040 Breach of Google's Salesforce Instance
Financial Services6 months ago

Analyzing the UNC6040 Breach of Google's Salesforce Instance

In June 2025, Google's internal Salesforce instance was compromised by the cybercriminal group UNC6040, also known as ShinyHunters. The attackers employed a sophisticated voice phishing (vishing) campaign, impersonating IT support to deceive employees into installing a malicious version of Salesforce's Data Loader application. This granted unauthorized access to sensitive business customer data, including names and contact details. The breach was swiftly identified and contained by Google, minimizing the exposure of sensitive information. ([avertium.com](https://www.avertium.com/flash-notices/flash-notice-google-salesforce-breach-an-in-depth-analysis-of-unc6040?utm_source=openai)) This incident underscores the escalating threat posed by social engineering attacks targeting cloud-based platforms. Organizations are urged to enhance their security measures, particularly in training employees to recognize and resist such deceptive tactics, to prevent similar breaches in the future.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Windows Zero-Day Vulnerabilities: Immediate Action Required
Government Administration6 months ago

Windows Zero-Day Vulnerabilities: Immediate Action Required

In early April 2026, a security researcher known as "Chaotic Eclipse" publicly disclosed proof-of-concept exploits for three Windows vulnerabilities: BlueHammer, RedSun, and UnDefend. These vulnerabilities, primarily affecting Microsoft Defender, enable local privilege escalation and the ability to block Defender updates. Shortly after disclosure, threat actors began exploiting these zero-days in the wild, with incidents reported as early as April 10. Microsoft has since patched BlueHammer (CVE-2026-33825) in the April 2026 security updates; however, RedSun and UnDefend remain unpatched, leaving systems vulnerable to attacks that can grant SYSTEM-level access or disable critical security updates. The rapid exploitation of these vulnerabilities underscores the critical importance of timely patch management and the risks associated with delayed disclosures. Organizations must remain vigilant, ensuring that security measures are up-to-date and that they have incident response plans in place to address potential breaches resulting from unpatched vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
DraftKings Credential-Stuffing Attack Results in 30-Month Prison Sentence
Gambling/Casinos6 months ago

DraftKings Credential-Stuffing Attack Results in 30-Month Prison Sentence

In November 2022, DraftKings, a prominent sports betting platform, experienced a credential-stuffing attack that compromised nearly 68,000 user accounts. Attackers utilized previously stolen credentials to gain unauthorized access, leading to the theft of approximately $635,000 from around 1,600 accounts. The perpetrators, including Nathan Austad and Joseph Garrison, sold access to these accounts, with accomplice Kamerin Stokes reselling them through his own platform. Stokes, known online as 'TheMFNPlug,' continued his illicit activities even after initial legal actions, reopening his shop with the tagline 'fraud is fun.' This incident underscores the persistent threat of credential-stuffing attacks, especially in industries handling sensitive financial information. The case highlights the importance of robust cybersecurity measures and the need for users to employ unique, strong passwords across different platforms to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Alerts on Active Exploitation of Apache ActiveMQ Vulnerability CVE-2026-34197
Financial Services6 months ago

CISA Alerts on Active Exploitation of Apache ActiveMQ Vulnerability CVE-2026-34197

In April 2026, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) identified active exploitation of a critical vulnerability in Apache ActiveMQ, designated as CVE-2026-34197. This flaw, present for 13 years, allows authenticated attackers to execute arbitrary code via the Jolokia JMX-HTTP bridge. The vulnerability was discovered by Horizon3 researcher Naveen Sunkavally using the Claude AI assistant and has been patched in ActiveMQ Classic versions 6.2.3 and 5.19.4. The exploitation of this long-standing vulnerability underscores the persistent risks associated with unpatched software and the importance of proactive vulnerability management. Organizations using Apache ActiveMQ are urged to update their systems promptly to mitigate potential threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Payouts King Ransomware Exploits QEMU VMs to Evade Detection
Information Technology/IT6 months ago

Payouts King Ransomware Exploits QEMU VMs to Evade Detection

In April 2026, the Payouts King ransomware group employed QEMU virtual machines (VMs) to evade endpoint security measures. By deploying hidden Alpine Linux VMs on compromised systems, they executed malicious payloads and established covert SSH tunnels, effectively bypassing host-based defenses. Initial access was gained through exposed SonicWall VPNs and exploitation of the SolarWinds Web Help Desk vulnerability (CVE-2025-26399). The attackers utilized tools like AdaptixC2, Chisel, BusyBox, and Rclone within the VMs to facilitate their operations. This incident underscores a growing trend where threat actors leverage virtualization technologies to circumvent traditional security controls. The use of QEMU VMs for stealthy operations highlights the need for enhanced monitoring and security measures that can detect and mitigate such sophisticated attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Inside an Underground Guide: How Threat Actors Vet Stolen Credit Card Shops
Banking/Mortgage6 months ago

