The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4731 threat reports
Page 371 of 395
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 4441–4452 / 4731 reports
Cl0p Ransomware Targets Oracle E-Business Suite: 2025 Executive Extortion Wave Uncovered
Financial Services9 months ago

Cl0p Ransomware Targets Oracle E-Business Suite: 2025 Executive Extortion Wave Uncovered

In October 2025, Google Mandiant and the Google Threat Intelligence Group reported a new extortion campaign targeting organizations using Oracle E-Business Suite. The campaign, believed to be orchestrated by the financially motivated Cl0p ransomware group, involved the distribution of extortion emails to C-level executives, claiming theft of sensitive business data. Attackers leveraged weaknesses in Oracle’s environment to exfiltrate confidential information, applying pressure for payment through credible threats of public disclosure and operational disruption. This incident highlights the evolving nature of ransomware tactics towards high-value enterprise applications and direct executive outreach. This case demonstrates the increasing trend of threat actors focusing on business-critical cloud and ERP platforms, not only for data theft but also to maximize ransom leverage. Sophisticated phishing, lateral movement, and exploitation of complex SaaS ecosystems make such attacks especially challenging to detect and contain.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Multi-Vector Cyber Assault 2025: CarPlay, Cloud SQL, & iCloud Under Attack
Automotive9 months ago

Multi-Vector Cyber Assault 2025: CarPlay, Cloud SQL, & iCloud Under Attack

In October 2025, coordinated threat actors launched a multi-vector attack campaign leveraging a critical CarPlay exploit, BYOVD (Bring Your Own Vulnerable Driver) tactics, SQL server compromise for covert command-and-control (C2), and targeted backdoor deployments against iCloud accounts. Attackers exploited unpatched vulnerabilities across automotive infotainment systems, enterprise firewalls, and cloud environments, enabling lateral movement and persistent access. The campaign demonstrated a sophisticated blend of supply chain targeting, abuse of trusted encryption protocols, malicious browser extension injection, and data exfiltration at scale. Impacted organizations faced substantial operational disruption, data loss, and the risk of regulatory penalties due to exposure of sensitive customer information and business-critical systems. This incident underscores the rapid evolution of attacker tradecraft, particularly in hybrid infrastructures and connected vehicles. The convergence of cloud, automotive, and critical business services in a single campaign highlights the increasing necessity for comprehensive, real-time security that spans east-west traffic, encrypted channels, and multi-cloud platforms.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Malicious PyPI Package 'soopsocks' Infects 2,653 Systems in Supply-Chain Breach
Computer Software/Engineering9 months ago

Malicious PyPI Package 'soopsocks' Infects 2,653 Systems in Supply-Chain Breach

In October 2025, security researchers discovered a malicious Python package named "soopsocks" on the official Python Package Index (PyPI) repository, which was designed to masquerade as a legitimate SOCKS5 proxy tool while covertly delivering backdoor functionalities to affected Windows machines. Attackers used this supply-chain vector to reach unsuspecting developers and organizations, resulting in 2,653 downloads before the package was taken down by PyPI administrators. The malware enabled attackers to deploy additional payloads, potentially leading to data exfiltration and further system compromise across multiple organizations. This incident exemplifies the persistent risk of open-source ecosystem attacks, as threat actors increasingly target software supply chains and code repositories. It highlights the urgent need for organizations to harden software development pipelines and monitor third-party dependencies for tampering or malicious behavior.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
US Government 2025 Shutdown: Cyber Intel Sharing and Defense at Risk
Government Administration9 months ago

US Government 2025 Shutdown: Cyber Intel Sharing and Defense at Risk

In October 2025, a US federal government shutdown led to the temporary lapse of critically important cyber threat information sharing, coinciding with the expiration of the Cybersecurity Information Sharing Act of 2015. As Congressional inaction prevented reauthorization, legal protections for companies sharing threat data vanished, making organizations hesitant or unable to exchange intelligence. Mass furloughs affected over 65% of Cybersecurity & Infrastructure Security Agency (CISA) personnel, and many critical contractors were released, significantly slowing incident response, vulnerability patching, and cross-sector collaboration. The resulting operational gaps increased the risk of adversaries targeting federal networks and exploiting unpatched vulnerabilities. This incident highlights the risks posed by government policy disruptions and shrinking cyber workforce capacity, underscoring how national cybersecurity posture is deeply interconnected with policy stability. Its relevance is underscored by mounting state-backed cyber threats, increased phishing targeting vulnerable personnel, and heightened urgency for robust identity and incident response controls.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
ShinyHunters Target Salesforce: Social Engineering Breach Exposes SaaS Security Gaps
Computer Software/Engineering9 months ago

ShinyHunters Target Salesforce: Social Engineering Breach Exposes SaaS Security Gaps

In early 2024, Google’s Mandiant research team identified a targeted campaign by the ShinyHunters threat group leveraging advanced social engineering techniques against Salesforce environments. The attackers—tracked as UNC6040—used convincing phishing lures and manipulation of Salesforce user credentials to gain unauthorized access to sensitive corporate data. By circumventing authentication measures and exploiting insufficient internal network segmentation and monitoring, ShinyHunters exfiltrated confidential business records, customer data, and intellectual property. The breach highlighted the group’s evolving tactics and the risks posed to organizations that rely on cloud SaaS platforms like Salesforce for critical operations. This incident underscores the increasing sophistication of social engineering attacks, with criminals exploiting both technical and human vulnerabilities in cloud platforms. As SaaS adoption accelerates, similar threats are expected to rise, placing renewed emphasis on identity security, comprehensive threat detection, and adherence to zero trust principles.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(low)
Read report
Red Hat's 2024 GitLab Breach: Supply Chain Risks and the Rise of Crimson Collective
Computer Software/Engineering9 months ago

Red Hat's 2024 GitLab Breach: Supply Chain Risks and the Rise of Crimson Collective

In September 2024, Red Hat disclosed a breach of its self-managed GitLab instance used by its Consulting services, following claims by the Crimson Collective ransomware group of compromising over 28,000 private repositories. The attackers allegedly exfiltrated software source code and Customer Engagement Reports (CERs), which may contain network details, configuration data, and sensitive credentials. Red Hat initiated remediation steps and assured that its primary software supply chain and core products were not impacted. Belgian authorities warned of potential high-risk exposure for organizations with ties to Red Hat Consulting. This incident underscores a growing trend of supply chain attacks targeting private code repositories and related assets, especially in environments where critical infrastructure and third-party integrations are involved. As ransomware groups pivot to extortion and supply chain vectors, organizations must urgently review their repository and credential management, even on self-managed systems.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
Oracle 2025: Clop Ransomware Group Launches Extortion Campaign Against E-Business Suite Clients
Financial Services9 months ago

Oracle 2025: Clop Ransomware Group Launches Extortion Campaign Against E-Business Suite Clients

In late September 2025, Oracle E-Business Suite customers were subjected to a wave of targeted extortion emails reportedly sent by threat actors aligned with the Clop ransomware group. The campaign leveraged hundreds of compromised legitimate third-party accounts to send messages claiming theft of customer data from Oracle environments. While Oracle confirmed the outreach and ongoing investigations, it did not specify which vulnerabilities were exploited nor confirm any customer data breach. Multiple Oracle E-Business Suite vulnerabilities, including remotely exploitable flaws, had been patched in July 2025, but ongoing research has yet to verify attack details or data loss. This incident is emblematic of the growing sophistication of financially motivated ransomware groups, who now often use large-scale phishing and extortion campaigns before confirming a breach. The campaign highlights increasing pressure on organizations to patch critical software rapidly and maintain heightened vigilance against social engineering, especially as adversaries leverage supply chain vectors and undermine trust with third-party compromise.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(high)
Read report
How North Korean IT Workers Infiltrated Global Businesses: 2025 Insider Threat Surge
Information Technology/IT9 months ago

How North Korean IT Workers Infiltrated Global Businesses: 2025 Insider Threat Surge

Between 2021 and mid-2025, North Korean nationals covertly infiltrated thousands of businesses worldwide by posing as legitimate remote IT and finance workers. According to Okta and other cyber threat intelligence sources, over 130 unique identities were linked to North Korean operatives who participated in more than 6,500 job interviews across roughly 5,000 companies, affecting industries from technology and finance to healthcare and manufacturing. The scheme enabled the North Korean regime to launder payments in violation of international sanctions, while threat actors refined methods to evade common screening controls and exploit global hiring pipelines. High volumes of applications, especially in remote roles, allowed these operatives to bypass national and enterprise-level defenses, embedding deeper into victim organizations’ critical workflows and data environments. The global expansion and sophistication of North Korea’s IT worker operation underscore a dangerous evolution in cyber-enabled insider threats and economic espionage. With a 220% increase in detected North Korean IT worker activity year-over-year, businesses worldwide now face heightened risk regardless of geography or sector, making identity vetting and remote work controls a top security priority.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
WestJet 2025 Data Breach: How Social Engineering and Remote Access Led to Massive Data Exposure
Airlines/Aviation9 months ago

WestJet 2025 Data Breach: How Social Engineering and Remote Access Led to Massive Data Exposure

In June 2025, Canadian airline WestJet suffered a major data breach affecting approximately 1.2 million customers. Threat actors exploited social engineering to reset an employee’s password, gaining access through Citrix systems and compromising both Windows and Microsoft cloud networks. The attackers were able to exfiltrate sensitive personal data, including full names, dates of birth, physical addresses, passport or government IDs, travel information, rewards member data, and select customer service interactions. While no credit card numbers or passwords were disclosed, the incident required investigation by law enforcement and forced WestJet to notify affected users and authorities across North America, offering free identity monitoring. This breach highlights the growing effectiveness of identity-based attacks, particularly those leveraging social engineering to bypass traditional security controls via remote access platforms. With aviation and travel industries increasingly targeted, this incident underscores the urgent need for modern Zero Trust approaches and continuous monitoring of east-west traffic within enterprise networks.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
Allianz Life Data Breach 2025: Cloud CRM Attack Exposes 1.5 Million
Insurance9 months ago

Allianz Life Data Breach 2025: Cloud CRM Attack Exposes 1.5 Million

In July 2025, Allianz Life, a major American insurance provider, suffered a significant data breach after threat actors—suspected to be part of the ShinyHunters extortion group—gained unauthorized access to a third-party cloud-based CRM system. The breach exposed sensitive personal information including names, addresses, dates of birth, and Social Security numbers for nearly 1.5 million individuals, encompassing customers, financial professionals, and employees. The incident was publicly disclosed shortly after it occurred, with Allianz confirming that Allianz SE, its global parent company, was not impacted. In response, Allianz initiated notifications to affected parties and regulatory authorities and is offering two years of free identity theft monitoring. This incident highlights the persistent risks posed by supply chain and third-party service vulnerabilities, especially as attackers increasingly target trusted cloud-based platforms such as Salesforce. The breach underscores the necessity for vigilant monitoring, rigorous access controls, and enhanced segmentation within cloud ecosystems for all organizations handling sensitive data.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Klopatra Trojan: VNC-Powered Android Banking Attacks Sweep Europe in 2025
Banking/Mortgage9 months ago

Klopatra Trojan: VNC-Powered Android Banking Attacks Sweep Europe in 2025

In March 2025, a newly identified Android trojan named Klopatra emerged, targeting over 3,000 devices across Europe by masquerading as a legitimate IPTV and VPN app. Researchers from Cleafy discovered that this banking and remote access trojan—believed to be operated by a Turkish-speaking cybercrime group—leveraged VNC-based remote control, overlay attacks, anti-analysis techniques, and Accessibility Service abuse to steal banking credentials, manipulate transactions, exfiltrate clipboard and keystroke data, and harvest cryptocurrency wallet information. The malware sidestepped Google Play protections by distributing its dropper app on unofficial websites and continuously evolving, with at least 40 builds detected since its appearance. This incident underscores the growing sophistication and adaptability of Android malware, including the deployment of advanced evasion techniques and real-time remote access capabilities. As mobile banking adoption rises globally, such attacks signal an urgent need for stronger app vetting, user awareness, and holistic endpoint security strategies in enterprise and consumer environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Motility Software Suffers Major Ransomware Breach Impacting Over 766,000 Clients
Automotive9 months ago

Motility Software Suffers Major Ransomware Breach Impacting Over 766,000 Clients

In June 2024, Motility Software Solutions, a prominent provider of dealer management software, suffered a ransomware attack that resulted in the unauthorized access and exposure of sensitive data from approximately 766,000 clients. The attackers infiltrated Motility's networks, deployed ransomware to encrypt critical systems, and exfiltrated customer data, including personal and financial information. The attack caused significant operational disruptions for both Motility and its dealership clients, who rely on the platform for daily business operations. The incident highlights the persistent threat ransomware actors pose to software supply chains serving multiple downstream businesses. This breach is especially noteworthy amid an ongoing rise in ransomware targeting SaaS and vertical market providers, with attackers prioritizing data exfiltration for extortion. Regulators and business partners are increasing their demands for improved security controls and rapid incident disclosure, especially for service providers entrusted with large volumes of sensitive client data.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports