Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 37 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 433–444 / 4893 reports
Critical Code Injection Vulnerability Exposes Kiteworks Email Security Platform
Critical Code Injection Vulnerability Exposes Kiteworks Email Security Platform
Financial Services1 month ago

Critical Code Injection Vulnerability Exposes Kiteworks Email Security Platform

In October 2026, Kiteworks released security patches addressing 126 vulnerabilities, including CVE-2026-54154, a maximum-severity code injection flaw in their Email Protection Gateway (EPG). This critical vulnerability allowed unauthenticated remote attackers to achieve arbitrary code execution and full administrative control through a chain of path traversal, code injection, and missing authentication flaws. The vulnerability was discovered through Kiteworks' bug bounty program and prompted the company to issue an emergency advisory urging customers to shut down their servers as a precautionary measure until patches could be deployed. This incident highlights the growing sophistication of code injection attacks targeting enterprise file-sharing and email security platforms. With nearly 400 Kiteworks instances exposed on the internet and over 100 million end-users potentially affected, the vulnerability demonstrates how critical infrastructure components remain prime targets for attackers seeking to compromise corporate communications and data transfer systems.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Microsoft Warns: AI Arms Race Favors Cybercriminals in 2026
Computer Software/Engineering1 month ago

Microsoft Warns: AI Arms Race Favors Cybercriminals in 2026

Microsoft's 2026 Digital Defense Report reveals that threat actors are currently winning the AI arms race, leveraging artificial intelligence to accelerate vulnerability discovery, malware development, and attack execution from days to minutes. State-sponsored groups from China, Russia, and North Korea are actively using AI tools for reconnaissance, social engineering, and automated malware generation, while the median time between vulnerability discovery and weaponization has dropped below 24 hours. This technological advantage allows attackers to stockpile zero-day vulnerabilities and execute sophisticated campaigns with unprecedented speed and scale. This report highlights a critical inflection point in cybersecurity where AI democratizes advanced attack capabilities, enabling less sophisticated threat actors to execute operations previously reserved for nation-state groups while giving elite adversaries autonomous attack capabilities.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Operation KillSwitch: How International Law Enforcement Dismantled a Teen-Led Ransomware Empire
Financial Services1 month ago

Operation KillSwitch: How International Law Enforcement Dismantled a Teen-Led Ransomware Empire

In September 2026, international law enforcement's Operation KillSwitch dismantled the KillSec ransomware gang, arresting three suspects and identifying a 16-year-old as the group's alleged administrator. The coordinated action involving ten countries seized the gang's dark web leak site, five servers containing 110 terabytes of stolen data, and disrupted operations responsible for approximately 500 successful attacks worldwide since 2024. KillSec exploited software vulnerabilities and poorly secured edge devices to breach corporate systems, steal sensitive data, and extort victims through their data leak site, receiving substantial ransom payments. This takedown highlights the growing trend of younger cybercriminals leading sophisticated ransomware operations and demonstrates how international cooperation can effectively disrupt modern ransomware-as-a-service ecosystems. The gang's use of artificial intelligence to build infrastructure and identify victims represents an emerging threat vector that organizations must prepare to defend against.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical FortiMail Zero-Day CVE-2026-104286 Exploited in Active Attacks
Critical FortiMail Zero-Day CVE-2026-104286 Exploited in Active Attacks
Financial Services1 month ago

Critical FortiMail Zero-Day CVE-2026-104286 Exploited in Active Attacks

In October 2026, Fortinet disclosed CVE-2026-104286, a critical path traversal vulnerability in FortiMail with a CVSS score of 9.8. The flaw allows unauthenticated attackers to write arbitrary files on vulnerable systems through crafted HTTP requests, affecting FortiMail versions 7.2.0-7.2.9, 7.4.0-7.4.8, 7.6.0-7.6.6, and 8.0.0-8.0.1. Attackers actively exploited this zero-day to deploy malicious libraries, modify system binaries, and establish data exfiltration channels to remote servers at compromised IP addresses. This incident highlights the growing trend of attackers targeting email security appliances as high-value entry points into enterprise networks, particularly exploiting path traversal vulnerabilities that bypass authentication mechanisms and enable immediate system-level access.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
International Law Enforcement Dismantles KillSec Ransomware Operation, Arrests 16-Year-Old Leader
International Law Enforcement Dismantles KillSec Ransomware Operation, Arrests 16-Year-Old Leader
Financial Services1 month ago

International Law Enforcement Dismantles KillSec Ransomware Operation, Arrests 16-Year-Old Leader

In September 2026, international law enforcement arrested three individuals including a 16-year-old Spanish teen suspected of leading the KillSec ransomware-as-a-service operation. The coordinated operation involved police from Spain, Germany, UK, and Romania, resulting in the seizure of KillSec's leak site, servers, and over 110 terabytes of stolen data. KillSec exploited software vulnerabilities and cloud storage misconfigurations to breach approximately 1,000 organizations worldwide, with 500 confirmed successful attacks causing substantial financial damage including one incident in Catalonia worth nearly €1 million. This arrest highlights the growing sophistication of young cybercriminals operating ransomware-as-a-service models and the increasing effectiveness of international law enforcement cooperation in dismantling major ransomware operations that threaten critical infrastructure globally.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Custom GPT Exploitation: How Threat Actors Weaponized AI Platforms for RAT Delivery in 2026
Custom GPT Exploitation: How Threat Actors Weaponized AI Platforms for RAT Delivery in 2026
Computer Software/Engineering1 month ago

Custom GPT Exploitation: How Threat Actors Weaponized AI Platforms for RAT Delivery in 2026

In September 2026, threat actors launched a sophisticated ClickFix campaign exploiting OpenAI's Custom GPT feature to deliver remote access Trojans (RATs). Attackers created malicious Custom GPTs mimicking legitimate ChatGPT releases, leveraging trusted domains from OpenAI and Google to deceive victims. The attack chain began when users interacted with fake Custom GPTs named "Plus 5.6" through the official ChatGPT domain, then redirected to a Google Sites page with fake CAPTCHA prompts. Victims were tricked into executing PowerShell commands that downloaded MSI files, which used legitimate Canon-signed applications to sideload malicious DLLs and deploy RATs capable of data theft, surveillance, and network infiltration. Huntress security researchers documented at least 40 confirmed incidents from this campaign. This attack represents an evolution in social engineering tactics, exploiting trust in AI platforms and legitimate cloud infrastructure to bypass traditional security awareness training focused on domain verification.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Citrix NetScaler Under Fire: CVE-2026-88771 Exploits Deploy Sophisticated Web Shells
Citrix NetScaler Under Fire: CVE-2026-88771 Exploits Deploy Sophisticated Web Shells
Financial Services1 month ago

Citrix NetScaler Under Fire: CVE-2026-88771 Exploits Deploy Sophisticated Web Shells

In October 2026, threat actors actively exploited CVE-2026-88771, a critical pre-authentication command injection vulnerability in Citrix NetScaler ADC and Gateway devices. The attackers leveraged this 9.5 CVSS-rated flaw to deploy sophisticated post-exploitation payloads, including Python reverse shells and Perl scripts that created superuser accounts, archived configuration data, and installed PHP web shells disguised as legitimate CSS resources. LevelBlue's research revealed exploitation attempts across multiple customer environments, with attackers using malicious authentication events containing 'pitboss' and 'NSPPE' strings to execute arbitrary commands and establish persistent access. This incident highlights the growing sophistication of network infrastructure attacks, where adversaries combine critical vulnerabilities with advanced evasion techniques to maintain persistence while blending malicious resources with legitimate web assets.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Bitget's $387M Loss: How North Korean Hackers Exploited Third-Party Zero-Day Vulnerabilities
Bitget's $387M Loss: How North Korean Hackers Exploited Third-Party Zero-Day Vulnerabilities
Financial Services1 month ago

Bitget's $387M Loss: How North Korean Hackers Exploited Third-Party Zero-Day Vulnerabilities

In September 2026, cryptocurrency exchange Bitget suffered a devastating $387.5 million theft when North Korean threat actors exploited a zero-day vulnerability in third-party security products. The attackers gained access to high-level internal credentials through compromised security appliances, beginning their infiltration as early as August 31, 2026. Using a customized tool specifically designed for Bitget's wallet system, the threat actors executed unauthorized withdrawals across 11 blockchains, bypassing existing risk controls and affecting assets including XRP, ETH, USDT, and others. This incident highlights the growing sophistication of supply chain attacks targeting cryptocurrency exchanges, with North Korean APT groups increasingly exploiting third-party vendor vulnerabilities to access high-value targets. The attack demonstrates the critical need for enhanced vendor risk management and zero-trust architectures as cryptocurrency platforms become prime targets for nation-state actors seeking to fund illicit activities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Apple CoreGraphics Zero-Click Exploit: How CVE-2026-86950 Weaponized PDFs Through WhatsApp
Apple CoreGraphics Zero-Click Exploit: How CVE-2026-86950 Weaponized PDFs Through WhatsApp
Computer Software/Engineering1 month ago

Apple CoreGraphics Zero-Click Exploit: How CVE-2026-86950 Weaponized PDFs Through WhatsApp

In September 2026, Apple patched CVE-2026-86950, a critical CoreGraphics vulnerability that may have been exploited in highly sophisticated zero-click attacks against specific targeted individuals. The flaw allows malicious PDFs with crafted embedded fonts to trigger memory corruption on unpatched iPhones and Macs. Security researchers at Calif published the first public proof-of-concept, demonstrating how attackers can cause controlled out-of-bounds writes through malformed TrueType fonts. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, requiring federal agencies to patch by October 2026. Evidence suggests WhatsApp may have been used as a delivery vector, as Meta Product Security was credited with the discovery and recent WhatsApp versions include new PDF attachment scanning capabilities. This incident highlights the continuing evolution of zero-click exploits targeting messaging platforms and document processing frameworks, representing a significant threat to high-value targets including government officials, journalists, and activists who rely on secure communications.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
MetaMask Security Incident Triggers Emergency Ethereum Validator Exit
MetaMask Security Incident Triggers Emergency Ethereum Validator Exit
Financial Services1 month ago

MetaMask Security Incident Triggers Emergency Ethereum Validator Exit

MetaMask disclosed an ongoing security incident in October 2026 affecting part of its infrastructure, prompting the precautionary exit of affected Ethereum validators from its non-custodial staking operations. While the company stated no immediate threat to MetaMask wallets was identified, the incident forced coordination with external partners and security advisors to address and remediate the issue. The incident impacted MetaMask's validator operations within the Lido protocol, with all affected validators expected to complete the exit process by October 7, 2026, potentially incurring foregone rewards and downtime penalties. This incident highlights the growing sophistication of attacks targeting cryptocurrency infrastructure and staking services, reflecting broader trends in threat actors increasingly focusing on decentralized finance (DeFi) platforms and blockchain infrastructure as high-value targets with significant financial impact potential.

Medium impact

Kill Chain

ICInitial Compromise(low)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(high)
Read report
Google's Gemini 4 Argon: The AI Security Double-Edged Sword of 2026
Google's Gemini 4 Argon: The AI Security Double-Edged Sword of 2026
Computer/Network Security1 month ago

Google's Gemini 4 Argon: The AI Security Double-Edged Sword of 2026

In October 2026, Google released Gemini 4 Argon, an advanced AI model with autonomous vulnerability discovery capabilities, to trusted cyber defenders through its Fairwind Program. The model demonstrates unprecedented ability to find, validate, and patch critical software vulnerabilities, including discovering a previously unknown critical healthcare software vulnerability affecting hospitals worldwide. Google plans to release a version without cyber guardrails to trusted defenders while implementing safeguards against misalignment and indirect prompt injections. This incident highlights the emerging dual-use nature of AI security tools, where advanced models capable of autonomous vulnerability discovery can be weaponized by malicious actors if proper controls aren't maintained, representing a new frontier in AI security risks.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Critical Cisco SD-WAN Authentication Bypass Exposes Enterprise Networks to Admin-Level Compromise
Critical Cisco SD-WAN Authentication Bypass Exposes Enterprise Networks to Admin-Level Compromise
Telecommunications1 month ago

Critical Cisco SD-WAN Authentication Bypass Exposes Enterprise Networks to Admin-Level Compromise

In September 2026, threat actors began actively exploiting a critical authentication bypass vulnerability (CVE-2026-76504) in Cisco Catalyst SD-WAN Manager, scoring 9.8 on the CVSS scale. The flaw allows unauthenticated remote attackers to gain administrative privileges through crafted HTTP requests that exploit improper URI encoding handling. CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on September 30, 2026, giving federal agencies until October 3 to apply patches. The attack grants full administrative API access without authentication credentials. This incident highlights the persistent targeting of SD-WAN infrastructure, with eight Cisco SD-WAN vulnerabilities appearing on CISA's KEV list in 2026 alone, demonstrating attackers' recognition of these platforms as high-value targets for enterprise network compromise.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports