Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

The finance sector continues to face sustained and evolving cyber threats driven by the high value of financial data, credentials, and transactional access. Malware remains one of the most common and effective mechanisms used to compromise financial institutions, payment platforms, and end users, enabling fraud, data theft, and operational disruption.

CVE-2025-34299 is a critical vulnerability in Monsta FTP, a web-based file transfer tool, unauthenticated arbitrary file write via remote download leading to remote code execution (RCE). Affecting versions 2.11 and earlier, it enables attackers to upload malicious files via a crafted SFTP or FTP connection, compromising servers without credentials. This flaw has seen active exploitation through opportunistic scans. By January 2026, Vulnerable instances remain exposed.

In the early hours following reports of a U.S. military operation involving Venezuela, social media feeds were flooded with dramatic images and videos that appeared to show the capture of Venezuelan president Nicolás Maduro. Within minutes, AI-generated photos of Maduro being escorted by U.S. law enforcement, scenes of missiles striking Caracas, and crowds celebrating in the streets racked up millions of views across various social media channels. The problem?

In cybersecurity, speed has always mattered, but never as much as it does today. Modern enterprises are operating in an era of constant digital acceleration. Cloud-first strategies, third-party integrations, and remote workforce enablement have massively expanded the digital footprint of nearly every organization. With that expansion has come an explosion in internet-facing assets, many of which sit outside the visibility and control of security teams.

This article was authored by Daniel Ilan, Rahul Mukhi, Prudence Buckland, and Melissa Faragasso from Cleary Gottlieb, and Brian Lichter and Elijah Seymour from Stroz Friedberg, a LevelBlue company. Recent disclosures by Anthropic and OpenAI highlight a pivotal shift in the cyber threat landscape: AI is no longer merely a tool that aids attackers, in some cases, it has become the attacker itself.

In 2025, KrakenLabs tracked a series of shifts that reshaped how cyber threats materialized across organizations. Drawing on research conducted throughout the year, this article highlights the most consequential developments observed by KrakenLabs in 2025, where attacker success depended less on new tools or novel exploits and more on the large-scale exploitation of people, identity, and trusted access.

Securely scale search, security, and observability apps on any cloud provider. We are thrilled to announce a major milestone in our commitment to security, privacy, and regulatory compliance for Elastic Cloud Serverless. Elastic Cloud Serverless has now attained a comprehensive suite of key compliance certifications across all of our available cloud providers: Amazon Web Services (AWS), Microsoft Azure, and Google Cloud (GCP).

Some attacks are easy to spot. Others aren’t. In many cases, nothing obviously breaks or crashes, and no malware ever shows up. Nothing looks wrong at first. Access appears normal, and systems continue to run as usual. Modern attacks are challenging to detect because attackers often use the same tools and access paths as legitimate users. In addition, attackers remain low-key and use access that appears normal.