Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 31 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 361–372 / 4893 reports
Web3 Supply Chain Attacks Target Enterprise Cloud Infrastructure
Web3 Supply Chain Attacks Target Enterprise Cloud Infrastructure
Computer Software/Engineering1 month ago

Web3 Supply Chain Attacks Target Enterprise Cloud Infrastructure

Unit 42 researchers have identified a sophisticated evolution in supply chain attacks where threat actors exploit Web3 infrastructure components and open-source repositories to infiltrate enterprise cloud environments. These attacks leverage the decentralized nature of Web3 technologies, including blockchain nodes, smart contracts, and decentralized applications, as entry points into traditional cloud infrastructure. Attackers compromise popular npm packages, Docker containers, and Kubernetes configurations used in Web3 development, then pivot to cloud workloads and data repositories. The campaign has affected multiple organizations across financial services and technology sectors, resulting in data exfiltration and cryptocurrency theft. This attack pattern represents a critical shift as Web3 adoption accelerates in enterprise environments, creating new attack surfaces that traditional security controls often miss due to the hybrid nature of these deployments.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
SonicWall Issues Critical SSRF Vulnerability Warning for SMA1000 Gateways
SonicWall Issues Critical SSRF Vulnerability Warning for SMA1000 Gateways
Government Administration1 month ago

SonicWall Issues Critical SSRF Vulnerability Warning for SMA1000 Gateways

SonicWall disclosed a maximum-severity server-side request forgery (SSRF) vulnerability (CVE-2026-102255) affecting SMA1000 series appliances in October 2026. The flaw exists in the Appliance WorkPlace interface of SMA1000 6210, 7210, and 8200v models, allowing remote unauthenticated attackers to exploit an unintended alternate access path to direct appliances to issue requests on their behalf and perform unauthorized operations. SonicWall released hotfixes to address the vulnerability, with over 400 Internet-exposed SMA1000 appliances currently tracked by security researchers. This incident underscores the continuing threat to enterprise VPN infrastructure, as SMA1000 appliances have been repeatedly targeted throughout 2026 with multiple zero-day exploits leading to ransomware deployment and custom malware installation across government agencies and large corporations.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical Atlassian Vulnerability CVE-2026-21589 Exploited Within Hours of PoC Release
Critical Atlassian Vulnerability CVE-2026-21589 Exploited Within Hours of PoC Release
Computer Software/Engineering1 month ago

Critical Atlassian Vulnerability CVE-2026-21589 Exploited Within Hours of PoC Release

In October 2026, threat actors began exploiting CVE-2026-21589, a critical unauthenticated arbitrary file access vulnerability affecting multiple Atlassian products including Jira, Confluence, and Bitbucket. Within hours of watchTowr publishing a detailed technical report and proof-of-concept, Previdian detected active exploitation attempts on their honeypot network. The vulnerability allows attackers to access specific files in the application's web root directory without authentication, and in Crowd-integrated deployments, can escalate to full administrator access by reading plaintext credentials from configuration files. This incident highlights the accelerating timeline from vulnerability disclosure to active exploitation in the modern threat landscape. The rapid weaponization demonstrates how detailed technical research, while valuable for defenders, can be immediately leveraged by threat actors with automated scanning tools and public proof-of-concepts becoming available within hours of disclosure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
PoeLLM Cryptomining Botnet Exploits AI Server Vulnerabilities
PoeLLM Cryptomining Botnet Exploits AI Server Vulnerabilities
Information Technology/IT1 month ago

PoeLLM Cryptomining Botnet Exploits AI Server Vulnerabilities

The PoeLLM cryptomining campaign has compromised over 3,400 AI servers since April 2026, targeting exposed AI services like LiteLLM, Ollama, and Gotenberg PDF converter. The malware uses an innovative command-and-control mechanism, extracting IPv4 addresses from keywords in a poem hosted on GitHub. Once infected, servers become scanning platforms that exploit CVE-2026-42271 and CVE-2026-48710 for unauthenticated remote code execution while mining cryptocurrency through the Kryptex service. Peak activity reached 800 active infected systems in a single day, primarily affecting systems across the United States and Western Europe. This incident highlights the growing threat to AI infrastructure, as these systems often run on powerful GPU clusters with poor security configurations and excessive internet exposure, making them prime targets for cryptomining operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
The New Ransomware Playbook: Why Backup Infrastructure Has Become Target Zero
The New Ransomware Playbook: Why Backup Infrastructure Has Become Target Zero
Health Care / Life Sciences1 month ago

The New Ransomware Playbook: Why Backup Infrastructure Has Become Target Zero

Ransomware groups including ALPHV/BlackCat, BlackMatter, and Gunra have evolved their tactics to specifically target backup infrastructure before encrypting primary systems. In February 2024, ALPHV encrypted Change Healthcare's systems through an unprotected remote access portal, while BlackMatter systematically destroyed NEW Cooperative and Crystal Valley's backup stores using compromised admin credentials. These attacks demonstrate a strategic shift where threat actors eliminate recovery options to maximize ransom payment pressure, with UnitedHealth paying $22 million and still facing $1.6 billion in total recovery costs. This trend reflects the ransomware ecosystem's maturation as attackers recognize that organizations with intact backups rarely pay ransoms. The targeting of backup infrastructure has become standard operating procedure, forcing organizations to fundamentally rethink their recovery strategies and implement immutable storage, network isolation, and credential segregation to maintain viable restoration capabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Google Domains Hijacked in Sophisticated ccTLD Registry Supply-Chain Attack
Google Domains Hijacked in Sophisticated ccTLD Registry Supply-Chain Attack
Internet1 month ago

Google Domains Hijacked in Sophisticated ccTLD Registry Supply-Chain Attack

In late 2024, threat actors successfully compromised third-party operators managing country-code top-level domains (ccTLDs) for Ghana (.gh), American Samoa (.as), and Sierra Leone (.sl), allowing them to hijack multiple Google domains and obtain unauthorized HTTPS certificates. The attackers modified authoritative DNS records to redirect legitimate Google traffic to attacker-controlled infrastructure, potentially enabling man-in-the-middle attacks, credential harvesting, and service disruption. This supply-chain attack highlights the critical vulnerability of DNS infrastructure and the cascading impact when trusted domain registries are compromised. This incident underscores the growing threat to DNS infrastructure as nation-state and sophisticated threat actors increasingly target supply-chain components to compromise high-value targets like Google's services and domains.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
MonsterCloud CEO Indicted: The Hidden Costs of Ransomware Recovery Fraud
MonsterCloud CEO Indicted: The Hidden Costs of Ransomware Recovery Fraud
Computer/Network Security1 month ago

MonsterCloud CEO Indicted: The Hidden Costs of Ransomware Recovery Fraud

Zohar Pinhasi, CEO of ransomware recovery firm MonsterCloud, was indicted in October 2026 for allegedly defrauding clients by secretly paying ransomware operators while claiming to use proprietary decryption technology. From June 2018 to June 2023, prosecutors allege Pinhasi facilitated over $8 million in ransom payments while charging victims more than $19 million for recovery services. In documented cases, MonsterCloud charged victims $150,000 after paying attackers $8,200, and $380,000 after paying $236,000 to cybercriminals. The scheme allegedly involved over 300 companies across the United States and Canada. This case highlights the growing sophistication of ransomware ecosystem fraud, where recovery firms exploit victim desperation during crisis situations. As ransomware attacks increase 41% year-over-year and average ransom demands exceed $2 million, the emergence of fraudulent recovery services represents a dangerous secondary victimization trend that organizations must vigilantly avoid.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
FBI Issues Critical Warning on FortiBleed Campaign Targeting Enterprise VPN Infrastructure
FBI Issues Critical Warning on FortiBleed Campaign Targeting Enterprise VPN Infrastructure
Government Administration1 month ago

FBI Issues Critical Warning on FortiBleed Campaign Targeting Enterprise VPN Infrastructure

The FBI has issued warnings about ongoing FortiBleed attacks targeting exposed Fortinet FortiGate firewalls and SSL VPN gateways. Attackers exploit previously leaked credentials from a massive June 2024 breach affecting 73,932 devices across 194 countries, using distributed GPU clusters to crack stolen password hashes offline. Once inside, threat actors create administrator accounts, delete existing admin access, and establish persistence for lateral movement. The campaign has been linked to INC/Lynx and Payload ransomware operations, with over 86,644 devices now compromised according to SOCRadar. This incident highlights the growing sophistication of credential harvesting operations and the persistent threat of VPN-based initial access brokers feeding the ransomware ecosystem. With attackers now packaging compromised access for sale and targeting organizations based on revenue potential, the FortiBleed campaign represents a significant escalation in organized cybercrime infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Registry Takeover: How Attackers Hijacked Three ccTLDs to Issue Fraudulent Google Certificates
Registry Takeover: How Attackers Hijacked Three ccTLDs to Issue Fraudulent Google Certificates
Financial Services1 month ago

Registry Takeover: How Attackers Hijacked Three ccTLDs to Issue Fraudulent Google Certificates

In October 2026, threat actors compromised three country-code top-level domains (ccTLDs) - .gh (Ghana), .sl (Sierra Leone), and .as (American Samoa) - to obtain unauthorized HTTPS certificates for Google domains. The attackers exploited vulnerabilities in the domain registry infrastructure to issue legitimate SSL/TLS certificates that could be used to impersonate Google services in man-in-the-middle attacks. While Google's own systems remained secure, the incident exposed critical weaknesses in the global DNS and certificate authority ecosystem, potentially affecting millions of users who could be redirected to malicious sites appearing legitimate with valid encryption. This incident highlights the growing sophistication of supply chain attacks targeting internet infrastructure. As threat actors increasingly focus on certificate authorities and DNS registries to bypass traditional security measures, organizations must implement stronger certificate transparency monitoring and adopt zero-trust architectures that verify identity beyond SSL certificates.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
MALFEX Supply Chain Attack: How 40K+ npm Downloads Delivered Overlord RAT
MALFEX Supply Chain Attack: How 40K+ npm Downloads Delivered Overlord RAT
Computer Software/Engineering1 month ago

MALFEX Supply Chain Attack: How 40K+ npm Downloads Delivered Overlord RAT

The MALFEX campaign represents a sophisticated npm supply chain attack that has been active since August 2023, with threat actors publishing 12 packages and compromising over 40,000 downloads. Eight malicious packages were designed to deploy the Overlord RAT and custom Node.js stealers targeting Discord, browsers, Telegram, and cryptocurrency wallets on Windows systems. The Portuguese-speaking threat actor, identified as 'Murizada,' used lifecycle hooks and dependency chains to execute malicious payloads, with the 'function-flag' package alone accounting for 37,419 downloads. The campaign demonstrates advanced supply chain manipulation techniques and has expanded beyond npm to include WordPress exploits and macOS targeting. This incident highlights the growing sophistication of supply chain attacks targeting developer ecosystems, with threat actors increasingly leveraging trusted package repositories to distribute malware at scale. The campaign's longevity and evolution across multiple platforms signals a concerning trend in how adversaries are adapting their tactics to exploit the expanding attack surface of modern development workflows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Critical Pre-Authentication SSRF Flaw Exposes SonicWall SMA1000 Appliances
Critical Pre-Authentication SSRF Flaw Exposes SonicWall SMA1000 Appliances
Financial Services1 month ago

Critical Pre-Authentication SSRF Flaw Exposes SonicWall SMA1000 Appliances

SonicWall disclosed four critical vulnerabilities in its SMA1000 appliances on October 6, 2026, including CVE-2026-102255, a maximum CVSS 10.0 pre-authentication server-side request forgery (SSRF) flaw. The vulnerability allows unauthenticated attackers to access internal functionality through the WorkPlace portal, potentially enabling unauthorized operations on the network gateway. Additional vulnerabilities include OS command injection and stored XSS flaws requiring administrator access. SonicWall released hotfixes for affected models 6210, 7210, and 8200v, with no evidence of active exploitation reported. This marks the third instance in 2026 where SonicWall has patched critical pre-authentication SSRF flaws in SMA1000 appliances, highlighting ongoing security challenges in SSL-VPN infrastructure amid the continued expansion of remote work environments and sophisticated nation-state targeting of network perimeter devices.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
ClickFix Attacks Evolve: How Threat Actors Are Hiding Malicious Payloads in 2026
ClickFix Attacks Evolve: How Threat Actors Are Hiding Malicious Payloads in 2026
Financial Services1 month ago

ClickFix Attacks Evolve: How Threat Actors Are Hiding Malicious Payloads in 2026

In October 2026, cybersecurity researchers identified advanced ClickFix social engineering attacks that have evolved to better conceal malicious payloads from security detection systems. Two notable campaigns were discovered: one involving the CrocoRat malware that hides PowerShell commands in DNS TXT records, and another that pre-fetches malicious scripts into browser cache disguised as PNG files. These attacks continue to exploit human trust by presenting fake technical problems or CAPTCHA prompts, instructing victims to paste commands into Windows Run or PowerShell, but now employ sophisticated evasion techniques to bypass initial security defenses. This incident demonstrates the ongoing evolution of social engineering attacks as threat actors adapt to modern security controls. The sophistication of payload concealment techniques reflects attackers' understanding of detection capabilities and their commitment to developing countermeasures that exploit the gap between user trust and technical verification.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports