Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 24 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 277–288 / 4893 reports
Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery
Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery
Information Technology/IT3 weeks ago

Record-Breaking Microsoft Patch Tuesday: 1,413 CVEs Signal New Era of AI-Driven Vulnerability Discovery

In October 2026, Microsoft released a record-breaking Patch Tuesday update containing 1,413 vulnerabilities across its enterprise products and services, surpassing the previous annual record of 1,261 CVEs set in 2020. Among these vulnerabilities was one actively exploited zero-day, CVE-2026-96951, affecting Windows Shell that allows attackers to bypass security features. The massive volume of vulnerabilities was attributed to AI-accelerated discovery processes, though experts noted that exploitation rates have not increased proportionally. Microsoft introduced "risk cohorts" to help customers prioritize patching efforts amid the overwhelming number of monthly security updates. This incident highlights the growing challenge organizations face in vulnerability management as AI tools dramatically accelerate both vulnerability discovery and the security patching burden, fundamentally changing how enterprises must approach cybersecurity risk assessment and remediation prioritization.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Hirudo Android Malware: The Next Evolution in Banking App Attacks
Hirudo Android Malware: The Next Evolution in Banking App Attacks
Banking/Mortgage3 weeks ago

Hirudo Android Malware: The Next Evolution in Banking App Attacks

In October 2024, researchers discovered Hirudo, a sophisticated Android banking trojan that replaces legitimate banking applications with malicious versions to bypass security controls. The malware targets financial institutions across Indonesia, China, India, Mexico, Morocco, and Thailand by distributing infected apps through fake shopping, adult content, and entertainment platforms. Once installed, Hirudo uninstalls genuine banking apps and replaces them with patched versions containing hooking engines that disable app signature verification, accessibility checks, and Play Integrity controls while enabling credential theft, screen recording, and remote device access. This incident highlights the evolution of mobile banking malware toward application-level compromises rather than traditional device-level attacks, representing a significant escalation in threat sophistication that challenges current mobile security paradigms and banking app protection mechanisms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack
CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack
Government Administration3 weeks ago

CISA Issues Urgent Warning: Ivanti Connect Secure Zero-Day CVE-2026-104935 Under Active Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent warning about CVE-2026-104935, a high-severity authentication bypass vulnerability in Ivanti Connect Secure (ICS) being actively exploited as a zero-day since October 1st, 2026. The vulnerability allows remote attackers to execute arbitrary commands without authentication on targeted ICS systems. Threat actor UTA0576 has been chaining this flaw with two other vulnerabilities to achieve unauthenticated root-level code execution, targeting Active Directory credentials, LAPS passwords, and BitLocker recovery keys. This incident highlights the persistent targeting of VPN infrastructure by sophisticated threat actors, continuing a pattern of Ivanti Connect Secure exploitation that has plagued organizations for years. With over 5,600 Internet-exposed ICS hosts identified and federal agencies ordered to patch by Friday, this represents another critical supply chain risk affecting enterprise remote access security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack
Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack
Financial Services3 weeks ago

Cisco Patches Critical Zero-Day CVE-2026-76519 in Email Gateway Under Active Attack

In October 2026, Cisco disclosed and patched CVE-2026-76519, an actively exploited zero-day vulnerability in its Secure Email Gateway (SEG) that allows remote unauthenticated attackers to execute commands with root privileges. The flaw stems from a relative path traversal weakness in SEG's Advanced Malware Protection feature, exploitable through maliciously crafted email attachments. Cisco became aware of active exploitation in October 2026 and has deployed mitigations on cloud instances while providing indicators of compromise to help customers detect potential breaches. This represents the fourth critical SEG vulnerability exploited in the wild since November 2021, highlighting the persistent targeting of email security infrastructure by threat actors seeking initial access and lateral movement capabilities within enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Ledger Supply-Chain Attack Exposes Critical Hardware Security Gaps
Ledger Supply-Chain Attack Exposes Critical Hardware Security Gaps
Financial Services3 weeks ago

Ledger Supply-Chain Attack Exposes Critical Hardware Security Gaps

In October 2026, Ledger discovered a sophisticated supply-chain attack targeting its cryptocurrency hardware wallets sold through Southeast Asian reseller CryptoBilis. Attackers implanted microcontrollers into devices that intercepted 24-word recovery phrases and transmitted them via LTE using provisioned eSIMs, leading to cryptocurrency theft from multiple users. The implants operated independently without modifying Ledger's Secure Element or OS, making them undetectable by standard integrity checks. Ledger responded by halting sales across Southeast Asia and Hong Kong while investigating the breach's full scope. This incident highlights the growing sophistication of supply-chain attacks targeting cryptocurrency infrastructure, occurring amid increased regulatory scrutiny and the rising adoption of hardware wallets by institutional investors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
FBI Disrupts Massive North Korean IT Worker Infiltration Scheme
FBI Disrupts Massive North Korean IT Worker Infiltration Scheme
Information Technology/IT3 weeks ago

FBI Disrupts Massive North Korean IT Worker Infiltration Scheme

In October 2026, the FBI conducted Operation Lonestar Roundup, raiding 40 residences in Texas and seizing 187 laptops used by North Korean threat group Famous Chollima (WageMole) in fraudulent IT worker schemes. The operation disrupted a sophisticated supply chain infiltration where DPRK operatives used stolen identities, laptop farms, and remote access tools to secure employment at U.S. companies while generating revenue for the sanctioned regime. Authorities arrested two U.S. nationals and charged 14 individuals total, including 12 Chinese defendants, in schemes that affected over 70 companies and generated approximately $3 million since 2019. This incident highlights the evolving threat of state-sponsored actors infiltrating corporate supply chains through identity fraud and remote work infrastructure, representing a critical escalation in North Korea's cyber operations targeting Western technology companies and their sensitive data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies
Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies
Information Technology/IT3 weeks ago

Famous Chollima Exposed: How North Korean IT Workers Infiltrated 70+ U.S. Companies

The U.S. Department of Justice charged 14 individuals and dismantled over 40 laptop farms across Texas in October 2026, disrupting a North Korean fraudulent IT worker scheme known as Famous Chollima. Operating from 2019 to July 2025, the operation involved North Korean IT workers using stolen U.S. identities to secure remote positions at over 70 American companies, generating approximately $3 million in revenue that was funneled back to the DPRK regime to fund nuclear weapons programs. The scheme utilized U.S.-based facilitators who hosted company laptops and enabled financial transfers, while threat actors employed sophisticated techniques including device hash spoofing and subcontracting work to South Asian and West African freelancers. This incident highlights the evolving sophistication of nation-state actors using social engineering and identity theft to penetrate corporate networks at scale. The case demonstrates how geopolitical adversaries are increasingly leveraging legitimate business processes and remote work infrastructure to circumvent sanctions and fund military programs, making insider threat detection and identity verification critical security priorities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications
Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications
Financial Services3 weeks ago

Critical PAN-OS Zero-Day CVE-2026-0322 Exploited: Zero-Trust Security Implications

In October 2026, Palo Alto Networks disclosed CVE-2026-0322, a high-severity remote code execution vulnerability in PAN-OS management interfaces with a CVSS score of 8.6. The zero-day flaw affects PA-Series and VM-Series firewalls, as well as Panorama appliances, allowing authenticated attackers with network access to execute code as root. Limited exploitation has been observed targeting the management interface from three identified IP addresses, prompting CISA to add the vulnerability to its Known Exploited Vulnerabilities catalog with a federal mitigation deadline of October 17, 2026. This incident highlights the growing trend of sophisticated attackers targeting network infrastructure devices to establish persistent access and pivot into internal networks. As organizations increasingly rely on cloud-native architectures and zero-trust frameworks, vulnerabilities in critical security appliances represent high-value targets for threat actors seeking to bypass perimeter defenses and compromise enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors
Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors
Information Technology/IT3 weeks ago

Critical Nextcloud Collabora Vulnerability Enables Web Shell Backdoors

In September 2026, attackers exploited a critical command injection vulnerability (CVE-2026-110447) in Nextcloud's Collabora Online Built-in CODE Server app to deploy web shells on vulnerable servers. The flaw allowed unauthenticated attackers to execute arbitrary commands when the local document server was offline during restarts, upgrades, or crashes. Multiple administrators reported compromised servers starting September 10, with attackers deploying PHP web shells and searching for cryptocurrency wallets, credential stores, and sensitive files. Collabora patched the vulnerability in version 26.4.303 on September 11, but the security advisory wasn't published until October 14, leaving many installations exposed for weeks. This incident highlights the growing trend of supply chain attacks targeting third-party integrations and the critical importance of timely security disclosures, especially as organizations increasingly rely on interconnected cloud applications and document collaboration platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation
Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation
Financial Services3 weeks ago

Microsoft Disrupts Billion-Scale Storm-3119 Phishing Operation

In October 2026, Microsoft led a coalition including Health-ISAC, Japan Cybercrime Control Center, and private sector partners to disrupt three major phishing-as-a-service (PhaaS) kits: CoGUI, Haozi, and Iron Man System. These Chinese-language cybercriminal operations, tracked as Storm-3119 and Storm-2990, facilitated over one billion phishing emails and SMS messages targeting 75,000 organizations across 150+ countries since January 2026. The threat actors leveraged compromised Microsoft and Google cloud environments purchased through the YAM Store marketplace, generating tens of millions in revenue while targeting healthcare, financial, and government sectors globally. This disruption highlights the evolving sophistication of phishing-as-a-service ecosystems that abuse legitimate cloud infrastructure at scale. As organizations increasingly adopt cloud-first strategies, attackers are weaponizing trusted platforms to bypass traditional security controls, making this incident particularly relevant for understanding modern credential theft and initial access broker tactics.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Cisco Email Gateway Vulnerability Under Active Attack: CVE-2026-76519 Analysis
Critical Cisco Email Gateway Vulnerability Under Active Attack: CVE-2026-76519 Analysis
Financial Services3 weeks ago

Critical Cisco Email Gateway Vulnerability Under Active Attack: CVE-2026-76519 Analysis

In October 2026, Cisco disclosed CVE-2026-76519, a critical vulnerability in Cisco Secure Email Gateway with a CVSS score of 9.8, actively exploited by threat actors. The flaw allows unauthenticated attackers to write files to the appliance's operating system by sending crafted email attachments through the gateway, potentially achieving root-level command execution. Cisco discovered the vulnerability through internal security scanning and became aware of active exploitation in October 2026, affecting gateways with File Reputation service enabled and Content Scanner Tools versions older than 25.3.0.5525. This incident highlights the continuing trend of attackers targeting email security infrastructure as critical attack vectors, particularly as organizations increasingly rely on cloud-based email filtering solutions. The vulnerability represents part of a broader pattern of sophisticated attacks against enterprise security appliances that serve as chokepoints for organizational communications.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
UK Sanctions Cryptomus: How $7 Billion Crypto Platform Fueled Russian Money Laundering
UK Sanctions Cryptomus: How $7 Billion Crypto Platform Fueled Russian Money Laundering
Financial Services3 weeks ago

UK Sanctions Cryptomus: How $7 Billion Crypto Platform Fueled Russian Money Laundering

In October 2026, the United Kingdom imposed economic sanctions against Cryptomus, a cryptocurrency platform that served as a major conduit for ransomware payments, darknet market transactions, and financial services helping Russia circumvent existing restrictions. Previously operating under names like Certa Payments and Xeltox Enterprises before rebranding to Heleket, the platform processed over $7 billion in transactions since 2022, including funds associated with child exploitation, terrorist financing, and human trafficking. The sanctions freeze all UK-based assets and prohibit British companies from conducting business with the platform, effectively shutting down operations that Canada's previous $176 million fine failed to stop. This marks the first instance of a Five Eyes country sanctioning a cryptocurrency operation incorporated in another Five Eyes jurisdiction, demonstrating unprecedented international coordination against illicit financial infrastructure supporting state-sponsored money laundering.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports