Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
California Crypto Laundering: $230M Theft and Tracing the Mixers – 2024 Incident
In 2024, a California resident pleaded guilty to laundering over $25 million in cryptocurrency, part of a broader $230 million theft stemming from a major cyber heist targeting a cryptocurrency platform. The attacker leveraged sophisticated tactics to siphon digital assets and enlisted money-laundering services to funnel proceeds through a series of mixers, obscuring the criminal origins. Investigators traced the flows across multiple wallets and exchanges over several months—ultimately apprehending the facilitator in the U.S. This multi-jurisdictional operation illustrated both the scale of modern crypto theft and challenges in asset recovery for victims and exchanges. The case underscores the mounting trend of advanced laundering techniques following crypto thefts, as decentralized financial ecosystems and global regulatory gaps give threat actors new cover. Organizations handling digital assets face heightened pressure for compliance, zero trust, and full-spectrum monitoring.
8 months ago
Kill Chain
Meet ShinySp1d3r: How Affiliate Ransomware Powered by ShinyHunters Ups the Stakes
In mid-2024, cybersecurity researchers discovered an in-development version of the ShinySp1d3r ransomware-as-a-service (RaaS) platform, believed to be created by the infamous ShinyHunters threat group. The platform equips criminal affiliates with a toolkit designed to automate ransomware deployment, data encryption, and multi-extortion capabilities. Early builds circulated within cybercrime forums preview advanced features, such as dashboard controls, automated leak sites, and an affiliate earnings model, underscoring the maturity and commercialization of the threat. The potential for widespread, coordinated attacks against enterprises and public sector organizations is significantly heightened by the accessibility and ease-of-use facilitated by this service. The emergence of ShinySp1d3r represents a growing trend of professionalized cybercrime, where sophisticated threat actors develop and market turnkey attack platforms to less-skilled operators. This further accelerates ransomware proliferation and amplifies the risks for organizations reliant on digital infrastructure.
8 months ago
Kill Chain
CISA Forces Rapid Patch of Fortinet Zero-Day Exploited in Real Attacks
In June 2024, U.S. government agencies were urgently ordered by CISA to patch a critical vulnerability in Fortinet's FortiWeb web application firewall after it was discovered being exploited as a zero-day. Threat actors leveraged this flaw to bypass security controls, potentially gaining unauthorized access to sensitive government systems. The incident underscores the persistent targeting of network edge devices and highlights the risks associated with unpatched security infrastructure. The rapid CISA directive required agencies to address the exploit within seven days, reflecting the severe operational risk and potential for further compromise. This event demonstrates a rising focus on web application and perimeter device vulnerabilities by sophisticated adversaries, especially those exploiting zero-days. The urgency of the directive and the exploitation method signal a larger industry trend: attackers increasingly prioritize zero-day vulnerabilities in widely deployed security products to maximize impact and evade detection.
8 months ago
Kill Chain
Operation WrtHug: How Legacy ASUS Routers Became a Global Botnet in 2024
In early 2024, thousands of end-of-life ASUS WRT routers worldwide were compromised in a large-scale campaign dubbed "Operation WrtHug". Attackers exploited at least six known vulnerabilities in outdated router firmware to hijack control of the devices. These compromised routers were assimilated into a new botnet infrastructure, enabling malicious actors to facilitate unauthorized traffic routing, launch further attacks, and potentially intercept sensitive data passing through these compromised endpoints. The incident points to neglected device lifecycle management and widespread exposure due to unpatched, unsupported consumer hardware. This breach is particularly notable as it reflects a growing trend: attackers shifting focus to vulnerable, unmaintained IoT and networking hardware. With legacy devices lacking security updates, organizations face heightened risk of compromise and regulatory scrutiny, while defenders must urgently address asset visibility and enforcement across distributed infrastructure.
8 months ago
Kill Chain
Sanctions Hit Russian Bulletproof Hosting Providers Backing Global Ransomware
In June 2024, the United States, together with the United Kingdom and Australia, imposed sanctions on Russian bulletproof hosting provider Media Land and associated entities. Investigations revealed these providers had knowingly facilitated ransomware operations and other cybercriminal activities by offering infrastructure shielding malicious actors from law enforcement, particularly ransomware gangs operating out of Russia. The sanctions block their financial assets and prohibit transactions, aiming to disrupt the ecosystem supporting high-profile global ransomware attacks and cybercrime. This incident is significant amid a surge in ransomware and supply-chain attacks worldwide, with threat actors increasingly relying on bulletproof hosting to evade detection. Governments are moving quickly to cut off these enablers as part of a broader strategy against organized cybercrime.
8 months ago
Kill Chain
Phishing-as-a-Service Evolves: Sneaky2FA Adds Browser-in-the-Browser Attacks in 2024
In early June 2024, cybersecurity researchers reported that the Sneaky2FA phishing-as-a-service (PhaaS) kit has adopted the Browser-in-the-Browser (BitB) attack tactic, previously used by red teamers, to improve the effectiveness of credential phishing campaigns. This new feature enables threat actors using the Sneaky2FA service to launch highly convincing fake login pop-ups, closely mimicking legitimate authentication flows, including prompts for multifactor authentication (MFA). The update broadens the risks for both organizations and individuals, as traditional indicators of phishing are increasingly hard to spot. The deployment of BitB tactics by a turnkey phishing kit marks a concerning development in the automation and commercial accessibility of advanced cybercrime techniques. This incident underscores the escalating sophistication of phishing attacks driven by the commoditization of offensive security techniques. Organizations face renewed urgency to revisit their authentication controls, user awareness training, and phishing-resistant MFA, as adversary innovation quickly outpaces conventional defense measures.
8 months ago
Kill Chain
FortiWeb CVE-2025-58034: Command Injection Attack on Fortinet's WAF
In November 2025, Fortinet disclosed a medium-severity vulnerability in its FortiWeb application firewall, tracked as CVE-2025-58034 (CVSS 6.7), which was found exploited in the wild. The flaw is an OS command injection issue (CWE-78) that allows authenticated attackers to execute unauthorized OS commands via improper neutralization of special elements. Attackers leveraged this weakness to gain control over vulnerable web application environments, potentially facilitating lateral movement, data access, and further exploitation, with threat activity detected before a patch was widely adopted. This incident highlights a persistent trend of attackers rapidly weaponizing new vulnerabilities in widely deployed web application security platforms. With adversaries increasingly targeting edge appliances and exploiting authentication weaknesses, organizations must prioritize timely vulnerability management and layered defense to protect sensitive workloads.
8 months ago
Kill Chain
Ransomware Disrupts European Airports in 2025: HardBit & SonicWall VPN Exploit
In September 2025, a coordinated HardBit ransomware attack caused significant operational disruptions across several European airports. The attack exploited a vulnerability in SonicWall SSL VPN devices (CVE-2024-40766), allowing threat actors to bypass multi-factor authentication and gain unauthorized access to critical infrastructure. Prompt law enforcement action led to the arrest of an initial suspect by the UK’s National Crime Agency, though details remain limited as investigations continue. The attack, labeled by researchers as primitive yet effective, underscores how quickly threat actors are leveraging both publicly available exploits and compromised credentials to disrupt essential services with ransomware. This event made headlines due to its impact on vital transportation infrastructure and prompted an international response highlighting the growing urgency for robust network segmentation, encrypted traffic measures, and rapid threat detection. The incident also reflects a broader trend of ransomware actors increasingly targeting critical sectors using innovative entry vectors and expanding their global footprint.
8 months ago
Kill Chain
Mobile Malware Soars in Q3 2025: Key Insights from Kaspersky's Global Report
In Q3 2025, Kaspersky reported a significant surge in mobile malware activity, with 47 million attacks prevented globally targeting Android devices with Trojans, adware, banking malware, and ransomware. Threat actors exploited new variants—including BADBOX and sophisticated Trojans like Triada and Fakemoney—utilizing methods such as pre-installed backdoors and malicious app mods. Mobile banking Trojans (especially Mamont and Coper) and region-targeted malware attacks in Turkey, India, Iran, and Germany impacted financial data security and user privacy, highlighting expanding attacker sophistication and supply chain compromise. This incident is critical as it illustrates the rising prevalence and complexity of mobile threats, coinciding with increased ransomware attacks and evolving delivery channels. The continued targeting of financial apps and global user bases signals an urgent need for organizations to strengthen mobile security, visibility, and compliance with privacy mandates.
8 months ago
Kill Chain
ServiceNow AI Agents Breached in 2025 via Second-Order Prompt Injection
In November 2025, security researchers uncovered a novel method by which ServiceNow's Now Assist generative AI platform could be manipulated through second-order prompt injection attacks. By exploiting default configurations and inherent agent-to-agent communication, attackers could coerce agentic AI features into executing unauthorized operations. This exposure allowed malicious actors to access, copy, and exfiltrate sensitive enterprise data without proper user authorization. The attack leverages prompt injection to bypass intended policy boundaries, posing significant data risk to organizations relying on ServiceNow’s AI-driven automations. This incident highlights a growing threat landscape in which AI agent-to-agent interactions are harnessed for sophisticated attacks. With increased enterprise adoption of generative AI and autonomous agents, security around configuration and prompt validation has become mission-critical. Organizations should assess agent communication safeguards and be vigilant against emerging prompt injection and shadow AI risks.
8 months ago
Kill Chain
EdgeStepper: PlushDaemon’s DNS Hijack Shakes Supply Chain Trust
In late 2025, the threat actor PlushDaemon leveraged a custom Go-based implant named EdgeStepper to facilitate a sophisticated supply chain attack targeting organizations relying on automated software updates. By hijacking DNS queries via EdgeStepper, attackers rerouted legitimate update traffic to attacker-controlled infrastructure, covertly delivering malware payloads. This adversary-in-the-middle campaign exploited a weakness in outbound traffic validation and DNS trust, leading to silent compromise of enterprise endpoints through poisoned software update mechanisms. The incident resulted in widespread concerns over supply chain integrity and exposed gaps in security monitoring of encrypted or internal network flows. This incident highlights the growing trend of adversaries exploiting DNS and software supply chains as primary attack vectors. With regulatory and industry focus tightening on secure update mechanisms and zero trust, similar AitM tactics are escalating in both frequency and sophistication, requiring renewed urgency for organizations to enhance detection at the DNS and network boundary layers.
8 months ago
Kill Chain
Operation WrtHug: Tens of Thousands of ASUS Routers Hijacked in Global Botnet Surge
In late 2025, tens of thousands of end-of-life ASUS routers worldwide were hijacked in a large-scale operation dubbed "WrtHug." The attackers exploited six unpatched vulnerabilities in outdated ASUS WRT firmware, targeting devices primarily in Taiwan, the U.S., and Russia, among others. After gaining unauthorized access, WrtHug actors enrolled these routers into a global botnet, leveraging them for coordinated command-and-control traffic and potentially for further attacks. The campaign highlighted the sustained risk posed by unsupported network equipment in both consumer and business environments. This incident underscores an ongoing surge in attacks targeting aging and end-of-life IoT devices, as cybercriminals capitalize on lapses in patching and lifecycle management. Organizations globally are under renewed pressure to inventory, segment, and securely retire vulnerable network infrastructure as such botnet tactics intensify.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports