Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 281 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3361–3372 / 4903 reports
SolarWinds Web Help Desk 2026 Untrusted Data Deserialization RCE
Information Technology/IT9 months ago

SolarWinds Web Help Desk 2026 Untrusted Data Deserialization RCE

In January 2026, a critical vulnerability (CVE-2025-40551) was discovered in SolarWinds Web Help Desk (WHD), allowing unauthenticated remote code execution through untrusted data deserialization. Exploitation of this flaw enables attackers to execute arbitrary commands on the host system, potentially leading to full system compromise. SolarWinds released WHD version 2026.1 on January 28, 2026, addressing this and other vulnerabilities. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/cve-2025-40551?utm_source=openai)) The inclusion of CVE-2025-40551 in CISA's Known Exploited Vulnerabilities catalog underscores the urgency for organizations to apply the patch promptly. This incident highlights the persistent threat posed by deserialization vulnerabilities and the importance of timely software updates to mitigate such risks. ([securityweek.com](https://www.securityweek.com/fresh-solarwinds-vulnerability-exploited-in-attacks/?utm_source=openai))

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Eclipse Foundation's 2025 Response to Unauthorized Extension Uploads
Computer Software/Engineering9 months ago

Eclipse Foundation's 2025 Response to Unauthorized Extension Uploads

In May 2025, the Eclipse Foundation identified a vulnerability in the Open VSX Registry's automated publishing system, potentially allowing unauthorized extension uploads. The flaw, reported by Koi Security researchers, involved inadequate isolation in build scripts, exposing a privileged token that could be exploited to publish extensions under any namespace. The issue was promptly addressed, with a fix deployed by June 24, 2025, and a comprehensive audit confirming no evidence of exploitation. As a precaution, 81 extensions were deactivated. This incident underscores the critical importance of securing automated processes in software supply chains to prevent unauthorized access and maintain trust in open-source ecosystems. The Eclipse Foundation has since implemented enhanced security measures, including sandboxing build processes and enforcing stricter credential management, to mitigate similar risks in the future.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Understanding the n8n 2026 Authenticated RCE Vulnerability
Information Technology/IT9 months ago

Understanding the n8n 2026 Authenticated RCE Vulnerability

In early 2026, multiple critical vulnerabilities were identified in n8n, an open-source workflow automation platform. These flaws, collectively tracked as CVE-2026-25049, allowed authenticated users with permissions to create or modify workflows to execute arbitrary system commands on the host server. Exploitation of these vulnerabilities could lead to full system compromise, including unauthorized access to sensitive data and potential lateral movement within connected systems. The issues were addressed in versions 1.123.17 and 2.5.2, released in January 2026. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/critical-n8n-flaws-disclosed-along-with-public-exploits/?utm_source=openai)) This incident underscores the importance of rigorous input validation and sandboxing mechanisms in software development. It also highlights the necessity for organizations to promptly apply security patches to mitigate risks associated with known vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft Warns of Python Infostealers Targeting macOS via Fake Ads and Installers
Computer Software/Engineering9 months ago

Microsoft Warns of Python Infostealers Targeting macOS via Fake Ads and Installers

In late 2025, Microsoft observed a surge in macOS-targeted information-stealing campaigns leveraging Python-based malware. Attackers employed social engineering tactics, including malicious advertisements and fake installers, to distribute infostealers like Atomic macOS Stealer (AMOS), MacSync, and DigitStealer. These campaigns utilized fileless execution, native macOS utilities, and AppleScript automation to harvest sensitive data such as web browser credentials, iCloud Keychain contents, and developer secrets. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/?utm_source=openai)) This trend underscores a significant shift in cyber threats, with attackers expanding their focus beyond Windows to target macOS environments. The use of cross-platform languages like Python facilitates rapid adaptation of malware across different operating systems, posing increased risks to organizations with diverse device ecosystems. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/?utm_source=openai))

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
DEAD#VAX Malware Campaign: A New Era of Fileless Attacks
Financial Services9 months ago

DEAD#VAX Malware Campaign: A New Era of Fileless Attacks

In early February 2026, cybersecurity researchers uncovered a sophisticated malware campaign named DEAD#VAX, which utilized phishing emails to distribute Virtual Hard Disk (VHD) files hosted on the InterPlanetary File System (IPFS). These VHD files, disguised as PDF documents, contained obfuscated scripts that, upon execution, deployed AsyncRAT—a remote access trojan—into trusted Windows processes entirely in memory, leaving minimal forensic traces on disk. This method allowed attackers to gain extensive control over compromised systems, facilitating surveillance and data exfiltration. The campaign's use of decentralized file hosting and fileless execution techniques highlights a significant evolution in malware delivery and evasion strategies. ([thehackernews.com](https://thehackernews.com/2026/02/deadvax-malware-campaign-deploys.html?utm_source=openai)) The DEAD#VAX campaign underscores a growing trend among cybercriminals to exploit legitimate system features and decentralized technologies to bypass traditional security measures. The reliance on IPFS for hosting malicious payloads and the employment of fileless malware execution present new challenges for detection and mitigation, emphasizing the need for advanced threat intelligence and adaptive defense mechanisms in the face of evolving cyber threats. ([thehackernews.com](https://thehackernews.com/2026/02/deadvax-malware-campaign-deploys.html?utm_source=openai))

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Microsoft's New Scanner Bolsters AI Security by Detecting LLM Backdoors
Computer Software/Engineering9 months ago

Microsoft's New Scanner Bolsters AI Security by Detecting LLM Backdoors

In February 2026, Microsoft unveiled a lightweight scanner designed to detect backdoors in open-weight large language models (LLMs). This tool identifies malicious alterations by analyzing three key behavioral signals: distinctive attention patterns triggered by specific inputs, unintended data memorization, and activation by multiple similar triggers. The scanner operates efficiently without requiring additional model training or prior knowledge of potential backdoors, making it applicable across various GPT-style models. However, it necessitates access to model files and is most effective against deterministic backdoors. This development underscores Microsoft's commitment to enhancing AI security and trustworthiness. ([microsoft.com](https://www.microsoft.com/en-us/security/blog/2026/02/04/detecting-backdoored-language-models-at-scale/?utm_source=openai)) The release of this scanner is particularly timely given the increasing integration of LLMs into critical applications. Recent research highlights the ease with which backdoors can be embedded into AI models, even with minimal malicious data. ([arstechnica.com](https://arstechnica.com/ai/2025/10/ai-models-can-acquire-backdoors-from-surprisingly-few-malicious-documents/?utm_source=openai)) Microsoft's proactive approach addresses these emerging threats, aiming to safeguard AI systems from covert manipulations that could compromise their integrity and reliability.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Unveiling the Rublevka Team: A Deep Dive into the 2023 Crypto Wallet Draining Operation
Financial Services9 months ago

Unveiling the Rublevka Team: A Deep Dive into the 2023 Crypto Wallet Draining Operation

In 2023, the cybercriminal group known as 'Rublevka Team' orchestrated large-scale cryptocurrency thefts, amassing over $10 million through affiliate-driven wallet draining campaigns. Operating as a 'traffer team,' they utilized a network of social engineering specialists to direct victims to malicious landing pages. These pages, impersonating legitimate crypto services, deployed custom JavaScript scripts that tricked users into connecting their wallets and authorizing fraudulent transactions. The group's fully automated infrastructure provided affiliates with tools such as Telegram bots, landing page generators, and support for over 90 wallet types, enabling high-volume scams with minimal oversight. This incident underscores the evolving threat landscape in the cryptocurrency sector, highlighting the shift towards scalable, service-based cybercrime models. The Rublevka Team's operations pose significant risks to cryptocurrency platforms, fintech providers, and brands, emphasizing the need for proactive monitoring and defense strategies to protect customers and maintain trust.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
GlassWorm Malware Compromises Open VSX Registry in 2026 Supply Chain Attack
Computer Software/Engineering9 months ago

GlassWorm Malware Compromises Open VSX Registry in 2026 Supply Chain Attack

In late January 2026, a sophisticated supply chain attack compromised the Open VSX Registry, an open-source marketplace for Visual Studio Code extensions. Threat actors gained unauthorized access to a trusted developer's account, 'oorzc,' and injected malicious code into four widely-used extensions: FTP/SFTP/SSH Sync Tool, I18n Tools, vscode mindmap, and scss to css. These extensions, collectively downloaded over 22,000 times, delivered the GlassWorm malware, which targeted macOS systems to exfiltrate sensitive data, including browser credentials, cryptocurrency wallets, and developer secrets. The malware employed advanced evasion techniques, such as locale checks to avoid Russian systems and utilizing the Solana blockchain for command-and-control communications. ([thehackernews.com](https://thehackernews.com/2026/02/open-vsx-supply-chain-attack-used.html?utm_source=openai)) This incident underscores the escalating threat of supply chain attacks within the developer ecosystem. The exploitation of trusted extensions highlights the need for enhanced security measures in open-source platforms. Organizations must prioritize the integrity of their development tools and implement robust monitoring to detect unauthorized modifications promptly.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
APT28's Operation Neusploit: Exploiting Microsoft Office Zero-Day in 2026
Government Administration9 months ago

APT28's Operation Neusploit: Exploiting Microsoft Office Zero-Day in 2026

In January 2026, the Russian state-sponsored group APT28 launched 'Operation Neusploit,' targeting users in Ukraine, Slovakia, and Romania. They exploited CVE-2026-21509, a vulnerability in Microsoft Office, by sending specially crafted Rich Text Format (RTF) documents via phishing emails. Opening these documents triggered a multi-stage infection chain, deploying malware such as MiniDoor, an Outlook email stealer, and PixyNetLoader, which installed the Covenant Grunt implant for command-and-control operations. Microsoft released an out-of-band patch on January 26, 2026, but active exploitation was observed as early as January 29, 2026. This incident underscores the rapid weaponization of newly disclosed vulnerabilities by advanced persistent threat actors and highlights the critical need for organizations to promptly apply security patches. The use of localized social engineering tactics and sophisticated evasion techniques in this campaign reflects an evolving threat landscape, emphasizing the importance of comprehensive cybersecurity measures.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Security Flaws in Google Looker: A Wake-Up Call for Cloud Security
Financial Services9 months ago

Critical Security Flaws in Google Looker: A Wake-Up Call for Cloud Security

In late 2025, critical vulnerabilities were discovered in Google Looker, a widely used business intelligence platform. These flaws allowed attackers to execute remote code and exfiltrate sensitive data across different Google Cloud Platform (GCP) tenants. The most severe issue enabled unauthorized users to gain full control over Looker instances, potentially leading to data manipulation and deeper network infiltration. Google promptly patched these vulnerabilities in its cloud-hosted services; however, organizations using self-hosted Looker instances were required to manually apply the updates to mitigate the risks. ([helpnetsecurity.com](https://www.helpnetsecurity.com/2026/02/04/google-looker-vulnerabilities-cve-2025-12743/?utm_source=openai)) This incident underscores the growing threat landscape targeting cloud-based business intelligence tools. As organizations increasingly rely on such platforms, ensuring robust security measures and timely patch management becomes imperative to prevent unauthorized access and data breaches.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Chronus Hack Exposes Millions in Mexican Government Data Breach 2026
Government Administration9 months ago

Chronus Hack Exposes Millions in Mexican Government Data Breach 2026

In January 2026, the Mexican government faced a significant data breach when the hacker group Chronus infiltrated at least twenty public institutions, including the Mexican Tax Administration Service (SAT) and the Mexican Social Security Institute's Welfare Program (IMSS-Bienestar). The attackers exfiltrated sensitive data encompassing tax records, personal information, and professional details of millions of citizens. This breach exposed critical vulnerabilities in the government's digital infrastructure, leading to heightened risks of identity theft, fraud, and extortion. Despite the severity of the incident, official responses have been limited, raising concerns about the state's preparedness and transparency in handling cybersecurity threats. This incident underscores a troubling trend of escalating cyberattacks targeting Mexican governmental entities. The increasing sophistication and frequency of such breaches highlight the urgent need for robust cybersecurity measures and proactive strategies to safeguard sensitive public data against evolving digital threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
CISA Highlights Four Actively Exploited Vulnerabilities in February 2026
Government Administration9 months ago

CISA Highlights Four Actively Exploited Vulnerabilities in February 2026

In February 2026, the Cybersecurity and Infrastructure Security Agency (CISA) added four vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog, indicating active exploitation. These vulnerabilities include CVE-2019-19006 and CVE-2025-64328 in Sangoma FreePBX, CVE-2021-39935 in GitLab Community and Enterprise Editions, and CVE-2025-40551 in SolarWinds Web Help Desk. The vulnerabilities range from improper authentication and OS command injection to server-side request forgery and deserialization of untrusted data, posing significant risks to affected systems. The inclusion of these vulnerabilities in the KEV Catalog underscores the persistent threat posed by unpatched software. Organizations are urged to prioritize remediation efforts to mitigate potential exploitation, as these vulnerabilities are actively targeted by malicious actors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports