Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 253 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3025–3036 / 4903 reports
Critical Vulnerabilities in Veeam Backup & Replication: Immediate Action Required
Financial Services8 months ago

Critical Vulnerabilities in Veeam Backup & Replication: Immediate Action Required

In January 2026, Veeam released security updates to address multiple critical vulnerabilities in its Backup & Replication software, notably CVE-2025-59470, which allows Backup or Tape Operators to perform remote code execution as the postgres user by sending malicious parameters. These flaws affect version 13.0.1.180 and earlier builds, potentially enabling unauthorized access and control over backup infrastructures. Organizations are strongly urged to apply the available patches promptly to prevent potential system compromise and data loss. ([thehackernews.com](https://thehackernews.com/2026/01/veeam-patches-critical-rce.html?utm_source=openai)) The urgency of this update is underscored by the increasing targeting of backup systems by threat actors, aiming to exploit such vulnerabilities for data exfiltration and ransomware attacks. Ensuring timely patching and adherence to security best practices is crucial to safeguard sensitive data and maintain operational integrity.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Authorities Dismantle SocksEscort Botnet Exploiting 369,000 IPs
Telecommunications8 months ago

Authorities Dismantle SocksEscort Botnet Exploiting 369,000 IPs

In March 2026, an international law enforcement operation dismantled the SocksEscort botnet, which had infected approximately 369,000 residential routers across 163 countries since 2020. The botnet, powered by the AVrecon malware, allowed cybercriminals to route malicious internet traffic through compromised devices, facilitating large-scale fraud and other illicit activities. The operation, codenamed Operation Lightning, resulted in the seizure of 34 domains, 23 servers, and the freezing of $3.5 million in cryptocurrency assets. This takedown underscores the persistent threat posed by botnets leveraging residential devices and highlights the importance of securing home and small business routers against exploitation. The incident serves as a critical reminder for organizations and individuals to regularly update and monitor their network devices to prevent similar compromises.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
CrackArmor: Critical Vulnerabilities in Linux AppArmor Demand Immediate Attention
Information Technology/IT8 months ago

CrackArmor: Critical Vulnerabilities in Linux AppArmor Demand Immediate Attention

In March 2026, cybersecurity researchers identified nine critical vulnerabilities, collectively named 'CrackArmor,' within the Linux kernel's AppArmor module. These flaws, present since 2017, allow unprivileged users to manipulate security profiles, bypass user-namespace restrictions, and execute arbitrary code within the kernel, leading to potential root privilege escalation and compromised container isolation. The vulnerabilities affect all Linux kernels since version 4.11 on distributions integrating AppArmor, including Ubuntu, Debian, and SUSE. Immediate kernel patching is strongly advised to mitigate these risks. The disclosure of CrackArmor underscores the persistent challenges in securing kernel-level modules and the importance of timely vulnerability management. Organizations relying on AppArmor for mandatory access control should prioritize updates and review their security configurations to prevent exploitation of these flaws.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Steam Malware Incident 2025: A Wake-Up Call for Digital Platform Security
Computer Games8 months ago

Steam Malware Incident 2025: A Wake-Up Call for Digital Platform Security

Between July and September 2025, multiple games on the Steam platform, including 'BlockBlasters' and 'PirateFi,' were found to contain malware designed to steal users' cryptocurrency and personal data. These games, initially appearing legitimate, were later updated to include malicious code that compromised the security of players' systems. The malware led to significant financial losses, with reports indicating over $150,000 stolen from affected users. Notably, Twitch streamer Raivo 'RastalandTV' Plavnieks lost $32,000 in donations intended for his cancer treatment after installing 'BlockBlasters.' Valve Corporation, the operator of Steam, removed the malicious games from the platform and advised affected users to perform full system resets to eliminate potential threats. This incident underscores the evolving tactics of cybercriminals targeting digital platforms and the importance of vigilant security practices for both platform operators and users.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CrashFix: Unveiling the Latest ClickFix Variant Deploying Python RATs
Financial Services8 months ago

CrashFix: Unveiling the Latest ClickFix Variant Deploying Python RATs

In January 2026, Microsoft Defender Experts identified a new evolution in the ongoing ClickFix campaign, dubbed 'CrashFix'. This variant begins with victims installing a malicious browser extension that impersonates legitimate ad blockers. Once installed, the extension deliberately crashes the browser and displays a fake security warning, instructing users to execute a command via the Windows Run dialog. This command abuses the legitimate Windows utility 'finger.exe' to download and execute a Python-based Remote Access Trojan (RAT), granting attackers persistent access to the compromised system. The RAT enables extensive reconnaissance, data exfiltration, and potential deployment of additional malware payloads. The 'CrashFix' variant represents a significant escalation in ClickFix tactics, combining user disruption with sophisticated social engineering to increase execution success while reducing reliance on traditional exploit techniques. This evolution underscores the growing trend of attackers leveraging trusted user actions and native OS utilities to bypass traditional defenses, highlighting the critical need for behavior-based detection and heightened user awareness.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Storm-2561's 2026 SEO Poisoning Campaign: A Wake-Up Call for VPN Security
Computer/Network Security8 months ago

Storm-2561's 2026 SEO Poisoning Campaign: A Wake-Up Call for VPN Security

In January 2026, the threat actor known as Storm-2561 initiated a credential theft campaign by distributing trojanized VPN clients through search engine optimization (SEO) poisoning. Users searching for legitimate enterprise VPN software were redirected to attacker-controlled websites hosting malicious ZIP files. These files contained digitally signed trojans masquerading as trusted VPN clients, which, upon installation, harvested VPN credentials. The malware employed techniques such as DLL sideloading and displayed fake VPN sign-in dialogs to capture user credentials. Microsoft observed this activity and attributed it to Storm-2561, a group active since May 2025, known for propagating malware through SEO poisoning and impersonating popular software vendors. The campaign underscores the exploitation of trust in search engine rankings and software branding as social engineering tactics to steal data from users seeking enterprise VPN software. Additionally, the abuse of trusted platforms like GitHub to host malicious installer files highlights the evolving sophistication of such attacks. Organizations are advised to implement multi-factor authentication (MFA) on all accounts, exercise caution when downloading software, and ensure the authenticity of sources to mitigate such threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
INTERPOL's Global Crackdown: 45,000 Malicious IPs Dismantled, 94 Arrested
Banking/Mortgage8 months ago

INTERPOL's Global Crackdown: 45,000 Malicious IPs Dismantled, 94 Arrested

Between July 18, 2025, and January 31, 2026, INTERPOL coordinated a global operation involving 72 countries, resulting in the dismantling of 45,000 malicious IP addresses and servers associated with phishing, malware, and ransomware activities. This effort led to the arrest of 94 individuals and the seizure of 212 electronic devices and servers. Notable actions included the arrest of 40 suspects in Bangladesh linked to various cybercrimes and the identification of over 33,000 fraudulent websites in Macau targeting critical infrastructure. This operation underscores the escalating threat of transnational cybercrime and the necessity for coordinated international responses. The increasing sophistication and scale of cybercriminal activities highlight the urgent need for enhanced cybersecurity measures and global cooperation to protect individuals and organizations from emerging digital threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Google Chrome Zero-Day Vulnerabilities Patched in March 2026
Financial Services8 months ago

Google Chrome Zero-Day Vulnerabilities Patched in March 2026

In March 2026, Google identified and patched two high-severity zero-day vulnerabilities in its Chrome browser: CVE-2026-3909, an out-of-bounds write in the Skia graphics library, and CVE-2026-3910, an inappropriate implementation in the V8 JavaScript engine. Both flaws allowed remote attackers to execute arbitrary code via crafted HTML pages and were actively exploited in the wild. Google released updates to address these issues, urging users to update their browsers promptly. This incident underscores the persistent threat posed by zero-day vulnerabilities and the importance of timely software updates. The rapid identification and patching of these flaws highlight the need for continuous vigilance and proactive security measures in the face of evolving cyber threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Iran MOIS's 2026 Cyber Collaboration with Criminal Groups
Health Care / Life Sciences8 months ago

Iran MOIS's 2026 Cyber Collaboration with Criminal Groups

In March 2026, Iran's Ministry of Intelligence and Security (MOIS) intensified its cyber operations by collaborating with cybercriminal groups to enhance the scale and effectiveness of its attacks. This partnership led to a series of sophisticated cyberattacks targeting critical infrastructure and private sector entities in the United States and Europe. The MOIS leveraged the expertise and tools of cybercriminals to conduct operations that included data breaches, ransomware attacks, and disruptive activities against government and corporate networks. ([forbes.com](https://www.forbes.com/sites/steveweisman/2026/03/03/irans-cyberwarfare-attacks-will-be-targeting-critical-infrastructure/?utm_source=openai)) This incident underscores a concerning trend where state-sponsored actors are increasingly partnering with cybercriminal organizations to achieve geopolitical objectives. Such collaborations blur the lines between nation-state and criminal cyber activities, complicating attribution and response efforts. Organizations must remain vigilant and adapt their cybersecurity strategies to address this evolving threat landscape.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Sophisticated Phishing Campaign Leverages React and EmailJS for Credential Theft
Financial Services8 months ago

Sophisticated Phishing Campaign Leverages React and EmailJS for Credential Theft

In March 2026, a sophisticated phishing campaign was identified, utilizing a React-based web application to create a dynamic and convincing fake Dropbox Transfer page. The attackers distributed emails impersonating WeTransfer notifications, enticing recipients to click on a link leading to the fraudulent site. Upon attempting to download the purported files, users were prompted to enter their email credentials. These credentials were then exfiltrated using EmailJS, a legitimate email service, allowing the attackers to collect sensitive information without deploying their own infrastructure. This method not only enhanced the credibility of the phishing page but also helped evade traditional security measures. The use of React for dynamic content rendering and the exploitation of legitimate services like EmailJS signify an evolution in phishing tactics, making detection and prevention more challenging. Organizations must remain vigilant and educate users about such sophisticated social engineering techniques to mitigate the risk of credential theft.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(low)
Read report
Critical Reverse Proxy Vulnerabilities in Fabio and OAuth2-Proxy Expose Web Applications to Attacks
Financial Services8 months ago

Critical Reverse Proxy Vulnerabilities in Fabio and OAuth2-Proxy Expose Web Applications to Attacks

In 2025, critical vulnerabilities were identified in two widely used reverse proxy applications: Fabio and OAuth2-Proxy. CVE-2025-48865 in Fabio allowed attackers to manipulate the Connection header, enabling the removal of security-critical X-Forwarded headers, potentially leading to unauthorized access to backend systems. Similarly, CVE-2025-64484 in OAuth2-Proxy permitted authenticated users to inject underscore variants of X-Forwarded-* headers, bypassing the proxy's filtering logic and potentially escalating privileges in upstream applications. Both vulnerabilities stemmed from improper handling and normalization of HTTP headers, exposing significant security risks in web architectures. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-48865?utm_source=openai)) These incidents underscore the systemic issues in reverse proxy implementations, highlighting the need for rigorous validation and normalization of HTTP headers to prevent similar exploits. Organizations must prioritize updating affected systems and implementing robust security measures to mitigate such vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Stryker's 2026 Cyberattack: A Wake-Up Call for the Medical Tech Industry
Government Administration8 months ago

Stryker's 2026 Cyberattack: A Wake-Up Call for the Medical Tech Industry

In March 2026, Stryker Corporation, a leading U.S.-based medical technology company, suffered a significant cyberattack orchestrated by the Iran-linked group Handala Hack. The attackers infiltrated Stryker's network, deploying wiper malware that erased data from over 200,000 devices and exfiltrated more than 50 terabytes of sensitive information. This breach disrupted operations across 79 countries, affecting both corporate and personal devices connected through Stryker's mobile device management software. ([tomshardware.com](https://www.tomshardware.com/tech-industry/cyber-security/iran-hacking-group-claims-attack-on-med-tech-company-stryker-says-over-200-000-devices-have-been-wiped-clean-and-over-50tb-of-data-extracted?utm_source=openai)) This incident underscores the escalating threat of state-sponsored cyberattacks targeting critical infrastructure and private sector entities. The use of wiper malware by nation-state actors highlights the need for robust cybersecurity measures and proactive defense strategies to mitigate such risks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports