The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Investment Management/Hedge Fund/Private Equity
Breach intelligence, attack campaigns, and threat reports targeting the Investment Management/Hedge Fund/Private Equity sector.
Explore Other Sectors
Investment Management/Hedge Fund/Private Equity Threat Reports
ASCII Smuggling Phishing Campaign: How Invisible Unicode Characters Evaded Email Security in 2026
In February 2026, Microsoft identified a large-scale phishing campaign that peaked at 2.37 million daily messages, employing ASCII smuggling techniques with invisible Unicode characters to evade email security filters. Threat actors inserted Unicode characters from the Tags block (U+E0000–U+E007F) within finance-related keywords, splitting terms like 'funding' into 'fun[invisible character]ding' to bypass traditional word-based detection systems. The campaign utilized 148 finance-themed sender domains and leveraged legitimate ActiveCampaign email marketing infrastructure to deliver business funding and loan-themed lures. While Microsoft Defender caught over 99% of messages through other detection signals, the technique represents a significant evolution in phishing evasion tactics. This incident highlights the growing sophistication of social engineering attacks as threat actors adapt AI prompt injection techniques for traditional phishing campaigns, demonstrating how emerging attack vectors quickly cross over between different threat landscapes.
2 weeks ago
Kill Chain
Cosmos EVM Vulnerability: How Poor Disclosure Processes Led to $5.7M in Losses
Between August 20-25, 2026, attackers exploited a critical balance-handling flaw (GHSA-7g4w-cg88-2cq2) in the Cosmos EVM module to drain funds from six blockchains, stealing approximately $5.72 million. The vulnerability was initially reported through Cosmos Labs' bug bounty program on April 25, 2026, but was incorrectly assessed as posing no risk to live networks. By August 13, Cosmos Labs confirmed all Cosmos EVM chains were affected regardless of decimal configuration, yet proceeded with a public silent patch process instead of private distribution to affected networks. The flaw allowed attackers to manipulate vesting account balances through unchecked arithmetic operations, causing balance wrapping to approximately 2^256 and enabling unauthorized fund drainage. This incident highlights critical gaps in vulnerability disclosure processes and supply chain security management, particularly relevant as blockchain infrastructure becomes increasingly interconnected and organizations struggle with coordinated security updates across distributed networks.
- Banking/Mortgage
- Capital Markets/Hedge Fund/Private Equity
- Investment Management/Hedge Fund/Private Equity
3 weeks ago
Kill Chain
INTERPOL's Massive West African Cybercrime Takedown: What Operation Jackal IV Reveals About Modern Fraud Networks
INTERPOL's eight-month Operation Jackal IV resulted in 58 arrests and identification of 263 suspects across 22 countries, targeting West African organized crime groups including Black Axe. The operation disrupted romance scams, cryptocurrency fraud, business email compromise schemes, and money laundering networks that collectively stole over €988 million. Key raids included a South African syndicate targeting English-speaking retirees ($2.67 million seized, 257 accounts blocked) and a Romanian call center promising fake cryptocurrency returns (€143 million stolen globally, 11 arrests made). This latest crackdown represents the fourth iteration of Operation Jackal, demonstrating escalating international cooperation against West African cybercrime syndicates that have become increasingly sophisticated in their crime-as-a-service operations and cross-border financial fraud schemes. This incident highlights the growing threat of organized West African cybercrime groups that operate like legitimate businesses with specialized roles for conversion and retention agents, exploiting global financial systems through sophisticated social engineering and cryptocurrency laundering schemes.
4 weeks ago
Kill Chain
Apollo Global Management Hit by BlackFile Social Engineering Attack: $1 Trillion Firm Discloses Data Breach
Apollo Global Management disclosed a data breach occurring between July 6-10, 2024, where attackers used social engineering tactics to gain unauthorized access to cloud platforms. The attack was attributed to BlackFile, a threat group affiliated with The Com collective, which has been targeting financial institutions, law firms, and medical technology companies. Personal data including names, Social Security numbers, dates of birth, and contact information were compromised, though Apollo found no evidence of data being posted online or used for identity theft. This incident exemplifies the growing threat of sophisticated social engineering campaigns targeting the financial sector, particularly as cybercriminals increasingly focus on high-value private equity firms and leverage voice-phishing techniques to bypass traditional security controls.
1 month ago
Kill Chain
Ransom Busters' Secondary Extortion Tactics Target Ransomware Victims
In August 2026, a ransomware affiliate known as 'Ransom Busters' initiated a deceptive campaign targeting organizations previously victimized by ransomware attacks. The group claimed to have infiltrated ransomware groups' servers, offering to delete stolen data in exchange for payments ranging from $20,000 to $60,000. This approach involved direct communication with victim organizations, asserting unauthorized access to threat actors' infrastructure and proposing data recovery services for a fee. The legitimacy of these claims is highly questionable, as such actions would constitute violations of the U.S. Computer Fraud and Abuse Act. This incident underscores the evolving tactics within the ransomware ecosystem, where affiliates may exploit victims through secondary extortion schemes. Organizations are advised to exercise caution and skepticism toward unsolicited offers of assistance from unverified entities, as engaging with such actors may lead to further financial loss without any assurance of data recovery.
1 month ago
Kill Chain
BlackFile's 2026 Vishing Attacks on Financial Institutions
In early 2026, the cybercrime group BlackFile, also known as UNC6671 and linked to 'The Com,' initiated a series of sophisticated voice-phishing (vishing) attacks targeting major financial institutions, including private equity firms, law firms, and financial rating agencies. By impersonating IT support personnel, they deceived employees into divulging credentials, enabling unauthorized access to sensitive data. The group then exfiltrated this data and issued extortion demands, often starting around $3 million, with payments typically negotiated down to less than $1 million. Notably, BlackFile has expanded its operations under multiple brands—Redact, Pink, Helix, and Falcon—using shared infrastructure to target an average of 1.5 new victims daily. This incident underscores the persistent and evolving threat posed by cybercriminal groups employing social engineering tactics. The financial sector's susceptibility to such attacks highlights the critical need for enhanced employee training, robust authentication mechanisms, and vigilant monitoring to mitigate the risks associated with vishing and data extortion schemes.
1 month ago
Kill Chain
SafePal Data Breach: Lessons in Securing Third-Party Integrations
In August 2026, SafePal, a cryptocurrency hardware wallet provider, disclosed a data breach affecting approximately 39,798 customers. The breach, which occurred between March 2, 2025, and April 11, 2026, exposed customers' names, email addresses, shipping addresses, phone numbers, and purchase information. The company identified an authorization flaw in a third-party order-tracking plugin as the attack vector, allowing unauthorized access to customer order details. While no wallet seed phrases, private keys, or payment information were compromised, the exposed data increases the risk of targeted phishing and social engineering attacks against affected individuals. This incident underscores the critical importance of securing third-party integrations within e-commerce systems, especially for companies handling sensitive customer information. The breach highlights the evolving tactics of cybercriminals targeting the cryptocurrency sector, emphasizing the need for continuous security assessments and robust incident response strategies.
- Computer Software/Engineering
- Investment Management/Hedge Fund/Private Equity
- Capital Markets/Hedge Fund/Private Equity
1 month ago
Kill Chain
UNC6671's Vishing Tactics: A Wake-Up Call for SaaS Security
In early 2026, the financially motivated threat group UNC6671, operating under the 'BlackFile' brand, initiated a series of sophisticated voice phishing (vishing) attacks targeting employees' personal mobile devices. Posing as internal IT support, the attackers directed victims to fraudulent login portals designed to harvest credentials and multi-factor authentication (MFA) tokens. Utilizing adversary-in-the-middle (AiTM) techniques, UNC6671 gained unauthorized access to cloud environments, including Microsoft 365 and Okta, and exfiltrated sensitive data using automated scripts. The stolen information was then leveraged for extortion, with demands often reaching seven figures. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/?utm_source=openai)) This campaign underscores a significant shift in cyberattack methodologies, emphasizing the exploitation of human factors over technical vulnerabilities. The success of UNC6671's operations highlights the critical need for organizations to implement phishing-resistant MFA solutions and enhance employee awareness to mitigate social engineering threats. ([cloud.google.com](https://cloud.google.com/blog/topics/threat-intelligence/blackfile-vishing-extortion-operation/?utm_source=openai))
1 month ago
Kill Chain
UNC6671's 2026 Cyberattacks on Hedge Funds: A Wake-Up Call
In August 2026, a series of cyberattacks targeted prominent hedge funds and private-equity firms, including Point72 Asset Management, Millennium Management, Two Sigma Investments, and Citadel. The attackers, identified as UNC6671 and associated with the BlackFile group, employed sophisticated voice phishing (vishing) techniques to impersonate corporate IT helpdesks. By directing employees to fraudulent login pages, they captured credentials and session cookies, enabling unauthorized access to corporate systems. This breach led to significant data exfiltration and subsequent extortion attempts, with ransom demands reaching up to $3 million, though settlements often averaged around $750,000. This incident underscores a concerning trend in cyber threats, where attackers leverage social engineering to bypass traditional security measures. The financial sector's increasing reliance on cloud-based services and single sign-on (SSO) platforms presents new vulnerabilities, emphasizing the need for enhanced employee training and robust security protocols to mitigate such risks.
1 month ago
Kill Chain
ClickFix Campaign Deploys Go-Based Infostealer on macOS to Steal Cryptocurrency
In August 2026, a sophisticated ClickFix campaign targeted macOS users, deploying a Go-based infostealer designed to exfiltrate sensitive data, including browser-stored passwords, Apple Keychain information, and cryptocurrency assets. The attack initiated through deceptive emails directing users to execute commands in the Terminal, leading to the download of a Bash script that gathered system information and retrieved a Mach-O payload tailored to the victim's processor architecture. The malware established persistence by masquerading as a legitimate macOS process and circumvented security alerts by removing quarantine attributes. Notably, it could intercept and modify cryptocurrency transactions, diverting a configurable percentage of funds to the attacker, affecting assets like Bitcoin, Litecoin, Dogecoin, Monero, Ethereum, and Ripple's XRP. This incident underscores the evolving threat landscape where attackers employ advanced social engineering techniques to bypass traditional security measures. The use of Go-based malware highlights a trend towards cross-platform capabilities, increasing the potential reach and impact of such attacks. Organizations must remain vigilant, educating users on the risks of executing unverified commands and enhancing endpoint detection mechanisms to identify and mitigate such sophisticated threats.
- Capital Markets/Hedge Fund/Private Equity
- Computer Software/Engineering
- Investment Management/Hedge Fund/Private Equity
1 month ago
Kill Chain
Coldcard Hardware Wallet Flaw Results in Massive Bitcoin Theft
In July 2026, a critical vulnerability in Coldcard hardware wallets led to the theft of approximately $70.2 million in Bitcoin. The flaw, introduced in a March 2021 firmware update, caused the devices to use a deterministic software pseudorandom number generator (PRNG) instead of the intended hardware random number generator (RNG) for seed generation. This oversight allowed attackers to predict wallet seeds by analyzing device-specific information and prior RNG states, enabling unauthorized access to funds. Coinkite, the manufacturer, released emergency firmware updates on July 31, 2026, but emphasized that updating the firmware does not secure existing seeds. Users were advised to generate new seeds using the patched firmware and transfer their assets accordingly. This incident underscores the critical importance of robust entropy sources in cryptographic systems and highlights the potential risks associated with firmware updates that inadvertently introduce vulnerabilities.
- Investment Banking/Venture
- Investment Management/Hedge Fund/Private Equity
- Capital Markets/Hedge Fund/Private Equity
1 month ago
Kill Chain
Apple Sued Over Fake App Store Crypto Wallet App Stealing $1.8M in Bitcoin
In July 2026, Apple faced a lawsuit from three individuals alleging that approximately $1.8 million in Bitcoin was stolen after they downloaded and used a fraudulent Sparrow Wallet application from the App Store. The plaintiffs claim that the malicious app impersonated the legitimate Sparrow Bitcoin wallet, prompting users to enter their seed phrases, which led to unauthorized transfers of their Bitcoin to wallets controlled by scammers. The legitimate Sparrow Wallet is a desktop application without an iOS version, and its developer had previously reported similar fraudulent apps on the App Store. This incident underscores the persistent threat of malicious applications infiltrating trusted platforms, highlighting the need for enhanced app vetting processes and user vigilance. The rise in such fraudulent apps exploiting cryptocurrency users calls for immediate action to bolster security measures and protect consumers from financial losses.
1 month ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports