Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Ransomware's New Playbook: 2024 Sophisticated Extortion Hits Major Enterprises
In early 2024, a prominent enterprise fell victim to a highly sophisticated ransomware attack orchestrated by the notorious LockBit gang. Attackers gained entry through compromised credentials, swiftly encrypting critical systems and demanding a $30 million ransom within 72 hours, threatening public data exposure. The perpetrators leveraged professional, SaaS-style operations, exploiting sensitive internal documentation—such as financials and cyber insurance details—to tailor their extortion tactics. Business operations were severely disrupted as the company rushed to contain the breach, initiate crisis response procedures, and engage third-party negotiators. This incident underscores the growing maturity of ransomware groups, who now use advanced negotiation and psychological tactics alongside technical exploits. The increased reliance on credential theft and swift lateral movement, combined with extortion strategies targeting both IT infrastructure and organizational psychology, reflects a broader trend impacting all sectors.
8 months ago
Kill Chain
Salesloft's GitHub Compromise Sparks 2024 Supply Chain Breach
In early 2024, Salesloft experienced a significant cybersecurity breach after attackers compromised a developer's GitHub account. By exploiting weak authentication protocols, threat actors were able to steal OAuth tokens, which enabled them to access and manipulate connected Salesforce instances of downstream customers, resulting in a widespread supply chain attack. The attackers leveraged their foothold to propagate malicious code and gain privileged access to hundreds of enterprise environments, exposing sensitive data and business operations across multiple organizations. This incident highlights the escalating risk presented by software supply chain attacks, particularly those exploiting code repositories and third-party integrations. It underscores the urgent need for organizations to implement strong access controls, enforce zero trust principles, and continuously monitor code and account activity in their development workflows.
8 months ago
Kill Chain
45 New Domains Fuel Salt Typhoon's Stealthy APT Campaign (2024)
In mid-2024, security researchers uncovered that the China-based Advanced Persistent Threat group Salt Typhoon (UNC4841) had deployed 45 new domains and previously undiscovered infrastructure to facilitate persistent, stealthy compromises of targeted organizations. Exploiting their advanced tradecraft, Salt Typhoon gained and maintained long-term access undetected, leveraging encrypted traffic and lateral movement techniques. The attacks primarily targeted sectors with sensitive data and critical infrastructure, amplifying operational and reputational risk for the victims. The campaign demonstrates ongoing actor adaptation and the challenges of detecting covert infrastructure expansion. This incident is especially relevant as organizations face a surge in nation-state actor activity leveraging novel infrastructure and sophisticated evasion methods. The discovery highlights the evolving threat landscape, where increased regulatory pressure and cloud adoption make comprehensive visibility and proactive response capabilities more critical than ever.
8 months ago
Kill Chain
2025 NPM Supply Chain Breach: Phishing Attack on JavaScript Developer Risks Crypto Theft
In September 2025, a targeted supply chain attack compromised at least 18 widely used JavaScript packages on the NPM repository after a key developer, Josh Junon, was phished. The attackers created a convincing fake NPM login website, stealing both credentials and a one-time 2FA token to access the developer's account. They injected malicious code into popular packages, enabling browser-based interception of cryptocurrency transactions and redirection of funds to attacker-controlled wallets. The breach was discovered rapidly by Aikido, which alerted the maintainer, enabling a swift cleanup and limiting broader damage. This incident underscores the persistent risks lurking in open-source software supply chains, particularly as threat actors evolve their tactics to bypass conventional security controls using phishing and social engineering. The rapid containment averted a potentially devastating impact, but the episode highlights ongoing vulnerabilities in software ecosystems reliant on centralized package maintainers.
8 months ago
Kill Chain
MostereRAT Malware: New Era of EDR Bypass and Persistent Threats
In 2024, security researchers uncovered a sophisticated campaign deploying the 'MostereRAT' malware against Windows environments. The threat actor used advanced techniques to deliver an EDR (Endpoint Detection and Response)-killing tool, enabling long-term, covert persistence on infected systems. MostereRAT blends into legitimate network traffic, leverages encrypted channels, and systematically disables or bypasses security controls, making detection and remediation difficult. Impacted organizations faced risks of data exfiltration, lateral movement, and significant business disruption, with attackers maintaining access for extended periods before discovery. This incident highlights the increasing prevalence of anti-EDR malware designed to counter modern defensive capabilities. As organizations adopt stronger endpoint security, attackers are deploying stealthier, more evasive malware, presenting ongoing challenges for incident detection, compliance, and cyber resilience.
8 months ago
Kill Chain
Logit-Gap Steering: New Jailbreak Threat Undermines LLM Security in 2024
In mid-2024, academic security researchers unveiled a novel attack against large language models (LLMs) termed "logit-gap steering." This technique exploits the mathematical limits of alignment training by manipulating the logits—the raw output probabilities—of refusal and affirmation tokens. Attackers found that by identifying and minimizing the gap through tailored prompt suffixes, they could frequently bypass internal model guardrails and elicit harmful or disallowed responses, even on the latest open-source models such as gpt-oss-20b, LLama, Gemma, and Qwen. The published methodology demonstrated over 75% attack success rates and triggered industry-wide concern about the resilience of current AI safety controls. This incident comes at a pivotal time as organizations accelerate adoption of AI and generative language models in production. The research spotlights a significant, previously underestimated vector for LLM jailbreak attacks, amplifying regulatory scrutiny and forcing enterprises to re-evaluate security practices for AI deployments.
8 months ago
Kill Chain
2025 Retail Salesforce Data Heist: Extortion Attack Exposes Cloud Security Gaps
In mid-2025, a sophisticated data extortion campaign targeted high-end retail organizations leveraging Salesforce environments. Threat actors—identified as UNC6040 (responsible for access and reconnaissance) and Bling Libra (aka ShinyHunters, handling extortion)—gained initial access through voice-based phishing (vishing) techniques. After establishing a foothold, they conducted in-depth reconnaissance to collect sensitive customer data, including names, birthdates, contact details, and account metadata, which was then exfiltrated. The attackers threatened public disclosure unless the victim organizations paid a ransom, all while leaving minimal forensic traces due to a lack of malware deployment and custom tools. This incident highlights the increasing sophistication of financially motivated cybercrime operations and an industry-wide shift towards data theft extortion without ransomware. There is an urgent need for retail and cloud-reliant enterprises to reassess their security controls, as social engineering vectors bypass traditional perimeter defenses and regulatory scrutiny around cloud data protections intensifies.
8 months ago
Kill Chain
Remote Code Execution via Model Namespace Reuse Hits AI Supply Chains
In early 2024, security researchers identified a novel AI supply-chain attack involving 'model namespace reuse' on popular machine learning platforms such as Hugging Face. Threat actors exploited the inherent trust in model names and namespaces to upload malicious AI models, thereby enabling remote code execution upon download or integration into downstream applications. The attack allowed adversaries to compromise systems within seconds of a user or developer integrating tainted models, potentially resulting in data breach, lateral movement, or disruption of AI-driven business processes. This incident underscores the growing risk within the AI and ML ecosystem, where reliance on third-party and community-contributed models is accelerating. As more organizations rapidly adopt AI across production workloads, supply-chain vulnerabilities like namespace reuse present urgent challenges for security and compliance.
8 months ago
Kill Chain
Sextortion at Scale: Lessons from 1,900 Cryptocurrency Extortion Emails (2021–2025)
Between June 2021 and August 2025, researchers analyzed nearly 1,900 sextortion emails sent globally as part of orchestrated financial extortion campaigns. Threat actors leveraged email as the primary attack vector, issuing blackmail demands and requesting payments to over 200 unique cryptocurrency addresses (primarily Bitcoin). The attackers frequently rotated wallet addresses to hinder tracing, with most being active for only a few days. While 28% of the wallet addresses received no payments, the majority collected varied sums, with a median received amount of approximately $4,315 per address; a handful captured large sums exceeding $75,000. These campaigns underline the continuing prevalence and evolution of cryptocurrency-enabled extortion tactics. Sextortion remains a persistent cybercrime threat, with campaigns adapting to changes in cryptocurrency use and email security. Recent analysis suggests a downward trend in victim willingness to pay, potentially reflecting higher user awareness and stronger resilience to such scams, but attackers are refining techniques to maintain extortion income.
8 months ago
Kill Chain
The New Insider Threat: How a Fake Employee Infiltrated a Tech Giant in 2025
In August 2025, an advanced cyberattack targeted a major tech company when an attacker successfully joined the organization as a new employee using a fabricated identity, bypassing digital and in-person HR and IT onboarding checks. The attacker, under the alias 'Jordan from Colorado,' leveraged expertly forged credentials and references to gain legitimate system access and privileges from day one. Once inside, the attacker rapidly accessed sensitive data, established lateral footholds through internal network movement, and deployed covert remote access tools. The business suffered significant intellectual property theft and operational disruptions before the activity was detected during a routine audit. The incident demonstrates a rising trend in identity-based infiltration, where social engineering is used not to breach perimeters but to abuse trusted onboarding processes. This kind of attack highlights the urgent need for organizations to modernize identity verification and insider threat detection in response to sophisticated credential fraud and evolving attacker tradecraft.
8 months ago
Kill Chain
Gambler Panel: The Rise of Affiliate-Driven Scam Gambling Operations in 2025
In July 2025, researchers uncovered a rapid proliferation of fraudulent online gambling platforms connected to a Russia-based affiliate operation called 'Gambler Panel.' This scheme enables thousands of affiliates to launch polished scam gambling sites using a turnkey fake casino engine and aggressive social media lures—often involving fraudulent endorsements and false claims of free credits. Victims are tricked into making cryptocurrency 'verification deposits' which are subsequently stolen, with attempts to cash out consistently denied. The operation is highly organized, offering detailed playbooks and infrastructure supporting over 1,200 domains run by a network of more than 20,000 affiliates. This incident highlights a new, scalable model for financial fraud: cybercriminals outsourcing risk and execution to large affiliate networks via sophisticated, multi-platform campaigns. The case underscores the dangers posed by accessible, turnkey scam infrastructure and the challenges organizations face in monitoring affiliate-driven threat activity targeting consumers globally.
8 months ago
Kill Chain
Sitecore Zero-Day Breach: ViewState Exploits Lead to Remote Code Execution
In early 2024, threat actors exploited a zero-day vulnerability in Sitecore's ASP.NET-based content management system by weaponizing exposed machine keys, enabling remote code execution via malicious ViewState deserialization. Attackers bypassed authentication controls to inject arbitrary code and gain persistent control over vulnerable web servers, leading to potential data exfiltration and site takeover. Multiple Sitecore installations globally were at risk, highlighting weaknesses in secure key management and web application security monitoring. Organizations faced reputational and operational impacts as attackers abused trusted digital experiences to deliver malware and conduct further intrusions. The incident is part of a broader surge in deserialization and code injection attacks targeting legacy .NET applications. Zero-day exploitation against business-critical CMS platforms increases urgency for robust segmentation, runtime detection, and zero trust controls to defend against rapidly evolving attack techniques.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports