Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
2025 Red Hat OpenShift AI Vulnerability Exposes Hybrid Cloud to Full Takeover
In October 2025, a critical privilege escalation vulnerability was disclosed in Red Hat OpenShift AI, a popular platform for managing AI workloads across hybrid cloud infrastructures. The flaw allowed attackers to obtain elevated permissions and, under certain conditions, seize full control of affected environments. Security researchers identified that threat actors could exploit weak internal segmentation and misconfigurations within the AI lifecycle management layers, resulting in potential unauthorized lateral movement and broad operational impact across connected workloads. Red Hat promptly released advisories and patches, but organizations running unpatched versions remain at risk of infrastructure takeover and sensitive data exposure. This incident comes amid a surge in attacks targeting AI infrastructure and hybrid cloud environments, as adversaries increasingly exploit complex, interconnected platforms. The breach highlights the escalating risk posed by privilege escalation flaws in widely adopted enterprise AI solutions and underscores the urgent need for rigorous segmentation, threat detection, and rapid patch cycles.
8 months ago
Kill Chain
OneLogin 2025: OIDC/API Key Flaw Exposes Client Secrets to Attackers
In October 2025, a critical security vulnerability (CVE-2025-59363, CVSS 7.7) was disclosed in the One Identity OneLogin IAM platform. The flaw allowed threat actors to use compromised or exposed API keys to retrieve sensitive OpenID Connect (OIDC) application client secrets. Attackers exploiting this vulnerability could potentially impersonate trusted applications, resulting in unauthorized access to protected enterprise resources and disruption of identity-based authentication flows. OneLogin responded with a patch following public disclosure, but the exposure window placed numerous organizations at risk of credential theft and downstream compromise. This incident highlights persistent risks in identity and access management platforms, especially around API security and secret handling. Recent trends show attackers increasingly targeting IAM tools and exploiting weak OIDC/OAuth implementations, making robust zero trust segmentation, continuous threat monitoring, and compliance with established frameworks more critical than ever.
8 months ago
Kill Chain
Chinese APT Group Abuses VMware Privilege Escalation Flaw Throughout 2023
In 2023, sophisticated threat actors attributed to China exploited a previously unknown privilege-escalation vulnerability in VMware platforms for nearly a year before its discovery. Attackers leveraged this flaw, which appeared benign, to gain persistent and stealthy access to targeted virtual infrastructure. Their methods enabled lateral movement, data gathering, and privileged actions within highly segmented data center and cloud environments, affecting a broad range of organizations relying on virtualization for critical workloads. The long-term nature of the operation underscores challenges in detecting nation-state activity exploiting zero-day and privilege-related weaknesses. This incident highlights a broader escalation in advanced persistent threat (APT) campaigns targeting cloud and virtualization layers. As attackers increasingly exploit such integral software stacks with subtle techniques, organizations must reevaluate network segmentation, privilege management, and continuous monitoring to remain resilient.
8 months ago
Kill Chain
Klopatra: The Stealth Android Banking Trojan Draining European Accounts Overnight
In mid-2024, the Klopatra Android banking Trojan emerged as a major threat to mobile users in Italy and Spain. Disguised as the popular but illicit Mobdro streaming app, the malware leveraged social engineering tactics to trick users into granting dangerous Accessibility permissions. Once installed, Klopatra used advanced obfuscation, anti-analysis techniques, and commercial packers to avoid detection. Attackers remotely took control of compromised devices while users slept, using stolen credentials and simulated taps to access and empty bank accounts through a series of stealthy transfers—all while remaining undetected until victims discovered their losses in the morning. The Klopatra incident underscores a rising trend in real-time, remote-controlled mobile banking fraud, combining overlays, credential theft, and session manipulation. As attackers continue targeting mobile banking, organizations and end-users must adapt defenses to evolving TTPs and maintain vigilance toward app sideloading.
8 months ago
Kill Chain
China APT Launches Fileless, Precision Attack in 2024: Lateral Movement and Cloud Risk
In early 2024, an advanced persistent threat (APT) group dubbed 'Phantom Taurus,' believed to be affiliated with China, executed a sophisticated cyberattack targeting large enterprises in the finance and technology sectors. The attackers leveraged an in-memory, fileless backdoor ('IIServerCore') on Microsoft Windows servers to evade traditional detection, exploiting east-west traffic within cloud and hybrid environments. Initial access was likely gained through phishing and exploitation of public-facing applications, enabling lateral movement and persistent foothold. Impact included disruption of business operations, potential data exfiltration, and internal system compromise, with detection hampered by the backdoor's stealth techniques and encrypted command and control channels. This incident underscores an increasing trend of nation-state actors employing fileless malware and leveraging deep Windows system knowledge to bypass endpoint and network defenses. The use of advanced lateral movement tactics and persistent, in-memory attack tools highlights ongoing gaps in east-west cloud visibility and the urgency for zero trust segmentation across enterprise environments.
8 months ago
Kill Chain
Windows 10 EOL: The Mass Enterprise Vulnerability Surge of 2024
In October 2024, Windows 10—widely used across enterprise networks—will reach end-of-life, ceasing to receive security patches from Microsoft. This event will instantly triple the number of unsupported operating systems found within business environments, dramatically expanding the global attack surface. Cybercriminals are expected to exploit these 'undead' or unpatched devices by leveraging known vulnerabilities, conducting packet sniffing, lateral movement, and data exfiltration attacks—especially against organizations with poor segmentation and lacking egress enforcement. This shift is particularly significant as attackers increasingly target infrastructure vulnerabilities and exploit legacy systems. The upcoming EOL is driving regulatory attention and sparking urgent reviews of segmentation, east-west security, and encrypted traffic controls in enterprise risk postures.
8 months ago
Kill Chain
Broadcom Patches VMware NSX Flaws Flagged by NSA: What It Means for Cloud Security in 2024
In June 2024, Broadcom addressed two high-severity vulnerabilities in VMware NSX, originally discovered and reported by the U.S. National Security Agency (NSA). The flaws—tracked as CVE-2024-22246 (Local Privilege Escalation) and CVE-2024-22247 (Authentication Bypass)—could allow attackers to escalate privileges or bypass security controls on affected VMware NSX deployments. No evidence of exploitation in the wild has been reported, but these vulnerabilities could have enabled threat actors to move laterally, evade segmentation, and compromise critical virtualized environments if left unpatched. This disclosure comes amid heightened scrutiny of virtualization platforms used in cloud and hybrid infrastructures. As state actors increasingly target foundational cloud technologies and security researchers identify complex flaws, enterprises are pressed to maintain rapid patch cycles and review dependency trust, especially for technologies underpinning multi-cloud architectures.
8 months ago
Kill Chain
CISA: Critical Linux Sudo Vulnerability (CVE-2025-32463) Now Under Active Attack
In September 2025, cybersecurity authorities, including CISA, issued urgent warnings regarding a critical privilege escalation vulnerability (CVE-2025-32463) in the Linux sudo package. Attackers exploited this flaw to execute arbitrary commands with root-level privileges using the -R (--chroot) option even if the user was not listed in the sudoers file. The vulnerability, present in sudo versions 1.9.14 to 1.9.17 and discovered by Rich Mirch of Stratascale, went public with a proof-of-concept exploit shortly after its disclosure, facilitating active exploitation globally. Federal agencies were given a strict deadline to apply mitigations due to confirmed in-the-wild attacks. This incident underscores the persistent threat of privilege escalation in foundational system components and the risks posed by quickly weaponized exploits. The urgency reflects both the ease of exploitation and the wide adoption of vulnerable Linux versions, making rapid patching a critical imperative for organizations.
8 months ago
Kill Chain
Critical Remote Code Execution Vulnerability in WD My Cloud Devices Raises Security Stakes
In June 2024, Western Digital disclosed a critical security vulnerability in its My Cloud NAS devices, allowing unauthenticated remote attackers to execute arbitrary system commands via specially crafted HTTP requests. The exploited flaw, identified as CVE-2024-23333, affects multiple My Cloud firmware versions, exposing data and device functionality to full compromise. Western Digital released urgent firmware patches following the discovery, and no widespread exploitation was reported at the time of disclosure. However, researchers highlighted that remotely exploitable flaws in NAS devices pose significant risk for both individual and enterprise users who rely on these systems for data backup and storage. This incident underscores the growing prevalence of remote code execution vulnerabilities targeting storage infrastructure, particularly as attackers increase focus on internet-exposed edge devices. With data privacy regulations tightening and threat actors refining exploit automation, prompt patching and network segmentation are more critical than ever to prevent lateral movement and data exfiltration.
8 months ago
Kill Chain
Cisco Firewall Vulnerabilities: Nearly 50,000 Devices at Immediate Risk from Active Zero-Day Attacks
In September 2025, nearly 50,000 Cisco Adaptive Security Appliance (ASA) and Firepower Threat Defense (FTD) firewalls exposed to the public internet were found to be vulnerable to two critical zero-day flaws: CVE-2025-20333 and CVE-2025-20362. These vulnerabilities enabled remote, unauthenticated attackers to execute arbitrary code and access restricted VPN-related endpoints. Ongoing exploitation began before patches became available, targeting government and enterprise networks worldwide. Threat actors deployed custom malware (Line Viper) and a GRUB bootkit (RayInitiator), prompting emergency directives from agencies like CISA for immediate patching and device removal, especially for unsupported hardware. The lack of effective patch management and delayed response increased risk of network breaches, lateral movement, and data exfiltration. This incident underscores the persistent threat of infrastructure vulnerabilities and rapid weaponization of zero-day flaws targeting critical networking equipment. With attackers increasingly automating reconnaissance and exploitation, organizations face mounting regulatory and business pressure to maintain timely patching, robust monitoring, and segmented security controls.
8 months ago
Kill Chain
MatrixPDF: How Advanced PDF Phishing Kits Are Bypassing Security in 2025
In September 2025, security researchers uncovered the MatrixPDF toolkit—an advanced phishing and malware distribution tool that leverages benign-looking PDF files to lure victims into credential theft or malware downloads. MatrixPDF allows attackers to embed JavaScript, blur sensitive fields, and add deceptive overlays within imported PDFs, guiding users to external phishing sites or payloads. Sold via cybercrime forums and Telegram for up to $1,500/year, MatrixPDF's PDFs can bypass popular email gateways, including Gmail, exploiting the trust users place in PDF attachments and the limits of email filtering. The primary impact is the heightened risk of successful phishing and malware campaigns targeting enterprises and individuals, resulting in potential credential compromise and further lateral movement. MatrixPDF exemplifies the growing sophistication of cybercriminal DIY toolkits and their focus on evading modern email defenses through social engineering and weaponized, interactive documents. This shift highlights the ongoing arms race between attackers engineering for delivery success and defenders developing detection tactics for multi-layered, context-aware threats.
8 months ago
Kill Chain
WestJet Data Breach 2025: Passport Info Exposed in Major Airline Cyberattack
In June 2025, Canadian airline WestJet revealed a cybersecurity breach that resulted in the exposure of sensitive customer information, including names, dates of birth, mailing addresses, travel documents such as passports and government IDs, requested accommodations, complaints, and loyalty program data. The breach, disclosed after disruptions to internal systems and the company’s mobile app, was investigated over several months, with findings confirmed in mid-September. While no official attribution has been confirmed, the notorious Scattered Spider threat group was active in targeting the aviation industry at the time. The FBI is assisting with the investigation, and all affected customers have been notified. This breach is of significant concern as it exemplifies the intensifying targeting of travel and aviation sectors by sophisticated threat actors using advanced social engineering and credential-harvesting techniques. The incident also underscores increasing regulatory scrutiny and customer awareness around identity-related attacks and privacy risks in critical infrastructure industries.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports