Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 316 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3781–3792 / 4903 reports
Microsoft 2025 MSMQ and IIS Outage: A Cautionary Tale of Security Permissions Gone Wrong
Financial Services10 months ago

Microsoft 2025 MSMQ and IIS Outage: A Cautionary Tale of Security Permissions Gone Wrong

In December 2025, Microsoft enterprise customers experienced widespread outages in applications and IIS web services following the deployment of Patch Tuesday updates (KB5071546, KB5071544, KB5071543). These updates introduced changes to the Message Queuing (MSMQ) security model, restricting NTFS permissions on the C:\Windows\System32\MSMQ\storage folder. As a result, non-administrator MSMQ users lost write access, causing MSMQ to fail and IIS sites to return misleading 'insufficient resources' errors. This affected core business processes dependent on MSMQ, with no immediate fix available; Microsoft urged affected organizations to reach out for mitigation guidance. This incident highlights ongoing risks from software supply chain updates and privileged permission management changes at the operating system level. As cloud workloads and zero-trust architectures become more prevalent, enterprises must strengthen configuration management and anomaly response to avoid business disruption from untested or misconfigured OS-level security changes.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
DOJ Takes Down E-Note: Ransomware Laundering Hub Disrupted in 2024 Crackdown
Financial Services10 months ago

DOJ Takes Down E-Note: Ransomware Laundering Hub Disrupted in 2024 Crackdown

In early 2024, the US Department of Justice, in partnership with international law enforcement, dismantled the E-Note cryptocurrency exchange—a major online infrastructure used for laundering illicit proceeds from ransomware and cybercrime. Authorities indicted Mykhalio Petrovich Chudnovets, a Russian national alleged to have operated E-Note since 2010, with facilitating the transfer of over $70 million in stolen or extorted funds from attacks targeting sectors like healthcare and critical infrastructure. Federal and state agencies seized E-Note servers, websites, and mobile apps, obtaining customer and transaction data to further map criminal networks. This takedown highlights cybercriminals’ growing use of specialized laundering platforms to enable ransomware and account takeover monetization at scale. As regulatory scrutiny intensifies and attacker infrastructure becomes more modular and resilient, law enforcement action against these enablers is an increasing priority.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
WhatsApp GhostPairing: How Device Linking Fueled 2024 Account Hijacks
Financial Services10 months ago

WhatsApp GhostPairing: How Device Linking Fueled 2024 Account Hijacks

In mid-2024, threat actors launched a sophisticated social engineering campaign dubbed 'GhostPairing' to hijack WhatsApp accounts by abusing the platform's legitimate device-linking feature. Attackers initiated account compromise by tricking victims into sharing pairing codes, which allowed unauthorized access to their WhatsApp accounts on new devices without triggering standard multi-factor authentication. Once inside, attackers could impersonate victims, access chat histories, and leverage compromised accounts for further malicious activity. The attack exploited inherent trust in WhatsApp's device linking and its secure communication channels, highlighting risks even in end-to-end encrypted environments. This incident underscores the growing trend of attackers subverting user authentication processes, exploiting legitimate features for account takeover, and using highly convincing social engineering methods. With messaging apps central to both business and personal communications, the security and user-awareness gaps demonstrated here remain acutely relevant.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Cisco 2025 AsyncOS Zero-Day: UAT-9686 Exploitation of Email Gateway Appliances
Government Administration10 months ago

Cisco 2025 AsyncOS Zero-Day: UAT-9686 Exploitation of Email Gateway Appliances

In late November 2025, Cisco discovered a major cybersecurity incident involving active exploitation of an unpatched zero-day vulnerability (CVE-2025-20393) in its AsyncOS operating system, impacting Secure Email Gateway (SEG) and Secure Email and Web Manager (SEWM) appliances. The flaw, leveraged exclusively on internet-facing appliances with non-standard configurations, enables remote code execution as root when the Spam Quarantine feature is exposed. Attribution points to UAT-9686, a Chinese-nexus advanced persistent threat actor, utilizing malware such as AquaShell, AquaTunnel, Chisel, and AquaPurge for backdoor access, lateral movement, and log deletion. The campaign has resulted in persistent compromise, requiring full appliance rebuilds for remediation. This incident underscores the persisting risk that unpatched zero-days pose to enterprise infrastructure, particularly from advanced threat actors using sophisticated malware implant chains. It illustrates a broader industry trend of increasingly swift exploitation of newly discovered vulnerabilities and public toolkits by nation-state actors.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
GhostPoster Malware Infects 17 Firefox Extensions: Supply Chain Risks Hit 50,000+ Users
Computer Software/Engineering10 months ago

GhostPoster Malware Infects 17 Firefox Extensions: Supply Chain Risks Hit 50,000+ Users

In late 2025, cybersecurity researchers discovered a campaign named GhostPoster, which compromised the supply chain of Mozilla Firefox by infiltrating 17 browser add-ons with malicious JavaScript. These extensions, collectively downloaded over 50,000 times, were found to hijack affiliate links, inject tracking scripts, and facilitate click and ad fraud. Threat actors used logo image files within the add-ons to conceal the payload and persist across infected hosts. The extensions were promptly removed from the Mozilla add-ons marketplace upon disclosure, but impacted users may have experienced privacy violations and fraudulent activity. This incident highlights continued escalation in browser extension-based supply chain attacks and the increased sophistication of threat actors at targeting trusted ecosystem channels. With organizations relying on browser tools for productivity, ongoing diligence is required to detect, respond to, and prevent similar infiltrations leveraging obfuscated techniques.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical React2Shell Flaw Triggers Ultra-Fast Weaxor Ransomware Attack (2025)
Computer Software/Engineering10 months ago

Critical React2Shell Flaw Triggers Ultra-Fast Weaxor Ransomware Attack (2025)

In December 2025, cybercriminals exploited the critical React2Shell vulnerability (CVE-2025-55182), an unauthenticated remote code execution flaw in React Server Components' Flight protocol, to immediately deploy Weaxor ransomware in targeted organizations. The attackers gained access to public-facing servers running React/Next.js applications, rapidly executed an obfuscated PowerShell script to establish a Cobalt Strike beacon for C2, disabled Windows Defender, and launched the ransomware encryptor within a minute. The incident resulted in data encryption, file extensions changed to '.WEAX', ransom demands, shadow copy deletion, and event log wiping. Impact was limited to the initially compromised server due to the absence of lateral movement or data exfiltration. This incident highlights the increasing speed of cybercriminal exploitation of disclosed critical vulnerabilities, even before widespread patching can occur. The use of automated tooling and rapid weaponization of exploits are fueling a surge in opportunistic ransomware attacks on public-facing infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
SonicWall SMA1000 Zero-Day Breach: 2025’s Wake-Up Call for Secure Network Access
Financial Services10 months ago

SonicWall SMA1000 Zero-Day Breach: 2025’s Wake-Up Call for Secure Network Access

In December 2025, SonicWall disclosed active exploitation of two chained zero-day vulnerabilities (CVE-2025-40602 and CVE-2025-23006) in its SMA1000 Appliance Management Console (AMC). Attackers combined a local privilege escalation flaw with a critical pre-authentication deserialization vulnerability to achieve unauthenticated remote code execution with root privileges on exposed appliances. These devices, used by large organizations for secure VPN access, became an attractive target, with at least 950 systems publicly accessible at the time of disclosure. The threats originated from advanced actors leveraging these weaknesses to bypass security controls and gain deep network access. This incident highlights the persistent risk to network infrastructure from zero-day chaining and the ongoing focus of sophisticated attackers on secure remote access gateways. Heightened regulatory focus, increasing state-sponsored attack campaigns, and renewed emphasis on timely patch management are making such incidents highly relevant for CISOs and infrastructure owners today.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Amazon AWS 2025: Credential-Based Cryptomining Breach Hits the Cloud
Information Technology/IT10 months ago

Amazon AWS 2025: Credential-Based Cryptomining Breach Hits the Cloud

In late 2025, Amazon's AWS GuardDuty team uncovered a significant cryptomining campaign that exploited compromised IAM credentials to gain access to AWS Elastic Compute Cloud (EC2) and Elastic Container Service (ECS) environments. The attackers used valid credentials, rather than technical vulnerabilities, to deploy a malicious Docker Hub image carrying an SBRMiner-MULTI cryptominer. By rapidly launching large-scale EC2 and ECS tasks with high compute and memory allocations, the threat actor inflicted resource exhaustion and financial losses upon AWS customers. Attackers also enabled termination protection on compromised instances, effectively delaying incident response and extending mining profits. This incident is emblematic of the growing sophistication and automation in cloud resource abuse, highlighting an uptick in attacks leveraging stolen credentials rather than software flaws. As cloud adoption surges and cryptomining threats evolve, organizations face urgent pressure to enhance IAM hygiene, monitoring, and automated remediation to reduce risk.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
China-Linked Ink Dragon Breaches Governments With ShadowPad and FINALDRAFT Malware
Government Administration10 months ago

China-Linked Ink Dragon Breaches Governments With ShadowPad and FINALDRAFT Malware

Between July and October 2025, a sophisticated cyber-espionage campaign orchestrated by the China-linked group 'Ink Dragon' (a.k.a. Jewelbug, CL-STA-0049, Earth Alux, REF7707) targeted multiple European, Southeast Asian, and South American governments. The attackers leveraged advanced tools such as ShadowPad and FINALDRAFT malware to infiltrate official networks, move laterally through compromised systems, and exfiltrate sensitive government data via encrypted channels. Their operations exhibited a high degree of stealth, blending custom malware with legitimate administrative tools and exploiting trust in east-west network flows, putting confidential geopolitical and citizen information at direct risk. This incident underscores the increasing frequency and sophistication of state-sponsored espionage operations against government entities worldwide. It marks a significant trend where threat actors are adopting modular malware and advanced lateral movement techniques, emphasizing the urgent need for stronger east-west security controls and real-time anomaly detection in critical infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Zeroday Cloud 2025: $320,000 Awarded for Critical Cloud Platform Zero-Days
Information Technology/IT10 months ago

Zeroday Cloud 2025: $320,000 Awarded for Critical Cloud Platform Zero-Days

In December 2025, the inaugural Zeroday Cloud hacking competition in London highlighted severe risks facing cloud infrastructure by awarding $320,000 for the demonstration of 11 zero-day vulnerabilities across components like Redis, PostgreSQL, Grafana, and the Linux kernel. Notably, researchers exploited a container escape flaw in the Linux kernel, threatening tenant isolation—a cornerstone of cloud security. The impacted databases are integral to storing sensitive information, including credentials and user data. Although the event was hosted in a controlled environment, it provided a real-world showcase of how adversaries can achieve lateral movement and severe impact using previously unknown vulnerabilities. As critical cloud services grow more ubiquitous and attackers continue to innovate, this incident underscores the urgency for organizations to address emerging threats through proactive vulnerability management, layered defense, and rapid response capabilities.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
SonicWall SMA 100 Breach 2025: CVE-2025-40602 Actively Exploited
Financial Services10 months ago

SonicWall SMA 100 Breach 2025: CVE-2025-40602 Actively Exploited

In December 2025, SonicWall disclosed a security breach affecting its Secure Mobile Access (SMA) 100 series appliances, driven by exploitation of CVE-2025-40602—a local privilege escalation vulnerability. The issue arose due to insufficient authorization in the Appliance Management Console (AMC), enabling threat actors to elevate local privileges and gain greater control within affected systems. SonicWall confirmed active exploitation in the wild, prompting an urgent release of security patches while urging all customers to apply updates immediately. The incident underscores the risks facing network appliances and the rapid speed with which attackers can leverage new vulnerabilities to compromise enterprise infrastructure. This event occurs amidst a wider uptick in attacks targeting edge appliances from network security vendors, as adversaries increasingly exploit publicly disclosed software flaws soon after their publication. Organizations are under intensified regulatory and operational pressure to patch critical vulnerabilities rapidly and reinforce privilege management strategies.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
CISA Flags 3 New Actively Exploited Vulnerabilities: Cisco, SonicWall, ASUS
Government Administration10 months ago

CISA Flags 3 New Actively Exploited Vulnerabilities: Cisco, SonicWall, ASUS

In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) added three newly discovered vulnerabilities (CVE-2025-20393, CVE-2025-40602, and CVE-2025-59374) to its Known Exploited Vulnerabilities (KEV) Catalog based on active exploitation evidence. These flaws impact multiple Cisco products, SonicWall SMA1000, and ASUS Live Update, allowing attackers to gain unauthorized access, insert malicious code, or bypass input validations. Such exposures provide fertile ground for cybercriminals to enter networks, move laterally, and compromise data, posing significant operational and business continuity risks to affected organizations across sectors. Their rapid inclusion into the KEV Catalog reflects a surge in the exploitation of software supply chains and critical infrastructure technologies. With attackers leveraging faster exploit-to-impact timelines, government agencies and enterprises face mounting pressure to patch immediately and update their vulnerability and segmentation strategies to prevent cascading breaches.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports