Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports

Page 4 of 408

Explore Other Sectors

Accounting Aerospace Aerospace/Aviation Agriculture Airlines/Aviation Animation Apparel/Fashion Architecture/Planning Artificial Intelligence Artificial Intelligence/Machine Learning Arts/Crafts Automotive Aviation/Aerospace Banking/Mortgage Biotechnology/Greentech Blockchain/Cryptocurrency Broadcast Media Broadcasting Media Broadcasting/Media Building Materials Business Supplies/Equipment Capital Markets/Hedge Fund/Private Equity Chemical Chemicals Civic/Social Organization Civil Engineering Cloud Computing Cloud Computing/SaaS Cloud Native Security Fabric (CNSF)Cloud Services Commercial Facilities Commercial Real Estate Computer Games Computer Hardware Computer Networking Computer Software/Engineering Computer/Network Security Construction Consulting Consumer Electronics Consumer Goods Consumer Services Cosmetics Cosmetics Critical Manufacturing Cryptocurrencies Cryptocurrency Customer Services Cybersecurity Dairy Dating/Personal Services Dating/Social Platforms Defense/Space Design E-Learning Education Management Electrical/Electronic Manufacturing Emergency Services Energy Energy/Oil/Solar/Greentech Entertainment/Movie Production Environmental Services Events Services Executive Office Facilities Services Farming Fashion/Apparel Financial Services Fine Art Fishery Food Production Food/Beverages Fortune 500 companies Franchising Fundraising Gambling/Casinos Gaming Gaming/Casinos Government Administration Government Facilities Government Relations Graphic Design/Web Design Health Care / Life Sciences Healthcare Higher Education/Acadamia Hospitality Hospitals Human Resources/HR Import/Export Individual/Family Services Industrial Automation Information Services Information Technology/IT Insurance International Affairs International Trade/Development Internet Investment Banking/Venture Investment Management/Hedge Fund/Private Equity Judicial Judiciary Law Enforcement Law Practice/Law Firms Legal Services Legislative Office Leisure/Travel Logistics/Procurement Luxury Goods/Jewelry Machinery Management Consulting Manufacturing Maritime Market Research Marketing/Advertising/Sales Mechanical or Industrial Engineering Media Production Medical Equipment Medical Practice Military Industry Mining/Metals Mobile Museums/Institutions Music Newspapers/Journalism Non-Profit/Volunteering Oil/Energy/Solar/Greentech Online Publishing Other Industry Outsourcing/Offshoring Package/Freight Delivery Parking Pharmaceuticals Philanthropy Photography Plastics Political Organization Primary/Secondary Education Professional Services Professional Training Public Relations/PR Public Safety Publishing Industry Railroad Manufacture Real Estate/Mortgage Recreational Facilities/Services Religious Institutions Renewables/Environment Research Industry Restaurants Retail Industry Robotics Rural Healthcare Security/Investigations Semiconductors Shipbuilding Social Media/Internet Sporting Goods Sports Staffing/Recruiting Supermarkets Technology Technology/IT Telecommunications Think Tanks Toys and Games Transportation Travel/Tourism Trucking/Freight Utilities Venture Capital/VC Warehousing Water and Waste Management Water and Wastewater Water and Wastewater Systems Water and Wastewater Treatment Water Treatment Water, Waste, Steam, and Air Conditioning Services Water/Waste Management Water/Wastewater Water/Wastewater Management Water/Wastewater/Utilities Wholesale Wine/Spirits Wireless Writing/Editing

Showing 37–48 / 4893 reports

Information Technology/IT4 days ago

SonicWall Refuses to Patch Critical EoL GMS Flaws — What Your Security Team Must Do Now

In November 2026, SonicWall disclosed two unpatched vulnerabilities in its end-of-life Global Management System (GMS) 9.5.2 and earlier: CVE-2026-109593 (CVSS 9.1), an unauthenticated file read flaw enabling exposure of sensitive internal files, and CVE-2026-109594 (CVSS 6.8), a post-authentication SQL injection allowing database access or modification. Because GMS has reached end-of-life, SonicWall will issue no patches, leaving organizations running legacy GMS deployments permanently exposed. This follows active exploitation of a separate critical SSRF flaw (CVE-2026-102255, CVSS 10.0) in SonicWall infrastructure, with over 2,500 documented attack attempts logged since October 2026. The refusal to patch EoL systems is an accelerating industry pattern forcing security teams to choose between costly emergency upgrades and operating with known, publicly documented critical vulnerabilities. As threat actors increasingly target network management platforms as high-value pivot points, organizations relying on legacy SonicWall GMS deployments face compounding regulatory and operational risk with no vendor remediation path.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Information Technology/IT4 days ago

Root-Level Takeover via APT: How CVE-2026-109518 Turns a Package Retry into a Supply-Chain Weapon

On November 4, 2026, Debian, Ubuntu, and APT developers disclosed CVE-2026-109518, a critical vulnerability in the APT package manager affecting Debian 12+ and Ubuntu 22.04+. An attacker positioned as a man-in-the-middle — such as a malicious mirror, rogue proxy, or network interceptor — can exploit APT's default retry behavior (Acquire::Retries) to substitute a verified package with a malicious one during download, triggering arbitrary code execution as root at install time. The flaw carries a CVSS 4.0 score of 7.7 and affects all distributions built on Debian and Ubuntu. Patched APT versions were released the same day for Ubuntu 22.04 through 26.10 and Debian 11+, though Debian's testing branch remained on the vulnerable version hours after disclosure. This incident underscores the growing threat of supply-chain attacks targeting open-source package infrastructure. As enterprise Linux deployments proliferate across hybrid and multi-cloud environments, unencrypted or insufficiently monitored package-update traffic becomes a viable attack surface, making network-layer controls and transit encryption essential complements to patch management.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services4 days ago

ARTEX Agentic AI Turns ConnectWise Into a Supply Chain Weapon: What the October 2026 Attack Reveals About AI-Driven Cloud Threats

Between October 10–15, 2026, a suspected Chinese state-aligned threat actor deployed ARTEX, a Go-based multi-agent LLM penetration-testing framework, to execute an automated supply chain attack against ConnectWise Cloud Backup, compromising hundreds of global organizations across aerospace, defense, energy, financial services, government, and technology sectors. The attackers generated over 151,000 failed logon events via AI-driven password spraying, then abused pre-granted OAuth permissions to authenticate into downstream Microsoft 365 tenants without interactive logins. AI agents ran Microsoft Graph operations to perform directory reconnaissance, escalate privileges, and implant persistent OAuth backdoors—reducing time-to-privileged-access to under three hours per environment. This incident marks a watershed moment in offensive AI adoption: nation-state actors are now operationalizing autonomous agentic frameworks to compress attack timelines from days to hours, pivot across multi-tenant cloud architectures at machine speed, and leave persistent backdoors that survive primary remediation efforts. The convergence of AI-augmented intrusion and supply chain compromise demands immediate reassessment of cloud identity governance, OAuth application controls, and east-west segmentation strategies.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Information Technology/IT4 days ago

Node2Shell (CVE-2026-111497): Inside the Brotli Decoder Flaw That Threatens Every Cloud-Native Stack

On October 21, 2026, the Node.js project disclosed CVE-2026-111497, a CVSS v4.0 9.2-rated out-of-bounds write in the Brotli decoder library bundled across Node.js, Bun, .NET, Python, Envoy, Istio, and PHP for Windows. Dubbed Node2Shell, the unauthenticated flaw allows an attacker to deliver malicious Brotli-compressed data via inbound HTTP request bodies or outbound fetch() responses, potentially achieving remote code execution, memory disclosure, or denial of service. CISA added the CVE to its Known Exploited Vulnerabilities catalog on October 27, 2026, with a November 10 federal deadline. Honeypot telemetry confirms active exploitation attempts, and public proof-of-concept code emerged within hours of disclosure. Node2Shell underscores the systemic risk of shared compression libraries embedded across heterogeneous runtimes and service meshes. As cloud-native architectures proliferate—spanning Kubernetes clusters, Envoy-based service meshes, and polyglot microservices—a single upstream library flaw can simultaneously affect dozens of independent stacks, dramatically expanding the blast radius and complicating coordinated patch response.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Government Administration4 days ago

69GB in 24 Minutes: How Attackers Drained Philippine Migrant Worker Records from an Unguarded Government Server

In late October 2026, an unidentified threat actor breached the Philippine Overseas Employment Administration (POEA), exfiltrating approximately 69GB of sensitive data across 27 SQL Server backup databases in under 25 minutes. The attacker leveraged privilege escalation tools GodPotato and SeImpersonate alongside the Impacket Python library to move data to an open staging server hosted on UpCloud infrastructure in Singapore. Stolen records encompassed overseas-employment case management, accreditation files, contracts, and financial records including LandBank data. Threat intelligence firm Hunt.io discovered the breach by identifying an exposed open directory containing attack tools and transfer logs, though attribution remains unconfirmed. This incident underscores a troubling pattern of under-secured government portals in Southeast Asia being targeted for high-value diaspora PII. The combination of overprivileged service accounts, exposed management ports (SMB 445, WinRM 5985/47001), and the absence of egress controls enabled a rapid, high-volume exfiltration that mirrors tactics increasingly observed against public-sector entities across the Asia-Pacific region.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(high)

IImpact(high)

Read report

Telecommunications4 days ago

CVE-2026-58868: Google's Critical Android RCE Flaw Needs No Click — What Enterprises Must Do Now

In November 2026, Google disclosed CVE-2026-58868, a critical remote code execution vulnerability affecting Android versions 14 through 17, rooted in a heap buffer overflow within the FrameDecoder.cpp onOutputReceived function. The flaw requires no user interaction, enabling a remote attacker to execute arbitrary code silently on unpatched devices. Google's November 2026 security bulletin catalogued 216 vulnerabilities, 23 rated Critical, including a second zero-interaction flaw, CVE-2026-58882, capable of crashing emergency calls via a malformed WAP Push SMS. Patches were assigned to the 2026-11-01 and 2026-11-05 security patch levels, with distribution dependent on individual OEM and carrier schedules. Zero-interaction RCE vulnerabilities in mobile operating systems represent an escalating threat class, as they require no phishing lure or social engineering. With public proof-of-concept code already circulating for the related SMS denial-of-service flaw, the window between disclosure and active exploitation continues to narrow, increasing enterprise risk for unmanaged or BYOD Android endpoints.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Financial Services4 days ago

VasyGrek Dismantled: What the Russian Infostealer Gang's 100+ Attacks Reveal About Cloud Egress and Segmentation Gaps

In November 2026, Russian Ministry of Internal Affairs (MVD) arrested three suspected members of VasyGrek (also known as Fluffy Wolf), a financially motivated threat group active since 2016. The group executed phishing campaigns disguised as financial documents to deploy infostealers and remote access trojans including MetaStealer, WarZone RAT, PureRAT, and BurnsRAT, ultimately siphoning funds from compromised organizational bank accounts. Kaspersky documented over 100 attempted attacks across Russia, Belarus, and Kazakhstan between January and September 2026, targeting metallurgical, healthcare, oil and gas, energy, finance, and government sectors. Authorities seized computer equipment and dismantled virtual server infrastructure spread across foreign jurisdictions. VasyGrek's arrest underscores a persistent and evolving infostealer economy in which off-the-shelf RATs and stealers are layered with multi-stage infection chains and legitimate remote access tools to evade detection. Concurrent activity from Core Werewolf and Insolent Werewolf using ClickFix-style initial access and post-exploitation frameworks signals that the broader threat landscape targeting CIS-region organizations is intensifying, with tactics increasingly blending cybercrime and espionage tradecraft.

High impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(medium)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Information Technology/IT4 days ago

XSA-523: How a Single Rogue VM Can Own Your Entire Xen Host—and What to Do Now

In November 2026, the Xen Project disclosed two critical hypervisor vulnerabilities tracked as CVE-2026-102703 and CVE-2026-102704 under advisory XSA-523. The flaws reside in Xen's grant copy mechanism, which coordinates memory sharing between virtual machines. A logic error allows a malicious guest VM to bypass permission checks and read or write the memory of any other VM on the same host, including the privileged dom0 management domain. All Xen versions from 4.6 onward are affected. Downstream platforms including XCP-ng, Qubes OS, and multiple Debian releases require immediate patching and host reboots to remediate the exposure. VM-escape and hypervisor-level attacks are accelerating as cloud-native and multi-tenant architectures expand attack surfaces. The discovery of XSA-523 by an AI-assisted research tool (Anthropic's Claude) signals that automated vulnerability hunting is maturing, meaning threat actors have equivalent capability. Organizations running shared virtualization infrastructure—especially in healthcare, finance, and critical infrastructure—face heightened regulatory scrutiny and breach liability if hypervisor patching cadences lag behind disclosure timelines.

Critical impact

Kill Chain

ICInitial Compromise(medium)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(high)

Read report

Computer Software/Engineering4 days ago

CVSS 9.8: How a Crafted Image Upload Can Let Attackers Own Your Rails Server

In November 2026, the Ruby on Rails project disclosed a critical vulnerability (GHSA-f3w6-w445-fwh9, CVSS 9.8) in Active Storage, its file-upload subsystem. An unauthenticated attacker can upload a crafted file that exploits ImageMagick's MSL coder to write arbitrary files anywhere on the server's filesystem. Because Active Storage imposes no restrictions on which ImageMagick coders a file may invoke, and because the MSL coder can read and write named files via its scripting interface, exploitation requires only that a file be attached—no variant generation or explicit analysis call is needed. Apps storing uploads on disk are also exposed to arbitrary file reads, enabling credential theft (secret_key_base, database passwords, third-party tokens) and subsequent remote code execution or lateral movement. Rails fixed the flaw in versions 8.1.4.1 and 8.0.5.2, shipping a restrictive ImageMagick security policy alongside the patch. This disclosure follows a separate critical Active Storage flaw (CVE-2026-66066) patched in July 2026 targeting libvips users, signaling a sustained attacker focus on Rails file-processing pipelines. The pattern reflects a broader industry trend of chaining file-upload primitives with image-processing libraries to achieve server-side code execution—a technique with growing prevalence across web frameworks and SaaS platforms.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Government Administration5 days ago

Barracuda's 2026 Critical Flaws: How Authentication Bypass and Root Injection Put 200,000 Customers at Risk

In November 2026, Barracuda Networks disclosed two critical vulnerabilities affecting multiple network security appliances, including its Email Security Gateway, Load Balancer ADC, Web Application Firewall, and others. CVE-2026-116606, a pre-authentication authorization bypass in the ESG, allows attackers to modify global device configurations without credentials. CVE-2026-111560 enables authenticated administrators to inject OS-level commands that execute with root privileges. When chained, the two flaws grant full device compromise. Barracuda released patches across all affected product lines and urged customers to apply firmware updates immediately while restricting administrative interface access to trusted internal networks only. This disclosure echoes Barracuda's 2023 ESG zero-day campaign (CVE-2023-2868), exploited by Chinese-nexus group UNC4841 for over seven months before discovery. The recurrence of critical appliance-level flaws in the same vendor's product line signals a broader industry pattern: network security appliances remain high-value, under-monitored targets, and organizations relying on perimeter security without internal segmentation face compounding risk.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(medium)

EExfiltration(medium)

IImpact(medium)

Read report

Information Technology/IT5 days ago

LLMjacking 2026: How Stolen Cloud API Keys Became a $1 Million AI Fraud Problem

In 2026, Google's Threat Intelligence Group and Mandiant documented a surge in LLMjacking attacks, in which two coordinated threat clusters compromise enterprise cloud LLM infrastructure by stealing API keys, harvesting exposed endpoints, and reselling unauthorized access through proxy services called LLM mixers. One campaign tied to the service jet-night.com generated nearly $1 million in fraudulent token charges against a single victim organization, with some enterprises absorbing more than $100,000 in illegitimate cloud costs in a single day. Attackers also exploited CVE-2026-40217 in LiteLLM to execute arbitrary code, deployed reverse proxies, and established persistent backdoor access within compromised cloud environments. LLMjacking represents a rapidly maturing criminal economy around stolen AI infrastructure. As enterprises accelerate cloud AI adoption, exposed API keys and over-permissioned service accounts create immediate financial and operational risk. The emergence of underground LLM mixer marketplaces signals that credential-based AI resource hijacking is becoming a commoditized threat vector, demanding urgent attention to IAM hygiene, secrets management, and AI-specific egress controls.

Low impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(medium)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

Financial Services5 days ago

Inside the $6.34 Billion Binance Hack: How a Fake Job Interview Became the Biggest Crypto Heist in History

In October 2026, North Korean state-sponsored threat actors known as TraderTraitor (Lazarus Group / APT38) stole approximately $6.34 billion in digital assets from Binance, the world's largest cryptocurrency exchange. The attack began in September 2026 when hackers impersonating a recruiter lured a Binance software engineer through a fake job interview process, delivering zero-day custom malware embedded in a coding assignment hosted on a public code repository. The malware evaded endpoint detection, replaced a legitimate macOS development tool, and established a command-and-control channel. By October 20, attackers had pivoted to two additional employees in Binance's wallet infrastructure, harvesting credentials and a container deployment token before ultimately compromising the wallet signing service on October 29 and transferring billions across multiple blockchains. This incident underscores the accelerating sophistication of North Korean supply-chain and social-engineering campaigns—particularly Contagious Interview and Operation Dream Job—which are increasingly targeting financial and crypto-sector engineers with zero-day malware and identity-based lateral movement. As regulatory scrutiny of digital asset custodians intensifies globally, the breach highlights critical gaps in endpoint detection, internal segmentation, and privileged-access governance that all financial-sector organizations must urgently address.

Critical impact

Kill Chain

ICInitial Compromise(high)

PEPrivilege Escalation(high)

LMLateral Movement(high)

C&CCommand & Control(high)

EExfiltration(high)

IImpact(high)

Read report

1 2 3 4 5...408

[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports

Financial Services

SonicWall Refuses to Patch Critical EoL GMS Flaws — What Your Security Team Must Do Now

Root-Level Takeover via APT: How CVE-2026-109518 Turns a Package Retry into a Supply-Chain Weapon

ARTEX Agentic AI Turns ConnectWise Into a Supply Chain Weapon: What the October 2026 Attack Reveals About AI-Driven Cloud Threats

Node2Shell (CVE-2026-111497): Inside the Brotli Decoder Flaw That Threatens Every Cloud-Native Stack

69GB in 24 Minutes: How Attackers Drained Philippine Migrant Worker Records from an Unguarded Government Server

CVE-2026-58868: Google's Critical Android RCE Flaw Needs No Click — What Enterprises Must Do Now

VasyGrek Dismantled: What the Russian Infostealer Gang's 100+ Attacks Reveal About Cloud Egress and Segmentation Gaps

XSA-523: How a Single Rogue VM Can Own Your Entire Xen Host—and What to Do Now

CVSS 9.8: How a Crafted Image Upload Can Let Attackers Own Your Rails Server

Barracuda's 2026 Critical Flaws: How Authentication Bypass and Root Injection Put 200,000 Customers at Risk

LLMjacking 2026: How Stolen Cloud API Keys Became a $1 Million AI Fraud Problem

Inside the $6.34 Billion Binance Hack: How a Fake Job Interview Became the Biggest Crypto Heist in History

Stop Active Cloud Data Exfiltration

Products

By Role

Customer Stories

Solutions

Resources

Industry

Company

Tools

Security & Legal

Financial Services