Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Windows 10 End-of-Support: Patch Tuesday Signals Urgent Lifecycle Risk in 2025
In October 2025, Microsoft released KB5066791, the final mandatory Patch Tuesday update for Windows 10 as the operating system officially reached end-of-support status. This update addressed six zero-day vulnerabilities and 172 additional flaws. With free support and security updates discontinued, only customers enrolled in extended security updates (ESUs) are eligible for further patches. The shift leaves millions of endpoints—including in enterprise and consumer environments—potentially vulnerable to emerging threats targeting unpatched or unsupported Windows 10 systems as threat actors historically target end-of-life platforms for exploitation. The update also modified components like the Azure validation chain and removed outdated drivers, signaling a definitive end to mainstream security support. This event is particularly significant due to the accelerated exploitation trends observed following previous Microsoft OS end-of-life events. Attackers rapidly pivot to leverage newly found or previously unreported vulnerabilities, resulting in heightened lateral movement and potential compliance risks. Organizations must act swiftly to upgrade, implement segmentation, and enhance detection capabilities to avoid becoming easy targets.
8 months ago
Kill Chain
How Hacktivists Used Hashtags and DDoS to Disrupt in 2025
In early 2025, a surge in global hacktivist operations was observed, coordinated primarily via Telegram and X (formerly Twitter), with attackers leveraging hashtags to claim credit, issue threats, and organize campaigns. Over 120 hacktivist groups, originating in the MENA region but targeting organizations worldwide—including government, finance, and critical infrastructure—conducted highly visible DDoS attacks. These operations favored impact and propaganda over technical sophistication, resulting in significant service disruptions and reputational challenges for numerous victims, with attack announcements and proof frequently disseminated in near real-time. The campaign reflects a broader shift toward open, social-media-driven hacktivist tactics that often transcend regional geopolitics. As DDoS tools become more accessible and social platforms amplify coordination, all organizations—regardless of direct involvement in conflicts—face increased risk from ideologically motivated cyberattacks.
8 months ago
Kill Chain
Windows 11 Recall: New AI Feature Raises Alarming Data Security Concerns
In May 2025, security researchers highlighted significant privacy and security concerns in the Windows 11 Recall feature, an AI-powered function that automatically captures and stores screenshots and context of user activity. Although designed to enhance productivity by allowing seamless search and recall, the feature stores sensitive information—including potential credentials, private messages, and payment data—without robust controls or proven encryption. The built-in privacy filtering was found to be unreliable, enabling attackers or malware to leverage Recall’s artifacts to reconstruct user activity or exfiltrate high-value data. Because the Recall database is accessible without administrative privilege, organizations relying on default configurations could unintentionally expose critical information or face regulatory risks. This incident underscores the urgent need for organizations to review new operating system features before broad deployment, especially as attackers increasingly target post-compromise artifacts and AI-powered data collectors. High-profile attention to Recall has driven further debate on privacy standards and compliance, with heightened scrutiny from both regulators and security leaders.
8 months ago
Kill Chain
SolarWinds & MOVEit: The Wake-Up Call for Modern Supply Chain Cybersecurity
In recent years, a wave of major supply chain cyberattacks—most notably the SolarWinds compromise in 2020 and the MOVEit Transfer breach in 2023—have demonstrated how adversaries exploit trusted vendors to bypass defenses at scale. In the SolarWinds incident, attackers injected malicious code into the Orion software updates, leading to undetected access across 18,000 organizations, including government agencies and Fortune 500 companies. Just three years later, a zero-day vulnerability in MOVEit’s file transfer software enabled ransomware group Clop to exfiltrate and manipulate sensitive data from more than 2,000 global organizations, impacting over 62 million individuals. These incidents not only inflicted operational and reputational damage but also instigated regulatory and legal scrutiny, highlighting that even the most secure organizations remain vulnerable through third-party dependencies. Supply chain attacks now pose an elevated risk as threat actors increasingly target software providers, managed service firms, and widely used platforms to maximize reach and disruption. Rising regulatory expectations on supply chain oversight, combined with new TTPs like supply chain ransomware and identity abuse, solidify supply chain risk as a top boardroom and CISO concern.
8 months ago
Kill Chain
Fortra GoAnywhere MFT Breach: How CVE-2025-10035 Enabled a Major Ransomware Attack
In September 2025, Fortra disclosed that its GoAnywhere Managed File Transfer (MFT) platform suffered from a critical vulnerability (CVE-2025-10035) that was actively exploited by threat actors. Attackers leveraged this flaw—reportedly requiring a private cryptographic key, the origins of which are still unclear—to gain unauthorized access, moving laterally within cloud-based environments and exfiltrating data. Notably, Microsoft attributed ransomware intrusions and multi-stage attacks to a criminal group tracked as Storm-1175, leading to business disruptions and heightened risk for GoAnywhere users. Fortra responded by patching its services, investigating suspicious activity, and notifying affected customers, though questions remain regarding the root cause and extent of private key compromise. This incident highlights the growing risk of supply chain and third-party software vulnerabilities being exploited in ransomware campaigns. The exploitation of cryptography-dependent mechanisms signals an evolving sophistication among threat actors, pressing organizations to reconsider approaches to privileged cryptographic assets and drive urgency in patch management.
8 months ago
Kill Chain
Harvard University Hit by Clop Ransomware Through Oracle Zero-Day Exploit in 2025
In October 2025, Harvard University disclosed an ongoing investigation into a cybersecurity breach linked to the exploitation of a zero-day vulnerability (CVE-2025-61882) in Oracle's E-Business Suite servers. The Clop ransomware gang claimed responsibility after adding Harvard to its data leak site, stating sensitive administrative data was stolen and threatening public release if ransom demands were not met. The attack was part of a broader campaign targeting Oracle E-Business Suite customers globally, exploiting the flaw for extortion and data theft. Harvard applied the vendor’s emergency patch upon notification and reported the breach as limited to a small administrative unit, with no signs of further compromise. This incident underscores the continuous risk universities and other organizations face from sophisticated ransomware groups leveraging zero-day exploits to bypass conventional defenses. The rapid exploitation of newly discovered vulnerabilities and subsequent data thefts reflect an ongoing shift towards extortion-focused campaigns targeting high-profile institutions and critical business systems.
8 months ago
Kill Chain
Oracle E-Business Suite 2025 Flaw Sparks Urgent Clop Ransomware Concerns
In October 2025, Oracle issued an emergency patch addressing CVE-2025-61884, a critical information disclosure vulnerability in its E-Business Suite (EBS) affecting versions 12.2.3 through 12.2.14. The flaw, present in the Runtime UI component, allowed unauthenticated attackers to remotely access sensitive business data, bypassing standard authentication mechanisms. The incident followed the discovery that threat actors—most notably the Clop ransomware group—had recently targeted Oracle EBS zero-days in extortion schemes against executives, leveraging vulnerabilities to facilitate large-scale data theft. Although Oracle has not confirmed active exploitation of CVE-2025-61884, the urgency of the patch highlights heightened threat actor interest and continued risk for organizations with unpatched, internet-facing EBS deployments. This incident underscores an alarming trend: criminal groups exploiting zero-day and recently patched vulnerabilities in widely used business applications for extortion and data theft. The rapid evolution of attacker tactics, combined with the continued exposure of critical SaaS and ERP platforms, raises the stakes for organizations to accelerate patching cycles and strengthen segmentation and threat detection strategies.
8 months ago
Kill Chain
SonicWall VPN Breach 2025: Credential Theft Sparks Widespread Compromise
In October 2025, a widespread cyberattack compromised more than 100 SonicWall SSLVPN accounts across 16 customer environments through the use of stolen, valid credentials. Researchers at Huntress observed the attackers rapidly authenticating into multiple accounts, with some sessions ending abruptly while others progressed to network reconnaissance and attempts at lateral movement by targeting local Windows accounts. The campaign began around October 4, 2025, with most attack traffic tracing back to a single IP address. Although there is no direct link to a previous breach involving SonicWall firewall configuration files, the incident underscores a substantial exposure risk to sensitive systems, business operations, and potentially regulatory compliance requirements. This incident highlights the evolving threat landscape, where credential compromise—not brute force—enables rapid, large-scale intrusions into VPN infrastructures. The continued prevalence of identity-driven attacks against remote access systems amplifies the urgency for enhanced credential hygiene, multi-factor authentication, and zero-trust access controls in the face of sophisticated adversaries.
8 months ago
Kill Chain
Massive Multi-Country Botnet Launches RDP Attacks Against US Organizations
In October 2025, a massive botnet composed of devices spanning over 100 countries launched coordinated attacks targeting Remote Desktop Protocol (RDP) services in the United States. Security researchers first spotted a spike in unusual RDP traffic originating from Brazil, with further malicious activity quickly spreading globally. Attackers leveraged two primary techniques: RD Web Access timing attacks to infer valid usernames, and RDP web client login enumeration to access accounts through analysis of server response behaviors. The campaign utilized over 100,000 unique IP addresses sharing a similar TCP fingerprint, indicating a highly organized cluster-based operation. The attacks put both government and enterprise systems at risk of brute-force intrusion and potential credential compromise. This incident underlines the persistent and evolving threat posed by botnets against remote access services. With increasing remote work reliance and exposed RDP endpoints, such sophisticated, multi-geography attacks exploit common authentication weaknesses and call for urgent upgrades in defense, including MFA and network segmentation.
8 months ago
Kill Chain
Microsoft 2025: Zero-Day Exploit Prompts Emergency IE Mode Restrictions
In October 2025, Microsoft announced urgent restrictions on Internet Explorer (IE) mode within the Edge browser following the discovery of active zero-day exploits targeting the Chakra JavaScript engine. Threat actors leveraged sophisticated social engineering tactics to lure users to spoofed sites, where a previously unknown vulnerability in Chakra enabled remote code execution. Attackers combined this with a privilege escalation flaw to escape the browser sandbox and seize complete device control. Microsoft responded by removing easy methods to activate IE mode in Edge for consumer users, instead requiring manual configuration limited to explicit, approved sites, and urged migration from legacy technologies. This incident underscores the persistent risks associated with maintaining legacy web compatibility features such as IE mode, especially as threat actors increasingly exploit these pathways with sophisticated chains of zero-day vulnerabilities and social engineering. It highlights heightened urgency for organizations to migrate from deprecated software and rigorously manage legacy access points.
8 months ago
Kill Chain
Spain Shuts Down GXC Team: Crime-as-a-Service Powerhouse Busted in 2025
In May 2025, Spanish authorities dismantled the "GXC Team" cybercrime syndicate, arresting its alleged leader, a 25-year-old Brazilian known as "GoogleXcoder." Operating as a Crime-as-a-Service (CaaS) provider, the group developed and sold AI-powered phishing kits, multiple Android malware strains, and social engineering voice-scam tools, primarily via Telegram and Russian-speaking hacker forums. Their phishing operations targeted financial, transport, and e-commerce institutions in Spain, Slovakia, the UK, the US, and Brazil, facilitating large-scale credential theft through more than 250 spoofed sites. Law enforcement recovered stolen cryptocurrency, seized electronic evidence, and shut down illicit channels. The investigation, enabled by forensic analysis of devices and crypto transactions, remains ongoing, with further arrests anticipated. This incident highlights the rise of CaaS platforms using automation, AI, and malware-as-a-service approaches to accelerate phishing and fraud at scale. The GXC Team case underscores the evolving sophistication and reach of these criminal ventures, which now target numerous sectors globally and leverage encrypted communications to obfuscate operations.
8 months ago
Kill Chain
Fake Inflation Refund Phishing Texts Target New Yorkers in 2025 Smishing Attack
In October 2025, a coordinated smishing campaign targeted New York State residents with fraudulent text messages purporting to be from the Department of Taxation and Finance. The attackers claimed recipients were eligible for an 'Inflation Refund' and directed them to a phishing site impersonating an official state portal, where victims were prompted to submit sensitive personal data—name, address, email, phone number, and Social Security Number—under the guise of processing their refund. This malicious operation seeks to steal identities and facilitate extensive financial fraud. Government officials swiftly issued warnings, clarifying that legitimate refunds required no action from residents and urging vigilance. This incident is a stark reminder of the increasing sophistication of SMS phishing (smishing) attacks, which blend timely government programs with social engineering techniques. The campaign highlights the persistent risk posed by identity-centric attacks, especially as digital fraudsters exploit widespread economic uncertainty and official-sounding initiatives.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports