Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Sturnus Android Trojan Exposes Secure Messaging Apps in Major 2024 Threat
In May 2024, security researchers uncovered a new Android banking trojan named Sturnus targeting mobile devices in the wild. Sturnus stands out for its advanced multi-stage capabilities, allowing the malware to intercept and exfiltrate end-to-end encrypted messages from applications such as Signal, WhatsApp, and Telegram. The malware also leverages device accessibility services to gain total device control, enabling it to steal SMS, contacts, banking credentials, and intercept two-factor authentication (2FA). Initial infection is typically achieved via malicious sideloaded APKs distributed through phishing campaigns and third-party app stores, exposing users to substantial data theft and account compromise risk. This incident highlights a growing trend in Android malware evolution, where banking trojans are increasingly equipped with multi-app message theft, advanced evasion techniques, and device takeover functions. The widespread use of encrypted messaging apps in business and personal communication elevates the threat, driving demand for enhanced mobile endpoint security and stricter controls on app distribution.
8 months ago
Kill Chain
Crypto Mixer Crackdown: Samourai Wallet Founders Convicted for $237M Laundering Scheme
In 2024, the founders of Samourai Wallet, a cryptocurrency mixing service, were sentenced to prison by US authorities for their role in facilitating the laundering of over $237 million in illicit funds. Operating from 2015 through 2024, Samourai provided obfuscation tools that enabled criminals—including ransomware operators and darknet market traffickers—to conceal the origins and flows of cryptocurrency transactions. Authorities dismantled the platform and arrested the operators following a lengthy investigation. This action directly crippled a major infrastructure point in the cybercrime ecosystem, disrupting widespread money laundering tactics reliant on mixer services. The case underscores growing regulatory and law enforcement scrutiny of crypto-mixing services due to their integral role in financial crime, ransomware payments, and evasion of anti-money laundering (AML) controls. Organizations dealing in digital assets now face heightened compliance and monitoring pressures worldwide.
8 months ago
Kill Chain
D-Link DIR-878 End-of-Life Routers Hit by Critical 2024 RCE Flaws
In June 2024, D-Link issued an urgent advisory regarding three critical remote command execution (RCE) vulnerabilities affecting all models and hardware revisions of its end-of-life DIR-878 wireless routers. These flaws, discovered by cybersecurity researchers, allow unauthenticated remote attackers to execute arbitrary commands on the device, effectively gaining full control. Although D-Link had ended firmware support in 2021, the routers remain in widespread use, especially in emerging markets, increasing the exposure of organizations and individuals who have not decommissioned the devices. The attackers can exploit these weaknesses for lateral movement, network reconnaissance, or as a foothold into larger networks. This incident underscores the dangers posed by unsupported legacy hardware and the importance of proactive lifecycle management. Given the vulnerabilities enable full device compromise with no user interaction, similar RCE attacks targeting end-of-life networking equipment are likely to rise as threat actors pivot toward unpatched infrastructure.
8 months ago
Kill Chain
SonicWall SonicOS SSLVPN Flaw Leaves Firewalls Exposed to Crash Attacks
In June 2024, SonicWall disclosed a high-severity vulnerability in its SonicOS SSLVPN implementation, which allowed unauthenticated attackers to crash and potentially render SonicWall firewall appliances unusable. The flaw, identified as CVE-2024-XXXX, could be exploited remotely by sending specially crafted requests to exposed firewalls. SonicWall warned customers to urgently apply patches as no authentication was required to leverage the exploit, and exploitation could result in significant network downtime or gaps in perimeter defense. This incident highlights the ongoing risk to enterprises reliant on perimeter security devices and the speed with which attackers weaponize newly discovered vulnerabilities. With increasing attacks targeting Internet-exposed VPN gateways and firewalls, rapid patching and layered defensive controls are now more critical than ever.
8 months ago
Kill Chain
Salesforce 2024 Breach: Gainsight Supply Chain Compromise Exposes Customer Data
In June 2024, Salesforce launched an investigation after a supply chain breach at Gainsight, a software vendor, resulted in the theft of certain Salesforce customer data. Attackers exploited compromised Gainsight credentials to gain unauthorized access to customer information via third-party OAuth apps. Salesforce responded quickly by revoking refresh tokens linked to impacted Gainsight-published integrations and advised customers to take precautionary steps, including reviewing and rotating their credentials. While the breach did not affect Salesforce’s internal systems, it highlighted the significant risk posed by interconnected software supply chains and third-party integrations. This incident underscores the increasing sophistication of supply chain attacks targeting cloud platforms and SaaS providers. As businesses rely more heavily on integrated services and external vendors, attackers are exploiting trust relationships to bypass traditional security controls, emphasizing the urgent need for robust third-party risk management and continuous monitoring.
8 months ago
Kill Chain
GlobalProtect VPN Portals Probed by 2.3 Million Malicious Scan Sessions
Beginning on November 14, 2025, cybersecurity researchers detected an unprecedented surge in malicious scanning activity targeting Palo Alto Networks GlobalProtect VPN portals worldwide. Over 2.3 million scan sessions were recorded within days, emanating from a diverse array of global IP addresses and employing automated tools to probe for vulnerabilities and gather intelligence on remote-access infrastructure. While no large-scale exploitations or breaches have yet been confirmed, the scanning phase indicates advanced reconnaissance tactics that precede exploitation, raising significant concern for organizations relying on GlobalProtect for secure remote access. This event highlights a sharp escalation in mass automated reconnaissance against widely deployed VPN systems, following recent critical vulnerabilities in VPN technologies and a growing attacker focus on initial access vectors. The trend reinforces the urgency for improved monitoring, swift patching, and modern segmentation controls in remote-access environments.
8 months ago
Kill Chain
Google Uncovers BadAudio Malware in Chinese APT24 Espionage Campaign
In early 2024, Google’s Threat Analysis Group uncovered a sophisticated, years-long cyber espionage campaign orchestrated by the China-linked APT24 threat group. The attackers leveraged a newly discovered malware dubbed BadAudio to infiltrate government agencies, research institutions, and select private organizations. Initial access was obtained via spear-phishing campaigns, progressing to persistent lateral movement within compromised environments. BadAudio’s deployment enabled covert data exfiltration over encrypted channels, evading standard security controls and providing unmatched visibility and persistence for the attackers. The incident highlights the advanced tradecraft and evolving toolsets in use by nation-state threat actors, with business impacts centered on the loss of sensitive data and the undermining of critical organizational trust. The exposure of BadAudio signals a notable escalation in cyber espionage tactics, utilizing bespoke malware and encrypted traffic to circumvent modern defenses. Organizations across sectors are at risk as threat groups adopt similar methods, prompting increased scrutiny from regulators and heightened awareness around securing east-west traffic and anomaly detection.
8 months ago
Kill Chain
TamperedChef Malware: Fake Software Installers Fuel a Global Attack Wave
In late 2025, a widespread malvertising campaign dubbed 'TamperedChef' was uncovered by Acronis Threat Research Unit. Threat actors distributed fake installers of popular software through fraudulent ads and compromised websites to trick users into deploying malicious payloads. Once installed, the malware established persistence, deployed JavaScript-based remote access tools, and enabled lateral movement within enterprise and individual networks. The campaign demonstrated sophisticated social engineering tactics and leveraged encrypted command-and-control channels to evade traditional detection mechanisms, resulting in compromise of endpoints across multiple countries. This incident highlights a surge in supply chain and software installer threats, with attackers exploiting user trust and sophisticated malvertising techniques. As ransomware groups and financially motivated actors increasingly target software distribution vectors, organizations face mounting regulatory scrutiny and operational risk without multilayered defenses and advanced endpoint monitoring.
8 months ago
Kill Chain
Tsundere Botnet: How Blockchain-Powered Node.js Malware Threatened Global Supply Chains in 2025
In mid-2025, the Tsundere botnet, attributed to a Russian-speaking threat actor known as "koneko," emerged as a new and flexible malware campaign. It primarily targeted Windows users by disguising itself as installers for popular games or using Remote Monitoring and Management (RMM) tools to deliver its payload. The malware leveraged MSI and PowerShell-based installers to deploy malicious Node.js scripts, establishing persistence and communicating with its command-and-control (C2) infrastructure by dynamically retrieving C2 addresses from Ethereum blockchain smart contracts. This adaptive technique, along with a marketplace-enabled control panel, facilitated operational resilience and monetization among cybercriminals. This incident is significant due to the combination of modern supply chain manipulation, blockchain-based C2 address obfuscation, and pay-per-build business models. Tsundere highlights a trend toward malware leveraging decentralized platforms for better survivability against take-downs and rapid evolution, posing ongoing challenges for traditional defenses and compliance frameworks.
8 months ago
Kill Chain
Sturnus: New Android Trojan Hijacks Devices & Captures Encrypted Chats
In late 2025, cybersecurity researchers discovered a sophisticated Android banking trojan dubbed Sturnus, which enables credential theft and full device takeover for financial fraud. Sturnus stands out by bypassing encrypted messaging protections, capturing decrypted content directly from the device screen to monitor sensitive apps and intercept confidential chats. Threat actors leveraged phishing campaigns and malicious app distribution to compromise victims, ultimately gaining unauthorized access to financial information and conducting unauthorized transactions. The attack demonstrates the growing ingenuity of malware targeting mobile banking and highlights the challenges of relying solely on network-level encryption. This incident is especially timely due to the rapid evolution of mobile banking threats and attackers' increasing focus on defeating application-layer defenses. Sturnus's capability to monitor encrypted communications at the device level sets a worrying new precedent in malware TTPs, urging organizations to reassess endpoint and messaging security controls.
8 months ago
Kill Chain
Global WhatsApp Hack: CTM360 Exposes HackOnChat Social Engineering Campaign
In late 2025, cybersecurity firm CTM360 revealed 'HackOnChat,' a sophisticated, large-scale social engineering campaign targeting WhatsApp users globally. Threat actors orchestrated the attack via fake authentication portals and impersonation webpages, tricking victims into divulging credentials that enabled account hijacking. The operation weaponized WhatsApp's familiar interface, leveraging psychological manipulation and deception, and resulted in thousands of compromised accounts and malicious URLs. Disruption of user communications and risk of further abuse (such as account-based impersonation or fraud) were observed. This breach underscores the accelerating use of social engineering tactics in messaging platforms, reflecting a surge in identity-based attacks that exploit user trust in familiar interfaces. Security teams are increasingly alert to evolving credential-phishing methods that bypass traditional controls, especially as regulatory scrutiny of digital identity security intensifies.
8 months ago
Kill Chain
ThreatsDay 2025: Multi-Vector Attacks Redefine the Global Breach Landscape
In November 2025, a coordinated wave of multi-vector cyberattacks swept across organizations worldwide, leveraging zero-day exploits, LinkedIn spear-phishing, cryptocurrency theft, and vulnerabilities in IoT devices. Attackers exploited both east-west and egress traffic to evade detection, compromise sensitive data in transit, and establish persistent remote access. Prominent threat groups utilized unencrypted and encrypted traffic, weaponized browser extensions, and abused legitimate remote monitoring tools like AnyDesk. The result was disruption to business operations, regulatory investigations, and an uptick in ransomware and crypto-related financial crimes traced to state-sponsored and criminal actors. This incident underscores the escalating risk posed by attackers who blend diverse TTPs across cloud, hybrid, and enterprise networks. The convergence of espionage motives, cybercrime, and advanced ransomware strains highlights the need for real-time visibility, layered segmentation, and updated anomaly detection strategies.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports