Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 326 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 3901–3912 / 4903 reports
CISA Flags Active D-Link & Array Networks Vulnerabilities in 2025 KEV Catalog
Government Administration10 months ago

CISA Flags Active D-Link & Array Networks Vulnerabilities in 2025 KEV Catalog

In December 2025, the Cybersecurity and Infrastructure Security Agency (CISA) expanded its Known Exploited Vulnerabilities (KEV) Catalog to include two actively exploited vulnerabilities: CVE-2022-37055, a buffer overflow in D-Link routers, and CVE-2025-66644, an OS command injection flaw impacting Array Networks ArrayOS AG. These vulnerabilities provide attack vectors for cybercriminals to gain unauthorized access, conduct lateral movement, or exfiltrate sensitive data within federal and private sector networks. The directive mandates that all Federal Civilian Executive Branch (FCEB) agencies address these threats promptly to reduce risk exposure and protect operational integrity. This update underscores the persistent threat posed by unpatched network infrastructure vulnerabilities, which remain prime targets for attackers. Timely remediation of KEV-listed vulnerabilities is increasingly critical for all organizations amid a rising trend of targeted attacks against widely deployed network devices.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
React2Shell Vulnerability Triggers Mass Breach Across 30+ Organizations in 2025
Computer Software/Engineering10 months ago

React2Shell Vulnerability Triggers Mass Breach Across 30+ Organizations in 2025

In early 2025, researchers discovered that over 77,000 internet-exposed IP addresses are vulnerable to a critical Remote Code Execution (RCE) flaw in the React2Shell framework (CVE-2025-55182). Threat actors rapidly exploited this vulnerability to breach at least 30 organizations across sectors such as finance, healthcare, and technology. Attackers leveraged the exploit to gain remote control, exfiltrate data, and potentially deploy malware across impacted systems, highlighting significant risks to operational resilience and data privacy. The compromised firms are now racing to contain lateral movement and mitigate exposure amid ongoing incident response. This incident illustrates a growing trend of attackers rapidly weaponizing newly disclosed vulnerabilities in popular frameworks for mass exploitation. It underscores the urgent need for timely patch management, robust segmentation, and comprehensive monitoring to counter the escalating threat from opportunistic RCE attacks targeting exposed internet-facing assets.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Escalating Credential Attacks on Palo Alto GlobalProtect VPNs: 2024 Threat Review
Financial Services10 months ago

Escalating Credential Attacks on Palo Alto GlobalProtect VPNs: 2024 Threat Review

In early 2024, cybersecurity analysts observed a widespread campaign targeting Palo Alto Networks’ GlobalProtect VPN portals and SonicWall SonicOS API endpoints with aggressive login attempts and scanning activity. Threat actors used automated tools to conduct credential stuffing and exploit potential vulnerabilities in exposed VPN portals, aiming to gain unauthorized network access. While no specific breaches were confirmed, the campaign's scope affected numerous organizations globally relying on these remote access solutions, highlighting the heightened risk to large enterprises and managed service providers leveraging vulnerable or misconfigured VPN infrastructure. This incident illustrates the surge in identity-driven and credential-based attacks exploiting remote access technologies, especially as hybrid and remote workforces remain prevalent. The rapid evolution and broad targeting underscore the urgent need for continuous VPN hardening, robust access governance, and threat monitoring to preempt similar intrusion attempts impacting business continuity.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical React2Shell Flaw (CVE-2025-55182) Added to CISA KEV After Confirmed Exploitation
Computer Software/Engineering10 months ago

Critical React2Shell Flaw (CVE-2025-55182) Added to CISA KEV After Confirmed Exploitation

In June 2025, a critical remote code execution (RCE) vulnerability, CVE-2025-55182, impacting React Server Components (RSC) was added to CISA's Known Exploited Vulnerabilities catalog following confirmed reports of active exploitation. Attackers leveraged the flaw, known as 'React2Shell,' to execute arbitrary code on vulnerable servers by exploiting inadequate input validation, enabling lateral movement and potential compromise of sensitive systems and data. Several organizations in sectors reliant on JavaScript-based web infrastructures were affected, resulting in service disruptions and the risk of unauthorized data access and exfiltration. This incident highlights a broader trend in targeting supply chain and open-source components within modern web development stacks. The increasing frequency and sophistication of attacks on widely adopted frameworks like React underscore the urgency for rapid vulnerability remediation, improved code validation, and enterprise adoption of proactive threat detection to mitigate future large-scale RCE campaigns.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
AI IDEsaster: 30+ Vulnerabilities Expose Developer Environments to Prompt Injection & RCE (2025)
Computer Software/Engineering10 months ago

AI IDEsaster: 30+ Vulnerabilities Expose Developer Environments to Prompt Injection & RCE (2025)

In December 2025, over 30 serious security flaws—collectively named "IDEsaster"—were uncovered in popular AI-powered Integrated Development Environments (IDEs) by researcher Ari Marzouk (MaccariTA). Exploiting these vulnerabilities, attackers could inject malicious prompts, leading to unauthorized data exfiltration and remote code execution within developer environments. The flaws stemmed from unsafe integrations of AI features, including insufficient sandboxing and lack of network traffic controls, exposing sensitive code and credentials to threat actors. Notably, vulnerabilities allowed for lateral movement and direct access to code repositories, risking business continuity and intellectual property. This incident is especially significant as AI adoption in coding workflows accelerates, creating new attack vectors. The surge in prompt injection and AI supply chain threats, paired with evolving attacker tactics targeting developer tools, highlights the urgent need for organizations to strengthen segmentation, monitoring, and AI risk governance.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
How MCP Prompt Injection Attacks Bypassed AI Security Controls in 2024
Computer Software/Engineering10 months ago

How MCP Prompt Injection Attacks Bypassed AI Security Controls in 2024

In early 2024, cybersecurity researchers from Unit 42 uncovered a series of novel prompt injection attack vectors targeting applications built on the Model Context Protocol (MCP), an emerging technology that connects large language models (LLMs) to external data sources and tools. Threat actors exploited weaknesses in MCP sampling to inject malicious prompts, enabling sensitive data exfiltration, command execution, and unauthorized access to downstream APIs. The compromised LLM applications posed significant risks across industries utilizing MCP to enhance automation and efficiency, ultimately raising concerns over AI/ML-powered business processes. The attack highlighted urgent visibility, policy enforcement, and segmentation shortfalls in cloud-native environments. The MCP prompt injection incident underscores a surge in AI-driven threats, particularly as generative AI is rapidly being integrated into enterprise workflows. Regulatory bodies and CISOs now place a premium on robust framework adherence and continuous monitoring as generative AI vulnerabilities and supply-chain risks multiply.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Cloudflare 2024 Outage: Why Network Resilience and Redundancy Matter More Than Ever
Internet10 months ago

Cloudflare 2024 Outage: Why Network Resilience and Redundancy Matter More Than Ever

On June 20, 2024, Cloudflare, a major internet infrastructure and security provider, suffered a widespread service outage that disrupted access to thousands of websites and web services globally. The event was characterized by persistent 500 Internal Server Error messages for end users. Cloudflare initiated an internal investigation, ultimately attributing the incident to a critical infrastructure failure rather than a cyberattack or external threat. Throughout the outage, web-facing businesses, SaaS providers, and end-users experienced degraded network performance, extended downtime, and impact to brand trust, illustrating the magnitude of hyperscaler dependencies. The Cloudflare outage highlights the increasing risks associated with concentration of critical internet services and underscores the urgency for organizations to bolster resilience strategies. In an era of heightened service interdependencies and upticks in both incidents and attacks targeting fundamental service providers, outage preparedness and robust incident response planning are more essential than ever.

High impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
AI Agent Prompt Injection Turns GitHub Actions Into Supply Chain Backdoor
Computer Software/Engineering10 months ago

AI Agent Prompt Injection Turns GitHub Actions Into Supply Chain Backdoor

In early 2024, cybersecurity researchers at Aikido disclosed a critical supply-chain vulnerability affecting major AI coding tools such as Google Gemini, Claude Code, OpenAI Codex, and GitHub AI Inference. The flaw enables attackers to inject malicious prompts into software automation workflows like GitHub Actions, causing integrated AI agents with elevated privileges to execute unauthorized commands. Cunning use of crafted commit messages and pull requests can trick large language models into treating these inputs as actionable instructions, leading to code modifications, shell command execution, and privilege escalation within software repositories. The vulnerability, reported via responsible disclosure, has prompted urgent fixes in some tools, but similar weaknesses remain present in other platforms. This incident highlights the expanding risks of AI-powered automation in the software development supply chain. With organizations increasingly relying on LLM integrations, the potential for prompt injection and privilege abuse creates new avenues for compromise, underscoring the urgency for robust controls, regular audit, and architectural safeguards around agentic AI workflows.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How Sophisticated Attackers Exploited the 2025 React2Shell Zero-Day
Computer Software/Engineering10 months ago

How Sophisticated Attackers Exploited the 2025 React2Shell Zero-Day

In June 2025, a critical remote code execution vulnerability named React2Shell (CVE-2025-55182) was exploited in the wild against organizations using React Server Components. Within hours of the public disclosure and patch release, Chinese state-linked groups such as UNC5174 (CL-STA-1015), Earth Lamia, and Jackpot Panda, alongside opportunistic cybercriminals, began mass scanning and targeting exposed systems. The threat actors successfully deployed malware (notably Snowlight and Vshell), established persistent access, conducted credential theft, and attempted to extract Amazon Web Services configuration and credential files. Over 30 organizations across industries suffered breaches, including documented impact on customer cloud environments. This campaign demonstrates the increasing speed and coordination of attackers exploiting newly public vulnerabilities, especially in widely deployed frameworks like React and Next.js. The incident underscores the necessity of rapid patching, improved east-west traffic security, and continuous threat detection, as adversaries quickly weaponize disclosures for initial access and persistent footholds.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
China-Linked Supply Chain Breach Exploits React2Shell Flaw in 2025
Computer Software/Engineering10 months ago

China-Linked Supply Chain Breach Exploits React2Shell Flaw in 2025

In mid-2025, multiple China-linked threat actors launched widespread exploitation of the React2Shell vulnerability (CVE-2025-55182), a critical supply-chain flaw impacting React and Next.js applications. Within hours of the flaw’s public disclosure, attackers initiated automated scanning and weaponization campaigns, targeting internet-exposed services to quickly gain unauthorized, remote code execution. Successful intrusions enabled attackers to harvest sensitive data, escalate privileges, and pivot laterally within affected cloud environments. The rapid adoption of malicious payloads and swift exploitation before most organizations could patch led to substantial business risk, data loss, and potential compliance violations across sectors. This incident underscores an escalated threat landscape where nation-state actors rapidly exploit newly-disclosed supply-chain vulnerabilities. The speed and scope of these attacks reflect a significant uptick in zero-day exploitation campaigns and highlight the urgent need for organizations to strengthen patching velocity, endpoint monitoring, and east-west segmentation controls.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Cloudflare’s 2024 Outage: Lessons from the React2Shell RCE Emergency
Internet10 months ago

Cloudflare’s 2024 Outage: Lessons from the React2Shell RCE Emergency

In June 2024, Cloudflare experienced a significant outage after emergency patching efforts to address an actively exploited remote code execution (RCE) vulnerability in the React framework, dubbed "React2Shell." The incident unfolded as threat actors began leveraging the vulnerability to attempt unauthorized code execution on internet-facing workloads, prompting Cloudflare to rush critical security mitigations. While the attack itself targeted exploitation routes via React, it was the swift application of mitigations—rather than a direct breach—which triggered widespread downtime, temporarily impacting Cloudflare's global network operations and customer accessibility. This incident underscores the increasing speed and aggression of active exploitation cycles, particularly for zero-day vulnerabilities in widely used frameworks. As attacker sophistication grows and organizations race to patch critical flaws, operational disruptions and collateral damage are becoming more frequent in the ongoing effort to balance security with business continuity.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
Clop Ransomware Hits Barts Health NHS via Oracle Zero-Day
Health Care / Life Sciences10 months ago

Clop Ransomware Hits Barts Health NHS via Oracle Zero-Day

In early 2024, Barts Health NHS Trust disclosed a data breach after Clop ransomware actors exploited a zero-day vulnerability in Oracle E-Business Suite. The attackers gained unauthorized access to internal systems, exfiltrated sensitive files from a key database, and threatened further leaks. The attack leveraged unpatched software flaws as the entry vector, allowing for rapid lateral movement and data theft before being detected. The incident disrupted operations and triggered regulatory notifications due to the sensitive nature of patient and operational information. This breach highlights the ongoing risks posed by sophisticated ransomware groups exploiting zero-day vulnerabilities in widely used enterprise software. Attacks of this kind are increasingly common, especially in the healthcare sector, which remains a high-value target for ransomware due to legacy systems and critical service mandates.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports