Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 256 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3061–3072 / 4903 reports
SAP's March 2026 Security Patches Address Critical Vulnerabilities
Computer Software/Engineering8 months ago

SAP's March 2026 Security Patches Address Critical Vulnerabilities

In March 2026, SAP released security patches addressing critical vulnerabilities in its enterprise software. Notably, CVE-2019-17571, a code injection flaw in SAP Quotation Management Insurance (FS-QUO), and CVE-2026-27685, an insecure deserialization issue in SAP NetWeaver Enterprise Portal Administration, were both patched. These vulnerabilities could allow remote code execution, potentially leading to full system compromise. ([securityweek.com](https://www.securityweek.com/sap-patches-critical-fs-quo-netweaver-vulnerabilities/?utm_source=openai)) The timely release of these patches underscores the importance of proactive vulnerability management. Organizations are urged to apply these updates promptly to mitigate risks associated with these critical flaws.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Meta's 2026 Crackdown on Southeast Asia Scam Networks
Financial Services8 months ago

Meta's 2026 Crackdown on Southeast Asia Scam Networks

In March 2026, Meta, in collaboration with international law enforcement agencies, disabled over 150,000 Facebook and Instagram accounts linked to sophisticated scam centers operating in Southeast Asia. This coordinated effort, involving authorities from countries including Thailand, the U.S., the U.K., and Singapore, also led to 21 arrests by the Royal Thai Police. The crackdown targeted criminal networks in countries like Cambodia, Myanmar, and Laos, which have been running large-scale scam operations designed to evade detection and cause significant harm to individuals globally. ([about.fb.com](https://about.fb.com/news/2026/03/meta-global-law-enforcement-disrupt-major-southeast-asia-criminal-scam-networks/?utm_source=openai)) This operation underscores the escalating threat posed by industrialized online scams and highlights the necessity for continuous collaboration between tech companies and global law enforcement to protect users from increasingly sophisticated fraudulent activities. ([about.fb.com](https://about.fb.com/news/2026/03/meta-global-law-enforcement-disrupt-major-southeast-asia-criminal-scam-networks/?utm_source=openai))

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical n8n Vulnerabilities Expose Systems to Remote Code Execution
Information Technology/IT8 months ago

Critical n8n Vulnerabilities Expose Systems to Remote Code Execution

In early 2026, multiple critical vulnerabilities were identified in n8n, an open-source workflow automation platform. Notably, CVE-2026-27577 and CVE-2026-27493 allowed for remote code execution (RCE) through expression sandbox escapes and unauthenticated expression evaluations via Form nodes, respectively. These flaws enabled attackers to execute arbitrary commands on the n8n host, potentially leading to full system compromise. ([thehackernews.com](https://thehackernews.com/2026/03/critical-n8n-flaws-allow-remote-code.html?utm_source=openai)) The discovery of these vulnerabilities underscores the importance of timely software updates and vigilant security practices. Organizations utilizing n8n are urged to upgrade to patched versions immediately to mitigate potential exploitation risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Perplexity Comet AI Browser Phishing Attack 2026
Financial Services8 months ago

Perplexity Comet AI Browser Phishing Attack 2026

In March 2026, security researchers demonstrated a critical vulnerability in Perplexity's Comet AI browser, where attackers could manipulate the browser's AI assistant into executing phishing scams autonomously. By intercepting the browser's communication with AI services and feeding it into a Generative Adversarial Network (GAN), the researchers trained the AI to bypass its security measures and enter user credentials into malicious websites within minutes. This exploit highlights a significant shift in attack vectors, targeting AI models directly rather than end-users. The incident underscores the evolving threat landscape where AI-driven systems can be manipulated to perform unauthorized actions, emphasizing the need for robust security measures in AI integrations. As AI technologies become more prevalent, ensuring their resilience against such sophisticated attacks is paramount to maintaining user trust and data security.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Publicly Disclosed Zero-Days
Financial Services8 months ago

Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Publicly Disclosed Zero-Days

In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Among these, two zero-day vulnerabilities were publicly disclosed prior to patch release: CVE-2026-21262, an elevation of privilege flaw in SQL Server, and CVE-2026-26127, a denial-of-service vulnerability in .NET. Notably, none of these vulnerabilities were reported as actively exploited in the wild at the time of release. The update also included eight critical vulnerabilities, such as CVE-2026-21536, a remote code execution flaw in the Microsoft Devices Pricing Program, which Microsoft mitigated server-side without requiring user action. This Patch Tuesday marks the first in six months without any actively exploited zero-day vulnerabilities, indicating a positive trend in Microsoft's proactive security measures. However, the presence of publicly disclosed vulnerabilities underscores the importance of timely patch application to mitigate potential risks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft's March 2026 Patch Tuesday: Key Vulnerabilities and Updates
Computer Software/Engineering8 months ago

Microsoft's March 2026 Patch Tuesday: Key Vulnerabilities and Updates

In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Notably, two zero-day vulnerabilities were publicly disclosed prior to patch release: CVE-2026-21262, an elevation of privilege flaw in SQL Server, and CVE-2026-26127, a denial-of-service vulnerability in .NET. Additionally, a critical remote code execution vulnerability, CVE-2026-21536, affecting the Microsoft Devices Pricing Program, was mitigated server-side without requiring user action. While none of these vulnerabilities were reported as actively exploited in the wild, organizations are advised to apply the patches promptly to mitigate potential risks. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) The absence of actively exploited zero-day vulnerabilities in this release marks a positive shift from previous months. However, the public disclosure of certain flaws prior to patch availability underscores the importance of timely updates. Organizations should remain vigilant, as threat actors may exploit unpatched systems, emphasizing the need for robust patch management practices. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-march-2026/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Salesforce Experience Cloud Guest User Misconfiguration Breach 2026
Computer Software/Engineering8 months ago

Salesforce Experience Cloud Guest User Misconfiguration Breach 2026

In March 2026, the cybercriminal group ShinyHunters exploited misconfigured guest user profiles in Salesforce's Experience Cloud, leading to unauthorized access to sensitive customer data. By utilizing a modified version of the open-source tool AuraInspector, the attackers scanned public-facing Experience Cloud sites and extracted data without authentication. This breach impacted approximately 400 organizations, including high-profile companies such as Snowflake, Okta, LastPass, Sony, AMD, and Salesforce itself. The compromised data included names, phone numbers, and other CRM information, which were subsequently used for social engineering and voice phishing campaigns. Salesforce confirmed that the issue stemmed from customer-configured settings rather than a vulnerability in its platform. ([techradar.com](https://www.techradar.com/pro/security/shinyhunters-claims-its-behind-ongoing-salesforce-aura-data-theft-assault-warns-more-attacks-to-come?utm_source=openai)) This incident underscores the critical importance of proper configuration and regular auditing of cloud-based services. Misconfigurations, especially in widely used platforms like Salesforce, can lead to significant data breaches, emphasizing the need for organizations to adhere to security best practices and continuously monitor their systems for potential vulnerabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Chinese APT Group Exploits Middle East Tensions to Target Qatar with PlugX Malware
Oil/Energy/Solar/Greentech8 months ago

Chinese APT Group Exploits Middle East Tensions to Target Qatar with PlugX Malware

In early March 2026, the Chinese-linked Advanced Persistent Threat (APT) group known as Camaro Dragon launched a cyber-espionage campaign targeting entities in Qatar. Within 24 hours of the escalation of Middle East tensions, the group deployed PlugX malware using war-themed lure documents that mimicked legitimate communications related to the regional conflict. The infection chain involved malicious LNK files leading to DLL hijacking of a legitimate Baidu NetDisk binary, ultimately installing the PlugX backdoor. This malware enables remote command execution, keystroke logging, screen capture, and data exfiltration. The rapid deployment and contextually relevant lures highlight the group's ability to swiftly adapt to geopolitical events for intelligence gathering purposes. This incident underscores the increasing trend of state-sponsored cyber actors exploiting current geopolitical crises to enhance the effectiveness of their campaigns. Organizations, especially those in geopolitically sensitive regions, must remain vigilant against such rapidly evolving threats and ensure robust cybersecurity measures are in place to detect and mitigate sophisticated intrusion attempts.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
AWS Data Centers in Middle East Targeted by Drone Strikes in 2026
Defense/Space8 months ago

AWS Data Centers in Middle East Targeted by Drone Strikes in 2026

In early March 2026, Iranian drone strikes targeted Amazon Web Services (AWS) data centers in the United Arab Emirates (UAE) and Bahrain, causing significant structural damage and service disruptions. Two facilities in the UAE were directly hit, while a third in Bahrain sustained damage from a nearby strike. These attacks led to outages across multiple AWS services, including EC2, S3, and RDS, affecting businesses, financial institutions, and government entities in the region. AWS reported that recovery efforts would be prolonged due to the extent of the physical damage. ([thenationalnews.com](https://www.thenationalnews.com/business/2026/03/03/drone-strikes-damage-amazon-data-centres-in-uae-and-bahrain-disrupting-services/?utm_source=openai)) This incident underscores the vulnerability of cloud infrastructure to physical attacks, especially in geopolitically volatile regions. Organizations relying on cloud services must reassess their disaster recovery and data sovereignty strategies to ensure resilience against both cyber and kinetic threats. ([apnews.com](https://apnews.com/article/71066b0a822c4cfd88b61e3fe79af917?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Zero-Days
Health Care / Life Sciences8 months ago

Microsoft's March 2026 Patch Tuesday: Addressing 83 Vulnerabilities, Including Two Zero-Days

In March 2026, Microsoft released security updates addressing 83 vulnerabilities across its product suite, including Windows, Office, SQL Server, Azure, and .NET. Among these, eight were rated as critical, and two vulnerabilities—CVE-2026-26127 and CVE-2026-21262—were publicly disclosed prior to patch release, though neither had been exploited in the wild. CVE-2026-21536, a remote code execution flaw in Microsoft's Devices Pricing Program, received the highest severity rating with a CVSS score of 9.8. Microsoft has proactively mitigated this issue within its cloud infrastructure, requiring no customer action. ([anonhaven.com](https://anonhaven.com/en/news/microsoft-march-2026-patch-tuesday-83-cves/?utm_source=openai)) This update marks the first Patch Tuesday in six months without any actively exploited zero-day vulnerabilities. The absence of active exploitation provides organizations a crucial window to apply patches without the immediate pressure of ongoing attacks. However, the disclosure of vulnerabilities like CVE-2026-26127 and CVE-2026-21262 underscores the importance of timely patch management to preempt potential exploitation. ([cyberscoop.com](https://cyberscoop.com/microsoft-patch-tuesday-march-2026/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling Critical Reverse Proxy Header Vulnerabilities in 2025
Financial Services8 months ago

Unveiling Critical Reverse Proxy Header Vulnerabilities in 2025

In 2025, critical vulnerabilities were identified in reverse proxy applications, notably Fabio and OAuth2-Proxy, exposing significant security risks. CVE-2025-48865 in Fabio allowed attackers to manipulate or remove security-critical headers like X-Forwarded-Host and X-Real-IP by exploiting the HTTP Connection header, potentially leading to access control bypasses. Similarly, CVE-2025-64484 in OAuth2-Proxy enabled authenticated users to inject underscore variants of X-Forwarded-* headers, bypassing the proxy's filtering logic and potentially escalating privileges in upstream applications. These vulnerabilities underscore the importance of stringent header validation and normalization practices in reverse proxy configurations. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/CVE-2025-48865?utm_source=openai)) The discovery of these vulnerabilities highlights a systemic issue in how reverse proxies handle HTTP headers, emphasizing the need for organizations to reassess and fortify their security measures to prevent similar exploits.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SolarWinds Web Help Desk 2025 AjaxProxy RCE Vulnerability
Information Technology/IT8 months ago

SolarWinds Web Help Desk 2025 AjaxProxy RCE Vulnerability

In September 2025, a critical vulnerability (CVE-2025-26399) was identified in SolarWinds Web Help Desk, allowing unauthenticated remote attackers to execute arbitrary code on affected systems. This flaw, rooted in insecure deserialization within the AjaxProxy component, enables attackers to run commands on the host machine without authentication. Despite previous patches for related vulnerabilities (CVE-2024-28986 and CVE-2024-28988), this issue persisted, leading to active exploitation in the wild. Organizations using versions up to 12.8.7 are at significant risk and should apply the latest hotfix immediately. The recurrence of such vulnerabilities underscores the importance of comprehensive security reviews and prompt patch management. As attackers increasingly exploit deserialization flaws, organizations must prioritize securing their software supply chains and implementing robust monitoring to detect and respond to such threats promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports