The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Mythic: The Growing Threat of Post-Exploitation C2 Frameworks in Network Traffic
In early 2024, cybersecurity researchers revealed the widespread use of the Mythic post-exploitation framework by multiple threat actors to gain persistent control of compromised networks. Mythic, a versatile multi-platform C2 (command and control) toolkit, has enabled adversaries to evade endpoint detection tools while moving laterally, collecting data, and exfiltrating sensitive assets. By leveraging covert channels such as HTTP(S), SMB, WebSocket, Discord, and GitHub APIs, attackers have masked their traffic from traditional network security defenses. Incident response teams observed tailored communication modules, pivoting tactics, and sophisticated data encoding, resulting in delayed detection and prolonged dwell time within targeted organizations. This incident highlights the growing challenge for defenders as open-source offensive frameworks become more advanced and widely adopted. The surge of network-based C2 detection evasion tactics underscores the need for enhanced behavioral analysis, encrypted traffic inspection, and updated NDR/IDS capabilities, especially as regulatory and compliance scrutiny intensifies.
8 months ago
Kill Chain
Shanya Packer-as-a-Service: Ransomware’s New Obfuscation Arsenal
In May 2024, security researchers uncovered an emerging Packer-as-a-Service (PaaS) called Shanya, designed to help ransomware operators evade modern enterprise defenses. Shanya provides advanced payload obfuscation capabilities to threat actors, enabling the delivery of ransomware that bypasses endpoint detection and response (EDR) solutions. Attackers using Shanya can rapidly pack malware before deployment, making it harder to analyze and detect. Early incidents showed Shanya-packed ransomware used to swiftly gain lateral movement across compromised environments, disrupt business operations, and facilitate significant data encryption and extortion campaigns. The rise of packers like Shanya signals a growing trend: ransomware groups are leveraging SaaS-style services to increase automation, evasion, and reach. With increased regulatory scrutiny on incident response and a surge in ransomware targeting sectors with critical operations, businesses must urgently strengthen detection and response strategies to address evolving malware delivery techniques.
8 months ago
Kill Chain
Microsoft’s 2024 Zero-Day Exploitation: What Security Leaders Must Know
In June 2024, Microsoft released security updates addressing a critical zero-day vulnerability (CVE-2024-30051) that was actively exploited in the wild, targeting Windows operating systems. Threat actors leveraged this privilege escalation flaw to bypass security controls and gain elevated access privileges on compromised systems, potentially enabling further malware deployment and lateral movement. Nearly 50 vulnerabilities were patched in this cycle, with public proof-of-concept code available for several, raising the risk of rapid exploitation by cybercriminal groups and nation-state actors before widespread patch deployment. This incident underscores the persistent threat of zero-day vulnerabilities, the speed at which exploits circulate once publicly disclosed, and the substantial business risk posed to enterprises delaying patch management. Increasing regulatory scrutiny and evolving attack techniques demand urgent, proactive defense strategies.
8 months ago
Kill Chain
Storm-0249's Abuse of EDR Processes: A New Era of Stealth Attacks
In early 2024, threat actor Storm-0249 launched a series of stealthy attacks by weaponizing Endpoint Detection and Response (EDR) platforms alongside native Windows utilities. As an initial access broker, the group circumvented traditional EDR defenses to gain persistent entry into multiple enterprise environments. Leveraging legitimate EDR processes for their own activities, Storm-0249 was able to evade security monitoring, escalate privileges, and facilitate lateral movement. These tactics led to compromised data and footholds that were subsequently sold to other cybercriminal groups, increasing the overall risk for targeted organizations. The emergence of sophisticated actors repurposing security tools for malicious objectives highlights an urgent industry focus on advanced detection, segmentation, and the continual evolution of zero trust strategies. This incident reflects a growing trend: motivated threat groups exploiting trusted processes to blend in and extend dwell time inside modern network environments.
8 months ago
Kill Chain
AI Domain Impersonation Fuels 2024 ClickFix-Style Malware Surge
In early 2024, a cyberattack campaign known as the 'ClickFix Style Attack' emerged, exploiting cutting-edge social engineering and SEO poisoning techniques. Attackers leveraged widely searched AI-related domains such as Grok and ChatGPT, using search engine manipulation to lure unsuspecting users to weaponized websites. Once on these compromised pages, visitors were tricked into downloading malware under the guise of legitimate AI tools and browser extensions, enabling threat actors to gain persistent access to systems and exfiltrate sensitive data. The campaign highlights the growing sophistication and agility of attackers in blending trusted brands with social engineering ploys, ultimately threatening business operations and data integrity. This incident is particularly relevant as it showcases the convergence of AI hype, manipulated search results, and advanced social engineering, which increases the likelihood of successful malware delivery. Security teams must remain vigilant as attackers continue to target the widespread adoption of AI-driven tools and blur lines between legitimate and malicious sources.
8 months ago
Kill Chain
Microsoft December 2025 Patch Tuesday: Critical & Exploited Vulnerabilities Exposed
In December 2025, Microsoft addressed 57 vulnerabilities as part of its Patch Tuesday update, including three critical flaws and one (CVE-2025-62221) already being actively exploited. The vulnerabilities spanned across numerous Microsoft products such as Office, Outlook, Exchange, PowerShell, and the Windows Cloud Files Mini Filter driver. Notably, CVE-2025-64671 affected GitHub Copilot plugins for JetBrains, potentially enabling remote code execution via AI-driven code assistance. Attackers exploited privilege escalation and remote-code execution vectors, posing significant risks to system integrity and user data. The rapid disclosure and exploitation of some flaws before patches were available highlighted increasing attacker sophistication and speed. Incidents such as this emphasize the urgent need for timely patch management, especially as software supply chains and AI integrations become more prevalent. Security teams must remain vigilant against fast-emerging threats, as even mainstream platforms like Microsoft continue to face ongoing and complex exploitation attempts.
8 months ago
Kill Chain
Kubernetes NodeLogQuery (CVE-2024-9042): Command Injection Exploit Hits Windows Nodes
In late 2024, a command injection vulnerability in Kubernetes' NodeLogQuery feature (CVE-2024-9042) was actively exploited, primarily impacting clusters running Windows nodes with log read permissions enabled. Attackers leveraged the '/logs/' API endpoint, injecting operating system commands via GET parameters or path elements to gain unauthorized system access. Victims included enterprise environments utilizing the beta NodeLogQuery feature, which was not enabled by default. The exploit techniques involved turning Kubernetes' logging capabilities into a remote code execution avenue, exposing sensitive workloads to further compromise and potential lateral movement. This incident underscores a broader trend in targeting Kubernetes clusters at the API layer, as adversaries evolve their exploitation of cloud-native misconfigurations and insecure default settings. The attack highlights the need for enhanced east-west traffic controls, static analysis of cluster policies, and real-time anomaly detection to intercept emerging exploitation patterns in cloud and hybrid infrastructure.
8 months ago
Kill Chain
React2Shell: 2025’s Supply Chain Cyberattack Shocks 50+ Organizations
In June 2025, a surge of attacks leveraging the critical React2Shell vulnerability (CVE-2025-55182) swept across more than 50 organizations globally. The flaw, located in React Server Components and derivatives like Next.js, enabled diverse threat actors ranging from nation-states (notably North Korean and Chinese groups), cybercriminals, and botnets to achieve remote code execution. Attackers exploited unpatched instances, deploying a range of malware—including cryptominers, ransomware, and backdoors such as Mirai, XMRIG, and BPFDoor—affecting entities in finance, tech, education, government, and more. The incident’s rapid expansion was facilitated by the widespread availability of public proof-of-concept exploits and slow organizational patching. The React2Shell crisis highlights the fragility of the software supply chain and the speed at which novel exploits can be adapted by a wide array of adversaries. Security and regulatory scrutiny is intensifying, with urgent patching deadlines and increased concern due to the vulnerability’s ease of exploitation, high automation, and ability to evade traditional controls, reminiscent of the earlier Log4Shell incident.
8 months ago
Kill Chain
Microsoft Patches Critical Zero-Day in Windows: December 2025 Security Update
In December 2025, Microsoft issued patches for 57 vulnerabilities across its product suite as part of its final Patch Tuesday of the year. Notably, the release addressed an actively exploited zero-day vulnerability, CVE-2025-62221, impacting the Windows Cloud Files Mini Filter Driver. This use-after-free flaw, with a CVSS score of 7.8, allowed attackers to potentially gain system-level privileges when chained with code execution bugs. Affecting all supported versions of Windows, the vulnerability drew immediate attention from CISA and the cybersecurity community due to its presence in production environments and ongoing exploitation. The incident underscores a persistent trend of attackers targeting foundational Windows components through privilege escalation and memory management bugs. With the rising complexity of Microsoft’s ecosystem and a continued increase in vulnerabilities—especially as AI-related issues proliferate—organizations face growing pressure to rapidly deploy patches and strengthen monitoring against sophisticated exploits.
8 months ago
Kill Chain
Supply Chain Malware Infects VS Code, Go, npm & Rust: 2025 Developer Data Breach
In December 2025, cybersecurity researchers uncovered a sophisticated supply chain attack where malicious extensions on the Visual Studio Code Marketplace, along with booby-trapped Go, npm, and Rust packages, stealthily harvested sensitive developer data. Threat actors disguised two VS Code extensions as a popular dark theme and an AI-powered coding assistant, which, upon installation, downloaded stealer malware to exfiltrate screenshots, code, Wi-Fi passwords, clipboard content, and browser session data. Complementary attacks leveraged typosquatting in open-source package ecosystems, including npm, Go, and Rust, to hijack credentials and upload them to attacker-controlled infrastructure. This incident underscores the growing wave of software supply chain threats specifically targeting developer environments. As attackers increasingly exploit trusted dev tool repositories and package managers to gain initial access and exfiltrate enterprise credentials, organizations must urgently reevaluate their security posture around code dependencies and third-party extensions.
8 months ago
Kill Chain
STAC6565 & Gold Blade Exploit Recruitment Platforms in Canadian Ransomware Assault (2025)
Between February 2024 and August 2025, a financially-motivated threat group tracked as STAC6565 (with strong overlaps to the Gold Blade/RedCurl actor cluster) orchestrated a series of nearly 40 targeted cyberattacks, predominantly on Canadian organizations. The attackers utilized spear-phishing campaigns, delivering weaponized resumes via legitimate recruitment platforms to HR staff to gain initial access. Once inside, the group deployed a multi-stage attack chain using custom loaders and tools like RedLoader, RPivot, and Chisel, culminating in QWCrypt ransomware deployment on high-value endpoints including hypervisors. Data theft and extortion were observed, with a clear pattern of operational sophistication and periods of dormancy followed by refined attack waves. This incident highlights the increasing adoption of "hack-for-hire" models, hybrid attacks combining espionage and ransomware, and the innovative abuse of legitimate business platforms to sidestep conventional email security. Organizations globally—particularly those with HR exposures and reliance on virtualized infrastructure—face heightened risk as attackers rapidly iterate on TTPs to maximize impact and evade detection.
8 months ago
Kill Chain
Google Chrome 2025: AI Browsing Defenses Raise the Bar Against Indirect Prompt Injection
In December 2025, Google implemented new layered defenses in the Chrome browser to counter indirect prompt injection attacks following the introduction of agentic AI features. Attackers exploited weaknesses inherent in large language model-powered browser agents, attempting to override user intent, exfiltrate data from other sites, or execute rogue actions by injecting malicious prompts via untrusted web content. Google's updated architecture introduced components like the User Alignment Critic and Agent Origin Sets, isolating agent actions from attacker-controlled data and enforcing origin-based access controls. These measures aim to prevent data leaks and unauthorized automation that could compromise user accounts, sensitive information, or browser integrity. This incident highlights the rising risk of AI-driven browsing, where automated agents interacting with multiple web origins are exposed to sophisticated prompt-based attacks. The move reflects a broader industry push for deterministic (non-LLM) safeguards and ongoing regulatory and organizational scrutiny over rapidly evolving AI systems in end-user applications.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports