Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 27 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 313–324 / 4893 reports
Docker Hub's Two-Year Critical Flaw: How CVE-2026-105445 Exposed Container Supply Chains
Docker Hub's Two-Year Critical Flaw: How CVE-2026-105445 Exposed Container Supply Chains
Computer Software/Engineering3 weeks ago

Docker Hub's Two-Year Critical Flaw: How CVE-2026-105445 Exposed Container Supply Chains

Docker fixed a critical vulnerability (CVE-2026-105445) in Docker Hub that allowed attackers to push, pull, or delete container images as other users. The flaw, dubbed GhostPat, existed for over two years from August 2024 to September 2026 and stemmed from improper handling of personal access tokens (PATs) during account-to-organization conversions. Attackers could create a token, convert their account to an organization, and designate another user as owner, thereby gaining registry access under that user's identity. While Docker found no evidence of exploitation after reviewing 304,000 pushes, the vulnerability posed significant supply chain risks by enabling malicious image publication under legitimate names. This incident highlights the growing sophistication of supply chain attacks targeting container registries, coinciding with increased focus on software supply chain security following recent high-profile compromises and new regulatory requirements for software bill of materials tracking.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
The Gentlemen Ransomware Gang Industrialized EDR Evasion Into a Service Economy
The Gentlemen Ransomware Gang Industrialized EDR Evasion Into a Service Economy
Financial Services3 weeks ago

The Gentlemen Ransomware Gang Industrialized EDR Evasion Into a Service Economy

The Gentlemen ransomware-as-a-service operation emerged in late 2025 and rapidly ascended to become a top-five ransomware gang by Q1 2026 through their innovative EDR killer framework. The crew developed an industrialized approach to endpoint detection and response evasion, creating eight or more variants of their GentleKiller tool that targets over 400 security processes across 48 different security products. By offering affiliates a generous 90% revenue share compared to the industry standard of 80%, Gentlemen scaled their operation through volume rather than per-incident margins, transforming EDR evasion from a technical skill barrier into a commodity service available to low-skill threat actors. This incident represents the maturation of the bring-your-own-vulnerable-driver (BYOVD) attack technique from isolated tactics into a full-scale economy with pricing tiers, product roadmaps, and customer support models, fundamentally changing the threat landscape defenders face.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
SonicWall SMA Under Fire: CVE-2026-102255 Exploitation Reveals SSL-VPN Risks
SonicWall SMA Under Fire: CVE-2026-102255 Exploitation Reveals SSL-VPN Risks
Financial Services3 weeks ago

SonicWall SMA Under Fire: CVE-2026-102255 Exploitation Reveals SSL-VPN Risks

In October 2026, threat actors began actively exploiting CVE-2026-102255, a maximum-severity SSRF vulnerability in SonicWall SMA 1000 appliances. The flaw allows remote unauthenticated attackers to abuse the WorkPlace interface, directing appliances to issue internal requests and perform unauthorized operations. Cybersecurity firms Previdian and Defused detected exploitation attempts on their honeypot devices within days of SonicWall's advisory, despite the vendor initially reporting no evidence of active exploitation. This incident highlights the ongoing targeting of SSL-VPN and edge devices by cybercriminals, following previous zero-day attacks on SonicWall products by the Inc ransomware gang in July 2026. The vulnerability's trivial exploitation combined with SMA devices' position between public internet and corporate resources creates significant risk for organizations relying on legacy SSL-VPN solutions.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Trusted Cybersecurity Executive Turned Alleged Extortionist: The Edward Dubrovsky Case
Trusted Cybersecurity Executive Turned Alleged Extortionist: The Edward Dubrovsky Case
Computer/Network Security3 weeks ago

Trusted Cybersecurity Executive Turned Alleged Extortionist: The Edward Dubrovsky Case

Edward Dubrovsky, a prominent 54-year-old cybersecurity executive and ransomware negotiator, was arrested in Pennsylvania in October 2026 on federal extortion charges under the Computer Fraud and Abuse Act. The Canadian-based security professional, who previously served as an executive at incident response firm Cypfer and authored strategic guides on cyber-extortion response, is suspected of involvement with the ShinyHunters cybercrime collective. FBI investigations suggest connections to the group's recent breach of FBIjobs.gov, where attackers claimed to have stolen data from nearly every FBI employee and job applicant. This case represents a significant insider threat scenario where a trusted cybersecurity professional allegedly participated in the very criminal activities they were supposed to defend against. This incident highlights the growing concern of insider threats within the cybersecurity industry itself, as professionals with privileged access and deep knowledge of defensive strategies increasingly become targets for recruitment by cybercriminal organizations or choose to monetize their expertise through illegal means.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
GitLab's CVSS 10.0 Vulnerability Exposes Critical DevOps Security Gaps
GitLab's CVSS 10.0 Vulnerability Exposes Critical DevOps Security Gaps
Computer Software/Engineering3 weeks ago

GitLab's CVSS 10.0 Vulnerability Exposes Critical DevOps Security Gaps

GitLab released emergency patches for CVE-2026-97229, a maximum-severity vulnerability with a CVSS score of 10.0 that allows unauthenticated attackers to execute arbitrary code on GitLab servers. The integer overflow flaw exploits insufficient regular expression validation in CI/CD configurations, affecting all GitLab Community and Enterprise Edition versions from 19.2 to 19.4.1. Successful exploitation requires only a specially crafted regular expression in a CI/CD pipeline configuration, providing complete server compromise without authentication. The incident demonstrates the critical security risks in DevOps platforms where CI/CD pipeline vulnerabilities can provide direct server access. The disclosure follows a concerning pattern of maximum-severity GitLab vulnerabilities, including CVE-2026-85706 which saw active exploitation within hours of public disclosure, highlighting the urgent need for organizations to prioritize patch management in their DevSecOps environments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Midnight Mimosa Malware Turns Android Phones Into Botnet Proxies Through Supply Chain Attack
Midnight Mimosa Malware Turns Android Phones Into Botnet Proxies Through Supply Chain Attack
Consumer Electronics3 weeks ago

Midnight Mimosa Malware Turns Android Phones Into Botnet Proxies Through Supply Chain Attack

The Midnight Mimosa campaign, discovered by Bitdefender in 2026, involved preinstalled malware on low-cost Android devices built on MediaTek platforms. The malware, embedded in device firmware with system-level privileges, allowed operators to remotely install apps, conduct ad fraud, and convert infected devices into residential proxy nodes for botnets. Affecting thousands of devices across 150+ countries over two years, the campaign primarily targeted users in Mexico, France, Italy, and the U.S. The supply chain compromise involved white-label and counterfeit devices, with firmware signed by certificates attributed to Shenzhen Zediel Co., Ltd. This incident highlights the growing threat of supply chain attacks targeting mobile ecosystems, as threat actors increasingly leverage firmware-level compromises to establish persistent access that bypasses traditional security controls and user awareness.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical MarkLogic Vulnerabilities Enable Persistent Admin Takeover
Critical MarkLogic Vulnerabilities Enable Persistent Admin Takeover
Financial Services3 weeks ago

Critical MarkLogic Vulnerabilities Enable Persistent Admin Takeover

Progress Software disclosed 31 security vulnerabilities in MarkLogic Server on October 12, 2026, with five rated critical. Two of the most severe flaws (CVE-2026-85947 and CVE-2026-85948) allow accounts with limited management privileges to escalate to persistent administrator control of the database server. CVE-2026-85947 enables forest-management accounts to create persistent admin accounts, while CVE-2026-85948 exploits an XQuery injection flaw in deprecated Management API paths. The vulnerabilities affect MarkLogic 11.x before 11.3.7 and 12.x before 12.1.0, with fixes available since September 10, 2026. The disclosure follows another batch of 10 critical flaws published in August 2026, indicating an ongoing pattern of privilege escalation vulnerabilities in enterprise database platforms that require immediate attention from organizations relying on MarkLogic for mission-critical data management.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
GitLab Issues Critical Security Alert for CVE-2026-97229 Remote Code Execution Flaw
GitLab Issues Critical Security Alert for CVE-2026-97229 Remote Code Execution Flaw
Computer Software/Engineering3 weeks ago

GitLab Issues Critical Security Alert for CVE-2026-97229 Remote Code Execution Flaw

GitLab disclosed CVE-2026-97229, a maximum-severity remote code execution vulnerability in its CI/CD Regular Expression Compiler affecting Community and Enterprise editions. The critical flaw stems from an integer overflow weakness that allows unauthenticated attackers to execute arbitrary code on GitLab servers through specially crafted regular expressions in pipeline configuration files. GitLab has patched versions 19.2.8, 19.3.4, and 19.4.2, with GitLab.com already running the fixed version. The vulnerability was discovered through GitLab's HackerOne bug bounty program and impacts organizations including Fortune 100 companies using the platform. This incident highlights the growing threat landscape targeting DevSecOps platforms and CI/CD infrastructure, which have become critical attack vectors as organizations increasingly rely on automated development pipelines. The maximum severity rating and immediate patching requirement underscore the urgency of securing software supply chain components.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
AvisLoader Malware Leverages Tox P2P Networks to Evade Takedowns
AvisLoader Malware Leverages Tox P2P Networks to Evade Takedowns
Financial Services3 weeks ago

AvisLoader Malware Leverages Tox P2P Networks to Evade Takedowns

AvisLoader is a sophisticated Windows malware loader discovered by Varonis Threat Labs in October 2024 that uses the encrypted Tox peer-to-peer messaging network for command and control communications. The malware is delivered through ClickFix social engineering lures disguised as DocuSign document verification requests, tricking users into executing PowerShell commands that download and install the loader. AvisLoader employs multiple evasion techniques including UAC bypass methods, process hiding capabilities, and shortcut persistence mechanisms while communicating through Tox P2P networks to avoid traditional domain-based takedowns. This incident highlights the growing sophistication of malware distribution campaigns that leverage legitimate cloud services and encrypted P2P networks to evade detection and maintain persistent command and control infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Sophisticated Spy Chip Implants Compromise Ledger Hardware Wallets in Supply Chain Attack
Sophisticated Spy Chip Implants Compromise Ledger Hardware Wallets in Supply Chain Attack
Financial Services3 weeks ago

Sophisticated Spy Chip Implants Compromise Ledger Hardware Wallets in Supply Chain Attack

In October 2026, Ledger confirmed that hardware wallets distributed through Southeast Asian reseller CryptoBilis contained malicious spy chip implants designed to steal cryptocurrency. The sophisticated supply chain attack involved physically modifying Ledger Nano X devices with custom PCB implants that captured seed phrases through display output and button press monitoring, then transmitted the data via embedded eSIM and LTE connectivity. Researchers identified two variants of the implant, with the more advanced version fitting into the original form factor without obvious external indicators. The compromised devices were sold at discounted prices across Malaysia and other Southeast Asian markets, resulting in confirmed fund drains from affected users' wallets. This incident highlights the growing sophistication of hardware supply chain attacks targeting cryptocurrency infrastructure, demonstrating how threat actors are evolving from basic firmware modifications to engineered PCB implants that can bypass traditional security validations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Helpdesk Zero-Days Exploited in Hours as ShinyHunters Face Justice
Critical Helpdesk Zero-Days Exploited in Hours as ShinyHunters Face Justice
Financial Services3 weeks ago

Critical Helpdesk Zero-Days Exploited in Hours as ShinyHunters Face Justice

Multiple critical zero-day vulnerabilities were discovered in popular helpdesk software platforms, with threat actors exploiting these flaws within hours of public disclosure. The attacks targeted enterprise help desk systems, allowing unauthorized access to sensitive customer data and internal communications. Concurrently, law enforcement made significant arrests of ShinyHunters group members, a notorious cybercriminal organization responsible for numerous high-profile data breaches affecting millions of users globally. The incidents highlight the dangerous speed at which modern threat actors can weaponize newly disclosed vulnerabilities, often faster than organizations can implement protective measures. This wave of attacks represents a concerning acceleration in the exploit-to-compromise timeline, with security teams having minimal time to assess and mitigate risks before active exploitation begins.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
AWS Launches Production-Ready Quantum-Resistant Software Supply Chain Security
AWS Launches Production-Ready Quantum-Resistant Software Supply Chain Security
Computer Software/Engineering3 weeks ago

AWS Launches Production-Ready Quantum-Resistant Software Supply Chain Security

AWS has introduced comprehensive quantum-resistant signing capabilities for software supply chains using Module-Lattice-Based Digital Signature Algorithm (ML-DSA) across AWS KMS, AWS Private Certificate Authority, and IAM Roles Anywhere. This implementation addresses the 'harvest now, forge later' threat where attackers collect traditionally-signed artifacts today to forge signatures using future quantum computers. The solution provides end-to-end ML-DSA signing for binaries, container images, and software bills of materials, establishing a quantum-resistant root of trust that meets CNSA 2.0 requirements for US National Security Systems by 2030 and EU Cyber Resilience Act mandates by December 2027. This development represents a critical shift in supply chain security as quantum computing threats transition from theoretical to imminent regulatory requirements. Organizations now have production-ready tools to implement post-quantum cryptography before quantum computers can break current RSA and ECDSA signing mechanisms.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports