Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 30 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 349–360 / 4893 reports
Empire Market Takedown: 40-Year Sentence Marks New Era in Dark Web Enforcement
Empire Market Takedown: 40-Year Sentence Marks New Era in Dark Web Enforcement
Banking/Mortgage1 month ago

Empire Market Takedown: 40-Year Sentence Marks New Era in Dark Web Enforcement

Raheim Hamilton, co-creator of Empire Market, was sentenced to 40 years in prison for operating one of the largest dark web marketplaces from 2017 to 2020. The marketplace facilitated $430 million in illegal transactions, primarily drug sales totaling $375 million, serving 1.68 million users at its peak. Hamilton and co-defendant Thomas Pavey used cryptocurrency, encryption, and Tor networks to help users evade law enforcement detection while laundering proceeds through mixing services. This case highlights the growing sophistication of cybercrime marketplaces and law enforcement's enhanced capabilities to track cryptocurrency transactions and dismantle dark web operations, reflecting the ongoing battle between cybercriminals and authorities in the digital underground economy.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Uranium Finance Hack: How $53M Was Stolen Through Smart Contract Exploits
Uranium Finance Hack: How $53M Was Stolen Through Smart Contract Exploits
Financial Services1 month ago

Uranium Finance Hack: How $53M Was Stolen Through Smart Contract Exploits

In April 2021, Jonathan Spalletta exploited smart contract vulnerabilities in Uranium Finance, a decentralized cryptocurrency exchange on Binance's BNB Chain, stealing $53.3 million across two separate attacks. The first breach netted $1.4 million through zero-token withdrawal commands, followed by extortion for a sham bug bounty. Three weeks later, Spalletta exploited a transaction verification flaw that allowed him to drain 90% of the exchange's liquidity pools, forcing immediate shutdown. He laundered the stolen funds through Tornado Cash mixer and spent proceeds on collectibles including Magic cards and rare coins before being convicted in 2026. This case highlights the growing sophistication of DeFi attacks and the critical need for robust smart contract security as decentralized finance platforms become prime targets for cybercriminals seeking to exploit code vulnerabilities for massive financial gain.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Cisco Nexus Vulnerabilities Enable Complete Switch Takeover
Critical Cisco Nexus Vulnerabilities Enable Complete Switch Takeover
Telecommunications1 month ago

Critical Cisco Nexus Vulnerabilities Enable Complete Switch Takeover

In October 2026, Cisco disclosed five critical vulnerabilities (CVE-2026-76471, CVE-2026-76485, CVE-2026-76486, CVE-2026-76501, and CVE-2026-76465) in its NX-OS data center operating system affecting Nexus 3000 and 9000 Series switches. These flaws stem from validation failures in NX-API, Next Generation OAM (NGOAM), and MPLS OAM features, allowing remote attackers to execute arbitrary code with root privileges or cause denial-of-service conditions. The vulnerabilities require specific features to be enabled but can lead to complete switch compromise when exploited through crafted HTTP requests or malicious network packets. These vulnerabilities highlight the growing attack surface of critical network infrastructure as data centers become increasingly complex and feature-rich. With network switches serving as foundational components of enterprise and cloud environments, successful exploitation could enable lateral movement, traffic interception, and complete network compromise across multi-cloud deployments.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
FakeGit Campaign Exploits 17,000+ GitHub Repositories to Distribute Malware
FakeGit Campaign Exploits 17,000+ GitHub Repositories to Distribute Malware
Computer Software/Engineering1 month ago

FakeGit Campaign Exploits 17,000+ GitHub Repositories to Distribute Malware

The FakeGit malware campaign resurfaced in October 2024 with over 17,610 malicious GitHub repositories distributing SmartLoader malware and StealC infostealer. Threat actors exploited legitimate developer accounts and created convincing fake repositories with README files containing download buttons that delivered malicious ZIP archives. In just 34 hours starting October 4, attackers pushed over 13,000 repositories at a peak rate of 2,999 per hour, targeting AI skills repositories and MCP servers listed in public registries to maximize credibility and infection rates. This incident highlights the growing trend of supply chain attacks targeting developer platforms and AI infrastructure. As organizations increasingly adopt AI-powered development tools and automated deployment pipelines, attackers are exploiting trust relationships in code repositories to bypass traditional security controls and distribute malware at scale.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
October 2026 Threat Landscape: When Cybercriminals Turn on Each Other
October 2026 Threat Landscape: When Cybercriminals Turn on Each Other
Computer Software/Engineering1 month ago

October 2026 Threat Landscape: When Cybercriminals Turn on Each Other

A comprehensive cybersecurity threat bulletin from October 2026 highlighted multiple significant incidents including ransomware affiliate betrayal, supply chain attacks, and advanced persistent threats. Key incidents included a Russian Gentlemen ransomware affiliate called Azazel who double-crossed his own gang by stealing ransom proceeds from two dozen victims across six countries, malicious VS Code extensions linked to GlassWorm activity targeting developers, and a sophisticated phishing campaign combining traditional social engineering with AI prompt injection. The bulletin also detailed extradition of a Qilin ransomware suspect, critical vulnerabilities in healthcare devices regarding post-quantum cryptography readiness, and multiple supply chain compromises affecting npm packages and RubyGems targeting cryptocurrency developers. These incidents demonstrate the evolving sophistication of modern cyber threats, particularly the convergence of AI-enabled attacks, insider threats within criminal organizations, and the increasing targeting of development environments and supply chains as critical attack vectors.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Japan's API Security Crisis: How CVE-2026-72898 and Mobile API Abuse Exposed Millions
Japan's API Security Crisis: How CVE-2026-72898 and Mobile API Abuse Exposed Millions
Information Technology/IT1 month ago

Japan's API Security Crisis: How CVE-2026-72898 and Mobile API Abuse Exposed Millions

Throughout September 2026, Japan experienced a surge in data breaches affecting major organizations including Park24's Times Car service (6.6 million accounts) and Yakiniku King restaurant chain (10.7 million records). Attackers systematically exploited mobile API vulnerabilities by reverse-engineering smartphone applications to extract API keys and endpoints, then abusing internal APIs with elevated privileges. A critical component involved exploiting CVE-2026-72898, a CVSS 10.0 SQL injection vulnerability in Metabase business intelligence software that allowed unauthenticated access to administrator functions and connected databases. This incident represents a concerning evolution in API-focused attacks, demonstrating how threat actors are systematically targeting mobile application backends and business intelligence systems across multiple countries. The campaign's scope expanded beyond Japan to 13 other regions including South Korea, France, and Poland, indicating a coordinated effort to exploit common API security gaps and known vulnerabilities at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Japan Pioneers Active Cyber Defense: The World's First Proactive National Cybersecurity Framework
Japan Pioneers Active Cyber Defense: The World's First Proactive National Cybersecurity Framework
Government Administration1 month ago

Japan Pioneers Active Cyber Defense: The World's First Proactive National Cybersecurity Framework

Japan's Active Cyber Defense (ACD) framework represents a fundamental shift from voluntary incident reporting to mandatory disclosure and proactive threat disruption. Beginning October 1, 2026, designated critical infrastructure operators must report cyber incidents to government authorities, while new communications analysis capabilities will be operational by November 23, 2027. The framework enables government access to communications metadata and authorizes neutralization of attack infrastructure before significant damage occurs. This transformation comes as Japan faces an eleven-fold increase in cyberattack packets since 2015, with 99.4% originating from overseas IP addresses, primarily from Chinese strategic collection, North Korean revenue operations, and Russian cyber espionage campaigns. The ACD's four pillars encompass mandatory public-private collaboration, government communications analysis, active threat neutralization, and independent oversight through specialized commissions. This matters now as Japan becomes the first major democracy to implement comprehensive active cyber defense legislation amid escalating nation-state threats. The framework's emphasis on preventive action and real-time threat sharing establishes a new model for democratic cybersecurity governance that other nations are closely monitoring.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Tensorlake NPM Compromise Exposes AI Development Supply Chain Vulnerabilities
Tensorlake NPM Compromise Exposes AI Development Supply Chain Vulnerabilities
Computer Software/Engineering1 month ago

Tensorlake NPM Compromise Exposes AI Development Supply Chain Vulnerabilities

In October 2026, the popular Tensorlake npm package was compromised in a sophisticated supply chain attack by the Shai-Hulud worm campaign. Attackers pushed malicious code to version 0.5.144 that harvested credentials from CI environments, Kubernetes clusters, AWS accounts, and developer workstations while establishing persistence and enabling remote code execution. The malware specifically targeted AI development infrastructure, stealing tokens from GitHub, npm, HashiCorp Vault, and configuration files from AI tools like Anthropic Claude and Cursor. The worm also propagated by republishing compromised versions of other packages associated with victims' publishing identities, extending the attack's reach across the JavaScript ecosystem. This incident highlights the growing threat to AI development supply chains as attackers increasingly target machine learning and AI agent infrastructure to extract valuable enterprise data and intellectual property.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
MonsterCloud Ransomware Recovery Fraud: $19M Scam Exposes Industry Vulnerabilities
MonsterCloud Ransomware Recovery Fraud: $19M Scam Exposes Industry Vulnerabilities
Computer/Network Security1 month ago

MonsterCloud Ransomware Recovery Fraud: $19M Scam Exposes Industry Vulnerabilities

In October 2026, the U.S. Department of Justice charged Zohar Pinhasi, owner of Florida-based MonsterCloud, with wire fraud for allegedly defrauding ransomware victims by secretly paying ransom demands while claiming to use proprietary decryption tools. Between 2021 and 2023, Pinhasi charged clients over $19 million while secretly paying over $8 million in ransoms to threat actors, marking up fees by 500-1800% above actual ransom costs. In one case, he paid $8,200 to attackers but billed the client $150,000, falsely advertising advanced decryption capabilities that never existed. This case highlights the growing threat of secondary victimization in the ransomware ecosystem, where recovery firms exploit victim desperation. As ransomware attacks surge globally and organizations increasingly turn to third-party recovery services, this incident exposes critical trust gaps in the cybersecurity vendor ecosystem and underscores the need for transparency in incident response partnerships.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
16 Malicious Firefox Extensions Target Crypto Wallets in Sophisticated 2026 Campaign
16 Malicious Firefox Extensions Target Crypto Wallets in Sophisticated 2026 Campaign
Financial Services1 month ago

16 Malicious Firefox Extensions Target Crypto Wallets in Sophisticated 2026 Campaign

In October 2026, cybersecurity researchers discovered 16 malicious Mozilla Firefox extensions masquerading as legitimate Rabby and OKX cryptocurrency wallets. These extensions specifically targeted cryptocurrency users by intercepting wallet recovery phrases and private keys during import flows, then exfiltrating the stolen credentials to attacker-controlled Cloudflare Workers infrastructure. The campaign represents a continuation of earlier attacks documented in August 2026, with threat actors rotating package names and extension identifiers while reusing the same credential-harvesting logic and network infrastructure. All identified extensions have been removed from the Firefox add-on store as of October 5, 2026. This incident highlights the growing sophistication of cryptocurrency-focused malware campaigns and the increasing abuse of browser extension ecosystems for credential theft. The attack demonstrates how threat actors are systematically targeting the expanding cryptocurrency user base through trusted distribution channels, making extension security and wallet hygiene critical priorities for organizations and individuals managing digital assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
How AI-Powered ARTEX Tool Compromised South Korean Financial Institutions
How AI-Powered ARTEX Tool Compromised South Korean Financial Institutions
Banking/Mortgage1 month ago

How AI-Powered ARTEX Tool Compromised South Korean Financial Institutions

Between late September and early October 2026, threat actors leveraged ARTEX, an open-source AI-powered penetration testing tool developed in China, to conduct targeted attacks against South Korean financial institutions. The campaign utilized large language models including DeepSeek v4.1-flash, GLM-5.3, and Grok 4.6 to automate reconnaissance, exploitation, and data exfiltration. CrowdStrike discovered the operation through exposed directories on a Hong Kong-based IP address containing Claude Code session histories and ARTEX configuration files. Evidence suggests Chinese-speaking operators motivated by financial gain, with attackers specifically researching Korean data breach marketplaces and Telegram sales channels. This incident highlights the emerging threat of AI-weaponized attacks where sophisticated language models automate complex multi-stage cyber operations. The misuse prompted ARTEX's developer to immediately transition the tool to closed-source, demonstrating how legitimate security research tools are being rapidly co-opted by malicious actors to enhance attack capabilities at scale.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Microsoft FORGE Lab Scales AI Vulnerability Research to 140 CVEs in 2026
Microsoft FORGE Lab Scales AI Vulnerability Research to 140 CVEs in 2026
Computer Software/Engineering1 month ago

Microsoft FORGE Lab Scales AI Vulnerability Research to 140 CVEs in 2026

Microsoft's FORGE Lab demonstrated significant advances in AI-powered vulnerability research throughout 2026, discovering 140 CVEs in Windows systems and submitting 155 validated reports across 23 open-source projects. Using their multi-model agentic scanning harness (MDASH), the team achieved automated vulnerability discovery at scale, with proof-of-concept generation averaging $3.61 in model costs and 21.5 minutes per Linux kernel finding. The initiative included successful collaboration with the Linux Foundation's Akrites program, resulting in the first Akrites submission to achieve a merged Linux kernel patch. This research represents a paradigm shift in cybersecurity as AI-powered vulnerability discovery transitions from experimental capability to operational reality, fundamentally changing how organizations must approach security validation and remediation at machine speed.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports