Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4903 threat reports
Page 359 of 409
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 4297–4308 / 4903 reports
TruffleNet Attack Highlights Urgent AWS Cloud Credential Risks
Financial Services10 months ago

TruffleNet Attack Highlights Urgent AWS Cloud Credential Risks

In early 2024, a sophisticated campaign dubbed 'TruffleNet' leveraged stolen credentials to infiltrate Amazon Web Services (AWS) environments. Attackers, believed to leverage components of TruffleHog, obtained valid credentials via phishing and credential theft, bypassing weak controls to gain access to cloud accounts. Following initial compromise, the threat actors engaged in reconnaissance, lateral movement, and business email compromise (BEC) activities, exploiting privileges to move within the cloud infrastructure and exfiltrate sensitive data. The incident resulted in significant risk of data loss and operational disruption for affected organizations, highlighting the dangers of identity-based attacks in cloud environments. This attack reflects an escalating trend of attackers targeting cloud platforms through abused credentials and automated open-source tooling. Organizations face increased regulatory scrutiny and operational risk, underscoring the critical need for zero trust segmentation, strong identity controls, and real-time monitoring of cloud platforms.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
WSUS CVE-2025-59287: Mass Scanning and Rapid Exploitation Threaten IT Infrastructure
Government Administration10 months ago

WSUS CVE-2025-59287: Mass Scanning and Rapid Exploitation Threaten IT Infrastructure

In late October and early November 2025, security researchers observed a marked uptick in external scans targeting ports 8530/TCP and 8531/TCP, which are related to Microsoft Windows Server Update Services (WSUS). These scans were linked to the rapid exploitation of CVE-2025-59287, a critical vulnerability allowing remote attackers to execute unauthorized scripts on vulnerable WSUS servers. Threat actors leveraged both encrypted (TLS) and unencrypted channels, beginning with reconnaissance sweeps and quickly escalating to full network compromise of exposed endpoints. Given the public availability of exploit details and the speed of attacks, organizations with exposed WSUS servers have likely suffered unauthorized access or larger breaches. This incident highlights a surge in opportunistic exploitation of newly disclosed vulnerabilities, particularly affecting critical IT infrastructure. The level of automated scanning and rapid weaponization is emblematic of a broader trend: attackers systematically hunting for internet-exposed administration interfaces and supply-chain services, increasing regulatory and operational risks for enterprises.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
University of Pennsylvania Breach Exposes 1.2 Million Donor Records in 2024
Higher Education/Acadamia10 months ago

University of Pennsylvania Breach Exposes 1.2 Million Donor Records in 2024

In June 2024, a hacker claimed responsibility for breaching the University of Pennsylvania, exposing sensitive information on approximately 1.2 million donors as well as internal documentation. The threat actor infiltrated the university's IT environment, potentially exploiting weaknesses in data encryption and network segmentation. The attack resulted in the unauthorized access and potential leak of donor personal details, which could include names, contact information, and possibly financial data. The incident became publicly known after a 'We got hacked' email was sent from university channels, alerting stakeholders to the scale of the compromise. This incident highlights the increasing prevalence of large-scale data breaches targeting higher education and non-profit institutions. As threat actors employ more advanced techniques to exploit internal network gaps, organizations face mounting regulatory pressure to strengthen defenses and prevent sensitive data exposure.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Open VSX Access Token Leak Triggers 2024 Supply-Chain Security Incident
Computer Software/Engineering10 months ago

Open VSX Access Token Leak Triggers 2024 Supply-Chain Security Incident

In early June 2024, the Open VSX Registry—a key open-source repository for Visual Studio Code extensions—rotated its access tokens after developers inadvertently leaked credentials in public repositories. This exposure enabled unauthorized actors to publish malicious extensions, triggering a supply-chain attack that could have allowed widespread compromise of downstream developers and end users. Upon discovery, Open VSX revoked and replaced the affected tokens, advised pruning of potentially impacted extensions, and began audits to assess the scope of any malicious uploads. While swift action was taken, the incident highlighted ongoing risks associated with leaked credentials in public codebases and the challenges of securing distributed developer ecosystems. This supply-chain breach is highly relevant amid a surge in attacks abusing public software repositories and developer credentials. As threat actors increasingly target development tooling and code packages, organizations face rising pressure to enhance security around code signing, credential management, and extension vetting to reduce systemic software supply-chain risk.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
China-Linked Bronze Butler Exploits Lanscope Zero-Day for Cyber-Espionage in 2024
Government Administration10 months ago

China-Linked Bronze Butler Exploits Lanscope Zero-Day for Cyber-Espionage in 2024

In early 2024, China-linked APT group Bronze Butler (also known as Tick) exploited an undisclosed zero-day vulnerability in Motex Lanscope Endpoint Manager to deploy an upgraded version of its Gokcpdoor malware. The attackers leveraged this flaw to gain initial access and establish persistent footholds in targeted organizations, primarily for cyber-espionage purposes. Security researchers confirmed that the intrusion campaigns targeted East Asian entities and potentially exfiltrated sensitive data before the vulnerability was publicly disclosed and patched. The attack underscores the evolving sophistication of state-sponsored actors in weaponizing software supply chain vulnerabilities for stealthy intrusion. This incident exemplifies a broader surge in zero-day exploitation by nation-state actors, as well as a growing focus on endpoint management software as an attack vector. It highlights the urgent need for organizations to patch promptly, monitor lateral network traffic, and implement defense-in-depth strategies that reduce dwell time and lateral movement opportunities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
Nation-State Actors Infiltrate Ribbon Communications: 2024’s Latest APT Assault on US Telecom
Telecommunications10 months ago

Nation-State Actors Infiltrate Ribbon Communications: 2024’s Latest APT Assault on US Telecom

In December 2023, Ribbon Communications, a major US telecommunications provider, suffered a cyber intrusion attributed to suspected nation-state actors. Attackers gained unauthorized access to parts of the company’s internal network, leveraging advanced persistent threat (APT) techniques to bypass existing security controls and maintain sustained access over several months. Although Ribbon discovered the breach and contained it by early 2024, the company has not confirmed whether sensitive customer or operational data was exfiltrated. The incident has raised concerns about the vulnerability of critical telecom infrastructure to espionage and cyber-enabled disruption. This breach exemplifies the escalating cyber risk telecoms face from organized, highly sophisticated attackers targeting supply chains and core communications platforms. With the telecommunications sector increasingly in the crosshairs of state-sponsored actors, the event spotlights the urgent need for zero trust, segmentation, and advanced detection controls.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
Conti Ransomware Operator Arrested: International Crackdown on Cybercrime in 2024
Government Administration10 months ago

Conti Ransomware Operator Arrested: International Crackdown on Cybercrime in 2024

In July 2023, Ukrainian national Oleksii Oleksiyovych Lytvynenko, also known as Alexsey Alexseevich Litvinenko, was arrested in Ireland and later extradited to the United States on charges linked to his involvement with the notorious Conti ransomware group. Lytvynenko and his alleged co-conspirators infiltrated computer networks, stole and encrypted large quantities of sensitive data, and extorted ransom payments from over 1,000 victims worldwide—impacting public safety organizations and businesses across more than 30 countries. The group’s methods included stealing data, deploying ransomware, disseminating ransom notes, and leaking stolen information to force compliance. This case underscores the persistent threat posed by ransomware groups and highlights the evolving tactics attackers use, including rebranding after group takedowns. Lytvynenko’s prosecution demonstrates strengthened international law enforcement cooperation in cybercrime response, reinforcing the urgency for robust cyber defenses in the face of global ransomware operations.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Extradition of Ukrainian Conti Ransomware Operator Marks Major 2024 Cybersecurity Win
Financial Services10 months ago

Extradition of Ukrainian Conti Ransomware Operator Marks Major 2024 Cybersecurity Win

In 2024, a Ukrainian national suspected of being a key member of the notorious Conti ransomware group was extradited from Ireland to the United States to stand trial. US authorities allege that the individual played a significant role in orchestrating and facilitating ransomware campaigns, which involved infiltrating business environments, moving laterally, and deploying ransomware to encrypt and extort high-profile organizations. The impact of these attacks has included major operational shutdowns, data exfiltration, and significant financial losses for victims across multiple sectors, with the incident underscoring the persistent reach and operational capability of sophisticated cybercrime syndicates. This case is emblematic of a global crackdown on ransomware actors and highlights the growing cooperation between international law enforcement agencies. The continued prevalence of ransomware-as-a-service models, coupled with advances in digital forensics and extradition protocols, makes this arrest—and those likely to follow—a critical signal in the ongoing fight against organized cybercrime.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Australia Warns: BadCandy Infects Unpatched Cisco IOS XE Devices in 2024
Telecommunications10 months ago

Australia Warns: BadCandy Infects Unpatched Cisco IOS XE Devices in 2024

In June 2024, Australian cybersecurity authorities issued urgent warnings regarding ongoing cyberattacks targeting unpatched Cisco IOS XE devices across the country. Threat actors exploited known vulnerabilities to install the BadCandy webshell, enabling persistent, covert access to network infrastructure. Once a device was compromised, attackers leveraged the foothold for lateral movement, unauthorized surveillance, and potentially for command-and-control activities, putting government entities, businesses, and ISPs at risk. The infections are widespread and ongoing due to delayed patching and lack of robust segmentation. This incident highlights an increasing trend of sophisticated exploitation of edge network devices, demonstrating attackers’ focus on device-level vulnerabilities and lateral movement methods. The urgency is heightened by the scale and automation of attacks and the continued use of vulnerable systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Ransomware Gangs Exploit Critical Linux Kernel Flaw in 2024 Attacks
Financial Services10 months ago

Ransomware Gangs Exploit Critical Linux Kernel Flaw in 2024 Attacks

In early 2024, a high-severity privilege escalation vulnerability (CVE-2024-1086) in the Linux kernel was actively exploited by multiple ransomware gangs, as confirmed by CISA. Attackers used the flaw to gain root access on targeted Linux systems, bypassing standard user restrictions. This escalation provided threat actors the means to deploy ransomware payloads, encrypt files, and cripple business operations across sectors relying on Linux servers. The attack chain typically started with initial compromise of a Linux system, followed by privilege escalation and lateral movement, exposing organizations to data loss and downtime. This incident underscores the growing trend of ransomware operators targeting critical open-source infrastructure through recent or unpatched vulnerabilities. Organizations must adapt their security posture rapidly, as evidence of weaponization demonstrates that patching and vigilant privilege management remain urgent for foundational platforms like Linux.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CISA Flags China-Linked APT Exploitation of VMware Zero-Day (CVE-2025-41244)
Information Technology/IT10 months ago

CISA Flags China-Linked APT Exploitation of VMware Zero-Day (CVE-2025-41244)

In October 2025, a critical zero-day vulnerability, CVE-2025-41244, affecting VMware Aria Operations and VMware Tools was actively exploited by a China-linked Advanced Persistent Threat (APT) group. The attackers leveraged this flaw to achieve remote code execution within enterprise environments, bypassing authentication on exposed VMware instances. Initial access was typically gained via internet-facing management interfaces, followed by lateral movement to access sensitive data and systems. The incident prompted the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, highlighting the rapid operational impact and the potential for widespread compromise in cloud and hybrid infrastructures. This breach exemplifies the ongoing risk posed by state-sponsored actors exploiting enterprise software supply chain gaps and underscores the need for rigorous patch management and segmentation. Organizations face renewed urgency as attackers increasingly focus on high-value cloud platforms, driving heightened regulatory scrutiny and reinforcing the importance of visibility and agility in security operations.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Eclipse Foundation Supply Chain Risk: Open VSX Token Exposure Sparks Security Response
Computer Software/Engineering10 months ago

Eclipse Foundation Supply Chain Risk: Open VSX Token Exposure Sparks Security Response

In June 2025, the Eclipse Foundation, custodians of the Open VSX open-source project, took immediate remedial action after Wiz security researchers reported that authentication tokens had been unintentionally leaked in several Visual Studio Code (VS Code) extensions across official marketplaces. These exposed tokens could have allowed malicious actors to tamper with extensions, inject malicious code, or compromise downstream developer environments. Upon validation, the Eclipse Foundation promptly revoked a limited set of impacted tokens and notified affected extension maintainers, mitigating potential risks before evidence of active exploitation surfaced. This event underscores the inherent risks in software supply chains, particularly in widely-used open-source development tools. Software supply chain vulnerabilities remain a top concern for enterprises as development workflows increasingly depend on publicly distributed packages and extensions. The growing adoption of open-source ecosystems means that even small credential leaks can impact thousands of users, driving new urgency for continuous monitoring and proactive threat detection.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports