Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 246 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 2941–2952 / 4903 reports
HackerOne Data Breach 2026: Lessons in Third-Party Security
Computer/Network Security7 months ago

HackerOne Data Breach 2026: Lessons in Third-Party Security

In early 2026, HackerOne disclosed a data breach affecting 287 employees, resulting from a security incident at Navia, their U.S. benefits administrator. Between December 22, 2025, and January 15, 2026, attackers exploited a Broken Object Level Authorization (BOLA) vulnerability in Navia's systems, accessing sensitive personal information including Social Security numbers, full names, addresses, phone numbers, dates of birth, email addresses, and plan enrollment details. Navia detected the suspicious activity on January 23, 2026, and subsequently notified affected companies on February 20, 2026. This incident underscores the critical importance of securing third-party service providers, as vulnerabilities in external partners can directly impact an organization's data security. The breach also highlights the necessity for robust authorization mechanisms to prevent unauthorized data access. Organizations are reminded to continuously assess and monitor the security posture of their vendors to mitigate potential risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Citrix 2025 CVE-2025-5777 Memory Overread Vulnerability
Financial Services7 months ago

Citrix 2025 CVE-2025-5777 Memory Overread Vulnerability

In June 2025, Citrix disclosed a critical vulnerability (CVE-2025-5777) in NetScaler ADC and NetScaler Gateway, characterized by insufficient input validation leading to memory overread. This flaw allows unauthenticated attackers to extract sensitive information, including session tokens, from the memory of affected devices. Exploitation of this vulnerability can result in unauthorized access to systems and potential data breaches. Citrix released patches to address this issue and strongly urged customers to update their appliances promptly. ([support.citrix.com](https://support.citrix.com/external/article/CTX693420/netscaler-adc-and-netscaler-gateway-secu.html?utm_source=openai)) The urgency of addressing CVE-2025-5777 is underscored by active exploitation in the wild, with attackers leveraging this vulnerability to bypass authentication mechanisms. Organizations using affected Citrix products must prioritize patching to mitigate the risk of unauthorized access and data exfiltration. ([darkreading.com](https://www.darkreading.com/vulnerabilities-threats/citrix-patches-vulns-netscaler-adc-gateway?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
TeamPCP's Exploitation of Checkmarx GitHub Actions: A 2026 Supply Chain Attack
Computer Software/Engineering7 months ago

TeamPCP's Exploitation of Checkmarx GitHub Actions: A 2026 Supply Chain Attack

In March 2026, the threat actor known as TeamPCP exploited misconfigured GitHub Actions workflows maintained by Checkmarx, specifically targeting the 'checkmarx/ast-github-action' and 'checkmarx/kics-github-action' repositories. By leveraging stolen continuous integration (CI) credentials, TeamPCP injected malicious code into these workflows, leading to unauthorized access and potential data exfiltration. This breach underscores the critical importance of securing CI/CD pipelines and the risks associated with exposed credentials in cloud-native environments. The incident highlights a growing trend of cybercriminals targeting development infrastructure to propagate attacks. Organizations must prioritize the security of their software supply chains, implement robust access controls, and continuously monitor for unauthorized activities to mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
LiteLLM PyPI Supply Chain Attack: A Wake-Up Call for Open-Source Security
Computer Software/Engineering7 months ago

LiteLLM PyPI Supply Chain Attack: A Wake-Up Call for Open-Source Security

In March 2026, the LiteLLM Python package, a widely used library with over 95 million downloads in the past month, was compromised in a supply chain attack attributed to the TeamPCP hacking group. Malicious versions 1.82.7 and 1.82.8 were uploaded to the Python Package Index (PyPI), embedding an infostealer that harvested sensitive data, including SSH keys, cloud credentials, and Kubernetes secrets, from approximately 500,000 devices. The attack involved injecting base64-encoded payloads into the package, which, upon execution, deployed the 'TeamPCP Cloud Stealer' and established persistence mechanisms to exfiltrate data to attacker-controlled domains. This incident underscores the escalating threat of supply chain attacks targeting open-source ecosystems. The compromise of LiteLLM follows previous breaches by TeamPCP, including the Trivy vulnerability scanner and Checkmarx's KICS project, highlighting a pattern of targeting widely adopted development tools to maximize impact. Organizations are urged to implement stringent security measures, such as regular dependency audits, multi-factor authentication for package maintainers, and prompt rotation of exposed credentials, to mitigate the risks associated with such attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Yanluowang Ransomware Operator Sentenced to 6.75 Years in U.S. Prison
Financial Services7 months ago

Yanluowang Ransomware Operator Sentenced to 6.75 Years in U.S. Prison

In March 2026, Russian national Aleksei Olegovich Volkov was sentenced to 6.75 years in U.S. federal prison for his role as an initial access broker for the Yanluowang ransomware group. Between July 2021 and November 2022, Volkov infiltrated at least eight U.S. companies, including financial institutions and engineering firms, providing unauthorized network access to the ransomware operators. This collaboration led to significant financial losses and operational disruptions for the affected organizations. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/yanluowang-initial-access-broker-pleaded-guilty-to-ransomware-attacks/?utm_source=openai)) This case underscores the persistent threat posed by ransomware groups and their affiliates. Despite ongoing efforts to dismantle such operations, the involvement of skilled individuals like Volkov highlights the evolving tactics used to compromise corporate networks. Organizations must remain vigilant, continuously updating their cybersecurity measures to defend against sophisticated attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
PhantomRaven 2025: A Wake-Up Call for Open-Source Security
Computer Software/Engineering7 months ago

PhantomRaven 2025: A Wake-Up Call for Open-Source Security

In August 2025, a sophisticated supply chain attack named 'PhantomRaven' was identified, involving 126 malicious npm packages that collectively garnered over 86,000 downloads. These packages were designed to exfiltrate sensitive information, including npm authentication tokens, GitHub credentials, and CI/CD secrets, by leveraging Remote Dynamic Dependencies (RDD) to conceal malicious code, thereby evading traditional security scans. The campaign's widespread reach and advanced evasion techniques underscore the critical need for enhanced vigilance and security measures within the open-source software ecosystem. The 'PhantomRaven' incident highlights a growing trend of attackers targeting software supply chains to infiltrate development environments. This underscores the urgency for organizations to implement robust security practices, such as thorough dependency audits and real-time monitoring, to mitigate the risks associated with open-source software dependencies.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Cybercriminals Exploit Fake Resumes to Deploy Cryptominers in Corporate Networks
Human Resources/HR7 months ago

Cybercriminals Exploit Fake Resumes to Deploy Cryptominers in Corporate Networks

In March 2026, a sophisticated phishing campaign targeted French-speaking corporate environments by distributing emails with fake resumes. These emails contained highly obfuscated VBScript files disguised as CV documents. When executed, the scripts deployed cryptocurrency miners and information-stealing malware on the victims' systems, leading to unauthorized resource utilization and potential data breaches. This incident underscores the evolving tactics of cybercriminals who exploit common business processes, such as recruitment, to infiltrate organizations. The use of obfuscated scripts and the dual payload of cryptominers and infostealers highlight the need for enhanced email security measures and user awareness training to detect and prevent such multifaceted attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Malvertising Campaign Exploits ScreenConnect and Huawei Driver to Bypass EDR Systems
Accounting7 months ago

Malvertising Campaign Exploits ScreenConnect and Huawei Driver to Bypass EDR Systems

In March 2026, a large-scale malvertising campaign targeted U.S. individuals searching for tax-related documents. Attackers used Google Ads to distribute rogue installers for ConnectWise ScreenConnect, which deployed a tool named HwAudKiller. This tool exploited a vulnerable Huawei driver to disable endpoint detection and response (EDR) systems, allowing the installation of additional malware without detection. The campaign highlights the increasing sophistication of cyber threats leveraging legitimate tools and vulnerabilities to bypass security measures. Organizations must remain vigilant against such tactics, especially during periods when users are likely to seek specific information, such as tax season.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(low)
Read report
The Rise of AI-Powered Ransomware: A 2026 Threat Analysis
Health Care / Life Sciences7 months ago

The Rise of AI-Powered Ransomware: A 2026 Threat Analysis

In early 2026, cybersecurity researchers identified a significant escalation in ransomware attacks leveraging artificial intelligence (AI). Threat actors utilized AI to automate reconnaissance, craft sophisticated phishing emails, and develop polymorphic malware capable of evading traditional detection methods. Notably, the 'PromptLock' ransomware employed local large language models to generate dynamic malicious scripts, enabling cross-platform attacks on Windows, macOS, and Linux systems. This AI-driven approach allowed attackers to rapidly identify vulnerabilities, exploit valid credentials, and execute data exfiltration and encryption operations with unprecedented speed and efficiency. The integration of AI into ransomware campaigns has dramatically reduced the time from initial compromise to full system encryption, with some attacks unfolding in mere minutes. This acceleration poses a critical challenge for organizations, as traditional security measures struggle to keep pace with the evolving threat landscape. The emergence of AI-powered ransomware underscores the urgent need for enhanced cybersecurity strategies that incorporate AI-driven defense mechanisms to effectively counter these sophisticated attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Emerging Threat: Rogue IP KVM Devices in 2026
Information Technology/IT7 months ago

Emerging Threat: Rogue IP KVM Devices in 2026

In March 2026, security researchers identified a significant increase in the use of rogue IP-based Keyboard-Video-Mouse (KVM) devices by cybercriminals to gain unauthorized remote access to systems. These devices, when physically connected to target machines, allow attackers to control systems remotely, bypassing traditional network security measures. The exploitation of IP KVMs poses a substantial risk to organizations, as it enables persistent access and potential data exfiltration without detection by standard security tools. The current surge in rogue IP KVM usage underscores the evolving tactics of threat actors who are increasingly leveraging hardware-based attack vectors. This trend highlights the necessity for organizations to implement comprehensive physical security measures and to monitor for unauthorized hardware connections to mitigate such risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Driven Phishing Campaign Exploits Railway's Platform to Compromise Microsoft Cloud Accounts
Legal Services7 months ago

AI-Driven Phishing Campaign Exploits Railway's Platform to Compromise Microsoft Cloud Accounts

In March 2026, a sophisticated phishing campaign exploited AI-generated lures to compromise Microsoft cloud accounts across hundreds of organizations. Attackers utilized Railway's Platform as a Service to deploy credential harvesting infrastructure, creating unique phishing emails that bypassed traditional security measures. The campaign targeted various sectors, including construction, law, healthcare, and government, leveraging Microsoft's device authentication flow to obtain OAuth tokens valid for up to 90 days without requiring passwords or multifactor authentication. This incident underscores the escalating use of AI in cyberattacks, enabling threat actors to scale operations and evade detection more effectively. Organizations must enhance their security protocols to address AI-driven threats and implement robust monitoring systems to detect and mitigate such sophisticated phishing campaigns.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Russian Access Broker Sentenced to 81 Months for Facilitating Ransomware Attacks
Banking/Mortgage7 months ago

Russian Access Broker Sentenced to 81 Months for Facilitating Ransomware Attacks

In March 2026, Russian national Aleksei Volkov was sentenced to 81 months in a U.S. federal prison for his role as an initial access broker for ransomware groups, notably Yanluowang. Operating between July 2021 and November 2022, Volkov exploited vulnerabilities in corporate networks, selling access to ransomware operators. His activities led to over $9 million in confirmed losses and more than $24 million in intended losses across multiple U.S. businesses, including an engineering firm and a bank. Two victims paid a combined $1.5 million in ransom. This case underscores the evolving tactics of ransomware groups, which now include harassment and distributed denial of service attacks to pressure victims. The sentencing highlights the increasing legal consequences for cybercriminals and the importance of robust cybersecurity measures to prevent such breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports