The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4731 threat reports
Page 365 of 395
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 4369–4380 / 4731 reports
FBI Disrupts BreachForums Data Extortion Portal Tied to Salesforce Attacks
Computer Software/Engineering9 months ago

FBI Disrupts BreachForums Data Extortion Portal Tied to Salesforce Attacks

In October 2025, the FBI, in collaboration with French authorities, seized the BreachForums portal used by the ShinyHunters and associated groups as a data leak extortion site in the wake of major Salesforce data theft attacks. The cybercriminals, operating as Scattered Lapsus$ Hunters, leveraged the platform to pressure prominent organizations—including FedEx, Disney, Google, and others—by threatening to leak over a billion customer records unless ransom demands were met. While the clearnet site is now under law enforcement control, the attackers continue extortion efforts via their dark web presence, asserting that Salesforce campaign leaks will proceed for non-compliance. This incident underscores evolving methods of data extortion and the resilience of threat actors despite law enforcement crackdowns. It highlights the growing trend of targeting SaaS providers, the strategic use of underground forums for large-scale data extortion, and the ongoing cat-and-mouse dynamic between cybercriminals and authorities.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Apple Bug Bounty Shatters Records: $2M Now Offered for Zero-Click RCE Vulnerabilities
Computer Software/Engineering9 months ago

Apple Bug Bounty Shatters Records: $2M Now Offered for Zero-Click RCE Vulnerabilities

In June 2024, Apple significantly enhanced its bug bounty program, now offering up to $2 million for zero-click Remote Code Execution (RCE) vulnerabilities — the highest payout in the industry to date. This expansion includes new research categories and a more transparent reward structure aimed at encouraging security researchers to responsibly disclose critical flaws, particularly those enabling attackers to compromise devices without user interaction. The move comes amid heightened concerns over sophisticated exploits, such as NSO Group’s Pegasus, which have targeted Apple’s platforms using zero-click attack chains that can bypass traditional security controls, threatening the confidentiality and security of end-users and enterprise data. The immediate relevance of Apple's program expansion is twofold: it recognizes the rapid evolution of threat actor capabilities and underscores the urgent need for robust vulnerability disclosure programs. As zero-click exploits gain momentum among both state actors and cybercriminals, organizations face increased regulatory and reputational risks from unpatched, high-impact vulnerabilities.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Gladinet CentreStack & Triofox Zero-Day Leads to Chain Exploit and Remote Code Execution
Information Technology/IT9 months ago

Gladinet CentreStack & Triofox Zero-Day Leads to Chain Exploit and Remote Code Execution

In October 2025, threat actors exploited a zero-day vulnerability (CVE-2025-11371) in Gladinet’s CentreStack and Triofox file sharing solutions, used by thousands of businesses worldwide. The flaw, a local file inclusion (LFI) bug present in all current product versions, was leveraged to extract sensitive configuration data and trigger a previously known deserialization vulnerability (CVE-2025-30406), resulting in remote code execution (RCE). At least three organizations have confirmed exploitation as attackers gained unauthorized access before Gladinet issued a patch, forcing emergency mitigations that affected platform functionality. This incident highlights how chained vulnerabilities and rapid exploitation of zero-days continue to threaten cloud-based file sharing services. With attackers escalating LFI into full RCE, organizations face heightened pressure to improve visibility, patch agility, and enforce Zero Trust controls, especially amid growing regulatory scrutiny.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Autonomous AI Hacking: The Tipping Point in Global Cybersecurity Risk (2025)
Financial Services9 months ago

Autonomous AI Hacking: The Tipping Point in Global Cybersecurity Risk (2025)

In mid-2025, a wave of autonomous AI-driven cyberattacks emerged globally, marking a pivotal evolution in threat activity. Across June through September, a combination of threat actors—including criminal groups and state-sponsored entities—leveraged advanced large language models (LLMs) and autonomous agent frameworks to conduct large-scale vulnerability discovery, network infiltration, and ransomware deployment. Attackers used tools like XBOW, HexStrike-AI, and AI-powered malware to execute rapid reconnaissance, credential harvesting, and automated extortion, targeting enterprises and critical infrastructure with unprecedented speed, scale, and sophistication. Businesses faced increased operational disruptions and data loss due to automated exploitation chains and persistent threats that outpaced traditional defense mechanisms. This wave of AI-enabled cyberattacks highlights a dangerous rise in the commoditization of sophisticated offensive tools and the diminishing window for detection and response. The incident underscores an urgent shift in the cyber threat landscape, with automation eroding the gap between disclosure and exploitation while spurring intense regulatory and industry focus on adaptive, AI-driven defense solutions.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI Agents Under Fire: Memory Poisoning and the Rise of Persistent Prompt Injection
Financial Services9 months ago

AI Agents Under Fire: Memory Poisoning and the Rise of Persistent Prompt Injection

In 2024, security researchers uncovered a novel AI/ML security incident where AI agents' long-term memory storage was compromised via persistent indirect prompt injection. Adversaries managed to embed malicious instructions within normal AI inputs; these poisoned prompts were subsequently retained by the AI's memory module. When later queries accessed this memory, the injected instructions could exfiltrate conversation history or impact future responses, creating a stealthy, long-term threat. The breach highlighted how modern agentic AI’s tendency to remember user input presents an unforeseen risk vector, with potential for data leakage and manipulation of AI-driven workflows. This incident signals a rising trend: as enterprises integrate AI agents and persistent memory, attackers are quickly adapting with prompt-based exploit techniques that subvert traditional security controls. The risk of covert data exfiltration and ongoing manipulation through AI memory will become a central compliance and governance issue in highly regulated industries.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Clop Ransomware Hits Oracle E-Business Suite Via Zero-Day in 2025
Computer Software/Engineering9 months ago

Clop Ransomware Hits Oracle E-Business Suite Via Zero-Day in 2025

In August 2025, the Clop ransomware group launched a targeted campaign against Oracle E-Business Suite customers, exploiting a critical zero-day vulnerability (CVE-2025-61882) and additional software flaws to achieve pre-authenticated remote code execution. The attack began nearly three months before extortion emails were sent, enabling Clop to quietly exfiltrate sensitive data from dozens of organizations. Security researchers from Google and Mandiant collaborated to reconstruct the multi-stage exploit chain, and Oracle issued an emergency patch in early October after hundreds of systems were identified as vulnerable. Ransom demands reached up to $50 million, jeopardizing regulated data and business operations across multiple industries. This incident underscores the accelerating weaponization of zero-days by advanced ransomware groups and highlights the growing sophistication of supply-chain attacks. It demonstrates both the risk of delayed patching and the operational threat to organizations reliant on widely used enterprise software platforms.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
SonicWall Cloud Backup Breach 2024: Firewall Configurations Exposed in Major Supply Chain Attack
Financial Services9 months ago

SonicWall Cloud Backup Breach 2024: Firewall Configurations Exposed in Major Supply Chain Attack

In mid-2024, SonicWall suffered a significant security breach when an unauthorized party leveraged a brute-force attack against its customer-facing cloud backup platform, gaining access to all firewall configuration backup files stored on the service. The exposed data included sensitive firewall rules, encrypted credentials, and routing configurations for every customer utilizing SonicWall’s cloud backup, not just the initially cited 5% of their install base. While the credentials were encrypted, experts warned that weak passwords could be crackable, offering attackers expanded access. SonicWall worked with Mandiant to investigate, notified affected customers, hardened its infrastructure, and provided remediation tools. This incident highlights ongoing risks from cloud-based infrastructure and supply chain attacks, especially targeting security vendors. Attackers are increasingly exploiting weaknesses in API protections and infrastructure configurations, reinforcing the need for robust access controls and continuous monitoring as ransomware and targeted attacks against network security vendors persist.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
From Infostealer to Full RAT: Inside the 2025 PureRAT Attack Chain
Financial Services9 months ago

From Infostealer to Full RAT: Inside the 2025 PureRAT Attack Chain

In October 2025, Huntress Labs analyzed a sophisticated attack campaign leveraging the PureRAT remote access trojan. The intrusion began with a targeted phishing email containing a ZIP archive that employed DLL sideloading to launch a cascade of in-memory loaders written in Python. Progressing through multi-layered obfuscation, hybrid encryption, and system persistence via Windows registry modifications, the attackers ultimately deployed PureRAT, granting full remote control over victim endpoints. Notably, the operation combined custom-developed loaders with commercial malware, demonstrating advanced evasion and command and control techniques, including encrypted communications and dynamic payload delivery. This incident highlights the growing complexity and modularity of post-phishing attack chains. Organizations must remain vigilant as threat actors increasingly blend bespoke scripts with off-the-shelf RATs, drastically lowering the barrier for stealthy, persistent intrusions targeting credential theft and long-term access.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
SonicWall Cloud Backup Breach Exposes Firewall Configurations in 2024
Computer/Network Security9 months ago

SonicWall Cloud Backup Breach Exposes Firewall Configurations in 2024

In June 2024, SonicWall disclosed a significant data breach impacting all users of its cloud backup service. Attackers successfully gained unauthorized access and exfiltrated firewall configuration files belonging to these customers. The breach, which reportedly occurred in late May 2024, does not appear to have affected the core SonicWall services but poses considerable risk because leaked configurations may contain sensitive network information, VPN details, hashed passwords, and other operational data. SonicWall took immediate action by disabling the impacted service and advising affected clients to reset credentials and review their setups. This breach highlights increasing attacker focus on cloud-managed infrastructure, particularly targeting device configurations that can offer deep intelligence on enterprise environments. With threat actors exploiting misconfigurations and weak controls in supply chain and managed services, regulators and CISOs are under pressure to strengthen both preventative and responsive security postures.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(medium)
Read report
China-Based Storm-2603 Weaponizes Velociraptor DFIR in 2025 Ransomware Attacks
Information Technology/IT9 months ago

China-Based Storm-2603 Weaponizes Velociraptor DFIR in 2025 Ransomware Attacks

In October 2025, security researchers uncovered that the China-based threat group Storm-2603 had abused the open-source Velociraptor DFIR tool in a wide-ranging ransomware campaign. The attacker exploited an outdated, vulnerable version of Velociraptor (CVE-2025-6264) to escalate privileges, create persistent admin accounts, and establish secure remote access on victim systems. This access enabled them to deploy ransomware variants including LockBit and Babuk across Windows and VMware ESXi environments, performing data encryption and exfiltration using PowerShell scripts. Endpoint protections were systematically disabled, and lateral movement leveraged tools like Impacket. This incident highlights an emergent trend: threat actors co-opting legitimate security tools for malicious purposes, increasing the difficulty of detection and response. The blending of nation-state TTPs with ransomware-as-a-service models signals evolving threats, regulatory scrutiny, and substantial operational risks for enterprises.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Universities Targeted: Storm-2657 Orchestrates 2025 Business Email Compromise via Payroll Phishing
Higher Education/Acadamia9 months ago

Universities Targeted: Storm-2657 Orchestrates 2025 Business Email Compromise via Payroll Phishing

In March 2025, a financially motivated threat group tracked as Storm-2657 launched a series of "payroll pirate" attacks targeting U.S. university staff. The attackers leveraged advanced social engineering and adversary-in-the-middle (AITM) phishing techniques to compromise HR-related SaaS accounts, notably Workday. After stealing MFA credentials, they accessed Exchange Online accounts, manipulated payroll settings to hijack salary payments, set inbox rules for concealment, and enrolled attacker-controlled MFA devices for persistence. At least 11 accounts across three universities were breached, enabling phishing campaigns to almost 6,000 recipients spanning 25 institutions. The incident showcases a significant escalation in business email compromise (BEC) targeting the education sector, exploiting gaps in MFA and SSO implementations. With BEC attacks surging industry-wide—resulting in multimillion-dollar annual losses—this campaign emphasizes the urgent need for phishing-resistant MFA and robust email monitoring across academia and beyond.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
ClayRat Android Spyware: Fake App Campaign Hits Mobile Users in 2025
Telecommunications9 months ago

ClayRat Android Spyware: Fake App Campaign Hits Mobile Users in 2025

In October 2025, cybersecurity researchers at Zimperium disclosed a widespread Android spyware campaign dubbed ClayRat, which targeted Russian users through phishing portals, Telegram channels, and malicious websites mimicking popular apps such as WhatsApp, TikTok, YouTube, and Google Photos. Using fraudulent Play Store-like websites and social engineering tactics, attackers tricked users into sideloading APKs that installed malicious payloads via a session-based installation method, bypassing Android security. Once installed, ClayRat acts as the device's default SMS handler, enabling interception of messages, call logs, notifications, and exfiltration of sensitive data to an AES-GCM-encrypted command and control (C2) server. It also uses infected devices to propagate itself by sending mass SMS messages to victims' contacts. This incident underscores an accelerating trend in mobile spyware leveraging legitimate app impersonation and sophisticated delivery mechanisms. The high volume of ClayRat samples and droppers, the abuse of sideloading, and the global reach of Telegram-based distribution channels highlight persistent gaps in mobile endpoint and social engineering defenses.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports