Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 232 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2773–2784 / 4903 reports
Fortinet's 2026 Unauthenticated API Access Bypass: A Critical Security Alert
Computer/Network Security7 months ago

Fortinet's 2026 Unauthenticated API Access Bypass: A Critical Security Alert

In April 2026, Fortinet disclosed a critical vulnerability (CVE-2026-35616) in its FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. This improper access control flaw allowed unauthenticated attackers to execute unauthorized code or commands via crafted API requests. The vulnerability was actively exploited in the wild, prompting Fortinet to release emergency hotfixes and advise customers to apply them immediately. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616/?utm_source=openai)) The incident underscores the persistent targeting of Fortinet products by threat actors, highlighting the importance of timely patch management and vigilant monitoring of security advisories to mitigate risks associated with zero-day vulnerabilities. ([tenable.com](https://www.tenable.com/blog/cve-2026-35616-fortinet-forticlientems-improper-access-control-vulnerability-exploited-in-the?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
UNC1069's Social Engineering Compromise of Axios: A 2026 Supply Chain Attack
Computer Software/Engineering7 months ago

UNC1069's Social Engineering Compromise of Axios: A 2026 Supply Chain Attack

In late March 2026, the popular JavaScript HTTP client library Axios, with over 100 million weekly downloads, was compromised through a sophisticated social engineering attack. The North Korean state-sponsored group UNC1069 targeted lead maintainer Jason Saayman, gaining access to his npm account. The attackers published two malicious versions of Axios (1.14.1 and 0.30.4) that included a trojanized dependency, 'plain-crypto-js@4.2.1', which executed a post-install script to deploy a cross-platform Remote Access Trojan (RAT) upon installation. The malicious packages were available for approximately two to three hours before being removed, but the potential impact was significant due to Axios's widespread use. This incident underscores the increasing industrialization of social engineering attacks targeting open-source maintainers, highlighting the need for enhanced security measures within the software supply chain. The rapid detection and removal of the compromised packages prevented a more extensive breach, but the event serves as a critical reminder of the vulnerabilities inherent in widely used open-source projects.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Storm-1175's Rapid Exploitation of Web Vulnerabilities in 2026
Health Care / Life Sciences7 months ago

Storm-1175's Rapid Exploitation of Web Vulnerabilities in 2026

In early 2026, the financially motivated cybercriminal group Storm-1175 executed high-velocity ransomware campaigns by exploiting recently disclosed vulnerabilities in web-facing systems. The group rapidly transitioned from initial access to data exfiltration and deployment of Medusa ransomware, often within 24 hours. These attacks significantly impacted healthcare, education, professional services, and finance sectors across Australia, the United Kingdom, and the United States. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/04/06/storm-1175-focuses-gaze-on-vulnerable-web-facing-assets-in-high-tempo-medusa-ransomware-operations/?utm_source=openai)) This incident underscores the critical need for organizations to promptly apply security patches and enhance monitoring of web-facing assets. The rapid exploitation of vulnerabilities by threat actors like Storm-1175 highlights the importance of proactive defense measures to mitigate the risk of ransomware attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Fortinet FortiClientEMS 2026 Improper Access Control Vulnerability
Computer/Network Security7 months ago

Fortinet FortiClientEMS 2026 Improper Access Control Vulnerability

In April 2026, Fortinet disclosed a critical improper access control vulnerability (CVE-2026-35616) in FortiClient Endpoint Management Server (EMS) versions 7.4.5 and 7.4.6. This flaw allows unauthenticated attackers to execute unauthorized code or commands via crafted requests, leading to potential remote code execution and privilege escalation. The vulnerability has been actively exploited in the wild, prompting Fortinet to release emergency hotfixes and advise immediate patching to mitigate the risk. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/04/04/forticlient-ems-zero-day-cve-2026-35616/?utm_source=openai)) The exploitation of CVE-2026-35616 underscores the persistent targeting of Fortinet products by threat actors. Organizations are urged to apply the provided hotfixes promptly and monitor their systems for any signs of compromise to maintain robust security postures. ([tenable.com](https://www.tenable.com/blog/cve-2026-35616-fortinet-forticlientems-improper-access-control-vulnerability-exploited-in-the?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Fortinet's FortiClient EMS Zero-Day Vulnerability Exploited in 2026
Computer/Network Security7 months ago

Fortinet's FortiClient EMS Zero-Day Vulnerability Exploited in 2026

In early April 2026, Fortinet disclosed a critical zero-day vulnerability (CVE-2026-35616) in its FortiClient Endpoint Management Server (EMS), which was actively exploited in the wild. This improper access control flaw allowed unauthenticated attackers to execute unauthorized code or commands via crafted requests. Fortinet released an emergency hotfix for versions 7.4.5 and 7.4.6, with plans for a comprehensive patch in version 7.4.7. The vulnerability was added to CISA's known exploited vulnerability catalog, highlighting its severity and widespread impact. The rapid exploitation of CVE-2026-35616 underscores a growing trend of attackers targeting zero-day vulnerabilities in widely used security solutions. Organizations must remain vigilant, ensuring timely application of patches and hotfixes to mitigate such threats. This incident also emphasizes the importance of robust access controls and continuous monitoring to detect and respond to unauthorized activities promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
GrafanaGhost: Unveiling the Critical AI Prompt Injection Vulnerability in Grafana
Information Technology/IT7 months ago

GrafanaGhost: Unveiling the Critical AI Prompt Injection Vulnerability in Grafana

In April 2026, security researchers at Noma Security disclosed a critical vulnerability in Grafana, termed 'GrafanaGhost.' This exploit enables attackers to silently exfiltrate sensitive data by circumventing Grafana's AI defenses through prompt injection techniques. The attack does not require user interaction or authentication; it leverages crafted URLs to inject hidden instructions that Grafana's AI processes, leading to unauthorized data transmission to attacker-controlled servers. The vulnerability affects Grafana instances widely used for monitoring real-time financial metrics, infrastructure health data, and customer records, posing significant risks to enterprise data security. This incident underscores the escalating threat of AI prompt injection attacks, where adversaries manipulate AI systems to perform unintended actions. As AI integration in enterprise environments grows, such vulnerabilities highlight the urgent need for robust AI-specific security measures to prevent data breaches and maintain system integrity.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Fortinet EMS Vulnerability CVE-2026-35616: Immediate Action Required
Government Administration7 months ago

Fortinet EMS Vulnerability CVE-2026-35616: Immediate Action Required

In April 2026, a critical vulnerability (CVE-2026-35616) was discovered in Fortinet's FortiClient Enterprise Management Server (EMS). This flaw allowed unauthenticated attackers to bypass authentication controls and execute arbitrary code via specially crafted requests. Fortinet released emergency hotfixes to address the issue, urging immediate application to prevent exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) mandated federal agencies to patch affected systems by April 9, 2026, highlighting the significant risk posed by this vulnerability. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/cisa-orders-feds-to-patch-fortinet-flaw-exploited-in-attacks-by-friday/?utm_source=openai)) The exploitation of CVE-2026-35616 underscores the persistent threat of zero-day vulnerabilities in widely used enterprise solutions. Organizations are reminded of the critical importance of timely patch management and proactive security measures to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Drift Protocol's $280M Loss: A Case Study in Advanced Social Engineering
Computer Software/Engineering7 months ago

Drift Protocol's $280M Loss: A Case Study in Advanced Social Engineering

In April 2026, Drift Protocol, a decentralized finance platform on the Solana blockchain, suffered a sophisticated cyberattack resulting in the theft of approximately $280 million in digital assets. The attackers, identified as the North Korean state-sponsored group UNC4736, infiltrated the organization over a six-month period by posing as a legitimate quantitative trading firm. They engaged with Drift contributors at multiple industry conferences, building trust through in-person meetings and continued communication via Telegram. This prolonged social engineering campaign allowed them to gain unauthorized access to Drift's Security Council administrative powers, leading to the rapid exfiltration of funds. This incident underscores the evolving tactics of state-sponsored cyber actors, who are increasingly leveraging extended social engineering strategies to compromise high-value targets. The attack highlights the critical need for organizations to implement robust security protocols, including stringent verification processes and continuous monitoring, to defend against such sophisticated infiltration methods.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Storm-1175's Rapid Exploitation of Zero-Day Vulnerabilities in Medusa Ransomware Attacks
Health Care / Life Sciences7 months ago

Storm-1175's Rapid Exploitation of Zero-Day Vulnerabilities in Medusa Ransomware Attacks

In April 2026, Microsoft identified Storm-1175, a China-based cybercriminal group, exploiting zero-day vulnerabilities to deploy Medusa ransomware. The group rapidly transitioned from initial access to data exfiltration and ransomware deployment, often within 24 hours. They targeted sectors including healthcare, education, professional services, and finance across the U.S., U.K., and Australia. Storm-1175 utilized tools like PowerShell, PsExec, and remote monitoring software to establish persistence, conduct reconnaissance, and move laterally within networks. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/microsoft-links-medusa-ransomware-affiliate-to-zero-day-attacks/?utm_source=openai)) This incident underscores the increasing sophistication and speed of ransomware attacks, highlighting the critical need for organizations to promptly patch vulnerabilities and enhance their cybersecurity defenses to mitigate such rapidly evolving threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
BKA Unmasks REvil Leaders Behind 130 German Ransomware Attacks
Financial Services7 months ago

BKA Unmasks REvil Leaders Behind 130 German Ransomware Attacks

In April 2026, Germany's Federal Criminal Police Office (BKA) unmasked the identities of two key figures associated with the REvil ransomware-as-a-service (RaaS) operation. Daniil Maksimovich Shchukin, known online as 'UNKN,' and Anatoly Sergeevitsch Kravchuk were linked to 130 ransomware attacks across Germany, resulting in over €35.4 million in damages. The REvil group, active from 2019 to 2021, targeted high-profile organizations, demanding substantial ransoms in exchange for decrypting and not leaking data. ([thehackernews.com](https://thehackernews.com/2026/04/bka-identifies-revil-leaders-behind-130.html?utm_source=openai)) This revelation underscores the persistent threat posed by sophisticated ransomware groups and highlights the importance of international cooperation in cybercrime investigations. Organizations must remain vigilant, as the tactics employed by groups like REvil continue to evolve, posing significant risks to global cybersecurity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
GPUBreach 2026: Unveiling the Latest NVIDIA GPU Rowhammer Attack
Computer Hardware7 months ago

GPUBreach 2026: Unveiling the Latest NVIDIA GPU Rowhammer Attack

In April 2026, researchers from the University of Toronto unveiled 'GPUBreach,' a sophisticated attack leveraging Rowhammer techniques on NVIDIA GPUs equipped with GDDR6 memory. This method enables unprivileged CUDA kernels to induce bit-flips in GPU page tables, granting arbitrary GPU memory access. Exploiting vulnerabilities in NVIDIA drivers, attackers can escalate privileges to achieve full system compromise, even with Input-Output Memory Management Unit (IOMMU) protections active. The attack was demonstrated on NVIDIA RTX A6000 GPUs, commonly used in AI development and training workloads. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/new-gpubreach-attack-enables-system-takeover-via-gpu-rowhammer/?utm_source=openai)) The emergence of GPUBreach underscores a significant evolution in hardware-based attacks, highlighting the necessity for robust hardware security measures. As adversaries increasingly exploit hardware vulnerabilities, organizations must prioritize comprehensive security strategies that encompass both software and hardware components to mitigate such advanced threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the BlueHammer Windows Zero-Day Exploit
Financial Services7 months ago

Understanding the BlueHammer Windows Zero-Day Exploit

In April 2026, a security researcher operating under the alias 'Chaotic Eclipse' publicly disclosed a Windows zero-day vulnerability named 'BlueHammer.' This local privilege escalation flaw allows attackers to gain SYSTEM-level access by exploiting a combination of time-of-check to time-of-use (TOCTOU) and path confusion vulnerabilities. The researcher released proof-of-concept (PoC) code on GitHub, expressing dissatisfaction with Microsoft's handling of the disclosure process. As of the disclosure date, no official patch has been released, leaving systems vulnerable to potential exploitation. The public release of the BlueHammer exploit underscores the ongoing challenges in vulnerability disclosure and patch management. Organizations must remain vigilant, as unpatched zero-day vulnerabilities can be rapidly weaponized by threat actors, leading to significant security breaches and operational disruptions.

Medium impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports