The breach isn’t the problem. The spread is. →Free Assessment

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4731 threat reports
Page 390 of 395
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 4669–4680 / 4731 reports
Vyro AI 2024 GenAI Data Leak: Why Cyber Hygiene Can't Wait
Computer Software/Engineering9 months ago

Vyro AI 2024 GenAI Data Leak: Why Cyber Hygiene Can't Wait

In early 2024, Vyro AI experienced a significant data leak involving the unintentional exposure of proprietary and sensitive user data via a GenAI platform. The incident occurred when internal users, unaware of best security practices, shared confidential information with generative AI tools that did not have adequate encryption or access controls. This exposed private data to unauthorized individuals and third parties, highlighting deficiencies in the company’s data protection policies and cloud application oversight. This breach is emblematic of the growing risks associated with GenAI usage in enterprise environments, where shadow IT and user-driven data sharing can sidestep traditional security controls. As organizations adopt AI at scale, ensuring robust data governance and compliance is more critical than ever to avoid regulatory and reputational fallout.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
VMScape: 2025’s Critical Hypervisor Isolation Attack Exposes Cloud Risks
Information Technology/IT9 months ago

VMScape: 2025’s Critical Hypervisor Isolation Attack Exposes Cloud Risks

In September 2025, security researchers from ETH Zurich disclosed 'VMScape,' a sophisticated side-channel attack that breaks guest-host isolation in virtualized environments by exploiting incomplete speculative execution mitigations in modern AMD and Intel CPUs. The exploit enables a malicious guest VM to leak sensitive data, such as cryptographic keys, from the unmodified QEMU hypervisor memory, bypassing existing Spectre defenses without requiring host compromise. The attack impacts AMD Zen 1–5 and Intel Coffee Lake CPUs, allowing memory leaks at rates that threaten cloud multi-tenancy and data privacy. While VMScape requires deep technical expertise and sustained attack duration, its discovery highlights ongoing challenges in securing virtualization infrastructure against novel hardware-level threats. The incident underscores the need for prompt hardware and software mitigation deployment and a renewed focus on isolation techniques amid rising CPU vulnerability disclosures.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
Ascension Health 2024: Kerberoasting Ransomware Attack Exposes Microsoft Security Risks
Health Care / Life Sciences9 months ago

Ascension Health 2024: Kerberoasting Ransomware Attack Exposes Microsoft Security Risks

In May 2024, Ascension Health experienced a major ransomware breach, impacting over 5.6 million patient records. Attackers exploited a contractor’s click on a malicious Bing search result in Microsoft Edge, leveraging a 'Kerberoasting' attack against Microsoft Active Directory. By abusing weak and legacy RC4-encrypted Kerberos service account credentials, attackers escalated privileges and moved laterally across sensitive healthcare infrastructure, ultimately exfiltrating patient data and disrupting operations. The incident highlighted significant shortcomings in Microsoft's default security settings and communication of critical risks to enterprise customers, even after prior warnings from security experts and U.S. government officials. The breach is emblematic of a rising trend in identity-based and ransomware attacks exploiting outdated cryptographic standards across critical infrastructure sectors, especially healthcare. Regulatory and public scrutiny on vendor responsibility, ransomware defense, and secure default configurations have intensified following this high-profile compromise.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(high)
Read report
Panama Ministry of Economy Breach: INC Ransomware’s 2025 Attack Explained
Government Administration9 months ago

Panama Ministry of Economy Breach: INC Ransomware’s 2025 Attack Explained

In September 2025, Panama's Ministry of Economy and Finance (MEF) announced a cyber incident after the INC Ransomware gang claimed liability for a breach. The ministry reported detecting malicious software on one workstation, activating security protocols, and asserting no core systems or sensitive data were affected. However, INC Ransom posted evidence and claimed to have exfiltrated over 1.5 TB of emails, financial, and budgeting documents from MEF. The threat actor listed MEF on its leak site and began releasing data samples, raising concerns about the extent of exposure. This incident underscores the continued evolution and impact of ransomware-as-a-service (RaaS) operations targeting government and finance sectors. With INC Ransom’s repeated high-profile attacks, the breach reflects the growing risk of sophisticated data theft and extortion campaigns confronting public sector organizations globally.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
2025 Cursor AI Code Editor Vulnerability: Supply-Chain Risk via Malicious Repositories
Computer Software/Engineering9 months ago

2025 Cursor AI Code Editor Vulnerability: Supply-Chain Risk via Malicious Repositories

In September 2025, a security flaw was disclosed affecting Cursor, an AI-powered code editor, that allowed silent code execution when users opened repositories embedded with malicious payloads. The vulnerability stemmed from a default-disabled security setting, letting attackers execute arbitrary code on victim machines under their own user privileges. Security researchers highlighted the risk of potential supply-chain attacks, as any developer opening a tampered repository could unwittingly trigger the exploit, potentially leading to credential theft, system compromise, or further lateral movement within organizational networks. The impact was amplified by Cursor's AI-driven capabilities and its popularity in modern development environments. This incident spotlights the growing risks at the intersection of AI-driven tools and software supply chains. With more organizations relying on smart code editors and automated workflows, attackers are increasing their focus on weaknesses in tool defaults and developer behaviors, driving regulatory concern and heightening the urgency for robust code execution safeguards.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Cryptojacking Surge: TOR-Based Attack Exploits Docker API Misconfigurations in 2025
Information Technology/IT9 months ago

Cryptojacking Surge: TOR-Based Attack Exploits Docker API Misconfigurations in 2025

In July 2025, cybersecurity researchers identified a new wave of cryptojacking attacks leveraging the TOR network to hide command-and-control infrastructure. Attackers targeted internet-exposed and misconfigured Docker APIs, deploying malicious containers that mined cryptocurrency on compromised infrastructures. This campaign, tracked by Akamai and initially reported by Trend Micro in June 2025, showed sophisticated behaviors including blocking rival threat actors and securing persistence, which increased the impact on affected organizations by silently draining cloud computing resources and escalating operational costs. This incident highlights the growing convergence of container security risks and anonymizing networks like TOR, reflecting a broader trend of attackers shifting toward stealthy, infrastructure-focused exploits. With cloud-native workloads and container orchestration becoming standard, organizations face urgent regulatory and operational pressure to harden APIs and improve cloud security hygiene.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(high)
Read report
npm Supply-Chain Attack Exposes Open-Source Dependencies: 2024 Incident Analysis
Computer Software/Engineering9 months ago

npm Supply-Chain Attack Exposes Open-Source Dependencies: 2024 Incident Analysis

In June 2024, a supply-chain attack struck the widely used npm ecosystem when a threat actor compromised developer Josh Junon's account via a phishing-enabled two-factor reset. The attacker injected malicious code into 18 high-download open-source JavaScript packages, including 'ansi-styles', 'chalk', and 'debug', targeting cryptocurrency transactions. Although the incident caused significant alarm due to the downloads’ reach (>2 billion/week), rapid detection by the open-source community and immediate takedown by npm limited the impact. The injected packages were removed within hours, and the attacker ultimately stole just over $1,000 in cryptocurrency. This incident highlights the growing sophistication of supply-chain and social engineering attacks on open-source platforms. As attackers target developer credentials and critical project maintainers, organizations face renewed urgency to reassess their software supply chain controls and dependency management.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Microsoft Patch Tuesday 2025: Patch Critical Privilege Escalation Flaws Now
Information Technology/IT9 months ago

Microsoft Patch Tuesday 2025: Patch Critical Privilege Escalation Flaws Now

In September 2025, Microsoft released patches addressing 81 vulnerabilities across enterprise products and core Windows systems. No vulnerabilities were detected as actively exploited, but experts cautioned that several critical and high-severity flaws could become prime targets. Notably, CVE-2025-55232 (CVSS 9.8) enables unauthenticated code execution on Microsoft High Performance Compute Pack installations. Critical elevation of privilege issues, such as CVE-2025-54918 (Windows NTLM) and CVE-2025-55234 (Windows SMB), expose organizations to potential lateral movement, ransomware, and large-scale data exfiltration risks if not remediated. This incident underscores the growing urgency of rapid patch cycles as attacker interest in privilege escalation and lateral movement techniques surges. With threat actors leveraging unpatched vulnerabilities for ransomware and data theft, organizations must bolster detection and enforcement around privilege-oriented exploits.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
How Outdated Encryption in Microsoft Defaults Enabled the 2024 Ascension Ransomware Attack
Health Care / Life Sciences9 months ago

How Outdated Encryption in Microsoft Defaults Enabled the 2024 Ascension Ransomware Attack

In February 2024, Ascension, one of the largest healthcare organizations in the United States, suffered a massive ransomware attack linked to longstanding encryption flaws in Microsoft’s default configurations. Attackers infiltrated Ascension’s network via a phishing email opened by a contractor on a company laptop using default Microsoft Edge and Bing settings. Exploiting weak encryption (RC4) and leveraging the Kerberoasting technique on Microsoft Active Directory, the ransomware group rapidly gained administrative privileges and deployed malware across the organization’s systems. This breach compromised sensitive data belonging to over 5.6 million patients, including personal, medical, payment, insurance, and government identification records, and severely disrupted business operations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Global NPM Phishing Breach Exposes Billions to Supply Chain Malware
Computer Software/Engineering9 months ago

Global NPM Phishing Breach Exposes Billions to Supply Chain Malware

In September 2023, threat actors compromised the NPM account of Qix, a well-known developer, through a phishing attack and used the access to publish malicious updates to 18 highly popular open-source packages. These tainted packages, which collectively garnered over 2 billion weekly downloads, included 'ansi-styles', 'debug', 'chalk', and 'supports-color'. The inserted malware aimed to steal cryptocurrency by tampering with API calls and redirecting wallet transactions. The attack window was brief—about two hours—before the breach was discovered, the malicious versions withdrawn, and further spread prevented. While technical fallout was limited and the attackers profited minimally, the incident exposed significant vulnerabilities in the open-source software ecosystem and generated substantial remediation efforts globally. This episode highlights urgent risks inherent in software supply chains and the dependency of modern development on a small number of package maintainers. Public attention to supply chain defense, rapid incident response, and robust dependency vetting is rising as organizations face the reality of widespread reliance on community-maintained resources.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Microsoft September 2025 Patch Tuesday: Spotlight on Network Privilege Escalation Flaws
Financial Services9 months ago

Microsoft September 2025 Patch Tuesday: Spotlight on Network Privilege Escalation Flaws

On September 2025, Microsoft released security patches addressing over 80 vulnerabilities across Windows products, including 13 rated as 'critical.' Notably, CVE-2025-54918, a vulnerability in Windows NTLM authentication, allows attackers with network access and credential knowledge to elevate privileges to SYSTEM level remotely. Another disclosed vulnerability, CVE-2025-55234 in the SMB client, is also remotely exploitable and could result in code execution through replay attacks. Alongside these, the update addressed an NTFS remote code execution flaw (CVE-2025-54916) that, although not network-exploitable, poses significant risk via social engineering vectors. This Patch Tuesday illustrates a continued shift in attacker focus towards privilege escalation and lateral network movement within enterprise environments. Escalating regulatory scrutiny and rising advanced persistent threats reinforce the urgency of timely patching and integrated security controls for both external and east-west traffic.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
U.S. Indicts Ukrainian Ransomware Operator Behind Hundreds of Global Attacks
Health Care / Life Sciences9 months ago

U.S. Indicts Ukrainian Ransomware Operator Behind Hundreds of Global Attacks

In June 2024, the U.S. Department of Justice indicted Volodymyr Tymoshchuk, a Ukrainian national linked to the development and deployment of the Nefilim, LockerGoga, and MegaCortex ransomware variants. Operating under aliases such as 'deadforz' and 'farnetwork,' Tymoshchuk and his co-conspirators targeted organizations—including healthcare, industrial, and blue-chip companies—across the U.S., Europe, and Australia from at least 2018 onward. Over 250 U.S. and hundreds of global victims experienced encrypted systems, data theft, and significant operational disruption, resulting in tens of millions of dollars in damages attributed to ransom payments, mitigation, and recovery costs. This indictment underscores increasing law enforcement cooperation and heightened government focus on disrupting ransomware-as-a-service ecosystems. The ongoing campaign and associated public rewards for information highlight how ransomware actors continue evolving tactics, targeting high-revenue organizations and leveraging affiliate networks to scale global extortion operations.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports