Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 32 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 373–384 / 4893 reports
Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks
Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks
Banking/Mortgage1 month ago

Mass Website Compromise Campaign Delivers LunexStealer Through Fake Cloudflare Security Checks

In September 2026, Ukraine's CERT-UA identified over 100 compromised websites injected with malicious JavaScript to distribute LunexStealer malware through fake Cloudflare verification pages. The UAC-0277 threat cluster used ClickFix techniques and EtherHiding methods to selectively target Windows users arriving from search engines, delivering MSI packages that install sophisticated information-stealing capabilities including the LUNARAXE browser extension and NAIVEMESS file system access component. This campaign represents the growing sophistication of social engineering attacks that exploit trusted security interfaces like Cloudflare to bypass user suspicion and deliver advanced persistent threats.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Anthropic's AI Revolution in Cybersecurity: 129,000 Vulnerabilities Discovered Through Claude Models
Anthropic's AI Revolution in Cybersecurity: 129,000 Vulnerabilities Discovered Through Claude Models
Computer Software/Engineering1 month ago

Anthropic's AI Revolution in Cybersecurity: 129,000 Vulnerabilities Discovered Through Claude Models

Anthropic expanded its Cyber Verification Program in October 2026, providing vetted cybersecurity professionals with reduced-safeguard access to advanced AI models including Claude Opus 5.5 and Claude Sonnet 5.5. The company's Project Glasswing initiative discovered 129,000 verified software vulnerabilities between April and July 2026, with over 33,000 rated as critical or high-severity. The program offers three access tiers - Defense Access, Red Team Access, and Specialized Access - each with varying levels of safeguards removal for legitimate security testing and research purposes. This development highlights the growing intersection of AI capabilities and cybersecurity operations, as organizations increasingly leverage artificial intelligence for both defensive vulnerability discovery and offensive security testing. The dual-use nature of these AI tools underscores the need for careful access controls while democratizing advanced cybersecurity capabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Atlassian Data Center Under Attack: CVE-2026-21589 Exploited in Hours
Atlassian Data Center Under Attack: CVE-2026-21589 Exploited in Hours
Computer Software/Engineering1 month ago

Atlassian Data Center Under Attack: CVE-2026-21589 Exploited in Hours

In October 2026, threat actors began exploiting CVE-2026-21589, a critical arbitrary file access vulnerability in Atlassian Data Center products including Jira, Confluence, and Bitbucket. The flaw allows unauthenticated attackers to access sensitive files through path traversal manipulation, potentially exposing credentials and configuration data. Exploitation attempts began within two hours of public technical details being released, with 15 documented attacks from IP addresses in Japan and the US targeting honeypot networks. This incident highlights the accelerating timeline between vulnerability disclosure and active exploitation, demonstrating how modern threat actors rapidly weaponize public proof-of-concept code to target enterprise infrastructure at scale.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
FortiBleed Campaign Exposes Critical Gaps in Network Device Security
FortiBleed Campaign Exposes Critical Gaps in Network Device Security
Financial Services1 month ago

FortiBleed Campaign Exposes Critical Gaps in Network Device Security

The FBI and Secret Service issued warnings in October 2026 that the FortiBleed credential harvesting campaign continues targeting internet-facing Fortinet FortiGate firewalls and SSL VPN gateways. This Russian-speaking operation has successfully compromised over 86,644 device credentials across 194 countries using a sophisticated five-stage attack chain involving credential stuffing, passive traffic interception, GPU-accelerated password cracking, and lateral movement. The campaign exploits reused credentials and legacy SHA-256 password storage, with attackers creating persistent backdoor accounts and selling access to ransomware groups including INC and Lynx operators. This incident highlights the escalating threat to network perimeter devices as initial access brokers increasingly target enterprise VPN infrastructure to enable downstream ransomware operations, making credential security and multi-factor authentication critical defensive priorities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
PoeLLM Malware Exploits AI Infrastructure in Massive Cryptojacking Campaign
PoeLLM Malware Exploits AI Infrastructure in Massive Cryptojacking Campaign
Information Technology/IT1 month ago

PoeLLM Malware Exploits AI Infrastructure in Massive Cryptojacking Campaign

In 2026, cybersecurity researchers identified the Canto Incognito campaign, deploying PoeLLM malware to build a cryptocurrency mining botnet targeting AI and LLM infrastructure. Active since April 2026, the campaign infected over 3,400 servers, peaking at nearly 2,200 affected systems in mid-June. The Italian-speaking threat actors used a creative technique, hiding command-and-control addresses within poems hosted on GitHub, and targeted enterprise-facing deployments including LiteLLM, Gotenberg, Gitea, and Ivanti Sentry appliances to exploit their computational power for illicit mining operations. This incident highlights the growing threat to AI infrastructure as organizations rapidly deploy LLM services without adequate security controls, making them attractive targets for cryptojacking operations due to their powerful computing resources and often inadequate monitoring.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
Critical LMCache Vulnerability Exposes AI Infrastructure to Remote Code Execution
Critical LMCache Vulnerability Exposes AI Infrastructure to Remote Code Execution
Computer Software/Engineering1 month ago

Critical LMCache Vulnerability Exposes AI Infrastructure to Remote Code Execution

A critical vulnerability (CVE-2026-105192) in LMCache, an open-source caching system for large language model servers, allows unauthenticated remote code execution with a severity score of 9.8/10. The flaw affects LMCache versions 0.3.9 through 0.5.5 in multiprocess mode, where attackers can exploit Python pickle deserialization through ZeroMQ messaging to execute arbitrary code. The vulnerability particularly impacts deployments using routable network addresses, including LMCache's own Kubernetes example configuration, with no patch currently available. This incident highlights the growing security risks in AI infrastructure as organizations rapidly adopt LLM technologies without adequate security controls. The vulnerability represents a broader trend of supply chain risks in AI frameworks, following similar ShadowMQ vulnerabilities discovered across multiple AI inference platforms in 2025.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Atlassian CVE-2026-21589 Under Active Attack: Directory Traversal Vulnerability Exploited Within Hours
Atlassian CVE-2026-21589 Under Active Attack: Directory Traversal Vulnerability Exploited Within Hours
Computer Software/Engineering1 month ago

Atlassian CVE-2026-21589 Under Active Attack: Directory Traversal Vulnerability Exploited Within Hours

On October 5th, 2024, Atlassian published patches for a critical directory traversal vulnerability (CVE-2026-21589) affecting multiple products including Jira, Confluence, and Bitbucket. The vulnerability allows attackers to read arbitrary files within the web application directory by exploiting a path traversal flaw using the pattern "::" which gets translated to "/" on the server. Within 48 hours of the Watchtowr proof-of-concept publication, SANS Internet Storm Center honeypots detected active exploitation attempts from multiple Digital Ocean IP addresses targeting the /WEB-INF/web.xml file to extract sensitive configuration data. This incident highlights the accelerating timeline between vulnerability disclosure and active exploitation, with threat actors rapidly weaponizing published proof-of-concepts. The coordinated scanning activity from Digital Ocean infrastructure demonstrates how cloud platforms are increasingly leveraged for vulnerability research and exploitation campaigns targeting newly disclosed CVEs.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model
The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model
Financial Services1 month ago

The Expanding AI Attack Surface: Why Enterprise AI Security Goes Beyond the Model

Enterprise AI deployments are creating unprecedented attack surfaces that extend far beyond the AI model itself, encompassing the entire application stack including tools, data pipelines, APIs, identity systems, and cloud infrastructure. Unlike traditional applications with predictable logic, AI systems introduce probabilistic behavior and natural language processing that can be manipulated through prompt injection attacks to execute unauthorized actions across internal systems. These attacks can chain together to compromise service accounts, bypass tenant isolation, and expose sensitive data across multiple customer environments. The integration of AI into core business workflows has fundamentally altered the enterprise security landscape, requiring organizations to rethink their approach to threat modeling and security testing. Current security practices that focus solely on model safety or traditional application security miss critical vulnerabilities in the interconnected AI ecosystem, leaving organizations exposed to sophisticated attack chains that can traverse from user-facing chatbots to critical backend infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
FortiBleed Campaign Exposes Critical VPN Security Gaps Leading to Ransomware
FortiBleed Campaign Exposes Critical VPN Security Gaps Leading to Ransomware
Financial Services1 month ago

FortiBleed Campaign Exposes Critical VPN Security Gaps Leading to Ransomware

FortiBleed is an active credential compromise campaign targeting Fortinet firewalls and VPN gateways that has affected over 450,000 devices across 194 countries since early 2024. Attackers exploit vulnerabilities to steal credentials, create unauthorized admin accounts, and lock legitimate users out of their systems by changing passwords or disabling accounts. The FBI and Secret Service confirmed that FortiBleed serves as an initial access vector for ransomware affiliates including INC/Lynx and Payload, making standard patching and password resets insufficient for recovery. The campaign demonstrates the critical vulnerability of network perimeter devices and their role as high-value targets for initial access brokers. With VPN and firewall compromises becoming primary entry points for ransomware operations, organizations face increased pressure to implement zero-trust architectures and comprehensive credential management strategies to protect against these sophisticated supply chain attacks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Infrastructure Engineer Sentenced for $750K Ransomware-Style Insider Attack
Infrastructure Engineer Sentenced for $750K Ransomware-Style Insider Attack
Information Technology/IT1 month ago

Infrastructure Engineer Sentenced for $750K Ransomware-Style Insider Attack

In November 2023, Daniel Rhyne, a 57-year-old core infrastructure engineer at a New Jersey industrial company, executed a ransomware-style insider attack that locked over 3,000 devices across his employer's network. Using administrator credentials, Rhyne systematically changed passwords for 301 domain user accounts and multiple admin accounts to 'TheFr0zenCrew!', deleted 13 domain admin accounts, and shut down random servers. He demanded 20 Bitcoin (approximately $750,000) in a ransom email titled 'Your Network Has Been Penetrated', threatening to shut down 40 servers daily for ten days unless paid. Rhyne was sentenced to 32 months in federal prison in 2024. This case highlights the growing threat of insider attacks as organizations face increasing pressure from disgruntled employees and the evolving sophistication of internal threat actors who leverage legitimate access for malicious purposes.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Nikkei's Dual Email Breach Exposes Critical Cloud Security Gaps
Newspapers/Journalism1 month ago

Nikkei's Dual Email Breach Exposes Critical Cloud Security Gaps

Japanese media giant Nikkei disclosed two separate email account breaches in 2026, affecting both Google Workspace and Microsoft 365 platforms. In July, attackers compromised a Google Workspace account exposing personal information of 1,646 employees and business partners. A second incident in September involved threat actors accessing a Microsoft 365 account to launch 9,000 phishing emails targeting Nikkei staff and interviewees. The attacks highlight persistent targeting of the media organization, following previous incidents including a $29 million BEC attack in 2019, ransomware in 2022, and Slack breach affecting 17,000 users in 2025. This incident reflects the escalating threat landscape facing media organizations, where attackers increasingly target cloud email platforms to conduct secondary attacks and establish persistent access for future operations.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Fake AI Sites Steal Ad Accounts: The 2026 ChatGPT Phishing Campaign That Bypassed MFA
Fake AI Sites Steal Ad Accounts: The 2026 ChatGPT Phishing Campaign That Bypassed MFA
Marketing/Advertising/Sales1 month ago

Fake AI Sites Steal Ad Accounts: The 2026 ChatGPT Phishing Campaign That Bypassed MFA

In October 2026, cybercriminals launched a sophisticated phishing campaign targeting advertising account managers using fake AI assistant sites impersonating ChatGPT, Gemini, Claude, and Perplexity. The attackers leveraged browser-in-browser (BitB) attacks to steal login credentials and multi-factor authentication codes from agency staff and media buyers with access to multiple client accounts. The campaign exploited Meta's recent Muse AI agent launch as a lure, with human operators dynamically controlling the phishing flow to bypass MFA protections and potentially compromise hundreds of high-value advertising accounts. This incident highlights the escalating threat of AI-themed phishing attacks as cybercriminals exploit the rapid adoption of AI tools in business workflows. The campaign's sophisticated use of real-time operator control and adaptive interfaces across multiple platforms demonstrates how threat actors are evolving their tactics to target high-value accounts with significant financial exposure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports