Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 79 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 937–948 / 4893 reports
Unit 42 Confirms First AI-Enhanced Multi-Vector Cyberattacks in the Wild
Financial Services2 months ago

Unit 42 Confirms First AI-Enhanced Multi-Vector Cyberattacks in the Wild

Palo Alto Networks' Unit 42 has documented a significant escalation in cybersecurity threats, reporting the first confirmed case of AI-enhanced multi-vector attacks in the wild. In one investigated incident, attackers leveraged agentic AI frameworks to exploit 50 enterprise applications and vulnerabilities within 10 hours—a process that would have traditionally taken 10 days. The attackers demonstrated machine-speed reconnaissance, vulnerability discovery, and exploitation across the entire attack chain, representing what Unit 42 characterizes as a generational shift in cybersecurity. This development validates Unit 42's April 2024 prediction that AI capabilities demonstrated in controlled environments would reach adversaries within a year. The emergence of these attacks coincides with widespread availability of frontier AI models and agentic frameworks, fundamentally altering the threat landscape and challenging existing defensive strategies built for human-speed attacks.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
Emergency CISA Directive: Citrix NetScaler RCE Vulnerability Under Active Attack
Government Administration2 months ago

Emergency CISA Directive: Citrix NetScaler RCE Vulnerability Under Active Attack

CISA has issued an emergency directive ordering federal agencies to patch Citrix NetScaler appliances by August 29, 2026, following active exploitation of CVE-2026-8452, a high-severity memory overflow vulnerability. The flaw affects NetScaler ADC and Gateway appliances configured with VPN or AAA virtual servers, allowing unauthenticated attackers to achieve remote code execution as root. Initially categorized by Citrix as only capable of denial-of-service attacks, security researchers later demonstrated full RCE capabilities, leading to widespread "pray and spray" attacks deploying web shells on compromised systems. This incident highlights the critical security risks facing network infrastructure devices, particularly as threat actors increasingly target VPN and gateway appliances for initial access. With over 22,000 NetScaler ADC and 1,800 Gateway instances exposed online, this vulnerability represents a significant attack surface that could enable lateral movement and data exfiltration across enterprise networks.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
TeamPCP Supply Chain Attack: How Two Hackers Compromised 1,000+ Organizations Through Developer Platforms
Computer Software/Engineering2 months ago

TeamPCP Supply Chain Attack: How Two Hackers Compromised 1,000+ Organizations Through Developer Platforms

In August 2026, Australian Federal Police arrested two men aged 21 and 23 in connection with the TeamPCP hacking group's extensive supply chain attacks targeting developer platforms and open-source repositories. The group compromised trusted software components including packages from Trivy, LiteLLM, SAP, and TanStack, while also breaching high-profile organizations like OpenAI, GitHub, and the European Commission. Their malicious code injection campaigns affected over 1,000 organizations globally, resulting in the theft of 500,000 credentials and exfiltration of 300GB of data, with estimated remediation costs reaching hundreds of millions of dollars. This incident highlights the growing threat of supply chain attacks as cybercriminals increasingly target the software development ecosystem to achieve massive scale impact. With organizations' heavy reliance on open-source components and third-party packages, these attacks demonstrate how compromising a few trusted software elements can cascade into global security incidents affecting critical infrastructure and enterprise systems.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
PaperCut Zero-Day Exploitation: When Print Management Becomes a Gateway
Higher Education/Acadamia2 months ago

PaperCut Zero-Day Exploitation: When Print Management Becomes a Gateway

In August 2026, PaperCut Software issued an urgent security advisory warning of active zero-day exploitation targeting all versions of PaperCut NG and MF print management software. The company confirmed customer incidents involving Internet-exposed servers, with attackers exploiting an undisclosed vulnerability to gain initial access to corporate networks. PaperCut released emergency patches and provided indicators of compromise including suspicious pc-app.exe process activity and modified server.log files with specific database error patterns. The company has a documented history of being targeted by ransomware groups including Clop and LockBit who previously exploited PaperCut vulnerabilities for network access rather than direct document theft. This incident highlights the continued targeting of enterprise print management infrastructure as an attack vector, particularly relevant given the rise of ransomware groups exploiting Internet-facing business applications for initial compromise and the increasing sophistication of zero-day campaigns against widely-deployed enterprise software.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(medium)
Read report
Critical Next.js RCE Vulnerabilities Demand Immediate Patching: CVE-2026-75604 Analysis
Computer Software/Engineering2 months ago

Critical Next.js RCE Vulnerabilities Demand Immediate Patching: CVE-2026-75604 Analysis

Vercel released security patches on August 25, 2026, for two critical vulnerabilities in Next.js that enable unauthenticated remote code execution. CVE-2026-75604 (CVSS 9.0) affects Windows-hosted Next.js applications through a path traversal flaw, while a second vulnerability (CVSS 9.5) exploits AVIF image processing via a heap buffer overflow in the libheif library. Both vulnerabilities affect multiple Next.js versions spanning from 10.0.0 through 16.3.2, with no known workarounds for affected Windows deployments requiring immediate upgrades. This incident highlights the growing trend of AI-assisted vulnerability discovery and emphasizes the critical importance of securing web application frameworks. As Next.js powers millions of applications worldwide, these RCE vulnerabilities demonstrate how upstream dependency flaws and platform-specific issues can create widespread attack surfaces across the modern web ecosystem.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
AI-Powered HTTP Terminator Unleashes Novel Desync Attacks on Financial Websites
Banking/Mortgage2 months ago

AI-Powered HTTP Terminator Unleashes Novel Desync Attacks on Financial Websites

In 2026, security researcher James Kettle from PortSwigger developed HTTP Terminator, an AI-powered open source tool that autonomously discovers novel HTTP request smuggling vulnerabilities. The tool successfully identified and exploited previously unknown desync attack vectors against live enterprise websites, including multiple financial services companies. HTTP Terminator operates by analyzing successful exploits to inspire new attack techniques, creating a self-improving feedback loop that enhances its discovery capabilities over time. This research demonstrates AI's capability to conduct genuinely novel security research beyond simple vulnerability detection, marking a significant evolution in autonomous threat discovery. As AI-driven attack tools become more sophisticated and accessible through open source releases, organizations face an accelerated threat landscape where traditional defensive measures may struggle to keep pace with machine-generated exploit techniques.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Dark Caracal Unveils Blockchain-Powered GoCaracal Malware in Advanced Espionage Campaign
Telecommunications2 months ago

Dark Caracal Unveils Blockchain-Powered GoCaracal Malware in Advanced Espionage Campaign

The Lebanon-linked Dark Caracal threat group has deployed a previously unknown malware framework called GoCaracal to enhance its cyber espionage capabilities across Latin America. Discovered by Arctic Wolf researchers in August 2026 during investigation of a targeted intrusion in Venezuela, GoCaracal represents a significant evolution in Dark Caracal's toolkit, featuring modular architecture, encrypted communications, and innovative use of Ethereum blockchain for backup command-and-control infrastructure. The malware comes in two variants: a lightweight implant for initial access and a comprehensive version for intelligence harvesting and persistent control. This incident highlights the growing sophistication of state-sponsored espionage operations and their adaptation to modern defensive measures. The integration of blockchain technology for C2 resilience and modular malware design demonstrates how advanced persistent threat groups are evolving their tactics to maintain long-term access in increasingly monitored environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
How North Korean Operatives Are Infiltrating Organizations as Fake IT Workers
Health Care / Life Sciences2 months ago

How North Korean Operatives Are Infiltrating Organizations as Fake IT Workers

Throughout 2026, North Korean operatives significantly enhanced their tactics for infiltrating organizations by posing as legitimate IT workers using stolen or fabricated identities. Huntress Security documented three major investigations involving healthcare and financial services organizations where DPRK agents successfully gained employment, sent wages back to the regime, and potentially planted malware or stole sensitive data. These sophisticated insider threats utilized advanced techniques including PiKVM devices for remote hardware control, extensive VPN and proxy infrastructure to mask geolocation, digitally altered identity documents, and translation tools to overcome language barriers. This campaign represents the evolution of state-sponsored insider threats, where traditional perimeter security becomes irrelevant as malicious actors are hired as legitimate employees with authorized access to critical systems and data.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
CISA Sounds Alarm: Six Critical Vulnerabilities Under Active Exploitation
Information Technology/IT2 months ago

CISA Sounds Alarm: Six Critical Vulnerabilities Under Active Exploitation

In August 2026, CISA added six critical vulnerabilities to its Known Exploited Vulnerabilities catalog, including CVE-2026-8452 affecting Citrix NetScaler ADC and Gateway systems. Active exploitation was observed with attackers deploying web shells and conducting reconnaissance commands across 12 countries. The campaign also leveraged older Linux kernel flaws, Microsoft SQL Server vulnerabilities, and Red Hat system bugs, demonstrating how threat actors continue to exploit unpatched legacy systems alongside newer attack vectors. This incident highlights the persistent challenge of vulnerability management as AI-enabled threat actors increasingly automate exploitation of both recent and legacy flaws. The multi-vector approach demonstrates how attackers combine new and old vulnerabilities to maximize their attack surface against inadequately patched infrastructure.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
GPUThor Rowhammer Attack Bypasses NVIDIA GPU Security in 2026 Breakthrough
Computer Hardware2 months ago

GPUThor Rowhammer Attack Bypasses NVIDIA GPU Security in 2026 Breakthrough

In August 2026, University of Toronto researchers disclosed GPUThor, a sophisticated Rowhammer attack targeting NVIDIA workstation GPUs with GDDR6 memory that defeats error correction codes (ECC). The attack impacts RTX A6000, A5000, A4500, and A4000 models, enabling attackers to achieve denial-of-service conditions and privilege escalation to root access on host systems. GPUThor uses non-uniform hammering techniques to generate up to 377,000 bit flips per gigabyte, vastly exceeding previous GPU Rowhammer attacks and successfully bypassing NVIDIA's recommended ECC mitigation through multi-bit corruption exploitation. This hardware vulnerability represents a significant evolution in GPU-based attacks as organizations increasingly rely on shared GPU infrastructure for AI workloads and cloud computing. The attack highlights critical security gaps in hardware-level protections and the growing attack surface presented by specialized computing hardware in enterprise environments.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Dark Caracal's GoCaracal Malware Pioneers Ethereum Smart Contract C2 Infrastructure
Telecommunications2 months ago

Dark Caracal's GoCaracal Malware Pioneers Ethereum Smart Contract C2 Infrastructure

In June 2026, threat actors linked to Dark Caracal deployed GoCaracal, a previously undocumented Go-based malware framework, against a Venezuelan communications organization. Arctic Wolf discovered this sophisticated malware uses Ethereum smart contracts as a fallback mechanism to retrieve replacement command-and-control (C2) server addresses when primary servers fail. GoCaracal provides remote shell access, payload execution, browser data theft, keylogging, and remote desktop control capabilities, delivered through phishing campaigns using malicious SVG files. This incident demonstrates the evolution of C2 resilience mechanisms as threat actors adapt to increased infrastructure takedowns and incorporate blockchain technology for operational persistence, highlighting the need for comprehensive egress filtering and behavioral anomaly detection.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
How TeamPCP's Supply Chain Attack Compromised 1,000+ Organizations Through Trusted Security Tools
Computer Software/Engineering2 months ago

How TeamPCP's Supply Chain Attack Compromised 1,000+ Organizations Through Trusted Security Tools

In March 2026, the TeamPCP cybercrime syndicate executed a sophisticated supply chain attack that compromised multiple open-source security tools including Trivy scanner, Checkmarx KICS, and LiteLLM AI gateway. The attackers stole publishing credentials from trusted projects and pushed poisoned versions through legitimate release channels across GitHub Actions, Docker Hub, npm, PyPI, and OpenVSX ecosystems. This credential-chaining technique allowed them to compromise over 1,000 organizations globally, steal more than 500,000 credentials, and exfiltrate at least 300GB of sensitive data including CI/CD pipeline secrets and cloud access tokens. This incident highlights the growing sophistication of supply chain attacks targeting the software development lifecycle, particularly as organizations increasingly rely on open-source components and automated CI/CD pipelines without proper security controls and credential management practices.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports