Clearance Incident Response. Free through May 1, 2027, so you have time to patch.Estimate your Blast Radius in 60 secondsEstimate

aviatrix logoAviatrix
Under Active Attack
Industry Category

Financial Services

Breach intelligence, attack campaigns, and threat reports targeting the Financial Services sector.

4893 threat reports
Page 93 of 408
Explore Other Sectors
AccountingAerospaceAerospace/AviationAgricultureAirlines/AviationAnimationApparel/FashionArchitecture/PlanningArtificial IntelligenceArtificial Intelligence/Machine LearningArts/CraftsAutomotiveAviation/AerospaceBanking/MortgageBiotechnology/GreentechBlockchain/CryptocurrencyBroadcast MediaBroadcasting MediaBroadcasting/MediaBuilding MaterialsBusiness Supplies/EquipmentCapital Markets/Hedge Fund/Private EquityChemicalChemicalsCivic/Social OrganizationCivil EngineeringCloud ComputingCloud Computing/SaaSCloud Native Security Fabric (CNSF)Cloud ServicesCommercial FacilitiesCommercial Real EstateComputer GamesComputer HardwareComputer NetworkingComputer Software/EngineeringComputer/Network SecurityConstructionConsultingConsumer ElectronicsConsumer GoodsConsumer ServicesCosmeticsCosmeticsCritical ManufacturingCryptocurrenciesCryptocurrencyCustomer ServicesCybersecurityDairyDating/Personal ServicesDating/Social PlatformsDefense/SpaceDesignE-LearningEducation ManagementElectrical/Electronic ManufacturingEmergency ServicesEnergyEnergy/Oil/Solar/GreentechEntertainment/Movie ProductionEnvironmental ServicesEvents ServicesExecutive OfficeFacilities ServicesFarmingFashion/ApparelFinancial ServicesFine ArtFisheryFood ProductionFood/BeveragesFortune 500 companiesFranchisingFundraisingGambling/CasinosGamingGaming/CasinosGovernment AdministrationGovernment FacilitiesGovernment RelationsGraphic Design/Web DesignHealth Care / Life SciencesHealthcareHigher Education/AcadamiaHospitalityHospitalsHuman Resources/HRImport/ExportIndividual/Family ServicesIndustrial AutomationInformation ServicesInformation Technology/ITInsuranceInternational AffairsInternational Trade/DevelopmentInternetInvestment Banking/VentureInvestment Management/Hedge Fund/Private EquityJudicialJudiciaryLaw EnforcementLaw Practice/Law FirmsLegal ServicesLegislative OfficeLeisure/TravelLogistics/ProcurementLuxury Goods/JewelryMachineryManagement ConsultingManufacturingMaritimeMarket ResearchMarketing/Advertising/SalesMechanical or Industrial EngineeringMedia ProductionMedical EquipmentMedical PracticeMilitary IndustryMining/MetalsMobileMuseums/InstitutionsMusicNewspapers/JournalismNon-Profit/VolunteeringOil/Energy/Solar/GreentechOnline PublishingOther IndustryOutsourcing/OffshoringPackage/Freight DeliveryParkingPharmaceuticalsPhilanthropyPhotographyPlasticsPolitical OrganizationPrimary/Secondary EducationProfessional ServicesProfessional TrainingPublic Relations/PRPublic SafetyPublishing IndustryRailroad ManufactureReal Estate/MortgageRecreational Facilities/ServicesReligious InstitutionsRenewables/EnvironmentResearch IndustryRestaurantsRetail IndustryRoboticsRural HealthcareSecurity/InvestigationsSemiconductorsShipbuildingSocial Media/InternetSporting GoodsSportsStaffing/RecruitingSupermarketsTechnologyTechnology/ITTelecommunicationsThink TanksToys and GamesTransportationTravel/TourismTrucking/FreightUtilitiesVenture Capital/VCWarehousingWater and Waste ManagementWater and WastewaterWater and Wastewater SystemsWater and Wastewater TreatmentWater TreatmentWater, Waste, Steam, and Air Conditioning ServicesWater/Waste ManagementWater/WastewaterWater/Wastewater ManagementWater/Wastewater/UtilitiesWholesaleWine/SpiritsWirelessWriting/Editing

Financial Services Threat Reports

Showing 1105–1116 / 4893 reports
Securing the Software Supply Chain in the Age of AI-Generated Code
Computer Software/Engineering2 months ago

Securing the Software Supply Chain in the Age of AI-Generated Code

In August 2026, a significant security concern emerged regarding AI-generated code and its impact on the software supply chain. AI coding assistants, while enhancing developer productivity, have been found to introduce unvetted or hallucinated dependencies into codebases. This phenomenon, known as 'slopsquatting,' occurs when AI models suggest non-existent package names, which attackers can then register and populate with malicious code. Such vulnerabilities have led to compromised builds and increased security risks across numerous repositories. The urgency of this issue is underscored by the rapid adoption of AI coding tools and the corresponding rise in supply chain attacks. Organizations are now facing the challenge of implementing robust governance mechanisms to vet AI-generated code and prevent the ingestion of malicious dependencies, highlighting the critical need for proactive security measures in the era of AI-assisted development.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Trezor Data Breach 2026: Lessons in Supply Chain Security
Computer Hardware2 months ago

Trezor Data Breach 2026: Lessons in Supply Chain Security

In August 2026, Trezor, a leading cryptocurrency hardware wallet manufacturer, disclosed a data breach affecting nearly 14,000 customers. The breach occurred through their shipping and logistics provider, ShipMonk, whose systems were compromised via a vulnerability in the third-party analytics platform Metabase. This incident exposed customers' full names, shipping addresses, email addresses, and phone numbers. Trezor's internal systems and devices remained secure, but the exposed personal information heightened the risk of targeted phishing attacks against affected individuals. This breach underscores the critical importance of securing third-party service providers, as vulnerabilities in external platforms can directly impact primary organizations and their customers. The incident also highlights the evolving tactics of cybercriminals, who exploit supply chain weaknesses to access sensitive data, emphasizing the need for comprehensive security measures across all operational facets.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(high)
IImpact(high)
Read report
Critical VMware vCenter RCE Flaw Exploited for Reverse SSH Access
Information Technology/IT2 months ago

Critical VMware vCenter RCE Flaw Exploited for Reverse SSH Access

In August 2026, a critical vulnerability (CVE-2026-59310) in VMware vCenter's Syslog Server was actively exploited, allowing unauthenticated attackers to execute arbitrary code remotely. This flaw enabled the deployment of reverse SSH tools, granting persistent remote access to compromised systems. The attack campaign rapidly expanded, affecting 361 IP addresses across 47 countries, with significant concentrations in Germany, the U.S., Turkey, Iran, and France. The swift exploitation of this vulnerability underscores the increasing agility of threat actors in leveraging newly disclosed flaws. Organizations must prioritize timely patching and enhance monitoring to detect and mitigate such sophisticated attacks promptly.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(low)
C&CCommand & Control(high)
EExfiltration(low)
IImpact(low)
Read report
Understanding the LegacyHive Windows Zero-Day Vulnerability
Financial Services2 months ago

Understanding the LegacyHive Windows Zero-Day Vulnerability

In July 2026, a security researcher known as Nightmare Eclipse disclosed a zero-day vulnerability named 'LegacyHive' affecting the Windows User Profile Service. This flaw allows local non-administrator users to load and modify registry hives of other users, including administrators, potentially leading to privilege escalation. The proof-of-concept exploit was released shortly after Microsoft's July Patch Tuesday, impacting fully updated Windows systems. Microsoft has since released patches to address this vulnerability. The disclosure of LegacyHive underscores ongoing challenges in timely vulnerability management and the risks posed by unpatched systems. It highlights the importance of prompt patch application and the need for robust security practices to mitigate potential exploitation.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
Akira Ransomware Exploits Safe Mode to Disable EDR and Exfiltrate Data
Health Care / Life Sciences2 months ago

Akira Ransomware Exploits Safe Mode to Disable EDR and Exfiltrate Data

In August 2026, an Akira ransomware affiliate exploited an exposed SonicWall VPN device lacking multi-factor authentication to gain initial access to a target network. Within two hours, the attacker connected to the domain controller via RDP, enumerated Active Directory users and computers, and moved laterally to an application server. Utilizing WinRAR, they archived mapped file shares and employed the s5cmd tool to upload the stolen data to an attacker-controlled S3 bucket. Subsequently, AnyDesk was installed for persistent remote access. The attacker then rebooted the compromised host into Safe Mode with Networking, effectively disabling endpoint detection and response (EDR) solutions and Microsoft Defender’s real-time protection. Despite these efforts, the ransomware payload failed to execute due to system resource constraints, preventing file encryption. However, the attacker successfully exfiltrated sensitive data and credentials within a five-hour window. This incident underscores the evolving tactics of ransomware operators, particularly the use of Safe Mode to bypass security defenses. Organizations are advised to implement multi-factor authentication on all VPN accounts, monitor for Safe Mode boot configuration changes, and detect unauthorized remote access tools to mitigate such threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Global Crackdown on Cybercrime Crypting Services in 2025
Financial Services2 months ago

Global Crackdown on Cybercrime Crypting Services in 2025

In May 2025, a coordinated international law enforcement operation led by the U.S. Department of Justice resulted in the seizure of four domains—AvCheck[.]net, Cryptor[.]biz, Crypt[.]guru, and an undisclosed fourth—offering crypting and counter-antivirus (CAV) services. These services enabled cybercriminals to obfuscate malicious code, allowing malware to evade detection by antivirus software and infiltrate systems undetected. The operation, conducted in partnership with authorities from the Netherlands, Finland, France, Germany, Denmark, Portugal, and Ukraine, dismantled the infrastructure supporting these illicit services, marking a significant disruption in the cybercrime ecosystem. ([scyscan.com](https://www.scyscan.com/news/u.s.-doj-seizes-4-domains-supporting-cybercrime-crypting-services-in-global-operation/?utm_source=openai)) The takedown underscores the growing threat posed by crypting services, which have become integral to the operations of various cybercriminal groups, including those involved in ransomware-as-a-service (RaaS) schemes. By making sophisticated evasion techniques accessible to a broader range of threat actors, these services have contributed to the proliferation of malware campaigns targeting organizations worldwide. The successful disruption of these services highlights the importance of international collaboration in combating cybercrime and the need for organizations to implement robust security measures to detect and prevent obfuscated malware.

Low impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(high)
EExfiltration(medium)
IImpact(high)
Read report
City-Forum Campaign: A Wake-Up Call for SaaS Security
Financial Services2 months ago

City-Forum Campaign: A Wake-Up Call for SaaS Security

Since at least March 2025, an unidentified threat actor has been conducting a prolonged data theft campaign, dubbed "City-Forum," targeting organizations across various sectors by exploiting overly permissive guest access in Salesforce and ServiceNow platforms. The attacker developed custom tools to interact with less-documented interfaces, such as Salesforce's Lightning Web Runtime and ServiceNow's Service Portal search endpoint, enabling unauthorized access to sensitive data including customer information, support tickets, and internal communications. This incident underscores the evolving sophistication of cyber threats, highlighting the need for organizations to reassess and fortify their security configurations, especially concerning third-party integrations and guest access permissions. The campaign's duration and the attacker's ability to exploit undocumented interfaces emphasize the importance of continuous monitoring and proactive security measures.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(high)
IImpact(high)
Read report
Critical Vulnerabilities in Belgium's eID System Expose Citizens to Remote Code Execution
Government Administration2 months ago

Critical Vulnerabilities in Belgium's eID System Expose Citizens to Remote Code Execution

In August 2026, severe vulnerabilities were discovered in Belgium's eID authentication system, specifically within the 'Connective' browser extension. These flaws allowed attackers to steal citizens' identities, payment information, and execute remote code on users' machines. The extension, used by over 2 million individuals, failed to verify the origin of activation tokens, enabling malicious websites to impersonate legitimate services and interact with users' eID systems. Additionally, the native host application could be exploited to load arbitrary DLL files, leading to remote code execution without user interaction. This incident underscores the critical need for rigorous security assessments of browser extensions, especially those integral to national identity and financial systems. It highlights the broader risks associated with browser extension vulnerabilities and the potential for widespread exploitation if not promptly addressed.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(high)
Read report
Jewelbug APT's Dual Threat: Espionage Meets Cryptocurrency Theft
Government Administration2 months ago

Jewelbug APT's Dual Threat: Espionage Meets Cryptocurrency Theft

In August 2026, the Chinese state-sponsored advanced persistent threat (APT) group known as Jewelbug was identified conducting both cyber espionage and financial theft operations. Utilizing a unified command-and-control platform, Jewelbug managed to infiltrate government, military, and telecommunications organizations across Asia and the Middle East, while simultaneously orchestrating large-scale cryptocurrency thefts through fraudulent exchanges. Their sophisticated tactics included deploying custom malware such as the 'Antino' and 'ClientKing' backdoors, and a malicious browser extension named 'PDF Viewer' to exfiltrate sensitive data and financial assets. This incident underscores the evolving landscape of cyber threats, where state-sponsored actors are increasingly blending espionage with financial crimes. The dual-purpose operations of groups like Jewelbug highlight the necessity for organizations to adopt comprehensive cybersecurity strategies that address both traditional espionage and emerging financial cyber threats.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Exploitation of SharePoint Authentication Bypass Vulnerability CVE-2026-55040
Information Technology/IT2 months ago

Exploitation of SharePoint Authentication Bypass Vulnerability CVE-2026-55040

In July 2026, Microsoft disclosed a critical vulnerability in SharePoint Server, identified as CVE-2026-55040, which allows unauthenticated attackers to bypass authentication mechanisms via weaknesses in the JWT token validation process. This flaw enables adversaries to impersonate legitimate users, including administrators, potentially leading to unauthorized data access and modification. Following the release of a proof-of-concept (PoC) exploit by Rapid7, threat actors began actively exploiting this vulnerability, with multiple incidents reported globally, including a significant breach affecting the Swiss government's IT network. The rapid exploitation of CVE-2026-55040 underscores the critical importance of timely patch management and proactive security measures. Organizations utilizing SharePoint are urged to apply the latest security updates promptly and to implement robust monitoring and access controls to mitigate the risk of unauthorized access and data breaches.

Critical impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(medium)
LMLateral Movement(medium)
C&CCommand & Control(low)
EExfiltration(low)
IImpact(low)
Read report
Bleeding Llama: Critical Memory Leak in Ollama (CVE-2026-7482)
Computer/Network Security2 months ago

Bleeding Llama: Critical Memory Leak in Ollama (CVE-2026-7482)

In May 2026, a critical vulnerability known as 'Bleeding Llama' (CVE-2026-7482) was disclosed in Ollama, a widely used framework for running large language models locally. This unauthenticated heap out-of-bounds read flaw allows remote attackers to exfiltrate sensitive data—including API keys, user conversations, and system prompts—from any internet-exposed Ollama server with minimal effort. The vulnerability affects versions up to 0.17.0, with an estimated 300,000 servers exposed at the time of disclosure. Ollama addressed the issue in version 0.17.1, but many instances remain unpatched, leaving organizations vulnerable to data breaches and unauthorized access. ([lyrie.ai](https://lyrie.ai/research/research/2026-05-08-bleeding-llama-ollama-cve-2026-7482?utm_source=openai)) The 'Bleeding Llama' incident underscores the critical importance of timely patch management and robust security practices in AI infrastructure. As AI models become integral to business operations, ensuring their security is paramount to prevent data leaks and maintain trust in AI-driven systems.

Medium impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(high)
C&CCommand & Control(high)
EExfiltration(high)
IImpact(high)
Read report
Unveiling 'ShieldBreak': A New Zero-Day Threat in Microsoft Defender
Computer/Network Security2 months ago

Unveiling 'ShieldBreak': A New Zero-Day Threat in Microsoft Defender

In August 2026, security researcher Nightmare Eclipse disclosed a zero-day vulnerability named 'ShieldBreak' in Microsoft Defender, allowing attackers to escalate privileges to SYSTEM level on fully patched Windows 10, Windows 11, and Windows Server systems. This exploit leverages a user-mode callback hook during a Defender cloud-hydration scan via the Cloud Filter API (cfapi), effectively bypassing the previous 'RoguePlanet' patch (CVE-2026-50656). The proof-of-concept demonstrated a 100% success rate on tested systems. This incident underscores the persistent challenges in securing endpoint protection platforms and highlights the need for continuous vigilance and rapid response to emerging threats. Organizations must reassess their security postures, especially concerning privilege escalation vulnerabilities, to mitigate potential risks associated with such exploits.

High impact

Kill Chain

ICInitial Compromise(high)
PEPrivilege Escalation(high)
LMLateral Movement(medium)
C&CCommand & Control(medium)
EExfiltration(medium)
IImpact(medium)
Read report
[ INCIDENT RESPONSE // UNDER ATTACK? ]

Stop Active Cloud Data Exfiltration

Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.

Under Attack

Looking for threats in a different sector?

Browse All Threat Reports