Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 83 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 985–996 / 4893 reports
Oracle WebLogic Under Attack: CVE-2026-21962 Exploitation Campaign Analysis
Government Administration2 months ago

Oracle WebLogic Under Attack: CVE-2026-21962 Exploitation Campaign Analysis

In August 2026, CISA added CVE-2026-21962, a maximum-severity Oracle WebLogic Server vulnerability, to its Known Exploited Vulnerabilities catalog after confirming active exploitation. The flaw allows unauthenticated attackers with network access to compromise Oracle HTTP Server and WebLogic Server Proxy Plug-ins, leading to unauthorized data access and modification. Despite patches being available since January 2026, threat actors have actively exploited this vulnerability alongside other persistent WebLogic flaws, with researchers observing coordinated attacks from specific IP addresses targeting multiple enterprise environments. This incident demonstrates the ongoing challenge of patch management in enterprise environments and the persistent threat to web-facing Oracle infrastructure. The vulnerability's exploitation highlights how attackers continue leveraging a small set of highly-effective, simple-to-exploit vulnerabilities to compromise enterprise systems, particularly in organizations with delayed patching cycles.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Critical WordPress Admin Bypass: miniOrange SAML Vulnerabilities Under Active Attack
Information Technology/IT2 months ago

Critical WordPress Admin Bypass: miniOrange SAML Vulnerabilities Under Active Attack

In August 2026, security researchers discovered two critical authentication bypass vulnerabilities in the miniOrange SAML 2.0 Single Sign-On WordPress plugin, allowing attackers to gain administrator access without credentials. CVE-2026-61979 and CVE-2026-15981 stem from signature validation flaws that enable attackers to craft malformed SAML responses and bypass authentication entirely. Active exploitation attempts have been observed from multiple IP addresses in what appears to be opportunistic scanning campaigns targeting vulnerable WordPress sites. The vulnerabilities affect the plugin's signature verification process, where malformed signatures trigger OpenSSL errors that are incorrectly treated as valid authentication. DigitalOcean's security team first identified the threat when they detected anomalous admin session attempts from outside their trusted network, revealing an attacker had already obtained admin cookies through these exploits. This incident highlights the growing trend of attackers targeting identity and authentication systems, particularly SAML implementations that serve as critical trust boundaries in enterprise environments. With proof-of-concept code now available and active scanning campaigns underway, organizations face immediate risk from these easily exploitable vulnerabilities.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(medium)
Read report
E4del and PINHOLE RATs Turn FTP Services Into Covert Communication Channels
Financial Services2 months ago

E4del and PINHOLE RATs Turn FTP Services Into Covert Communication Channels

Cybersecurity researchers have identified a sophisticated new campaign employing FTP banners as dead drop resolvers (DDRs) to deliver two previously unreported remote access trojans (RATs) named E4del and PINHOLE. The threat actors behind this campaign are exploiting legitimate FTP services to establish command-and-control infrastructure while blending seamlessly with regular network traffic. This novel technique allows attackers to maintain persistent access to compromised systems while evading traditional detection methods that focus on more conventional C2 communication channels. The campaign demonstrates advanced operational security awareness and represents a significant evolution in how threat actors establish and maintain covert communication channels. This incident highlights the growing trend of threat actors exploiting legitimate services and protocols for malicious purposes, making detection increasingly challenging for traditional security tools. As organizations continue to expand their digital infrastructure, the abuse of standard network services like FTP for covert communication channels represents a critical blind spot in many security monitoring strategies.

Medium impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(low)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(medium)
Read report
How Frontier AI Models Are Forcing a Vulnerability Management Revolution
Financial Services2 months ago

How Frontier AI Models Are Forcing a Vulnerability Management Revolution

The emergence of Frontier AI models like Anthropic's Mythos has fundamentally disrupted traditional vulnerability management practices by enabling machine-speed identification of zero-day flaws and automated exploit chaining. Organizations previously relying on CVSS scores, EPSS rankings, and CISA's KEV list now face an accelerated threat landscape where vulnerabilities are weaponized faster than legacy patching cycles can address them. This paradigm shift demands immediate transformation of vulnerability management programs toward exposure management frameworks that assess true organizational risk beyond traditional scoring metrics. The revolution requires automated patch deployment strategies, ring-based testing methodologies, and critical stakeholder conversations about uptime requirements versus security imperatives in an era of AI-driven exploit development. This transformation represents a critical inflection point as cybersecurity programs must evolve from reactive, siloed approaches to proactive, integrated vulnerability and patch management ecosystems capable of matching AI-driven threat velocity.

Low impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
How 24 Malicious npm Packages Turned Trusted Mirrors into Phishing Infrastructure
Computer Software/Engineering2 months ago

How 24 Malicious npm Packages Turned Trusted Mirrors into Phishing Infrastructure

In August 2026, cybersecurity researchers discovered a sophisticated supply chain attack involving 24 malicious npm packages that exploited unpkg mirrors to host fake Cloudflare CAPTCHA pages. The threat actors embedded HTML files within npm packages that, when accessed through mirrors like unpkg.com, rendered convincing phishing pages designed to trick users into malicious actions. The campaign initially redirected victims to typosquat Microsoft login domains before pivoting to abuse KeyVal, a legitimate key-value store service, as a dead drop resolver to dynamically control redirection targets. This incident highlights the evolving threat landscape where attackers increasingly abuse legitimate infrastructure and trusted domains to bypass security controls. Supply chain attacks continue to surge as organizations struggle with securing third-party dependencies, while threat actors demonstrate growing sophistication in leveraging trusted services for malicious infrastructure, making detection and prevention more challenging for traditional security tools.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
Mirage2FA Campaign Exposes Critical Gaps in Traditional MFA Security
Information Technology/IT2 months ago

Mirage2FA Campaign Exposes Critical Gaps in Traditional MFA Security

The Mirage2FA phishing-as-a-service campaign targeted over 4,500 organizations across the US and EU from 2024 to 2026, exploiting Microsoft 365 login flows to bypass two-factor authentication. Using adversary-in-the-middle (AiTM) techniques, attackers stole passwords and session cookies, achieving a 48% compromise rate among targeted email addresses. The campaign primarily affected US-based companies in technology, manufacturing, and education sectors, with attackers gaining authenticated access to Microsoft 365 sessions and SSO-connected services, enabling account impersonation and data theft. This incident highlights the evolving threat landscape where traditional MFA is insufficient against sophisticated phishing operations that steal active sessions rather than just credentials, demonstrating the urgent need for phishing-resistant authentication methods and enhanced session management controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
CISA Escalates Oracle HTTP Server Vulnerability to KEV Status After Active Exploitation
Financial Services2 months ago

CISA Escalates Oracle HTTP Server Vulnerability to KEV Status After Active Exploitation

CISA has added CVE-2026-21962, an improper access control vulnerability in Oracle HTTP Server and Oracle WebLogic Server Proxy Plug-in, to its Known Exploited Vulnerabilities (KEV) Catalog following evidence of active exploitation in the wild. This vulnerability poses significant risks to federal enterprises and allows attackers to bypass authentication mechanisms, potentially leading to unauthorized system access and data compromise. The addition reinforces CISA's Binding Operational Directive (BOD) 26-04, which mandates federal agencies prioritize rapid remediation of high-risk vulnerabilities that grant total control of assets post-exploitation. This incident highlights the ongoing trend of state-sponsored and cybercriminal groups increasingly targeting enterprise web infrastructure vulnerabilities, particularly Oracle systems that are widely deployed across government and critical infrastructure sectors, making immediate patching and risk assessment essential.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(low)
Read report
CISA Red Team Assessment Exposes Critical Gap Between Strong and Weak SOC Operations
Government Administration2 months ago

CISA Red Team Assessment Exposes Critical Gap Between Strong and Weak SOC Operations

CISA conducted simultaneous red team assessments at two organizations in August 2026, revealing stark differences in defensive capabilities. Both organizations suffered full domain compromise and sensitive business system access, but Organization A failed to detect any malicious activity while Organization B rapidly identified and contained threats within 2-20 minutes. The assessments exposed critical gaps in cloud security, Active Directory configurations, and incident response processes across both critical infrastructure entities. This incident highlights the growing sophistication of identity-based attacks and the urgent need for organizations to mature their cloud security postures as threat actors increasingly target hybrid environments and exploit authentication mechanisms like Entra ID and AWS IAM.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(medium)
Read report
How Hostname Obfuscation Bypasses Cloud Security in SSRF Attacks
Computer Software/Engineering2 months ago

How Hostname Obfuscation Bypasses Cloud Security in SSRF Attacks

Attackers are increasingly using hostname obfuscation techniques to bypass IP-based blocklists in Server-Side Request Forgery (SSRF) attacks targeting cloud metadata services. Security researchers at SANS identified multiple methods where threat actors convert blocked IP addresses like 169.254.169.254 into resolvable hostnames using services like nip.io, sslip.io, and dynamic DNS tools such as 1u.ms. These techniques allow attackers to circumvent traditional IP filtering defenses and access sensitive cloud instance metadata, potentially leading to credential theft and privilege escalation in cloud environments. This attack vector represents a growing trend in cloud-native security evasion techniques, highlighting the inadequacy of simple blocklist-based defenses against modern SSRF exploitation methods targeting AWS, Azure, and GCP metadata services.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(low)
IImpact(low)
Read report
AI-Enabled Malware in 2026: Separating Reality from Research Hype
Financial Services2 months ago

AI-Enabled Malware in 2026: Separating Reality from Research Hype

Unit 42 researchers analyzed 405 AI-enabled malware samples between December 2024 and June 2025, discovering that only 12 samples (3%) reached production environments while 97% existed solely in research repositories and sandboxes. The study revealed that AI-enhanced threats like FunkSec ransomware, trojanized AI applications, and information stealers were successfully detected by existing security mechanisms without requiring novel detection approaches. All samples that attempted to reach customer environments were blocked by Palo Alto Networks products using behavioral analytics, sandbox analysis, and entropy detection. This research demonstrates the current reality of AI-powered cyber threats as threat actors increasingly integrate large language models into malware development cycles, accelerating iteration speeds and lowering barriers to entry while traditional security controls remain effective.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Provenance Blockchain State Divergence: $500K DeFi Vulnerability Analysis
Financial Services2 months ago

Provenance Blockchain State Divergence: $500K DeFi Vulnerability Analysis

In March 2026, Trail of Bits discovered a critical vulnerability in Provenance Blockchain, a Cosmos SDK-based financial services platform, that allowed any user to grant themselves admin control over marker accounts without holding tokens. The bug affected 82 markers representing live financial assets worth approximately $500,000, including validator incentive funds and community grant programs. Exploitation required only two transactions: one to gain admin permissions through a flawed authorization check, and another to either mint new tokens or drain escrowed assets. This incident highlights the growing risks in blockchain application security as DeFi and tokenized assets become mainstream. State synchronization vulnerabilities in smart contract platforms represent a critical attack vector that can bypass traditional access controls.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
U.S. Treasury Launches 'Economic D-Day' Against Iranian Cyber Operations Targeting Critical Infrastructure
Oil/Energy/Solar/Greentech2 months ago

U.S. Treasury Launches 'Economic D-Day' Against Iranian Cyber Operations Targeting Critical Infrastructure

In January 2025, the U.S. Treasury Department sanctioned four Iranian hackers as part of an 'economic D-Day' campaign against Iran's cyber operations. The sanctioned individuals - Keyvan Fayyaz Ghareh Blagh, Saber Shahbazi Balujeh, Mohammad Reza Kadkhoda'i, and Mojtaba Ghal'eh-Kuhi - conducted sophisticated attacks against U.S. critical infrastructure since late 2023, successfully compromising and exfiltrating data from energy companies, defense contractors, healthcare institutions, IT companies, and financial institutions. These attacks were directed by Iran's Ministry of Intelligence and Security (MOIS), with hackers motivated by both state objectives and personal financial gain, leading some to also target Iranian domestic companies. This incident highlights the escalating cyber warfare between nation-states and the U.S. government's increasingly aggressive economic response to state-sponsored cyberthreats. The sanctions represent a significant shift toward treating cyber operations as acts of war requiring comprehensive economic retaliation rather than just cybersecurity countermeasures.

High impact

Kill Chain

ICInitial Compromise(medium)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports