Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
North Korean AkdoorTea Supply Chain Attack Hits Global Crypto Developers
In September 2025, a sophisticated supply chain attack targeting the global cryptocurrency development sector was uncovered, orchestrated by North Korea-linked threat actors associated with the Contagious Interview campaign. Leveraging a newly identified backdoor named AkdoorTea—as well as tools like TsunamiKit and Tropidoor—the adversaries compromised software development environments across all major operating systems, including Windows. According to research from ESET, tracked as part of the DeceptiveDevelopment group, attackers used trojanized developer tools and social engineering tactics to infiltrate their targets and facilitate lateral movement, data theft, and potential deployment of further malware within sensitive crypto-related projects. This incident highlights the rising trend of nation-state attackers exploiting software supply chains to infiltrate innovative sectors such as cryptocurrency. It underscores the urgent need for improved east-west traffic visibility, zero trust segmentation, and threat detection controls, as organizations increasingly become targets for persistent, highly resourced adversaries.
8 months ago
Kill Chain
Salesforce AI Prompt Injection Bug Exposes CRM Data in 2025 Breach
In September 2025, security researchers at Noma Security identified a critical vulnerability, termed ForcedLeak (CVSS 9.4), in Salesforce Agentforce, an AI-powered platform for constructing automation agents. The flaw allowed threat actors to launch indirect prompt injection attacks against Agentforce’s integration with Salesforce’s CRM, opening avenues for exfiltration of sensitive customer relationship data. The attack leveraged manipulated AI prompts that bypassed input validation, ultimately resulting in confidential business and customer information being at risk of exposure until Salesforce deployed a rapid patch. This incident highlights the growing risks stemming from AI prompt injection vulnerabilities as more enterprises embrace AI-integrated SaaS for customer-facing processes. The Salesforce episode underscores regulatory and security urgency to address trust boundaries around rapidly-evolving AI within business-critical platforms.
8 months ago
Kill Chain
Vane Viper Powers 1 Trillion DNS Queries in 2025 Malvertising Mega-Breach
In September 2025, the threat actor group known as Vane Viper was revealed to be operating a vast and covert ad fraud and malvertising network, leveraging a staggering one trillion DNS queries to enable malware distribution globally. According to a detailed Infoblox technical report, Vane Viper manipulated core internet infrastructure using shell companies and complex ownership structures to obfuscate responsibility and perpetuate malicious adtech practices. Their operations enabled widespread malvertising campaigns, significantly impacting advertising platforms and exposing users worldwide to illicit downloads and credential theft. This breach underscores a recent surge in the use of advanced DNS tunneling and obfuscation tactics in cybercrime, particularly within ad fraud and malvertising schemes. The incident exemplifies how attackers increasingly exploit foundational internet protocols, challenging traditional detection and defense measures while prompting urgent regulatory attention and industry-wide response.
8 months ago
Kill Chain
Cisco ASA Zero-Day (CVE-2025-20333) Breach: Inside the CISA Emergency Response
In September 2025, Cisco disclosed a critical zero-day vulnerability (CVE-2025-20333, CVSS 9.9) affecting its Secure Firewall Adaptive Security Appliance (ASA) and Threat Defense (FTD) Software. Attackers actively exploited improper input validation in the VPN web server, enabling them to bypass authentication and potentially gain unauthorized access to sensitive environments. Cisco urged immediate patching as exploitation was observed targeting both perimeter and internal firewalls, demonstrating advanced lateral movement strategies. This exploitation prompted an emergency mitigation directive from CISA to reduce risk across U.S. federal agencies and private enterprises. This incident underscores the ongoing evolution of threat actors leveraging zero-days to target critical infrastructure firewalls, coinciding with a nationwide spike in sophisticated, identity-driven attacks. Organizations are under increasing regulatory scrutiny to patch rapidly and advance segmentation, threat monitoring, and east-west traffic controls.
8 months ago
Kill Chain
Scattered Spider Ransomware: Teen Member Arrested, Group Claims Shutdown in 2024
In June 2024, law enforcement arrested a teenage member of the notorious Scattered Spider ransomware group, a cybercriminal collective linked to disruptive attacks against major organizations including MGM Resorts and Caesars Entertainment. The arrest followed claims by the group that it was shutting down operations amid heightened law enforcement scrutiny and infighting among its members. Scattered Spider became infamous for leveraging social engineering and identity-based attacks to gain initial entry, then rapidly moving laterally to deliver ransomware and conduct data theft. This latest development underscores the increasingly aggressive response from law enforcement to high-impact ransomware threats. The recent action highlights the continued evolution and volatility of ransomware groups, many of which are now using sophisticated identity compromise and cloud-based attack chains. Organizations should remain vigilant as law enforcement disruptions may cause threat actors to splinter, rebrand, or accelerate new attack campaigns using similar techniques.
8 months ago
Kill Chain
Webshells Hidden in .well-known Directories: The 2024 Web Application Attack Trend
In September 2024, cybersecurity researchers observed a surge in malicious actors targeting the .well-known directory on web servers to deploy PHP-based webshells. Attackers exploited this typically-overlooked directory, intended for status and authentication files, as it remains web-accessible but hidden within the Unix filesystem. Logs and honeypot data detailed repeated attempts to probe and establish footholds via .well-known and its subdirectories, such as acme-challenge and pki-validation, with the clear goal of persistent, covert remote control. This technique illustrates an evolving trend in web application attacks, where multistage threats exploit common web standards and overlooked controls. Organizations face heightened risk from such stealthy compromises, underscoring the need for continuous monitoring and adaptive defense in the current threat landscape.
8 months ago
Kill Chain
Stately Taurus: 2022 Bookworm APT Campaign Unveiled in Southeast Asia
In 2022, cybersecurity researchers traced sophisticated spear-phishing attacks against government and commercial entities in Southeast Asia to Stately Taurus, a Chinese advanced persistent threat (APT) group active since at least 2012. Using the Bookworm malware, a modular remote access trojan (RAT) with advanced C2 and lateral movement capabilities, the threat actor gained initial access via tailored phishing emails, followed by persistence and data exfiltration. Detailed code analysis, shared infrastructure, unique PDB paths, and parallel tooling (e.g., ToneShell) confirmed high-confidence attribution. The campaign exposed OPSEC artifacts and overlapping infrastructure, confirming Stately Taurus’s long-term commitment to targeted espionage. This incident underscores a broader surge in targeted APT campaigns using modular malware and sophisticated infrastructure reuse. The precision of the Unit 42 Attribution Framework exemplifies the growing emphasis on multi-layered, evidence-based attribution, which is now critical as state-linked groups automate and diversify their attack techniques.
8 months ago
Kill Chain
Cisco SNMP Zero-Day: Active Exploits Target IOS XE Network Devices in 2025
In September 2025, Cisco disclosed a critical vulnerability (CVE-2025-20352) affecting its IOS and IOS XE operating systems, actively exploited via the SNMP subsystem. The flaw stems from a stack-based buffer overflow that allows authenticated remote attackers to trigger denial-of-service or potentially achieve root-level remote code execution. Attackers utilized crafted SNMP packets over both IPv4 and IPv6 to compromise devices with SNMP enabled, including popular models like the Meraki MS390 and Catalyst 9300. Cisco confirmed attacks in the wild following credential compromise, urging immediate patching, as no reliable workarounds exist. This incident highlights the ongoing risks associated with ubiquitous network protocols like SNMP and the necessity of rapid response to zero-day exploits within core infrastructure. The rise of attacks targeting network management systems signals both increased attacker sophistication and heightened regulatory scrutiny.
8 months ago
Kill Chain
GitHub Notification Phishing Abuses Y Combinator Brand for Crypto Theft (2025)
In September 2025, a widespread phishing campaign exploited GitHub's notification system to target software developers for cryptocurrency theft. Attackers impersonated the reputable startup accelerator Y Combinator and generated hundreds of fake issue notifications across GitHub repositories, tagging users to trigger authentic-looking emails. Victims were lured to a spoofed Y Combinator website with a subtle domain misspelling, where they were prompted to connect cryptocurrency wallets for 'verification.' Behind the scenes, obfuscated scripts authorized malicious transactions, draining wallets once users signed in. The fraudulent repositories were quickly reported and taken down, but it's unclear how many users suffered financial losses. This attack highlights the growing trend of threat actors leveraging trusted platforms for sophisticated social engineering, particularly as notification-based phishing campaigns increase and cryptocurrency remains a lucrative target. The evolving tactics underscore the urgent necessity for enhanced vigilance, technical controls, and authentication checks across digital collaboration tools.
8 months ago
Kill Chain
PyPI Phishing Attack Exposes Open-Source Supply Chain in 2025
In September 2025, the Python Package Index (PyPI) suffered a targeted supply-chain phishing campaign, where threat actors impersonated PyPI via convincing emails and domain lookalikes (such as pypi-mirror.org). Attackers sent phishing emails to PyPI maintainers, warning of account suspension and requesting email verification. Unsuspecting victims who followed malicious links and entered credentials risked account compromise, enabling attackers to breach legitimate developer accounts. The likely aim was to either infect existing packages with malware or introduce new malicious packages into trusted software repositories, potentially impacting the broader Python ecosystem. This incident underscores the growing sophistication of software supply-chain threats, especially as open-source repositories face sustained phishing campaigns and credential harvesting tactics. As phishing campaigns increasingly target developers and critical infrastructure, strong phishing-resistant authentication and vigilant domain monitoring are now essential industry-wide defenses.
8 months ago
Kill Chain
Obscura Ransomware 2025: What Enterprises Must Learn About Active Directory Attacks
In late August 2025, a newly discovered ransomware variant named Obscura was identified executing across several hosts within an enterprise network. The attack leveraged the organization's Active Directory infrastructure, using the NETLOGON share to automatically deploy a Go-based ransomware binary across all domain controllers and affected endpoints. The attackers created malicious scheduled tasks for persistent execution and attempted to enable remote desktop for potential lateral movement. The ransomware also attempted to disable endpoint recovery options, and the ransom note indicated both data encryption and exfiltration of sensitive company information. Limited security agent coverage hampered detection and response, amplifying the operational disruption and risk of sensitive data exposure. This incident underscores the evolving sophistication of ransomware actors in targeting critical authentication infrastructure and automated deployment mechanisms. As attackers increasingly combine data theft with operational disruption and target identity systems, organizations face heightened regulatory, financial, and reputational risks, warranting renewed focus on segmentation, visibility, and endpoint security.
8 months ago
Kill Chain
Interpol's 2024 Crackdown: $439 Million Seized from Global Cybercrime Networks
In 2024, Interpol coordinated a global operation targeting cybercrime rings responsible for large-scale financial crimes. Over a period of five months, law enforcement agencies from 61 countries worked together to investigate and disrupt online scams that included business email compromise (BEC), investment fraud, romance scams, and e-commerce fraud. The operation resulted in the seizure of more than $439 million in cash and cryptocurrency, exposing elaborate money laundering networks and identifying approximately 1,300 suspects linked to cyber-enabled financial crime groups. Thousands of victims worldwide were impacted by these schemes. This incident highlights the growing sophistication and international reach of financially motivated cybercrime, as well as the increasingly effective law enforcement collaborations to disrupt illicit networks. The operation reflects a heightened urgency for organizations to strengthen controls against online fraud and cyber-enabled theft, as attackers continually evolve their tactics.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports