Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Russian Cybercriminal Extradited for Massive Excel Malware Campaign
Russian national Searzhudin Tamirlanovich Aktulaev, 40, has been charged by the U.S. Department of Justice for orchestrating a sophisticated malware campaign between 2016 and 2017. Aktulaev created approximately 255 fake accounts on a freelance platform and distributed malware-laced Excel attachments to roughly 80,000 users. The attack leveraged social engineering tactics within trusted business communications to deliver malicious payloads, potentially compromising thousands of victims' systems and data. Aktulaev was arrested in Cyprus in May 2025 and extradited to the United States on August 28, 2026. This case highlights the persistent threat of nation-state actors exploiting trusted platforms and file formats for malware distribution, particularly as cybercriminals increasingly target business communication channels and use legitimate services as attack vectors in 2026's evolving threat landscape.
2 weeks ago
Kill Chain
SonicWall SMA 1000 Zero-Day Attack Chain: CVE-2026-83548 & CVE-2026-83549 Analysis
In September 2026, SonicWall disclosed two zero-day vulnerabilities (CVE-2026-83548 and CVE-2026-83549) in its Secure Mobile Access 1000 series VPN appliances that were actively exploited by attackers. The vulnerabilities allow threat actors to chain a pre-authentication server-side request forgery (SSRF) flaw with a post-authentication command injection vulnerability to achieve remote code execution on affected devices. SonicWall confirmed active exploitation and recommended immediate patching, system reimaging if compromised, and password resets for all affected appliances. This incident highlights the continued targeting of enterprise VPN infrastructure by sophisticated threat actors, reflecting a broader trend of attacks against network perimeter devices that became critical during remote work adoption and remain attractive targets for initial access operations.
2 weeks ago
Kill Chain
GitSpawn Attacks Target AI Coding Agents: CVE-2026-19592 Analysis
In September 2026, Manifold Security disclosed eight critical vulnerabilities across seven AI coding agents including Claude Code, Codex, and Cursor, where malicious Git configurations could execute attacker code without user approval. The flaws exploit the core.fsmonitor Git setting, allowing repository-supplied commands to run with full user privileges outside sandbox environments. Four vulnerabilities remained unpatched at publication, affecting popular development tools used by millions of developers worldwide. This incident highlights the growing security risks in AI-powered development environments as organizations increasingly adopt autonomous coding agents. With the rapid expansion of AI tooling in software development workflows, similar supply-chain attacks targeting developer infrastructure represent a critical emerging threat vector requiring immediate attention.
2 weeks ago
Kill Chain
First Major AI-Assisted Ransomware Attack: How Frontier AI Agents Executed 50+ Attack Techniques in 10 Hours
In September 2026, Unit 42 investigators responded to a groundbreaking ransomware attack where threat actors deployed frontier AI agents to autonomously breach an enterprise network in under 10 hours. The attackers used multiple AI agents working in parallel to compress traditional multi-week intrusion operations, executing over 50 MITRE ATT&CK techniques including network reconnaissance, secrets harvesting, privilege escalation, CI/CD pipeline exploitation, and cloud infrastructure hijacking. The AI-driven attack achieved the operational impact of multiple coordinated red teams while leaving behind an 80-page technical security audit documenting exploited vulnerabilities. This incident represents a critical inflection point in cybersecurity, demonstrating how threat actors are weaponizing frontier AI and agentic frameworks to dramatically accelerate attack timelines and operational efficiency, marking the emergence of machine-speed cyber operations as a mainstream threat vector.
2 weeks ago
Kill Chain
FBI Warns of Sophisticated OAuth Consent Phishing Campaign Targeting Prominent Figures
The FBI issued a public alert in late 2025 regarding a sophisticated OAuth consent phishing campaign targeting high-profile individuals, their family members, and associates through commercial messaging applications. Attackers impersonate government officials, journalists, and public personalities to trick victims into granting access to legitimate cloud services like Microsoft or Google under the pretense of reviewing documents. Once OAuth permissions are granted, attackers gain persistent access to emails, files, and sensitive data that cannot be revoked simply by changing passwords, requiring victims to manually invalidate tokens in application security settings. This campaign highlights the growing trend of identity-centric attacks that bypass traditional security measures including multi-factor authentication, representing a significant evolution in social engineering tactics that exploit trusted authentication protocols against prominent targets.
2 weeks ago
Kill Chain
PaperCut Zero-Day Attack: How Print Infrastructure Became the New Attack Vector
Two critical zero-day vulnerabilities in PaperCut NG and MF print management software (CVE-2026-81578 and CVE-2026-82078) were actively exploited by threat actors in August 2026 for data theft attacks. The flaws can be chained to bypass authentication and achieve remote code execution on vulnerable servers used by over 100 million users across 70,000 organizations globally. PaperCut Software released three emergency patches within a week to address the vulnerabilities, but threat intelligence indicates attackers are exploiting these flaws to dump database tables and steal sensitive data from exposed servers. With over 800 PaperCut servers still exposed online and a history of ransomware groups targeting similar vulnerabilities, this incident highlights the critical risk posed by internet-facing print management infrastructure. This incident underscores the growing trend of attackers targeting enterprise software zero-days for immediate data theft rather than prolonged persistence, reflecting the increasing sophistication and speed of modern threat actors in monetizing newly discovered vulnerabilities.
2 weeks ago
Kill Chain
Venezuelan ATM Jackpotting Ring Exposed: When Physical Access Beats Network Security
Five Venezuelan nationals pleaded guilty to conspiracy to commit bank larceny through ATM jackpotting attacks in Kansas during December 2025. The attackers attempted to install malware on ATMs in Wamego and Manhattan to force cash dispensers to empty their storage cassettes, but failed in both attempts and were arrested within days after surveillance cameras captured their activities. This case is part of a broader crackdown on the Tren de Aragua Venezuelan criminal organization, with the Justice Department charging 87 members in connection with ATM malware schemes that stole over $20 million in 2025. ATM jackpotting attacks represent a growing physical-digital threat where criminals bypass traditional network security by gaining direct hardware access to financial infrastructure, highlighting the critical need for comprehensive security that extends beyond network perimeters to protect physical endpoints and embedded systems.
2 weeks ago
Kill Chain
Critical Exchange Server Vulnerability Leaves 22,000 Organizations at Risk
In September 2026, security researchers discovered that nearly 22,000 Microsoft Exchange servers remained vulnerable to CVE-2026-62911, a high-severity authentication bypass vulnerability affecting Exchange Server 2016, 2019, and Subscription Edition. The flaw allows attackers with basic privileges to execute capture-replay attacks and hijack all user mailboxes on targeted servers. Despite Microsoft patching the vulnerability in August 2026, most servers remain unpatched, with Germany showing 85% of on-premises Exchange installations still vulnerable. The Netherlands NCSC reported that exploit code is already publicly available online. This incident highlights the persistent challenge of legacy system security as Exchange 2016 and 2019 reached end-of-support in October 2026, with Extended Security Updates ending the same month, leaving organizations exposed to mounting authentication bypass attacks.
2 weeks ago
Kill Chain
Critical Langflow Vulnerability CVE-2026-0768 Exploited to Steal AI and Cloud Credentials
Threat actors are actively exploiting CVE-2026-0768, a critical unauthenticated remote code execution vulnerability in Langflow, an open-source AI application development framework. The flaw allows attackers to execute arbitrary Python code with root privileges without authentication, enabling them to steal sensitive credentials including OpenAI API keys, AWS secrets, and administrative authentication tokens. VulnCheck detected over 360 exploitation attempts originating primarily from Russia, with attackers conducting reconnaissance and harvesting environment variables from compromised instances. This incident highlights the growing trend of AI infrastructure targeting as organizations rapidly adopt AI development platforms without adequate security controls, making them prime targets for credential theft and supply chain attacks.
2 weeks ago
Kill Chain
Faronics Deploy Platform Exploited in Sophisticated ScreenConnect RAT Campaign
Between July and August 2026, cybercriminals exploited the legitimate Faronics Deploy endpoint management platform to gain unauthorized administrative control over victim computers. The attackers used phishing emails disguised as invoices and tax documents to trick users into downloading a legitimate but malicious Faronics Deploy installer. Once installed, the threat actors remotely executed PowerShell scripts to deploy ConnectWise ScreenConnect remote access software, establishing persistent backdoor access to over 457 endpoints across multiple organizations. This incident highlights the growing trend of Living-off-the-Land (LotL) attacks where cybercriminals abuse legitimate administrative tools to bypass traditional security controls and establish covert command-and-control channels.
2 weeks ago
Kill Chain
Breeze Comet's Sophisticated Attack on Brazilian Payment Systems Exposes Critical Infrastructure Vulnerabilities
Since 2024, the financially motivated threat actor Breeze Comet (formerly UNC5669) has targeted Brazilian financial services, retail, and e-commerce organizations through sophisticated payment system manipulation attacks. The group gains initial access via password spraying and social engineering calls impersonating IT support to install remote access tools like AnyDesk, then deploys custom malware including COBALTSPIN, LIGHTPAINT, and MILDFROST to maintain persistence and lateral movement. Successfully executing hundreds of fraudulent transactions worth tens of thousands of dollars, the group specifically targets entities with access to Brazil's National Financial System Network and payment platforms like Pix, STR, and Boleto. This campaign represents a significant evolution in Latin American cybercrime from opportunistic retail fraud to direct targeting of core financial infrastructure. The threat actor's use of AI-assisted malware development and expansion into other Latin American and African countries signals a new model for financially motivated attacks that defenders must prepare for as interconnected payment ecosystems become increasingly vulnerable.
2 weeks ago
Kill Chain
How Mirage Kitten's NodeRabbit Malware Exploited Developer Trust in 2024
In 2024, Iranian APT group Mirage Kitten launched sophisticated social engineering campaigns targeting aviation and fintech sectors across the Middle East and Africa using two new cross-platform malware families: NodeRabbit and PollCat. The threat actors posed as recruiters on LinkedIn, delivering trojanized coding challenges that contained Node.js-based remote access trojans capable of running on Windows, Linux, and macOS. The malware established persistence through multiple mechanisms and communicated with command-and-control infrastructure hosted on Azure and Cloudflare, affecting organizations in Egypt, Ethiopia, and Afghanistan. This campaign represents a significant evolution in nation-state tactics, showcasing how APT groups are adapting to target developer communities through increasingly sophisticated supply chain attacks and social engineering techniques that exploit trust in professional recruitment processes.
2 weeks ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports