Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 354 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 4237–4248 / 4903 reports
SonicWall Cloud Backup Breach: How State-Sponsored Attackers Exploited API Weaknesses in 2025
Computer/Network Security10 months ago

SonicWall Cloud Backup Breach: How State-Sponsored Attackers Exploited API Weaknesses in 2025

In September 2025, SonicWall confirmed that state-sponsored threat actors orchestrated a security breach targeting its cloud backup environment. The attackers exploited an API vulnerability to gain unauthorized access to firewall configuration backup files stored in a specific cloud deployment. SonicWall's investigation determined the breach was limited to the exposure of these configuration files, with no evidence of lateral movement or impact to production systems. The breach prompted immediate containment actions, disclosure to affected customers, and a global review of cloud access controls and incident response procedures. This incident underscores the increasing risk posed by sophisticated, nation-state adversaries targeting cloud environments and API endpoints. It highlights how misconfigurations and insufficient segmentation in cloud infrastructure can facilitate data exposure, driving industry-wide reassessment of cloud-native security and compliance practices.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
Malicious AI Extension Sneaks onto VS Code Marketplace in Supply Chain Breach (2024)
Computer Software/Engineering10 months ago

Malicious AI Extension Sneaks onto VS Code Marketplace in Supply Chain Breach (2024)

In early June 2024, a malicious extension possessing rudimentary ransomware functionality, allegedly built with the aid of artificial intelligence, was discovered in Microsoft's Visual Studio Code (VS Code) Marketplace. The extension leveraged VS Code's trusted distribution to sneak past safeguards and, once installed, had the capability to encrypt targeted user files and demand a ransom. This supply chain attack was detected before it could be widely abused, but it highlights how adversaries are using AI to generate and deploy sophisticated threats within software ecosystems. This incident demonstrates a growing trend where supply chain platforms, such as code repositories and marketplaces, are exploited to gain privileged entry within developer environments. The blending of AI-enabled malware automation and trusted application channels raises urgent visibility, compliance, and policy enforcement concerns for organizations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Curly COMrades Weaponize Hyper-V: How Linux VMs Helped Evade Detection in 2025 Breach
Information Technology/IT10 months ago

Curly COMrades Weaponize Hyper-V: How Linux VMs Helped Evade Detection in 2025 Breach

In October 2025, the advanced persistent threat group Curly COMrades launched a sophisticated attack campaign exploiting Windows Hyper-V virtualization to evade endpoint detection and response (EDR) solutions. By covertly enabling Hyper-V on targeted systems, attackers deployed a minimal Alpine Linux-based virtual machine (VM) hidden within Windows hosts. This VM served as an isolated enclave to execute custom malware and facilitate command-and-control activities, significantly complicating detection and forensics for defenders. Victims experienced unauthorized data access and increased potential for lateral movement, while standard EDR tools failed to monitor the malicious payloads running inside the guest VM. This attack highlights a growing trend of leveraging virtualization and container technologies to bypass security controls. As organizations increasingly adopt hybrid and multi-cloud environments, adversaries are developing novel methods to mask malicious operations from traditional detection mechanisms, underscoring the need for advanced visibility and zero trust segmentation.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Cisco Firewall DoS Attack: How CVE-2025-20333 & CVE-2025-20362 Disrupted Critical Networks
Financial Services10 months ago

Cisco Firewall DoS Attack: How CVE-2025-20333 & CVE-2025-20362 Disrupted Critical Networks

In November 2025, Cisco disclosed a vulnerability exploitation campaign targeting its Secure Firewall ASA and Threat Defense (FTD) devices. Threat actors actively weaponized two zero-day vulnerabilities, CVE-2025-20333 and CVE-2025-20362, to force vulnerable appliances to unexpectedly reload, resulting in denial-of-service (DoS) conditions that disrupted network operations. Affected organizations saw service disruptions, increased operational risk, and potential visibility gaps, especially where patch management or segmentation was lacking. Cisco responded by recommending immediate updates, enhanced monitoring, and deployment of compensating security controls until all devices are patched. This incident underscores a continuing trend of attackers rapidly exploiting unpatched firewall vulnerabilities, threatening the network perimeter’s reliability. The rise in sophisticated DoS tactics against infrastructure devices points to an urgent need for proactive patching, segmentation, and visibility into both perimeter and east-west traffic.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Credential Stuffing at Scale: 2 Billion Email Addresses and 1.3 Billion Passwords Exposed in 2025
Financial Services10 months ago

Credential Stuffing at Scale: 2 Billion Email Addresses and 1.3 Billion Passwords Exposed in 2025

In late 2025, a massive credential stuffing incident came to light when nearly 2 billion email addresses and 1.3 billion unique passwords – sourced over years from various cybercriminal forums and compromised stealer logs – were aggregated and indexed by Synthient, then processed by Have I Been Pwned (HIBP) for user notification. The dataset included credentials from countless breaches, consolidated into one of the largest exposures of its kind to date. While the original leaks stemmed from malware infections, phishing, and prior breaches, the impact was compounded by password reuse and the easy redistribution of these records in the criminal underground. HIBP took technical and privacy-preserving steps to verify and notify affected users while preventing further risk of data linkage. This incident illustrates the ongoing risks posed by credential stuffing and highlights the long lifecycle of exposed data as threat actors continuously recycle and combine compromised information. The event underscores the importance of password hygiene, multi-factor authentication, and proactive notification as recycled data fuels ongoing cyberattacks across industries.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Phishing Attack Delivers Kalambur Backdoor via Trojanized ESET Installers in Ukraine
Computer/Network Security10 months ago

Phishing Attack Delivers Kalambur Backdoor via Trojanized ESET Installers in Ukraine

In May 2025, a Russia-aligned threat group tracked as InedibleOchotense conducted a spear-phishing campaign targeting Ukrainian organizations. Attackers impersonated Slovak security company ESET, delivering phishing emails and Signal messages containing malicious links to trojanized ESET installers. When unsuspecting victims executed these files, a previously undocumented backdoor named Kalambur was installed, granting attackers covert access to compromised systems and enabling persistent network reconnaissance, command execution, and data exfiltration. The impersonation of a well-known cybersecurity firm lent the campaign added credibility, elevating its success rate and risk to targeted entities. This incident is a stark illustration of evolving phishing TTPs that exploit software supply chain trust and employ realistic impersonation. The campaign highlights the enduring threat posed by nation-state actors employing sophisticated lures, and underscores the urgent need for vigilant software validation, phishing awareness, and robust protective controls across organizations operating in high-risk geopolitical regions.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Coinbase Hit by 2024 Phishing Attack Orchestrated by Scattered Spider
Financial Services10 months ago

Coinbase Hit by 2024 Phishing Attack Orchestrated by Scattered Spider

In February 2024, cryptocurrency exchange Coinbase experienced a sophisticated phishing attack executed by the 0ktapus (Scattered Spider) threat actor. Attackers sent targeted SMS and email messages to select Coinbase employees, impersonating IT support and leveraging social engineering to harvest login credentials and multi-factor authentication codes. They subsequently accessed internal dashboards, potentially viewing sensitive customer data. Prompt monitoring enabled Coinbase’s security team to detect the unusual access and contain the breach before widespread damage occurred, mitigating customer impact and avoiding direct financial loss. This incident highlights the increasing sophistication of phishing campaigns targeting high-value organizations, particularly those with significant user assets like Coinbase. Advanced phishing, often enabled by multi-stage social engineering and MFA bypass techniques, is intensifying across critical sector organizations in 2024.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Bronze Butler Exploits Zero-Day to Breach Japanese Enterprise Networks
Government Administration10 months ago

Bronze Butler Exploits Zero-Day to Breach Japanese Enterprise Networks

In early 2025, Chinese state-sponsored APT group 'Bronze Butler' exploited a zero-day vulnerability (CVE-2025-61932) in a widely used endpoint management platform to penetrate several Japanese organizations. The attackers gained privileged access by leveraging the flaw for initial compromise, then established persistence and moved laterally across victims’ networks. Exfiltrated data included sensitive business documents and internal communications. The coordinated campaign went undetected for weeks, resulting in significant operational disruption and exposure of confidential assets, raising alarms about cyber-espionage threats facing Japan’s critical industries. This breach highlights the intensifying use of zero-day vulnerabilities by advanced threat actors for targeting supply chain software and trusted management tools. Similar recent attacks signal a broader trend of sophisticated, nation-state-driven intrusions against key sectors in Asia, and reinforce the urgent need for proactive patch management and stronger east-west network segmentation.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Multiple ChatGPT Security Bugs Expose User Data in 2023 OpenAI Breach
Financial Services10 months ago

Multiple ChatGPT Security Bugs Expose User Data in 2023 OpenAI Breach

In March 2023, OpenAI faced a significant application security incident involving multiple vulnerabilities within its flagship ChatGPT platform. Attackers exploited bugs that enabled prompt injection, retrieval of other users’ conversation histories, and potential bypassing of safety restrictions, exposing sensitive user data and proprietary prompts. These exploits, which allowed lateral movement and unauthorized data exfiltration, highlighted systemic issues in handling session tokens, API security, and isolation of user environments. The breaches forced OpenAI to temporarily take ChatGPT offline, conduct emergency patching, notify users, and engage external security review. The operational impact included reputational damage and increased regulatory scrutiny over cloud-based AI platforms’ data handling. This event underscores the growing risk as generative AI platforms become integral to business operations and personal productivity. The use of increasingly complex APIs and reliance on cloud-native architecture have introduced new attack surfaces, making timely detection and robust segmentation critical. Regulatory bodies and security practitioners now regard application-layer lateral movement and API leakage as top-tier threats, especially given AI’s centrality to enterprise workflows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
WhatsApp’s Screen-Sharing Feature: The 2024 Social Engineering Scam You Didn’t See Coming
Financial Services10 months ago

WhatsApp’s Screen-Sharing Feature: The 2024 Social Engineering Scam You Didn’t See Coming

In early 2024, a growing wave of cyber scams exploited WhatsApp’s new screen-sharing feature. Threat actors, posing as trusted contacts or customer support agents, lured victims into screen-sharing sessions under false pretenses—most often by claiming to offer help or resolve issues. Once shared, attackers gained access to sensitive information displayed on victims’ devices, including banking credentials and one-time passwords (OTPs), resulting in significant financial losses and compromised personal data. The scam’s speed and sophistication allowed fraudsters to bypass traditional awareness training and exploit even tech-savvy users. This incident highlights how social engineering threats adapt quickly to new app features, and underscores the need for rapid security responses. With mobile devices playing a pivotal role in personal and financial life, the exploitation of trusted communication platforms marks a critical evolution in phishing and remote fraud tactics.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Capital One’s 2019 Cloud Breach: Insider Threats & Misconfiguration Risks
Banking/Mortgage10 months ago

Capital One’s 2019 Cloud Breach: Insider Threats & Misconfiguration Risks

In 2019, Capital One suffered a major data breach when Paige Thompson, a former AWS engineer, exploited a cloud misconfiguration—specifically a poorly secured firewall running in Capital One's AWS environment—to access the personal information of over 100 million customers. The attacker leveraged insider knowledge and a misconfigured identity and access management policy to move laterally and exfiltrate sensitive data, including social security numbers and bank account details. The breach resulted in substantial financial costs, regulatory scrutiny, and reputational damage to Capital One, with Thompson ultimately convicted of wire fraud and computer intrusion. This incident remains relevant as organizations increasingly migrate to the cloud and face similar risks of configuration errors, compounded by the complexity of managing access controls and real-time monitoring in cloud-native infrastructures. The Capital One breach exemplifies the critical need for robust cloud security measures and continuous compliance with evolving regulatory requirements.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
US Sanctions North Korean Banks for Cryptocurrency Cybercrime in 2024
Banking/Mortgage10 months ago

US Sanctions North Korean Banks for Cryptocurrency Cybercrime in 2024

In May 2024, the U.S. Treasury sanctioned two North Korean banks and eight individuals believed to be heavily involved in high-profile cryptocurrency laundering operations linked to state-sponsored cybercrime. The sanctioned parties allegedly laundered millions of dollars in digital assets stolen through cyberattacks and IT worker fraud, often hiding illicit proceeds to evade international detection. North Korean operatives reportedly posed as legitimate IT contractors for Western firms to gain unauthorized access to sensitive systems and divert funds, fueling further malicious operations and funding government programs in Pyongyang. This incident exemplifies shifting tactics in cyber-enabled financial crime, where attackers exploit advanced laundering techniques and foggy compliance areas around cryptocurrency. The urgency of improved detection and policy enforcement is fueled by growing international regulatory pressure and the adaptation of state-sponsored groups to exploit digital infrastructure.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports