Black Kite today announced its newest report, 2025 State of Financial Services: Hidden Dangers in the Vendor Ecosystem, which explores the shifting landscape of cyber threats in the financial sector, highlighting the critical importance of understanding and mitigating the hidden dangers within the vendor ecosystem. The report found that while banks and financial institutions possess strong defenses, third-party vendors often lack the same level of security, providing attackers with indirect access to the institutions they serve.
Over the past two years, successful ransomware attacks targeting the financial sector have decreased, from 191 disclosed victims in 2023 to 156 in 2024 and 55 as of mid-2025. There are several reasons why they are seeing a decrease, including difficulty in breaching systems and changes to the ransomware ecosystem. As highlighted in Black Kite’s 2025 Ransomware Report, the dismantling of major and well-equipped ransomware groups, such as LockBit and AlphV, led to fragmentation. This has opened the door to less sophisticated groups and Ransomware-as-a-Service (RaaS) tools being sold as an entry point for less experienced individuals. For instance, nearly one-third (26.6%) of finance threat actors are attributed to “Other,” which includes emerging or short-lived groups, reinforcing ransomware’s landscape as more fragmented, unpredictable, and opportunistic than ever.
Highlighting third-party risks, attackers are shifting from targeting financial institutions directly to exploiting weaker links within their ecosystems. External service providers, software vendors, and infrastructure partners often serve as alternative and more vulnerable entry points for attackers. Therefore, while the drop in direct attacks is promising, the risk of indirect access through third parties poses a serious threat.
The report’s key findings include:
- Shifting Attack Focus: Attackers increasingly exploit weaker links within the financial ecosystem, primarily through third-party vendors. This indicates that 65% of vendors are not maintaining current patch levels, which exposes financial institutions to inherited risk from known CVEs and potentially unpatched zero-day vulnerabilities in legacy technologies.
- Pervasive Vendor Vulnerabilities: A significant number of vendors exhibited critical security weaknesses, including outdated systems, poor patch management, and credential exposures. Black Kite researchers found that 31 out of 140 vendors have at least one critical vulnerability with a CVSS at or above 8, and 15 vendors show an extremely high risk with CVSS scores above 9. Additionally, Black Kite FocusTags™ found 90 vendors are flagged with high-risk threat categories, including 35 marked with KEV tags.
- Growing Supply Chain Impact: Vulnerabilities in vendors can lead to security risks for financial companies, even from non-cyber events like service outages. Case in point, in December 2024, Cl0p actively targeted companies using unpatched versions of Cleo’s MFT products. Cl0p claimed responsibility, listing 66 victims on their dark web extortion site, but researchers estimated that the actual number of impacted organizations to be in the hundreds. The exploitation resulted in operational disruptions across various sectors linked to financial supply chains, including retailers that faced delays in shipment tracking and inventory management, and manufacturers with production halts and increased downtime due to compromised integrations.
- Declining Direct Ransomware Attacks: The number of direct ransomware attacks on the financial sector has decreased from 191 companies in 2023 to 55 as of mid-2025, largely due to the implementation of strong defenses and the disruption of major threat groups.
Financial institutions can no longer afford a false sense of security based solely on their internal defenses. They must mitigate the dangers within their supply chain by adopting a proactive, intelligence-driven approach to vendor risk management. Only then can they truly strengthen their cybersecurity posture against the evolving landscape of threats to protect their assets, customers, and the stability of the broader financial ecosystem.
To read the report, visit here.
Methodology
The report’s data comes from a multi-source, intelligence-led investigation by the Black Kite Research & Intelligence Team (BRITE), with integrated streams of intelligence curated by BRITE between January 2023 and May 2025. The report focused on a targeted analysis of 140 vendors serving the financial sector. Selection was made based on a unique criterion: vendors whose client base included at least 10% financial sector customers, regardless of company size. This ensured that the analyzed vendor pool reflected high relevance and potential impact on the financial services supply chain.
McDonald’s AI Hiring Bot Exposed Millions of Applicants’ Data to Hackers Who Tried Password ‘123456 …. WTF??
Posted in Commentary with tags Hacked on July 10, 2025 by itnerdWired is reporting that McDonalds AI hiring bot “Olivia,” built by AI firm Paradox.ai, exposed millions of applicants’ data to hackers who tried the password ‘123456,’ according to security researchers Ian Carroll. You can read the research here: https://ian.sh/mcdonalds
Darren James, Senior Product Manager at cybersecurity firm Specops Software, commented:
“Even experienced IT developers make mistakes when it comes to passwords. And if these guys make mistakes that put their customers at risk, it’s even more likely that your end users will make the same errors, or make poor password choices, reuse passwords, and not follow best practice at all when it comes to cyber security and hygiene.
As such, organizations need to make sure that they adopt “fit for purpose” password policies wherever they can, to make sure that passwords, or even better passphrases, are simple to use, have not previously been breached, are strong enough for their intended use, and can be detected and acted upon should they become breached. On top of that, companies should use systems that can provide feedback to users to guide them about what is a good password, and wherever possible make use of a strong biometric 2nd factor.
All organizations should not just bury their heads in the sand about this threat. They should act quickly to have a good understanding of where they are right now when it comes to their password security posture.”
This is pretty stunning that an organization would use such a craptastic password? What this proves is that the bad guys don’t need any skill to pwn you because poor choices allow you to pwn yourself.
Leave a comment »