The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Financial Services
Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.
Explore Other Sectors
Financial Services Threat Reports
Critical Stored XSS Vulnerability in Zimbra's Briefcase Feature: CVE-2026-33370
In March 2026, a stored cross-site scripting (XSS) vulnerability, identified as CVE-2026-33370, was discovered in Zimbra Collaboration Suite (ZCS) versions 10.0 and 10.1. This flaw resided in the Briefcase feature, where insufficient sanitization of specific uploaded file types allowed attackers to embed malicious JavaScript. When users accessed these compromised files, the scripts executed within their session context, potentially leading to data exfiltration or unauthorized actions. Zimbra promptly addressed this issue by releasing version 10.1.19, urging all users to update their systems to mitigate the risk. ([nvd.nist.gov](https://nvd.nist.gov/vuln/detail/cve-2026-33370?utm_source=openai)) The discovery of CVE-2026-33370 underscores the persistent threat posed by XSS vulnerabilities in widely used collaboration platforms. Given Zimbra's extensive user base, including numerous businesses and government agencies, timely patching is crucial to prevent potential exploitation. This incident highlights the importance of regular security assessments and prompt software updates to safeguard sensitive information.
2 months ago
Kill Chain
Insider Threats: Cybersecurity Experts Turned Cybercriminals
In 2023, three U.S. cybersecurity professionals—Ryan Goldberg, Kevin Martin, and Angelo Martino—exploited their insider knowledge to conduct ransomware attacks using the ALPHV/BlackCat variant. Operating between April and December, they targeted multiple organizations, including a medical device company, a pharmaceutical firm, and a drone manufacturer. The trio encrypted victims' data and demanded substantial cryptocurrency ransoms, successfully extorting approximately $1.2 million from one victim. Their actions culminated in guilty pleas and subsequent prison sentences of four years each. ([justice.gov](https://www.justice.gov/opa/pr/two-americans-who-attacked-multiple-us-victims-using-alphv-blackcat-ransomware-sentenced?utm_source=openai)) This case underscores a disturbing trend where trusted insiders leverage their positions for malicious gain, highlighting the critical need for robust internal security measures and continuous monitoring to detect and prevent such insider threats.
2 months ago
Kill Chain
Progress ShareFile SZC Vulnerabilities: A 2026 Security Wake-Up Call
In April 2026, critical vulnerabilities were discovered in Progress Software's ShareFile Storage Zones Controller (SZC), specifically CVE-2026-2699 and CVE-2026-2701. These flaws allowed unauthenticated attackers to access restricted configuration pages and execute arbitrary code on affected systems. Despite the release of patches in March 2026, by July 2026, credible external threats targeting unpatched SZC instances prompted Progress to advise customers to immediately shut down their servers to prevent potential data breaches. This incident underscores the persistent risks associated with unpatched software vulnerabilities, especially in widely used enterprise solutions. Organizations are reminded of the importance of timely patch management and proactive security measures to mitigate evolving cyber threats.
2 months ago
Kill Chain
Critical Authentication Bypass in Gitea Docker Image (CVE-2026-20896)
In July 2026, a critical authentication bypass vulnerability, CVE-2026-20896, was discovered in Gitea's official Docker image versions up to and including 1.26.2. This flaw allowed unauthenticated attackers to impersonate any user, including administrators, by exploiting a default configuration that trusted reverse-proxy authentication headers from any source IP address. Exploitation began less than two weeks before public disclosure, with approximately 6,200 Gitea instances exposed on the public web. Successful exploitation granted attackers full access to repositories, CI/CD secrets, and administrative functions, posing significant risks to organizations relying on Gitea for source code management. The rapid exploitation of CVE-2026-20896 underscores the critical importance of promptly addressing default configuration vulnerabilities in widely used open-source tools. Organizations must remain vigilant, ensuring that default settings are reviewed and adjusted to align with security best practices to prevent unauthorized access and potential data breaches.
2 months ago
Kill Chain
Odido Data Breach 2026: A Wake-Up Call for Telecom Security
In February 2026, Dutch telecommunications provider Odido experienced a significant data breach when attackers accessed its customer contact system, compromising personal data of approximately 6.2 million customers. The exposed information included full names, addresses, mobile numbers, customer numbers, email addresses, IBANs, dates of birth, and identification details such as passport or driver's license numbers. The breach was executed through a phishing attack where a Dutch-speaking individual impersonated an Odido IT employee to deceive customer service representatives. The cybercriminal group ShinyHunters claimed responsibility for the attack, releasing an 88GB archive containing over 15 million records on the dark web. This incident underscores the escalating threat of sophisticated phishing and social engineering attacks targeting large organizations. The involvement of ShinyHunters, known for high-profile data breaches, highlights the need for enhanced cybersecurity measures and employee training to prevent similar incidents in the future.
2 months ago
Kill Chain
Ryuk Ransomware Operator Pleads Guilty in U.S., Faces 15 Years
In July 2026, 34-year-old Armenian national Karen Serobovich Vardanyan pleaded guilty in the United States to charges of hacking multiple U.S. companies and deploying Ryuk ransomware between November 2019 and April 2020. Vardanyan, who was extradited from Kyiv in April 2025, facilitated unauthorized access to corporate networks, leading to the encryption of systems and substantial ransom payments. Notably, a Michigan company paid 200 BTC (over $1.1 million at the time), contributing to a total of approximately 1,610 bitcoins (valued at around $15 million) extorted from victims. This case underscores the persistent threat posed by ransomware operations like Ryuk, which, at their peak, targeted around 20 organizations weekly and amassed over $150 million. The prosecution of Vardanyan highlights ongoing international efforts to combat cybercrime and hold perpetrators accountable, emphasizing the need for robust cybersecurity measures and vigilance against such attacks.
2 months ago
Kill Chain
Urgent Advisory: Progress ShareFile Security Threat Necessitates Immediate Action
In July 2026, Progress Software identified a critical security threat affecting ShareFile Storage Zone Controllers, leading to an immediate advisory for customers to shut down their Windows servers running these controllers. This precautionary measure was taken to prevent potential unauthorized access and data breaches. The company is collaborating with internal and external security experts to investigate the threat and has temporarily disabled access to affected accounts as a safeguard. This incident underscores the persistent vulnerabilities in file transfer solutions, reminiscent of previous exploits targeting similar systems. Organizations are urged to remain vigilant, apply security patches promptly, and monitor for any signs of compromise to mitigate the risk of data breaches and maintain operational integrity.
2 months ago
Kill Chain
Injective Labs GitHub Compromise Exposes Supply Chain Vulnerabilities
In July 2026, threat actors compromised the GitHub repository of Injective Labs' SDK project, leading to the publication of a malicious npm package, @injectivelabs/sdk-ts@1.20.21. This package contained code designed to exfiltrate cryptocurrency wallet private keys and mnemonic seed phrases by embedding fake telemetry functionality. The malicious version was released on July 8, 2026, and remained available for download until its deprecation. The attackers utilized a developer's GitHub account with a history of contributions to introduce the malicious code, which was then propagated across 17 additional @injectivelabs scoped packages, affecting numerous downstream users. This incident underscores the escalating threat of supply chain attacks targeting open-source repositories. The sophisticated nature of the attack, involving legitimate contributor accounts and widespread package dependencies, highlights the urgent need for enhanced security measures in software development pipelines to prevent similar breaches.
2 months ago
Kill Chain
June 2026 CVE Landscape: A 49% Surge in High-Impact Vulnerabilities
In June 2026, Insikt Group identified 60 high-impact vulnerabilities, marking a 49% increase from the previous month. Notably, 23 of these vulnerabilities were included in the US Cybersecurity and Infrastructure Security Agency (CISA)'s Known Exploited Vulnerabilities (KEV) catalog. The vulnerabilities affected products from 36 vendors, with Microsoft accounting for approximately 18%. ([vulnerability-lookup.org](https://www.vulnerability-lookup.org/2026/07/02/vulnerability-report-june-2026/?utm_source=openai)) This surge underscores the escalating threat landscape, emphasizing the need for organizations to prioritize vulnerability management and remediation efforts to mitigate potential exploits.
2 months ago
Kill Chain
Arrest of Pro-Russian Hacktivist in Spain Highlights Ongoing Cyber Threats
In July 2026, Spanish authorities, in collaboration with the FBI, arrested a suspected core member of pro-Russian hacktivist groups CyberArmy of Russia Reborn (CARR) and Z-Pentest in Palencia, Spain. The individual is accused of providing logistical support to a Ukrainian hacker affiliated with CARR and attempting to facilitate their escape to Russia. The suspect is also linked to coordinating cyber operations for the NoName057(16) group using encrypted messaging platforms. Seized items include multiple computers and frozen cryptocurrency wallets allegedly used to launder proceeds from stolen data sales. The suspect faces ongoing investigations for collaboration with a recognized terrorist organization and severe computer damage. ([es.euronews.com](https://es.euronews.com/my-europe/2026/07/06/la-policia-y-el-fbi-detienen-en-palencia-a-un-presunto-colaborador-de-hackers-prorrusos?utm_source=openai)) This arrest underscores the persistent threat posed by hacktivist groups targeting critical infrastructure across the United States and Europe. The incident highlights the importance of international cooperation in combating cybercrime and the need for organizations to bolster their cybersecurity defenses against such multifaceted threats.
2 months ago
Kill Chain
Critical ATM Software Vulnerabilities Uncovered
In July 2026, security researcher Matt Burch identified nine vulnerabilities in CryptWare's CryptoPro Secure Disk, a full-disk encryption and pre-boot authentication solution for Windows. These flaws could potentially allow attackers with physical access to ATMs to execute arbitrary code, bypass encryption, and steal cash. The vulnerabilities include integrity validation bypasses and improper storage of key materials, raising significant security concerns for organizations utilizing this software. This discovery underscores the critical need for robust physical and software security measures in ATMs, especially as 'jackpotting' attacks have been on the rise, with over 700 incidents reported in 2025, resulting in more than $20 million stolen. ([techcrunch.com](https://techcrunch.com/2026/02/19/fbi-says-atm-jackpotting-attacks-are-on-the-rise-and-netting-hackers-millions-in-stolen-cash/?utm_source=openai))
2 months ago
Kill Chain
Navigating the Security Landscape of AI Coding Tools
In July 2026, a comprehensive analysis revealed that while AI coding tools have significantly enhanced developer productivity, they also introduce substantial security vulnerabilities. Studies indicated that a significant portion of AI-generated code contained critical flaws, including injection vulnerabilities and hardcoded secrets. Additionally, incidents such as the 'GhostApproval' vulnerability in major AI coding assistants highlighted the potential for remote code execution and data exfiltration. These findings underscore the necessity for organizations to balance the productivity benefits of AI coding tools with rigorous security assessments and mitigation strategies. The current relevance of this issue is underscored by the rapid adoption of AI coding tools across industries, coupled with an increasing number of documented security incidents. As organizations integrate these tools into their development workflows, the potential for widespread security breaches grows, emphasizing the urgent need for enhanced security protocols and continuous monitoring.
2 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports