Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 38 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 445–456 / 4893 reports
CISA Elevates Cisco SD-WAN Vulnerability CVE-2026-76504 to KEV Catalog After Active Exploitation
CISA Elevates Cisco SD-WAN Vulnerability CVE-2026-76504 to KEV Catalog After Active Exploitation
Telecommunications1 month ago

CISA Elevates Cisco SD-WAN Vulnerability CVE-2026-76504 to KEV Catalog After Active Exploitation

CISA has added CVE-2026-76504, a Cisco Catalyst SD-WAN Manager hex encoding vulnerability, to its Known Exploited Vulnerabilities catalog following evidence of active exploitation. This vulnerability affects Cisco's SD-WAN management infrastructure and represents a significant risk to federal enterprises and organizations using Cisco's SD-WAN solutions. The addition to the KEV catalog requires federal agencies to prioritize rapid remediation under Binding Operational Directive 26-04, which establishes risk-based vulnerability management requirements for publicly exposed assets that could grant total system control post-exploitation. This incident highlights the ongoing targeting of network infrastructure management systems, particularly SD-WAN platforms that have become critical to hybrid and multi-cloud connectivity strategies as organizations expand their digital footprints.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
ScreenConnect Phishing Campaign Exploits Legitimate Remote Access Tools
ScreenConnect Phishing Campaign Exploits Legitimate Remote Access Tools
Information Technology/IT1 month ago

ScreenConnect Phishing Campaign Exploits Legitimate Remote Access Tools

In October 2024, threat actors launched a sophisticated phishing campaign leveraging legitimate ScreenConnect remote access tools to compromise victim systems. The attack began with deceptive emails claiming fraudulent wire transfers, directing recipients to download a preconfigured ScreenConnect client executable. The malicious file, signed by ConnectWise LLC and configured to connect to attacker-controlled infrastructure, bypassed traditional security controls by appearing as legitimate remote monitoring software. This campaign highlights the growing trend of attackers weaponizing trusted RMM tools to establish persistent remote access while evading detection through legitimate code signing certificates. This incident reflects the increasing sophistication of social engineering attacks combined with the abuse of legitimate remote access tools, a tactic that has become prevalent across multiple threat actor groups targeting organizations of all sizes.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
OpenAI vs Moonshot AI: How a Novel Encryption Bypass Exposed AI Model Vulnerabilities
OpenAI vs Moonshot AI: How a Novel Encryption Bypass Exposed AI Model Vulnerabilities
Computer Software/Engineering1 month ago

OpenAI vs Moonshot AI: How a Novel Encryption Bypass Exposed AI Model Vulnerabilities

In July 2024, OpenAI disrupted a coordinated AI model distillation attack attributed to Chinese rival Moonshot AI that exploited a novel encryption bypass vulnerability. The attackers manipulated model interactions by copying encrypted reasoning data from one conversation and requesting decryption in separate sessions, scaling to 16,000 prompts from 4,000 users at peak activity. OpenAI identified the pattern on July 1st with activity escalating through July 25th before full disruption on July 28th, affecting their ChatGPT reasoning capabilities without compromising databases or user conversations directly. This incident highlights the emerging threat landscape around AI intellectual property theft as Chinese companies systematically target U.S. AI models through sophisticated distillation techniques, prompting increased focus on AI-specific security controls and cross-border technology protection measures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
TeamViewer's Critical Security Update: Five Severe Vulnerabilities Demand Immediate Action
TeamViewer's Critical Security Update: Five Severe Vulnerabilities Demand Immediate Action
Information Technology/IT1 month ago

TeamViewer's Critical Security Update: Five Severe Vulnerabilities Demand Immediate Action

TeamViewer disclosed five high-severity vulnerabilities in September 2026 affecting its remote access software across Windows, Linux, and macOS platforms. The most critical flaw, CVE-2026-92370, enables remote session access control bypass leading to potential remote code execution, while four additional vulnerabilities allow local privilege escalation to NT AUTHORITY/SYSTEM or root access. The company urgently recommended all users update to version 15.82 to address these security issues, though no active exploitation has been detected. This incident highlights the ongoing security challenges facing remote access tools as hybrid work environments expand attack surfaces. Given TeamViewer's widespread enterprise adoption and history of being targeted by ransomware groups and nation-state actors, these vulnerabilities represent significant risk to organizational security infrastructure.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How Zero-Day Supply Chain Attacks Cost Bitget $387 Million: Lessons for Crypto Security
How Zero-Day Supply Chain Attacks Cost Bitget $387 Million: Lessons for Crypto Security
Financial Services1 month ago

How Zero-Day Supply Chain Attacks Cost Bitget $387 Million: Lessons for Crypto Security

Bitget cryptocurrency exchange suffered a devastating $387.5 million theft in September 2026 when North Korean threat actors exploited zero-day vulnerabilities in two third-party security appliances. The attackers gained initial access on August 31, deployed web shells and malware on production wallet infrastructure, then executed the theft across multiple blockchains over a three-hour period on September 25. Investigations by SlowMist and Google Mandiant revealed the attackers compromised critical backend systems used to authorize cryptocurrency transactions, ultimately spoofing the exchange's withdrawal processes to move funds from hot and warm wallets. This incident highlights the escalating sophistication of supply chain attacks targeting cryptocurrency infrastructure, particularly as North Korean state-sponsored groups continue targeting crypto exchanges with advanced zero-day exploits and multi-stage attack methodologies.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Critical Cisco SD-WAN Zero-Day Exploited: CVE-2026-76504 Authentication Bypass
Critical Cisco SD-WAN Zero-Day Exploited: CVE-2026-76504 Authentication Bypass
Telecommunications1 month ago

Critical Cisco SD-WAN Zero-Day Exploited: CVE-2026-76504 Authentication Bypass

In September 2026, Cisco disclosed CVE-2026-76504, a critical zero-day vulnerability in Catalyst SD-WAN Manager that attackers actively exploited to gain administrative privileges through authentication bypass. The flaw stems from improper handling of URI encoding in HTTP requests, allowing unauthenticated remote attackers to bypass authentication rules and access restricted API endpoints. Cisco confirmed active exploitation and provided indicators of compromise, including the use of %6a as URI-encoded character 'j' in malicious requests. CISA added the vulnerability to its Known Exploited Vulnerabilities catalog, mandating federal agencies patch by October 3, 2026. This represents the fifth actively exploited SD-WAN zero-day in 2026, highlighting the continued targeting of network infrastructure management platforms by threat actors seeking to compromise enterprise connectivity and potentially facilitate lateral movement across corporate networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Mass GitHub Credential Exposure Reveals Critical Gaps in DevSecOps Practices
Computer Software/Engineering1 month ago

Mass GitHub Credential Exposure Reveals Critical Gaps in DevSecOps Practices

In September 2026, Truffle Security's analysis of 224 million GitHub repositories revealed over 543,000 valid credentials remained publicly exposed despite GitHub's Push Protection security measures. The research examined 58 billion files and found credentials with a median exposure time of 784 days, with some dating back to 2009. Approximately 36.8% of exposed credentials were published after GitHub enabled Push Protection by default in February 2024, indicating the persistent challenge of secret management in public repositories. The exposure included database connection strings, API keys, and cloud service credentials that could provide unauthorized access to sensitive systems and data. This incident demonstrates the ongoing risk of accidental credential exposure in code repositories and highlights the critical need for comprehensive secret management practices across development workflows.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Critical MikroTik RouterOS Vulnerability Exposes Networks to Pre-Auth RCE Attacks
Critical MikroTik RouterOS Vulnerability Exposes Networks to Pre-Auth RCE Attacks
Telecommunications1 month ago

Critical MikroTik RouterOS Vulnerability Exposes Networks to Pre-Auth RCE Attacks

CISA issued a critical security advisory on September 30, 2026, warning of CVE-2026-84411, a pre-authentication integer underflow vulnerability in MikroTik RouterOS web management service. The flaw affects RouterOS versions below 7.24 and allows unauthenticated attackers to achieve arbitrary code execution with root privileges or cause denial of service through a single crafted HTTP request. While no active exploitation has been observed, the vulnerability poses significant risk to network infrastructure given MikroTik's widespread deployment in enterprise and service provider environments. This incident highlights the escalating threat to critical network infrastructure components, particularly as nation-state actors and cybercriminal groups increasingly target edge devices for persistent access and lateral movement capabilities.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Zimbra Email Servers Under Attack: CVE-2026-73570 Enables Web Shell Deployment and Credential Theft
Zimbra Email Servers Under Attack: CVE-2026-73570 Enables Web Shell Deployment and Credential Theft
Financial Services1 month ago

Zimbra Email Servers Under Attack: CVE-2026-73570 Enables Web Shell Deployment and Credential Theft

In July 2026, threat actors exploited CVE-2026-73570, an unauthenticated command injection vulnerability in Zimbra Collaboration Suite, to deploy web shells and harvest authentication secrets from internet-facing email servers. The critical flaw (CVSS 8.9) enabled attackers to execute remote code through specially crafted SMTP requests without authentication when SNMP notifications were enabled. Microsoft observed multi-stage attacks across multiple regions and industries between July 28 and August 7, 2026, where attackers deployed JSP web shells, established persistence mechanisms, escalated privileges, and exfiltrated mailbox data and authentication tokens including zimbraPreAuthKey and zimbraTwoFactorAuthSecret. This incident highlights the accelerating trend of targeting email infrastructure as attackers increasingly focus on business-critical communication systems and identity-related credentials that enable broader enterprise compromise and long-term persistence across hybrid cloud environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Dual-RMM Phishing Campaign Exploits MSP360 and ScreenConnect for Persistent Access
Dual-RMM Phishing Campaign Exploits MSP360 and ScreenConnect for Persistent Access
Information Technology/IT1 month ago

Dual-RMM Phishing Campaign Exploits MSP360 and ScreenConnect for Persistent Access

In July 2026, Microsoft detected sophisticated phishing campaigns where threat actors distributed legitimate MSP360 Remote Monitoring and Management (RMM) software installers disguised as meeting invitations, PDF readers, and software updates. Once executed, the digitally signed MSP360 installer established remote access and was used to deploy ConnectWise ScreenConnect as a secondary RMM channel, creating redundant access paths for attackers. The dual-RMM approach enabled threat actors to blend malicious activities with legitimate IT operations while maintaining persistent access for information collection and credential theft operations. This incident highlights the growing trend of Living-off-the-Land (LotL) attacks where cybercriminals abuse legitimate remote administration tools to evade detection and establish persistent access, making traditional security controls less effective against these camouflaged threats.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(low)
Read report
Russian State Hackers Deploy New RedFlick Technique in Automated Malware Campaigns
Russian State Hackers Deploy New RedFlick Technique in Automated Malware Campaigns
Government Administration1 month ago

Russian State Hackers Deploy New RedFlick Technique in Automated Malware Campaigns

In September 2026, Microsoft researchers identified a new malware delivery technique called 'RedFlick' being used by the Russian state-sponsored threat actor Star Blizzard (also known as COLDRIVER). This campaign represents a significant evolution in the group's tactics, streamlining their malware delivery process through automated scheduled tasks that deploy the CosmicPulse backdoor with minimal victim interaction. The attacks begin with phishing emails containing password-protected archives that house VHDX virtual disks with malicious LNK files disguised as PDFs. Microsoft observed at least 13 large-scale campaigns since early 2026, impacting over 100 organizations primarily in the US and UK, with particular focus on Ukrainian institutions and international organizations supporting Ukraine. This incident highlights the ongoing sophistication of state-sponsored cyber operations and the continuous evolution of attack methodologies. As geopolitical tensions remain high, organizations must prepare for increasingly automated and evasive attack chains that bypass traditional security controls through legitimate system utilities and scheduled task abuse.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Unsloth Studio Flaw Exposes Critical AI Supply Chain Risks
Unsloth Studio Flaw Exposes Critical AI Supply Chain Risks
Computer Software/Engineering1 month ago

Unsloth Studio Flaw Exposes Critical AI Supply Chain Risks

In June 2026, Pillar Security discovered a critical vulnerability in Unsloth Studio, the web UI for the popular open-source AI model fine-tuning library. The flaw allowed malicious AI models hosted on Hugging Face to execute arbitrary Python code during routine model inspection through the trust_remote_code setting. Simply selecting a malicious model triggered code execution before any model weights were loaded, potentially exposing proprietary training data, credentials, and enterprise AI development environments. Unsloth patched the vulnerability in version 2026.6.9 after responsible disclosure. This incident highlights the growing supply chain risks in AI development as organizations increasingly rely on third-party model repositories and automated tooling, making secure AI pipeline governance more critical than ever.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports