Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
US Government 2025 Shutdown: Cyber Intel Sharing and Defense at Risk
In October 2025, a US federal government shutdown led to the temporary lapse of critically important cyber threat information sharing, coinciding with the expiration of the Cybersecurity Information Sharing Act of 2015. As Congressional inaction prevented reauthorization, legal protections for companies sharing threat data vanished, making organizations hesitant or unable to exchange intelligence. Mass furloughs affected over 65% of Cybersecurity & Infrastructure Security Agency (CISA) personnel, and many critical contractors were released, significantly slowing incident response, vulnerability patching, and cross-sector collaboration. The resulting operational gaps increased the risk of adversaries targeting federal networks and exploiting unpatched vulnerabilities. This incident highlights the risks posed by government policy disruptions and shrinking cyber workforce capacity, underscoring how national cybersecurity posture is deeply interconnected with policy stability. Its relevance is underscored by mounting state-backed cyber threats, increased phishing targeting vulnerable personnel, and heightened urgency for robust identity and incident response controls.
8 months ago
Kill Chain
ShinyHunters Target Salesforce: Social Engineering Breach Exposes SaaS Security Gaps
In early 2024, Google’s Mandiant research team identified a targeted campaign by the ShinyHunters threat group leveraging advanced social engineering techniques against Salesforce environments. The attackers—tracked as UNC6040—used convincing phishing lures and manipulation of Salesforce user credentials to gain unauthorized access to sensitive corporate data. By circumventing authentication measures and exploiting insufficient internal network segmentation and monitoring, ShinyHunters exfiltrated confidential business records, customer data, and intellectual property. The breach highlighted the group’s evolving tactics and the risks posed to organizations that rely on cloud SaaS platforms like Salesforce for critical operations. This incident underscores the increasing sophistication of social engineering attacks, with criminals exploiting both technical and human vulnerabilities in cloud platforms. As SaaS adoption accelerates, similar threats are expected to rise, placing renewed emphasis on identity security, comprehensive threat detection, and adherence to zero trust principles.
8 months ago
Kill Chain
Red Hat's 2024 GitLab Breach: Supply Chain Risks and the Rise of Crimson Collective
In September 2024, Red Hat disclosed a breach of its self-managed GitLab instance used by its Consulting services, following claims by the Crimson Collective ransomware group of compromising over 28,000 private repositories. The attackers allegedly exfiltrated software source code and Customer Engagement Reports (CERs), which may contain network details, configuration data, and sensitive credentials. Red Hat initiated remediation steps and assured that its primary software supply chain and core products were not impacted. Belgian authorities warned of potential high-risk exposure for organizations with ties to Red Hat Consulting. This incident underscores a growing trend of supply chain attacks targeting private code repositories and related assets, especially in environments where critical infrastructure and third-party integrations are involved. As ransomware groups pivot to extortion and supply chain vectors, organizations must urgently review their repository and credential management, even on self-managed systems.
8 months ago
Kill Chain
Oracle 2025: Clop Ransomware Group Launches Extortion Campaign Against E-Business Suite Clients
In late September 2025, Oracle E-Business Suite customers were subjected to a wave of targeted extortion emails reportedly sent by threat actors aligned with the Clop ransomware group. The campaign leveraged hundreds of compromised legitimate third-party accounts to send messages claiming theft of customer data from Oracle environments. While Oracle confirmed the outreach and ongoing investigations, it did not specify which vulnerabilities were exploited nor confirm any customer data breach. Multiple Oracle E-Business Suite vulnerabilities, including remotely exploitable flaws, had been patched in July 2025, but ongoing research has yet to verify attack details or data loss. This incident is emblematic of the growing sophistication of financially motivated ransomware groups, who now often use large-scale phishing and extortion campaigns before confirming a breach. The campaign highlights increasing pressure on organizations to patch critical software rapidly and maintain heightened vigilance against social engineering, especially as adversaries leverage supply chain vectors and undermine trust with third-party compromise.
8 months ago
Kill Chain
How North Korean IT Workers Infiltrated Global Businesses: 2025 Insider Threat Surge
Between 2021 and mid-2025, North Korean nationals covertly infiltrated thousands of businesses worldwide by posing as legitimate remote IT and finance workers. According to Okta and other cyber threat intelligence sources, over 130 unique identities were linked to North Korean operatives who participated in more than 6,500 job interviews across roughly 5,000 companies, affecting industries from technology and finance to healthcare and manufacturing. The scheme enabled the North Korean regime to launder payments in violation of international sanctions, while threat actors refined methods to evade common screening controls and exploit global hiring pipelines. High volumes of applications, especially in remote roles, allowed these operatives to bypass national and enterprise-level defenses, embedding deeper into victim organizations’ critical workflows and data environments. The global expansion and sophistication of North Korea’s IT worker operation underscore a dangerous evolution in cyber-enabled insider threats and economic espionage. With a 220% increase in detected North Korean IT worker activity year-over-year, businesses worldwide now face heightened risk regardless of geography or sector, making identity vetting and remote work controls a top security priority.
8 months ago
Kill Chain
WestJet 2025 Data Breach: How Social Engineering and Remote Access Led to Massive Data Exposure
In June 2025, Canadian airline WestJet suffered a major data breach affecting approximately 1.2 million customers. Threat actors exploited social engineering to reset an employee’s password, gaining access through Citrix systems and compromising both Windows and Microsoft cloud networks. The attackers were able to exfiltrate sensitive personal data, including full names, dates of birth, physical addresses, passport or government IDs, travel information, rewards member data, and select customer service interactions. While no credit card numbers or passwords were disclosed, the incident required investigation by law enforcement and forced WestJet to notify affected users and authorities across North America, offering free identity monitoring. This breach highlights the growing effectiveness of identity-based attacks, particularly those leveraging social engineering to bypass traditional security controls via remote access platforms. With aviation and travel industries increasingly targeted, this incident underscores the urgent need for modern Zero Trust approaches and continuous monitoring of east-west traffic within enterprise networks.
8 months ago
Kill Chain
Allianz Life Data Breach 2025: Cloud CRM Attack Exposes 1.5 Million
In July 2025, Allianz Life, a major American insurance provider, suffered a significant data breach after threat actors—suspected to be part of the ShinyHunters extortion group—gained unauthorized access to a third-party cloud-based CRM system. The breach exposed sensitive personal information including names, addresses, dates of birth, and Social Security numbers for nearly 1.5 million individuals, encompassing customers, financial professionals, and employees. The incident was publicly disclosed shortly after it occurred, with Allianz confirming that Allianz SE, its global parent company, was not impacted. In response, Allianz initiated notifications to affected parties and regulatory authorities and is offering two years of free identity theft monitoring. This incident highlights the persistent risks posed by supply chain and third-party service vulnerabilities, especially as attackers increasingly target trusted cloud-based platforms such as Salesforce. The breach underscores the necessity for vigilant monitoring, rigorous access controls, and enhanced segmentation within cloud ecosystems for all organizations handling sensitive data.
8 months ago
Kill Chain
Klopatra Trojan: VNC-Powered Android Banking Attacks Sweep Europe in 2025
In March 2025, a newly identified Android trojan named Klopatra emerged, targeting over 3,000 devices across Europe by masquerading as a legitimate IPTV and VPN app. Researchers from Cleafy discovered that this banking and remote access trojan—believed to be operated by a Turkish-speaking cybercrime group—leveraged VNC-based remote control, overlay attacks, anti-analysis techniques, and Accessibility Service abuse to steal banking credentials, manipulate transactions, exfiltrate clipboard and keystroke data, and harvest cryptocurrency wallet information. The malware sidestepped Google Play protections by distributing its dropper app on unofficial websites and continuously evolving, with at least 40 builds detected since its appearance. This incident underscores the growing sophistication and adaptability of Android malware, including the deployment of advanced evasion techniques and real-time remote access capabilities. As mobile banking adoption rises globally, such attacks signal an urgent need for stronger app vetting, user awareness, and holistic endpoint security strategies in enterprise and consumer environments.
8 months ago
Kill Chain
Motility Software Suffers Major Ransomware Breach Impacting Over 766,000 Clients
In June 2024, Motility Software Solutions, a prominent provider of dealer management software, suffered a ransomware attack that resulted in the unauthorized access and exposure of sensitive data from approximately 766,000 clients. The attackers infiltrated Motility's networks, deployed ransomware to encrypt critical systems, and exfiltrated customer data, including personal and financial information. The attack caused significant operational disruptions for both Motility and its dealership clients, who rely on the platform for daily business operations. The incident highlights the persistent threat ransomware actors pose to software supply chains serving multiple downstream businesses. This breach is especially noteworthy amid an ongoing rise in ransomware targeting SaaS and vertical market providers, with attackers prioritizing data exfiltration for extortion. Regulators and business partners are increasing their demands for improved security controls and rapid incident disclosure, especially for service providers entrusted with large volumes of sensitive client data.
8 months ago
Kill Chain
Adobe Analytics 2025 Bug Exposes Cross-Tenant Tracking Data
In September 2025, an ingestion bug in Adobe Analytics caused cross-tenant data exposure, allowing customer tracking data from some organizations to appear in the analytics reports of others for nearly a day. The incident began on September 17 due to a performance optimization update that led to incorrect data values surfacing in Analysis Workspace reports. Approximately 3-5% of collected data—across Data Feeds, Live Stream, and scheduled reports—was impacted, with some fields being overwritten by data from other tenants. Adobe promptly reverted the change on September 18 and undertook remediation to cleanse datasets, advising customers to purge affected data from systems and backups to prevent further exposure. This incident underscores the risk posed by inadvertent data exposure within multi-tenant SaaS platforms and the criticality of robust data segregation and validation controls. With regulatory scrutiny over data privacy at an all-time high, such events illustrate how operational changes, even absent malicious intent, can have significant compliance and business ramifications for all affected customers.
8 months ago
Kill Chain
Ukraine 2025: CABINETRAT Backdoor Attack Leveraged Signal & XLL Add-ins
In September 2025, CERT-UA reported a targeted cyberattack campaign against Ukrainian organizations involving the CABINETRAT backdoor. The threat group tracked as UAC-0245 employed malicious Microsoft Excel XLL add-ins, disguised within ZIP archives distributed via Signal messenger, to covertly establish persistent backdoor access on victim systems. These XLL files, once executed, enabled attackers to conduct reconnaissance, data theft, and potential lateral movement inside compromised networks, raising concerns about operational disruption, espionage, and data confidentiality. This incident highlights the evolving threat landscape where adversaries leverage secure messaging platforms and file add-ins to bypass traditional email security and endpoint controls. The appearance of CABINETRAT underscores increasing sophistication in malware delivery and emphasizes the need for modern controls and East-West traffic visibility.
8 months ago
Kill Chain
Klopatra Android Banking Trojan Orchestrates VNC-Based Fraud in Spain and Italy
In August 2025, the Klopatra Android banking trojan was discovered by Cleafy, an Italian fraud prevention firm, after it compromised more than 3,000 smartphones—primarily in Spain and Italy. This sophisticated malware leveraged a hidden Virtual Network Computing (VNC) module that enabled threat actors to stealthily control infected devices remotely, bypassing traditional security measures and enabling real-time fraudulent activities. The attackers employed social engineering and malicious app delivery techniques to distribute the trojan, ultimately enabling the theft of sensitive banking credentials and direct manipulation of banking apps on compromised phones. The Klopatra campaign reflects the evolution of mobile threats in Europe, combining advanced remote access with banking-focused exfiltration. Its success underlines an urgent need for rigorous mobile device security as banking trojans rapidly adopt more covert control and anti-detection techniques.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports