Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
ShinySP1D3R Ransomware Hits Hybrid Clouds During Holiday 2024
In December 2024, organizations worldwide were targeted by the ransomware group known as ShinySP1D3R, identified as an offshoot of the Scattered LAPSUS$ Hunters collective. Attackers exploited vulnerabilities in unencrypted east-west and egress traffic to gain network access, rapidly deploying ransomware across hybrid cloud environments during the busy holiday season. The incident resulted in substantial service outages, data encryption, and led to operational delays for affected enterprises, reinforcing the dangers of sophisticated lateral movement paired with insufficient segmentation controls. This incident highlights a rising trend of threat actors striking during holidays when staffing is limited and detection/response windows are higher. The campaign’s use of advanced TTPs—such as distributed command and control and abuse of hybrid connectivity—emphasizes why zero trust architectures and continuous threat monitoring are now business-critical.
8 months ago
Kill Chain
Malicious Underground AI Models Like WormGPT 4 Are Supercharging Cybercrime in 2024
In early 2024, cybersecurity researchers uncovered an expanding underground marketplace for custom large language models (LLMs) such as WormGPT 4 and KawaiiGPT, designed to facilitate cybercrime. These jailbroken and open-source models, advertised and sold across dark web forums, lower the technical barrier for attackers by offering tools to scan for vulnerabilities, automate malware development, and accelerate tasks like phishing and lateral movement. Their accessibility—with minimal setup time, user-friendly interfaces, and affordable pricing—has enabled a broader range of cybercriminals to automate sophisticated attacks previously requiring advanced skills. The emergence of malicious LLMs highlights a growing trend where generative AI is weaponized in cybercrime. Unlike earlier incidents, these tools are now commercialized and widely supported, signaling a shift from simple model jailbreaking to specialized AI-enabled attack platforms. This evolution increases the urgency for organizations to strengthen AI risk management, augment detection strategies, and adapt compliance controls to address the new threat landscape.
8 months ago
Kill Chain
What the Gainsight–Salesforce Supply Chain Attack Teaches Us About SaaS Security in 2024
In late October 2024, Gainsight, a customer management SaaS provider, was implicated in a supply chain attack that impacted Salesforce environments. Attackers exploited the Gainsight connected app to obtain and abuse OAuth tokens, enabling unauthorized access to several Salesforce customer instances and raising concerns about lateral movement to other connected third-party applications. While initial reports from Salesforce identified compromised tokens and only a handful of affected customers, subsequent intelligence indicated the potential exposure of over 200 Salesforce instances. Mandiant and Salesforce collaborated to investigate the extent and mechanics of the attack, tracing earliest malicious activity to October 23, 2024. Despite ongoing forensics, Gainsight maintains that the breach impact was limited in scope, and no evidence has surfaced indicating a vulnerability within Salesforce’s platform itself. This incident reflects the growing trend of SaaS supply chain attacks that exploit authentication and integration mechanisms to reach downstream enterprise environments. The blend of fragmented disclosure, coordinated incident response, and rising third-party risks demonstrates the urgent need for improved visibility, segmented access, and standardized controls within interconnected SaaS ecosystems.
8 months ago
Kill Chain
Dartmouth College Data Breach: Clop Ransomware Targets Oracle EBS in 2024 Attack
In March 2024, Dartmouth College confirmed a data breach after the Clop ransomware gang published confidential information allegedly exfiltrated from the institution's Oracle E-Business Suite servers. The attackers exploited a zero-day vulnerability (associated with the MOVEit Transfer incidents) and infiltrated the college’s systems, ultimately stealing sensitive data, including personal and financial records of students, faculty, and staff. Dartmouth detected suspicious activity following Clop’s dark web disclosures, began forensics, and reported the incident to regulatory agencies. Disruptions to business operations and heightened security controls followed, with legal notifications sent to affected parties. The Dartmouth breach highlights the persistent targeting of higher education by ransomware groups exploiting supply chain and enterprise software vulnerabilities. With ransomware attacks involving exfiltration and public data leaks surging in 2024, institutions face mounting regulatory pressure and reputational risks, underscoring the urgent need for robust segmentation, encrypted traffic controls, and real-time threat detection.
8 months ago
Kill Chain
FBI Alert: $262M Stolen in 2024 Account Takeover Fraud by Bank Impersonators
In early 2024, the FBI reported a dramatic surge in account takeover (ATO) fraud targeting U.S. banking customers through sophisticated social engineering. Cybercriminals, primarily via phone and digital messages, impersonated legitimate bank support teams to exploit unsuspecting individuals. Attackers tricked victims into revealing credentials and one-time passcodes, enabling unauthorized access to bank accounts. Since January, over $262 million has been stolen in these highly coordinated campaigns, impacting both major financial institutions and their customers, with funds rapidly funneled out—often through cryptocurrency exchanges or money-mule accounts. This incident highlights an escalating trend of identity-driven attacks leveraging increasingly convincing social engineering tactics. As financial fraud rises sharply, financial institutions face mounting regulatory pressures to improve anomaly detection and secure authentication, while consumers must remain vigilant against evolving ATO schemes.
8 months ago
Kill Chain
CISA Uncovers 2025 Spyware Assaults on Signal and WhatsApp Users
In June 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) issued an urgent alert regarding active espionage campaigns exploiting commercial spyware and remote access trojans (RATs) to compromise high-value users on secure messaging apps including Signal and WhatsApp. Attackers utilized sophisticated social engineering techniques—such as phishing and malicious links—to covertly deliver malware, enabling unauthorized access to users' encrypted chats, sensitive attachments, and even device controls. The victims ranged from executives and journalists to government officials, highlighting the background emergence of advanced social engineering paired with novel spyware kit deployment. The incident triggered heightened scrutiny of both messaging app security and endpoint defense controls. This event is emblematic of a growing surge in targeted surveillance operations against individuals using encrypted communication platforms. It raises concern over the effectiveness of endpoint security, user awareness, and the need for proactive threat intelligence, while highlighting an evolution in adversary tactics toward cloud-based and identity-driven infiltration.
8 months ago
Kill Chain
How Online Formatting Tools Exposed Thousands of Credentials: The JSONFormatter & CodeBeautify Leak
In late 2025, researchers uncovered that thousands of sensitive credentials, including passwords and API keys from governments, telecoms, and critical infrastructure organizations, were exposed after being pasted into public web-based code formatting tools such as JSONFormatter and CodeBeautify. This inadvertent data exposure occurred over several years, as users leveraged these tools for convenience, unaware that information was being logged and stored without proper security. Security experts at watchTowr Labs discovered over 80,000 files containing this data, raising alarm over the significant risk posed to organizations relying on manual and unsecured workflows. This incident has highlighted the growing risks of shadow IT and insecure use of web utilities in enterprise environments. It mirrors a broader trend of misconfigured third-party tools creating substantial vulnerabilities, elevating concerns amid regulatory crackdowns and increased exploitation of exposed secrets by attackers.
8 months ago
Kill Chain
ToddyCat's 2025 Attack: How APTs Are Hijacking Microsoft 365 Email Tokens
In late 2025, the Advanced Persistent Threat (APT) group known as ToddyCat launched a sophisticated cyber espionage campaign targeting corporate environments across Europe and Asia. The attackers leveraged a new custom tool, TCSectorCopy, to steal Microsoft Outlook emails and Microsoft 365 OAuth 2.0 access tokens. By compromising user endpoints and abusing browser-based authentication flows, ToddyCat successfully exfiltrated sensitive email data and bypassed perimeter controls. The campaign, marked by its stealthy techniques, enabled attackers to maintain persistent access and move laterally within affected networks, significantly increasing the risk to sensitive enterprise communications and intellectual property. This incident highlights the growing reliance of threat actors on token theft and cloud-based attack vectors, posing new challenges for organizations with hybrid or cloud-first environments. It underscores the urgent need for advanced detection capabilities, Zero Trust network segmentation, and comprehensive identity protection strategies to counter emerging APT tactics.
8 months ago
Kill Chain
The Shai-hulud Worm Returns: 2024 Supply Chain Malware Breach Analysis
In early 2024, cybersecurity researchers identified a resurgence of the Shai-hulud worm leveraging a novel infection vector in supply chain attacks. The new variant executes malicious code during software preinstall, exposing assets in both build and runtime environments before traditional defenses can activate. Attackers embedded the worm into widely-used application packages, facilitating undiscovered lateral movement and unauthorized access to sensitive data across multicloud and hybrid infrastructures. In several cases, the attack bypassed conventional endpoint protections and rapidly compromised internal east-west traffic, threatening operational availability and regulatory compliance for impacted organizations. This incident signals an evolution in malware tactics, underscoring the growing threat posed by supply chain attacks and sophisticated lateral movement in modern enterprise networks. The renewed Shai-hulud campaign highlights the urgent need for robust zero trust segmentation, encrypted data in transit, and real-time threat detection to counter risks targeting build pipelines and cloud-native workloads.
8 months ago
Kill Chain
ShadowRay 2.0: New Botnet Hijacks AI Clusters for Cryptocurrency Mining
In early 2024, cybersecurity researchers discovered that threat actors had exploited a vulnerability in the open-source Ray framework to infiltrate AI infrastructure in organizations worldwide. By abusing misconfigured or vulnerable Ray clusters, attackers deployed a self-propagating botnet named ShadowRay 2.0 that hijacked compute resources for unauthorized cryptomining and exfiltrated sensitive data. The campaign demonstrated advanced lateral movement across cloud workloads, showcasing AI services as lucrative targets and exposing gaps in east-west security and segmentation policies. Impact included disrupted operations, increased cloud costs, and exposure of confidential data, impacting both cloud-native and hybrid environments. This incident is a stark example of how attackers rapidly weaponize software flaws in emerging technologies like AI platforms. With the proliferation of open-source AI frameworks and increased integration into core business operations, misconfigurations and unpatched vulnerabilities become high-value entry points for financially motivated cybercriminals.
8 months ago
Kill Chain
Oracle 2025 Identity Manager Breach: CVE-2025-61757 Exploited in New Extortion Campaigns
In 2025, Oracle’s Identity Manager platform was found to have a critical vulnerability, designated CVE-2025-61757, which was actively exploited by threat actors. Attackers leveraged this flaw to gain unauthorized access, escalate privileges, and potentially move laterally across enterprise environments leveraging Oracle's identity suite. This campaign followed earlier Oracle Cloud security incidents and a notable extortion trend targeting Oracle E-Business Suite customers, raising concerns about the security posture of widely-deployed identity management systems. This breach underscores an urgent industry shift: as digital identity becomes the new security perimeter, attackers increasingly target identity infrastructure. The incident’s exploit path highlights the need for robust segmentation, real-time threat detection, and compliance-driven control across cloud and enterprise platforms.
8 months ago
Kill Chain
JackFix Attack: How Phishing Evolved to Outsmart ClickFix Defenses
In early June 2024, a new phishing campaign dubbed the 'JackFix' attack emerged, leveraging adaptations of the previously known ClickFix tactic to bypass recently implemented technical mitigations. Threat actors used sophisticated psychological manipulation and novel evasion techniques to bypass security controls and deceive end users into clicking malicious links. Once inside targeted environments, the attackers engaged in lateral movement and data exfiltration, exploiting inadequate segmentation and detection gaps. Organizations affected experienced compromised credentials, unauthorized access to sensitive systems, and increased risk of regulatory exposure due to the attack’s ability to blend with normal traffic. This incident underscores the rapid evolution of phishing methods in response to security improvements, highlighting the urgent need for layered defenses and zero trust segmentation. The JackFix attack is part of a wider trend of phishing campaigns that employ behavioral engineering and technical countermeasures, challenging legacy detection and policy frameworks.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports