Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 48 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 565–576 / 4893 reports
Critical Zero-Day in Arista VeloCloud Orchestrator Exposes SD-WAN Infrastructure Risk
Critical Zero-Day in Arista VeloCloud Orchestrator Exposes SD-WAN Infrastructure Risk
Telecommunications1 month ago

Critical Zero-Day in Arista VeloCloud Orchestrator Exposes SD-WAN Infrastructure Risk

In September 2026, Arista Networks disclosed CVE-2026-93952, a maximum-severity zero-day vulnerability in VeloCloud Orchestrator (VCO) On-Prem deployments that was being actively exploited. The flaw stems from improper input validation in certificate-based authentication, allowing remote attackers to access privileged internal VCO host functionality without requiring system privileges or user interaction. The U.S. CISA immediately added the vulnerability to its Known Exploited Vulnerabilities catalog and mandated federal agencies secure their networks within 48 hours. This incident highlights the escalating threat to SD-WAN infrastructure as organizations increasingly rely on hybrid connectivity solutions. With Arista being a Fortune 500 company serving over 10,000 customers worldwide, this zero-day demonstrates how critical network infrastructure remains a high-value target for sophisticated threat actors seeking to compromise enterprise connectivity and potentially pivot to broader network access.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
How One Kubernetes YAML File Can Compromise Your Entire Google Cloud Organization
How One Kubernetes YAML File Can Compromise Your Entire Google Cloud Organization
Computer Software/Engineering1 month ago

How One Kubernetes YAML File Can Compromise Your Entire Google Cloud Organization

A critical security vulnerability in Google Kubernetes Config Connector (KCC) allows attackers with limited Kubernetes namespace access to escalate privileges and gain complete control over entire Google Cloud organizations. The attack, dubbed ConfigConfusion, exploits a confused deputy problem where KCC's organization-level service account executes IAM changes requested by users who lack corresponding Google Cloud permissions. Attackers can submit a single YAML IAMPolicyMember resource to grant themselves roles/owner privileges across the entire organization, effectively bypassing all authentication controls without ever possessing Google Cloud credentials. This vulnerability highlights the growing risks of infrastructure-as-code systems where authorization gaps between Kubernetes RBAC and cloud provider IAM create unprecedented privilege escalation pathways, particularly as organizations increasingly adopt GitOps workflows and multi-cloud architectures.

Critical impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
September 2026: State-Sponsored Groups Target Network Management Infrastructure
September 2026: State-Sponsored Groups Target Network Management Infrastructure
Telecommunications1 month ago

September 2026: State-Sponsored Groups Target Network Management Infrastructure

The September 2026 InfraTrust Pulse report revealed a concerning escalation in attacks targeting network infrastructure management systems, with 158 security advisories covering 1,699 vulnerabilities across 17 vendors. Attackers successfully exploited critical flaws in Cisco Secure Firewall Management Center (CVE-2026-20079), Cisco Identity Services Engine (CVE-2026-76460), and SonicWall SMA 1000 appliances before vendors could patch them. State-sponsored groups including Sandworm and ransomware gangs like Qilin chained these vulnerabilities to gain root access, deploy tunneling tools, harvest credentials, and establish persistent control over enterprise network infrastructure. This incident represents a strategic shift where threat actors are bypassing individual network devices to compromise the centralized management platforms that control entire network fabrics, amplifying their impact across organizations' critical infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
Check Point Security Gateway Under Attack: Critical VPN RCE Vulnerability Exploited in the Wild
Check Point Security Gateway Under Attack: Critical VPN RCE Vulnerability Exploited in the Wild
Computer/Network Security1 month ago

Check Point Security Gateway Under Attack: Critical VPN RCE Vulnerability Exploited in the Wild

Check Point confirmed active exploitation of CVE-2026-85102, a critical pre-authentication remote code execution vulnerability in its Security Gateway VPN certificate-handling functionality, beginning September 12, 2026. Threat actors used anonymizing infrastructure including VPNs and proxies to hide their locations while exploiting the flaw. The Dutch NCSC had previously warned of imminent exploitation on September 10. A second zero-day vulnerability, CVE-2026-93616, affecting the Management web service has been exploited since July 23, allowing script execution and Java class loading. CISA added both flaws to its Known Exploited Vulnerabilities catalog with a September 25 remediation deadline. This incident highlights the persistent targeting of VPN infrastructure by sophisticated threat actors, reflecting the broader trend of exploiting network perimeter security solutions that became critical during remote work adoption and continue to serve as high-value attack vectors.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
How Attackers Hijacked a Trusted Developer Domain for ClickFix Campaigns
Computer Software/Engineering1 month ago

How Attackers Hijacked a Trusted Developer Domain for ClickFix Campaigns

In September 2026, the commonly used placeholder domain third-party.com began serving ClickFix attacks targeting Windows users through a fake Cloudflare verification page. The attack copied malicious PowerShell commands to victims' clipboards, instructing them to execute the commands manually to bypass traditional security measures. Unlike reserved documentation domains like example.com, third-party.com was a registrable domain that had been referenced in thousands of code repositories and official documentation from trusted sources like Chromium and W3C. The attack represents a sophisticated supply chain threat that exploits developers' trust in documentation examples and demonstrates how attackers can weaponize commonly referenced infrastructure domains. While the payload servers were inactive during investigation, the incident highlights the risks of using non-reserved domains as placeholders in production code and documentation.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
RemControl Android Banking Malware: New MaaS Platform Targets Europe and Canada
RemControl Android Banking Malware: New MaaS Platform Targets Europe and Canada
Banking/Mortgage1 month ago

RemControl Android Banking Malware: New MaaS Platform Targets Europe and Canada

In September 2026, cybersecurity researchers discovered RemControl, a new Android malware-as-a-service (MaaS) platform targeting banking users across Europe and Canada through sophisticated phishing campaigns. The malware impersonates the popular TVTap IPTV application via fake Google Play pages and malvertising campaigns, deploying over 30 banking overlays to steal credentials from financial institutions across Italy, France, Spain, Poland, Portugal, and Canada. RemControl employs advanced evasion techniques including VPN services to block Google Play Protect scans, accessibility service abuse for remote device control, and dynamic C2 infrastructure rotation via Telegram channels. This incident highlights the continued evolution of mobile banking trojans, particularly the integration of AI-assisted development and sophisticated anti-detection mechanisms. The malware's ability to dynamically receive new targets and perform real-time device manipulation represents a significant escalation in mobile banking threats, coinciding with increased regulatory focus on mobile security frameworks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
First-Ever Terraform Registry Supply Chain Attack: North Korean Hackers Deploy Sophisticated Go Malware
First-Ever Terraform Registry Supply Chain Attack: North Korean Hackers Deploy Sophisticated Go Malware
Computer Software/Engineering1 month ago

First-Ever Terraform Registry Supply Chain Attack: North Korean Hackers Deploy Sophisticated Go Malware

In September 2026, cybersecurity researchers discovered North Korean threat actors using HashiCorp's Terraform Registry to distribute Go-based malware for the first time. The attackers published four malicious packages across Terraform providers and Go modules, accumulating over 1,600 downloads before detection. The malware employed sophisticated dual command-and-control channels using blockchain dead drops and Slack APIs, with execution triggered only during specific cryptographic operations to avoid detection. This campaign represents an expansion of the previously identified Graphalgo operation, demonstrating DPRK actors' continued evolution of supply chain attack vectors beyond traditional npm and PyPI repositories. This incident highlights the growing sophistication of state-sponsored supply chain attacks as threat actors diversify their distribution channels to target infrastructure-as-code and cloud-native development workflows, making detection and prevention increasingly challenging for organizations.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
GitLab Email Token Flaw Enables Supply Chain Attacks Through CI/CD Pipeline Compromise
GitLab Email Token Flaw Enables Supply Chain Attacks Through CI/CD Pipeline Compromise
Computer Software/Engineering1 month ago

GitLab Email Token Flaw Enables Supply Chain Attacks Through CI/CD Pipeline Compromise

In September 2026, Aikido Security disclosed a critical vulnerability in GitLab's email-based issue creation feature that allows attackers to impersonate users and execute unauthorized code commits. The flaw stems from GitLab's private email addresses for filing issues, which contain non-expiring tokens that can be exploited by anyone who obtains them. Attackers can use these leaked addresses to commit code patches to any branch the user has access to, including main branches, and trigger CI/CD jobs that execute with the victim's permissions. The attack bypasses IP restrictions and two-factor authentication, potentially compromising entire development pipelines and supply chains. This incident highlights the growing sophistication of supply chain attacks targeting developer infrastructure and CI/CD environments. As organizations increasingly rely on automated development workflows and DevOps practices, vulnerabilities in platforms like GitLab pose significant risks to software integrity and organizational security posture.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
ClickFix Attack Analysis: When Your Logo Becomes the Weapon
ClickFix Attack Analysis: When Your Logo Becomes the Weapon
Banking/Mortgage1 month ago

ClickFix Attack Analysis: When Your Logo Becomes the Weapon

ClickFix represents a sophisticated social engineering technique that leverages trusted brand logos and familiar verification prompts to deceive victims into executing malicious commands on their own systems. Unlike traditional malware campaigns, ClickFix attacks require no code injection or exploit delivery - instead, they manipulate users into becoming the attack vector themselves by mimicking legitimate CAPTCHA screens, brand verification pages, and system prompts. These campaigns adapt dynamically to victim operating systems, delivering tailored instructions for Windows or macOS environments, making detection through traditional signature-based methods ineffective. This attack method exemplifies the current shift toward human-centric attack vectors that bypass traditional security controls by exploiting psychological manipulation rather than technical vulnerabilities. As organizations increasingly deploy sophisticated endpoint protection and network security tools, threat actors are pivoting to techniques that leverage the weakest link in most security architectures - human trust and recognition patterns.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Microsoft Takes Down EvilTokens: How AI-Powered Phishing Services Threaten Enterprise Identity Security
Microsoft Takes Down EvilTokens: How AI-Powered Phishing Services Threaten Enterprise Identity Security
Financial Services1 month ago

Microsoft Takes Down EvilTokens: How AI-Powered Phishing Services Threaten Enterprise Identity Security

In September 2026, Microsoft successfully disrupted EvilTokens, a sophisticated phishing-as-a-service (PhaaS) platform operated by threat actor Storm-2992. The AI-powered cybercrime service facilitated device code phishing attacks targeting Microsoft 365 accounts, compromising over 12,000 inboxes across 10,000+ organizations worldwide. Microsoft seized 50 websites and disabled 150+ domains, while UK authorities arrested two suspects. EvilTokens distinguished itself by automating device code authentication abuse at scale, using AI to craft tailored phishing lures, analyze compromised inboxes for high-value targets, and streamline business email compromise campaigns sold for $1,500 upfront plus $500 monthly via Telegram. This incident highlights the alarming evolution of phishing-as-a-service platforms leveraging AI to democratize sophisticated attacks. As threat actors increasingly weaponize legitimate authentication mechanisms and AI capabilities, organizations face unprecedented challenges in defending against automated, scalable identity-based attacks that bypass traditional security controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Massive Chinese Relay Network Exposed Circumventing US AI Model Controls
Massive Chinese Relay Network Exposed Circumventing US AI Model Controls
Computer Software/Engineering1 month ago

Massive Chinese Relay Network Exposed Circumventing US AI Model Controls

In September 2026, Team Cymru researchers discovered a vast network of over 80,000 AI relay servers enabling Chinese users to access frontier AI models from US companies including OpenAI, Anthropic, Google, and xAI while masking their identities and locations. The relay infrastructure allows systematic circumvention of geographic restrictions and terms of service, with evidence suggesting large-scale model distillation attempts. Over an eight-day period, Chinese IP addresses transmitted 14TB of data through relay stations, with particularly suspicious traffic to Anthropic showing a 58:1 upload-to-download ratio consistent with AI model cloning operations. This campaign leverages open-source software packages like Claude Relay Service and sub2api, distributed through GitHub and Telegram channels with thousands of subscribers, pointing to widespread adoption of these circumvention techniques. This incident highlights the growing sophistication of AI intellectual property theft operations and the urgent need for enhanced detection capabilities as nation-state actors increasingly target frontier AI models for competitive advantage.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Gulf Cyber Crisis: UAE and Saudi Arabia Under AI-Powered Attack Siege
Gulf Cyber Crisis: UAE and Saudi Arabia Under AI-Powered Attack Siege
Financial Services1 month ago

Gulf Cyber Crisis: UAE and Saudi Arabia Under AI-Powered Attack Siege

The United Arab Emirates and Saudi Arabia absorbed 50% of all cyberattacks recorded across the Gulf region in the first half of 2026, with organizations experiencing nearly 2,700 attacks per week compared to the global average of 2,300. The attacks have shifted from highly visible DDoS and website defacements to sophisticated, targeted intrusions focusing on vulnerability exploitation (38% of initial access vectors), stealthy infiltration of critical infrastructure, and data gathering operations. These financially-motivated cybercriminals are leveraging AI tools to accelerate exploit development and target the expanded attack surfaces created by aggressive digital transformation initiatives in both nations. This incident reflects the broader evolution of cyber threats in 2026, where AI-assisted attackers are demonstrating near-autonomous capabilities that can progress faster than traditional defense mechanisms. The emergence of autonomous sandbox breakouts and AI-accelerated vulnerability discovery represents a fundamental shift in the threat landscape, forcing organizations to rethink their cybersecurity strategies beyond conventional perimeter defenses.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports