InfoSecBulletin Cybersecurity for mankind
From April 2024 to April 2025, Flashpoint analysts noted that the financial sector was a major target for threat actors, with 406 incidents publicly reported as ransomware attacks, accounting for seven percent of all ransomware incidents during that time.
Citrix NetScaler SAML 0-Day Flaw Under Attack
Major Danish university breached, 200,000 users at risk
Microsoft’s X account hijacked to promote Clippy crypto scam
Critical cPanel, GitLab AI Gateway and Dell CSM Flaws Enable RCE And Admin Hijacking
Nearly 100,000 email addresses exposed in first AI-related data breach in Singapore
Hackers Exploit Zimbra Mail Servers: TeamViewer patched 5 critical flaws
Google Warns of Hackers Actively Exploiting Citrix 0-Day Flaws
CISA Warns Critical MikroTik RouterOS Flaw While Cisco SD-WAN Zero-Day Exploited in Attacks
Apple Zero-Day Exploited: Pentagon Data Breach Reportedly Exposes Sensitive Data of 3 Million People
JadePuffer Agentic AI targets and destroys Azure’s cloud resources
Why Finance?
The financial sector consistently ranks as one of the most targeted industries for threat actors worldwide. Financial institutions handle large amounts of sensitive data, including financial transactions and customer information, making them attractive targets for cybercriminals. The critical nature of financial operations also raises the likelihood that these organizations will pay extortion and ransom demands.
The financial sector is appealing to malicious actors not just for financial gain, but also for its connections to other industries. They may target financial institutions to access information about other organizations, as one data breach can affect many partners and third parties.
The Threat Actors Targeting the Financial Sector:
Organizations must grasp the financial threat landscape by recognizing key players. Key threat actors targeting the financial sector from April 2024 to April 2025 include some of the most prominent and active groups.
Top Attack Vectors Facing the Financial Sector:
From April 2024 to April 2025, our analysts noted 6,406 posts about financial sector access in Flashpoint’s forum collections. How are these threat actor groups accessing financial data and systems? Flashpoint intelligence reveals they exploit third-party breaches, initial access brokers, insider threats, and other attack methods.
