Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
BlueNoroff's 2026 Zoom Phishing Campaign: A Wake-Up Call for Crypto Firms
In July 2026, the North Korean state-sponsored group BlueNoroff launched a sophisticated phishing campaign targeting cryptocurrency organizations. The attackers utilized typosquatted Zoom and Microsoft Teams domains to impersonate legitimate videoconferencing platforms. By hijacking trusted Telegram accounts, they invited high-ranking employees to fake meetings, where victims were prompted to grant webcam access. This access allowed the attackers to profile victims' cryptocurrency wallets before delivering malware, enabling selective targeting of high-value individuals. This incident underscores the evolving tactics of threat actors who exploit trust in widely used communication platforms. The integration of social engineering with advanced reconnaissance techniques highlights the need for heightened vigilance and robust security measures within the cryptocurrency sector.
1 month ago
Kill Chain
Interlock Ransomware's 2026 Exploitation of Cisco FMC Zero-Day Vulnerability
In early 2026, the Interlock ransomware group exploited a critical zero-day vulnerability (CVE-2026-20131) in Cisco Secure Firewall Management Center (FMC) software, allowing unauthenticated remote code execution as root. This exploitation began on January 26, 2026, 36 days prior to Cisco's public disclosure on March 4, 2026. The attackers leveraged this vulnerability to gain initial access, deploying custom malware and remote access tools to establish persistence, conduct reconnaissance, and ultimately deploy ransomware across various sectors, including education, healthcare, and manufacturing. The campaign demonstrated a high level of sophistication, utilizing fileless implants and memory-resident webshells to evade detection. ([aws.amazon.com](https://aws.amazon.com/blogs/security/amazon-threat-intelligence-teams-identify-interlock-ransomware-campaign-targeting-enterprise-firewalls/?utm_source=openai)) This incident underscores the increasing trend of ransomware groups exploiting zero-day vulnerabilities to infiltrate enterprise networks. The rapid exploitation of CVE-2026-20131 highlights the critical need for organizations to implement proactive vulnerability management, continuous monitoring, and robust incident response strategies to mitigate the risks associated with such advanced persistent threats.
1 month ago
Kill Chain
HollowGraph Malware: Exploiting Microsoft 365 Calendars for Stealthy Cyber-Espionage
In July 2026, cybersecurity researchers uncovered HollowGraph, a sophisticated malware that exploits Microsoft 365 calendar events for covert command-and-control (C2) communication and data exfiltration. By embedding encrypted instructions and stolen data within calendar events dated far into the future (e.g., May 13, 2050), HollowGraph effectively evades detection by blending malicious activities with legitimate Microsoft Graph API traffic. This technique has been observed targeting at least 12 Israeli organizations, with active communications detected between June and July 2026. The malware's design allows it to bypass traditional security measures, posing significant risks to organizations relying on Microsoft 365 services. The emergence of HollowGraph underscores a growing trend where threat actors leverage trusted cloud services to conduct stealthy cyber-espionage campaigns. This incident highlights the critical need for organizations to enhance monitoring of cloud-based activities, implement robust identity and access management controls, and stay vigilant against novel attack vectors that exploit legitimate platforms for malicious purposes.
1 month ago
Kill Chain
Critical Azure Automation Vulnerability (CVE-2025-29827) Exposes Cross-Tenant Identity Risks
In May 2025, a critical vulnerability (CVE-2025-29827) was identified in Microsoft's Azure Automation service, which is widely used for DevOps, resource deployment, and configuration management. The flaw stemmed from improper authorization mechanisms, allowing authenticated attackers to escalate privileges over the network. Exploiting this vulnerability, attackers could assume another tenant's automation identity, enabling them to create or modify automation scripts and access sensitive configuration data or credentials stored in Azure Automation accounts. This could lead to unauthorized creation, modification, or deletion of resources across an organization's cloud workloads. The vulnerability was assigned a CVSS score of 9.9, indicating its critical severity. Microsoft addressed the issue by updating the default settings to prevent automation accounts from being publicly accessible and issued an advisory to inform users of the necessary security measures. Organizations are advised to audit their Azure Automation configurations and ensure that proper access controls are in place to mitigate potential attacks.
1 month ago
Kill Chain
AI Agents Uncover Critical Redis Vulnerabilities: Immediate Action Required
In July 2026, researchers utilizing Moonshot AI's Kimi K3 agents identified multiple zero-day vulnerabilities in Redis versions 6.2.22, 7.4.9, 8.6.4, and 8.8.0. These vulnerabilities allowed authenticated remote code execution (RCE) through the RESTORE command, with additional dependencies on EVAL, XGROUP, and the RedisBloom module in certain versions. Redis promptly released seven security updates on July 23, 2026, to address these critical flaws. Organizations using affected Redis versions are urged to upgrade immediately to mitigate potential exploitation risks. ([eweek.com](https://www.eweek.com/news/moonshot-ai-kimi-k3-redis-rce-exploits-apac-china/?utm_source=openai)) This incident underscores the accelerating role of AI in both discovering and potentially exploiting software vulnerabilities. The rapid identification and proof-of-concept development by AI agents highlight the need for organizations to enhance their security posture and response times to emerging threats. ([news.shield53.com](https://news.shield53.com/ai-agents-discover-redis-zero-days-cve-analysis-and-rce-threat-across-redis-6x8x/?utm_source=openai))
1 month ago
Kill Chain
Golden Chickens Introduces Four New Modular Malware Families in 2026
In July 2026, the threat actors behind the Golden Chickens malware-as-a-service (MaaS) ecosystem, also known as Venom Spider, introduced four new malware families: TinyEgg, ChonkyChicken, a modularized variant of ChonkyChicken, and ChromEggscalator. These developments signify a strategic shift towards modular, operator-driven tools within the TAG-195 MaaS ecosystem. The modularized ChonkyChicken variant employs a controller-and-plugin architecture, allowing the base implant to dynamically load specific capability modules from attacker-controlled infrastructure, thereby reducing its static detection footprint. All four malware families exhibit consistent command-and-control mechanisms, shared persistence methods, string obfuscation, and execution via legitimate Windows binaries. This evolution underscores TAG-195's commitment to enhancing the adaptability and stealth of its offerings, catering to a diverse range of operational requirements. The emergence of these advanced, modular malware families highlights the ongoing sophistication of MaaS providers and the necessity for organizations to bolster their detection and response strategies against such evolving threats.
1 month ago
Kill Chain
Certighost Exploit: A New Threat to Active Directory Security
In July 2026, researchers H0j3n and Aniq Fakhrul disclosed a critical vulnerability in Active Directory Certificate Services (AD CS), dubbed 'Certighost'. This flaw allows low-privileged Active Directory users to obtain certificates for Domain Controllers, enabling them to impersonate these controllers. Exploiting this vulnerability, attackers can retrieve the 'krbtgt' secret through DCSync, potentially compromising the entire domain. Microsoft addressed this issue with the release of CVE-2026-54121, assigning it a CVSS score of 8.8. Organizations utilizing Enterprise CAs are urged to apply the July 14 updates promptly to mitigate this risk. The public availability of a proof-of-concept exploit underscores the urgency of this matter. While no active exploitation has been reported as of July 24, the existence of a working exploit increases the likelihood of future attacks targeting unpatched systems.
1 month ago
Kill Chain
ChatGPT's 'AgentForger' Vulnerability: A Wake-Up Call for AI Security
In June 2026, Zenity Labs identified a critical vulnerability in OpenAI's ChatGPT Workspace Agents, termed 'AgentForger.' This flaw allowed attackers to craft a phishing link that, when clicked by an employee, could silently create and deploy an autonomous AI agent within the organization's ChatGPT environment. This rogue agent would inherit the employee's identity and access privileges, operating without the employee's knowledge or consent. OpenAI addressed and patched this vulnerability by June 8, 2026. ([zenity.io](https://zenity.io/company-overview/newsroom/company-news/zenity-labs-uncovers-agentforger-a-chatgpt-vulnerability?utm_source=openai)) The 'AgentForger' incident underscores the evolving nature of cyber threats targeting AI systems. As organizations increasingly integrate AI agents into their workflows, ensuring robust security measures and prompt vulnerability management becomes paramount to prevent unauthorized access and potential data breaches.
1 month ago
Kill Chain
Russian Espionage Group Exploits Zimbra Vulnerability in 2025
In July 2025, the Russian state-sponsored threat group known as Laundry Bear initiated a cyber espionage campaign targeting government and commercial organizations by exploiting a zero-day vulnerability (CVE-2025-66376) in the Zimbra Collaboration Suite (ZCS). This vulnerability allowed attackers to execute malicious JavaScript via CSS @import directives in HTML emails, enabling unauthorized access to sensitive data such as emails, passwords, and two-factor authentication tokens. The exploit required no user interaction beyond viewing a malicious email, leading to significant data breaches across multiple sectors. ([cyberscoop.com](https://cyberscoop.com/russian-laundry-bear-zimbra-exploit/?utm_source=openai)) The continued exploitation of unpatched ZCS instances underscores the critical need for organizations to promptly apply security updates. This incident highlights the evolving tactics of state-sponsored actors and the importance of proactive cybersecurity measures to protect sensitive information. ([nsa.gov](https://www.nsa.gov/Press-Room/Press-Releases-Statements/Press-Release-View/Article/4553352/nsa-and-partners-alert-zimbra-collaboration-suite-users-of-a-russian-state-supp/?utm_source=openai))
1 month ago
Kill Chain
Critical Authentication Bypass in Check Point SmartConsole Exploited (CVE-2026-16232)
In July 2026, Check Point Software identified and patched a critical authentication bypass vulnerability (CVE-2026-16232) in its SmartConsole GUI admin panel. This flaw allowed unauthenticated remote attackers to obtain an application login token, granting full administrative privileges to Security Management Servers or Multi-Domain Security Management Servers. Exploitation required the management server to be exposed to the internet without IP restrictions on Trusted Clients. Successful attacks enabled adversaries to modify security configurations and policies, posing significant risks to affected organizations. The active exploitation of this vulnerability underscores the critical importance of securing management interfaces and adhering to best practices for access control. Organizations are urged to apply the provided patches promptly and implement recommended mitigations to prevent unauthorized access and potential compromise of security infrastructure.
2 months ago
Kill Chain
Chaos Ransomware's msaRAT: Concealing C2 Traffic Through Browsers
In July 2026, the Chaos ransomware group deployed a new Rust-based remote access trojan (RAT) named msaRAT, which leverages Chrome and Edge browsers to conceal command-and-control (C2) communications. By initiating a headless browser session and utilizing the Chrome DevTools Protocol (CDP), msaRAT routes its C2 traffic through the browser, effectively evading traditional network detection mechanisms. This method allows the malware to execute commands and exfiltrate data without direct network connections, significantly reducing the likelihood of detection. The emergence of msaRAT underscores a growing trend among threat actors to exploit legitimate applications and protocols to mask malicious activities. This technique highlights the need for enhanced behavioral analysis and anomaly detection capabilities within cybersecurity defenses to identify and mitigate such sophisticated threats.
2 months ago
Kill Chain
RefluXFS Vulnerability: Critical Linux Kernel Flaw Grants Root Access
In July 2026, a critical vulnerability known as RefluXFS (CVE-2026-64600) was disclosed in the Linux kernel's XFS filesystem. This nine-year-old race condition allows local attackers to overwrite protected files, such as /etc/passwd or SUID-root binaries, thereby gaining root privileges. The flaw affects systems running Linux kernel version 4.11 or later with XFS filesystems where reflink is enabled—a default setting in major enterprise Linux distributions. Exploitation is highly reliable, leaves no kernel log output, and the on-disk modifications persist across reboots. ([blog.qualys.com](https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600?utm_source=openai)) The discovery of RefluXFS underscores the persistent risk posed by longstanding vulnerabilities in widely used systems. Its exploitation bypasses standard security mechanisms, highlighting the need for continuous vigilance and prompt patching in the face of evolving threats. ([blog.qualys.com](https://blog.qualys.com/vulnerabilities-threat-research/2026/07/22/refluxfs-a-linux-kernel-local-privilege-escalation-to-root-in-xfs-cve-2026-64600?utm_source=openai))
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports