Cybersecurity Threat Advisory
Gemini Trifecta – Three Vulnerabilities Discovered in Google’s Gemini AI Suite
The recent disclosure of the “Gemini Trifecta” – a set of three vulnerabilities discovered in Google’s Gemini AI suite – highlights a growing reality for SEC-regulated firms: modern AI tools expand the attack surface in ways traditional controls do not fully address. Although Google has already patched these issues, the underlying risks remain relevant to any RIA adopting AI-enabled search, cloud automation, or browsing assistance. Each vulnerability demonstrated how AI can unintentionally execute harmful instructions, expose sensitive data, or misinterpret normal operational logs as commands.
For financial advisors entrusted with client wealth and bound by stringent SEC cybersecurity expectations, these findings reinforce the need to treat AI assistants as part of the security perimeter – not as harmless productivity tools. As more firms integrate AI into workflows, the lesson is clear: innovation must be paired with disciplined governance, vendor oversight, and robust Zero Trust principles.
Colonial Pipeline Attack and How it Relates to Financial Services
It seems that anyone with an online voice is writing about the pipeline attack. But, in case you missed it, on May 7, 2021 a major pipeline that carries fuel from Texas to the South-East United States was taken offline by a cyber-attack. This attack is known as...
HAFNIUM Targeting Exchange Servers with Zero-day Exploits
THREAT UPDATE Microsoft has released several security updates due to targeted attacks against vulnerabilities found in Microsoft Exchange Server (versions 2013, 2016, and 2019). Though the attacks are said to have been limited, Microsoft is urging the immediate...
Threat Advisory – Apple Releases High-Priority Updates
Threat Update After a browser fingerprinting and fraud detection detected an actively exploited vulnerability (which can be tracked as CVE-2022-22587) in Apple’s Safari 15 browser, Apple has released updates that fix the bug (iOS 15.3 and macOS Monterey 12.2). This...
Malicious PowerPoint Files Used to Take Over PCs
Threat Update Threat actors are creating socially engineered emails containing PowerPoint file attachments with the extension “.ppam” to hide malicious executables which can rewrite Windows registry settings to gain control over end user’s computers. It is one of many...
Malware and Ransomware Attacks Against Ukrainian Organizations
Threat Update In the ongoing conflict between Russia and Ukraine, security experts have been observing cyberattacks targeting Ukrainian government departments with overwhelming levels of Internet traffic and data-wiping malware. Upon further analysis, the Ukrainian...
WordPress Themes and Plugins Injected with Backdoor
Threat Update AccessPress, a popular WordPress theme and plugin provider, was compromised in early September 2021 and several of their themes and plugins were injected with a backdoor. This gave the attackers full access to websites that installed these plugins. While...
BlackByte Ransomware Group Gaining Traction
Threat Update The BlackByte Ransomware-as-a-Service group is quickly gaining traction by infecting and cryptolocking multiple companies. Reports regarding this ransomware in the wild have existed since July 2021. In response, the FBI and USSS (United States Secret...
Two Zero-Day Bugs in Zoom Clients and MMR Servers
Threat Update Recently, security researchers have reported an in-depth analysis of two zero-day vulnerabilities in the video calling service Zoom’s clients and Multimedia Router (MMR) servers. These vulnerabilities could allow attackers to execute arbitrary code,...
Cisco Nexus Series Switches Command Injection Vulnerability
Threat Update Cisco has released several patches to resolve vulnerabilities in their Cisco Nexus Series Switches. These vulnerabilities include critical flaws related to command injection, as well as three Denial of Service bugs in the NX-OS. These vulnerabilities are...