Inside an Underground Guide: How Threat Actors Vet Stolen Credit Card Shops

In April 2026, cybersecurity analysts uncovered an underground guide titled 'The Underground Guide to Legit CC Shops: Cutting Through the Bullshit,' which provides insight into how cybercriminals evaluate and select stolen credit card marketplaces. The guide emphasizes a structured approach to vetting suppliers, focusing on factors such as operational longevity, data quality, transparency, and community validation to mitigate risks associated with scams and law enforcement infiltration. This discovery highlights the increasing sophistication and discipline within the cybercriminal ecosystem, as threat actors adopt more methodical strategies to ensure the reliability and security of their illicit operations. Understanding these evolving tactics is crucial for developing effective countermeasures and disrupting fraudulent activities in the digital landscape.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Grinex Exchange Blames 'Western Intelligence' for $13.7M Crypto Hack
Financial Services6 months ago

Grinex Exchange Blames 'Western Intelligence' for $13.7M Crypto Hack

In April 2026, Grinex, a Kyrgyzstan-based cryptocurrency exchange with strong Russian ties, suffered a cyberattack resulting in the theft of approximately $13.7 million from Russian users' wallets. The exchange attributed the sophisticated attack to Western intelligence agencies, citing the advanced nature of the breach. The stolen funds were converted into TRX and ETH through decentralized trading protocols. Grinex, believed to be a rebranded version of the previously sanctioned Garantex exchange, had been under U.S. sanctions since August 2025 for facilitating illicit transactions and money laundering. This incident underscores the persistent vulnerabilities in cryptocurrency exchanges, especially those operating under sanctions. The attribution to state-sponsored actors highlights the escalating geopolitical tensions manifesting in cyber warfare. Organizations must bolster their cybersecurity measures and remain vigilant against increasingly sophisticated threats targeting financial platforms.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Operation PowerOFF Dismantles 53 DDoS-for-Hire Domains, Exposes 3 Million Criminal Accounts
Information Technology/IT6 months ago

Operation PowerOFF Dismantles 53 DDoS-for-Hire Domains, Exposes 3 Million Criminal Accounts

In April 2026, an international law enforcement operation known as Operation PowerOFF targeted the DDoS-for-hire ecosystem across 21 countries. Authorities seized 53 domains, arrested four individuals, and identified over 75,000 users involved in launching DDoS attacks. The operation disrupted booter services and dismantled infrastructure, including servers and databases, that supported these illicit activities. ([cyberscoop.com](https://cyberscoop.com/ddos-for-hire-takedowns-operation-poweroff/?utm_source=openai)) This crackdown underscores the persistent threat posed by DDoS-for-hire services, which enable individuals with minimal technical expertise to launch significant cyberattacks. The operation highlights the necessity for continuous vigilance and international cooperation to combat evolving cyber threats. ([cyberscoop.com](https://cyberscoop.com/ddos-for-hire-takedowns-operation-poweroff/?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Apache ActiveMQ CVE-2026-34197: Critical RCE Vulnerability Under Active Exploitation
Financial Services6 months ago

Apache ActiveMQ CVE-2026-34197: Critical RCE Vulnerability Under Active Exploitation

In April 2026, a critical remote code execution (RCE) vulnerability, CVE-2026-34197, was identified in Apache ActiveMQ Classic. This flaw resides in the Jolokia JMX-HTTP bridge, which, due to an overly permissive default access policy, allows authenticated attackers to execute arbitrary code on the broker's JVM. Exploitation involves invoking specific MBeans operations with crafted discovery URIs that load malicious Spring XML configurations, leading to full system compromise. Affected versions include Apache ActiveMQ Broker before 5.19.4 and from 6.0.0 before 6.2.3. ([sentinelone.com](https://www.sentinelone.com/vulnerability-database/cve-2026-34197/?utm_source=openai)) The urgency to address this vulnerability is heightened by its addition to CISA's Known Exploited Vulnerabilities (KEV) catalog, indicating active exploitation in the wild. Organizations using affected versions should prioritize upgrading to patched releases and review access controls to mitigate potential threats. ([securityonline.info](https://securityonline.info/apache-activemq-rce-jolokia-cve-2026-34197/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Jaguar Land Rover Cyberattack August 2025: A Comprehensive Analysis
Automotive6 months ago

Jaguar Land Rover Cyberattack August 2025: A Comprehensive Analysis

In late August 2025, Jaguar Land Rover (JLR), the UK's largest automotive manufacturer, experienced a significant cyberattack that severely disrupted its operations. The attack, attributed to the cybercriminal group 'Scattered Lapsus$ Hunters,' led to a complete shutdown of JLR's production facilities across the UK, Slovakia, China, India, and Brazil. The company halted production on September 1, 2025, and the disruption extended for over five weeks, with operations resuming in mid-October. This incident resulted in substantial financial losses, with JLR reporting nearly £200 million in direct costs and a 43% decline in vehicle output during the affected period. The attack also had a cascading effect on the broader automotive supply chain, leading to layoffs and economic repercussions across the sector. ([computerweekly.com](https://www.computerweekly.com/news/366630592/Jaguar-Land-Rover-admits-data-has-been-compromised-in-cyber-attack?utm_source=openai)) This incident underscores the escalating threat of ransomware attacks targeting critical infrastructure and large-scale manufacturing operations. The JLR cyberattack highlights the vulnerabilities within interconnected supply chains and the potential for significant economic impact resulting from such breaches. It serves as a stark reminder for organizations to bolster their cybersecurity measures, particularly in the face of increasingly sophisticated cyber threats.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports