Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
WhatsApp’s Screen-Sharing Feature: The 2024 Social Engineering Scam You Didn’t See Coming
In early 2024, a growing wave of cyber scams exploited WhatsApp’s new screen-sharing feature. Threat actors, posing as trusted contacts or customer support agents, lured victims into screen-sharing sessions under false pretenses—most often by claiming to offer help or resolve issues. Once shared, attackers gained access to sensitive information displayed on victims’ devices, including banking credentials and one-time passwords (OTPs), resulting in significant financial losses and compromised personal data. The scam’s speed and sophistication allowed fraudsters to bypass traditional awareness training and exploit even tech-savvy users. This incident highlights how social engineering threats adapt quickly to new app features, and underscores the need for rapid security responses. With mobile devices playing a pivotal role in personal and financial life, the exploitation of trusted communication platforms marks a critical evolution in phishing and remote fraud tactics.
8 months ago
Kill Chain
Capital One’s 2019 Cloud Breach: Insider Threats & Misconfiguration Risks
In 2019, Capital One suffered a major data breach when Paige Thompson, a former AWS engineer, exploited a cloud misconfiguration—specifically a poorly secured firewall running in Capital One's AWS environment—to access the personal information of over 100 million customers. The attacker leveraged insider knowledge and a misconfigured identity and access management policy to move laterally and exfiltrate sensitive data, including social security numbers and bank account details. The breach resulted in substantial financial costs, regulatory scrutiny, and reputational damage to Capital One, with Thompson ultimately convicted of wire fraud and computer intrusion. This incident remains relevant as organizations increasingly migrate to the cloud and face similar risks of configuration errors, compounded by the complexity of managing access controls and real-time monitoring in cloud-native infrastructures. The Capital One breach exemplifies the critical need for robust cloud security measures and continuous compliance with evolving regulatory requirements.
8 months ago
Kill Chain
US Sanctions North Korean Banks for Cryptocurrency Cybercrime in 2024
In May 2024, the U.S. Treasury sanctioned two North Korean banks and eight individuals believed to be heavily involved in high-profile cryptocurrency laundering operations linked to state-sponsored cybercrime. The sanctioned parties allegedly laundered millions of dollars in digital assets stolen through cyberattacks and IT worker fraud, often hiding illicit proceeds to evade international detection. North Korean operatives reportedly posed as legitimate IT contractors for Western firms to gain unauthorized access to sensitive systems and divert funds, fueling further malicious operations and funding government programs in Pyongyang. This incident exemplifies shifting tactics in cyber-enabled financial crime, where attackers exploit advanced laundering techniques and foggy compliance areas around cryptocurrency. The urgency of improved detection and policy enforcement is fueled by growing international regulatory pressure and the adaptation of state-sponsored groups to exploit digital infrastructure.
8 months ago
Kill Chain
Global Credit Card Fraud Rings Dismantled in Europol-Led €300M Operation
In 2024, international law enforcement agencies, coordinated by Europol, dismantled three interconnected credit card fraud and money laundering rings responsible for more than €300 million in losses, impacting 4.3 million cardholders worldwide across 193 countries. The sophisticated criminal groups orchestrated large-scale thefts using stolen and counterfeit credit card data, leveraging advanced technology and vast dark web networks to execute fraudulent transactions on a global scale. Their activities spanned several years, with victims spread across multiple financial institutions, highlighting significant vulnerabilities in payment security and international collaboration. The bust resulted in arrests, asset seizures, and cut off a major underground economy impacting consumers and businesses. This case illustrates the increasing scale and complexity of financially motivated cybercrime, as threat actors use digital platforms and cross-border tactics to avoid detection. Ongoing regulatory and industry attention to payment fraud and anti-money-laundering measures underscores the need for improved threat detection and international cooperation.
8 months ago
Kill Chain
Google's 2024 Warning: AI-Powered Malware Leveraging LLMs in the Wild
In early 2024, Google's Threat Intelligence Group (GTIG) detected a rise in cyberattacks involving new malware families leveraging artificial intelligence, particularly large language models (LLMs), to enhance evasiveness, automate code generation, and increase payload adaptability in real time. Attackers orchestrated campaigns using AI-enhanced malware to breach enterprise environments through sophisticated spear-phishing, malicious attachments, and exploited vulnerabilities, successfully bypassing traditional detection methods. Some campaigns were linked to known advanced persistent threat (APT) groups, causing disruptions to business operations, data confidentiality, and elevating the risk profile for organizations across various sectors. This incident underscores a pivotal shift in the cyber threat landscape toward swift, adaptive attacks driven by AI capabilities. The integration of LLMs into malware enables more dynamic compromise techniques, signaling urgent need for advanced threat detection and revised security controls across industries.
8 months ago
Kill Chain
University of Pennsylvania 2024 Data Breach: Alumni and Donor Information Compromised
In June 2024, the University of Pennsylvania confirmed a data breach involving unauthorized access to several internal systems linked to its development and alumni activities. Attackers infiltrated the university’s IT infrastructure, resulting in the theft of sensitive personal and institutional data. The breach impacted donors, alumni, and staff, exposing information such as names, contact details, and potentially financial data. University officials discovered the intrusion after observing suspicious activity and promptly initiated an investigation. Law enforcement and cybersecurity specialists were engaged to contain the incident, assess affected systems, and notify those impacted. This breach highlights the persistent risks that higher education institutions face from increasingly sophisticated cyberattacks, especially targeting sensitive donor and alumni databases. As ransomware and data exfiltration trends intensify, universities must enhance defenses and closely align with compliance frameworks to mitigate regulatory, reputational, and operational risks.
8 months ago
Kill Chain
State-Sponsored Attackers Breach SonicWall Firewall Backups in 2023
In September 2023, SonicWall disclosed a security breach where state-sponsored threat actors gained unauthorized access to systems containing customer firewall configuration backup files. The incident was investigated thoroughly, and SonicWall determined that sophisticated attackers exploited vulnerabilities, allowing access to backup files with potentially sensitive customer information. The breach did not involve ransomware or financial extortion but had the potential to expose operational details and configurations of deployed firewalls, raising concerns over further lateral movement or exploitation. Attacks like these underscore the growing threat posed by well-resourced, nation-state actors directly targeting technology vendors and supply chain components. As attackers prioritize exploiting configuration data, the security of infrastructure suppliers is under renewed scrutiny and regulatory interest, emphasizing the need for robust data encryption, segmentation, and incident response.
8 months ago
Kill Chain
Hyundai AutoEver America Breach: SSN & ID Data Exposed in Latest 2024 Attack
In early 2024, Hyundai AutoEver America suffered a significant data breach after cyber attackers gained unauthorized access to the company's IT environment. Sensitive personal information, including Social Security Numbers and driver's license details, belonging to customers and employees was exposed over the course of the intrusion. The breach was detected and disclosed following internal investigations and third-party forensics, with impacted individuals promptly notified. While the company did not report operational disruptions, the exposure of such regulated data poses risks of identity theft and regulatory scrutiny. This incident underscores the growing trend of threat actors targeting organizations in the automotive sector for high-value personal data. It spotlights the importance of strong data-in-transit controls and proactive east-west traffic monitoring, as regulators and attackers alike escalate pressure on firms entrusted with sensitive consumer information.
8 months ago
Kill Chain
Gootloader Malware Loader Strikes Back: 2024 SEO Poisoning Campaign Unveiled
In early June 2024, cybersecurity researchers reported the resurgence of the Gootloader malware loader after a seven-month hiatus. The campaign utilizes SEO poisoning tactics to drive unsuspecting users to fraudulent websites that appear in popular search engine results. Once on these sites, victims are tricked into downloading malicious files, which Gootloader then leverages to install additional malware payloads such as ransomware or information stealers. This renewed activity demonstrates a continued evolution of the Gootloader group’s techniques, making detection and prevention difficult for organizations. The impact spans both enterprise and individual users, increasing risks of data theft, ransomware infections, and business disruptions. This campaign’s return highlights an alarming trend: threat actors are rapidly enhancing their distribution channels using social engineering and search engine manipulation. As cybercriminals adapt faster than many organizations secure their environments, it is urgent to reassess security controls, training, and detection reliability against loader-based threats.
8 months ago
Kill Chain
CentOS Web Panel Suffers Wide Scale Attacks Via Remote Command Execution Flaw
In early 2024, a critical remote command execution (RCE) vulnerability in CentOS Web Panel (CWP) was actively exploited by threat actors, as publicly warned by the U.S. Cybersecurity & Infrastructure Security Agency (CISA). Attackers leveraged this flaw, tracked as CVE-2022-44877, to gain unauthorized access to servers running CWP, enabling them to execute arbitrary commands and potentially take full control of affected systems. This exploitation campaign targeted internet-facing CWP instances, presenting significant risks to organizations relying on the popular Linux-based server management tool. The fallout included possible data compromise, deployment of additional malware, and interruption of web services. This incident highlights a growing trend in mass exploitation of critical web application vulnerabilities, with attackers increasingly focusing on widely-adopted open-source platforms. High-profile government advisories and the prevalence of ransomware toolkits leveraging RCE flaws have driven organizations to reinforce patch management and incident response as regulatory and operational priorities.
8 months ago
Kill Chain
CISA Adds Gladinet and CWP Flaws to KEV After Confirmed Exploitation
In November 2025, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added critical vulnerabilities impacting Gladinet and Control Web Panel (CWP) to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation in the wild. Attackers have leveraged CVE-2025-11371 and similar flaws, which expose sensitive files or directories, enabling unauthorized code execution and unauthorized access to critical business data. Exploitation techniques include remote access and privilege escalation, with incidents observed in both enterprise and cloud environments. The exploited weaknesses have led to compromised systems and elevated business risk for affected organizations. This incident highlights an escalating trend in the exploitation of web-facing management panels and software supply chain components, making east-west traffic security and timely vulnerability management crucial for defenders. Regulatory and industry pressure is mounting as the pace and sophistication of attacks accelerate.
8 months ago
Kill Chain
US Sanctions North Korean Network for $12.7M Crypto Laundering and IT Fraud
In November 2025, the U.S. Treasury Department sanctioned ten North Korean individuals and entities after uncovering a multi-year scheme involving crypto laundering and IT-related financial fraud totaling $12.7 million. These actors, linked to North Korea’s state-sponsored cyber operations, leveraged encrypted and unencrypted channels to move illicit funds across international financial systems. Their activities supported North Korea’s nuclear weapons ambitions and exploited gaps in network segmentation, egress controls, and threat detection processes. This incident underscores an escalation in nation-state cryptocurrency laundering methods and demonstrates continued exploitation of global IT workforce outsourcing, heightening regulatory focus and increasing the cyber risk to organizations transacting digitally or hiring remote technical staff.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports