✨ The Containment Era is here. Secure AI workloads before they breach. →The Containment Era is here. →The Containment Era is here. →Explore ✨
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
US Sanctions North Korean Banks for Cryptocurrency Cybercrime in 2024
In May 2024, the U.S. Treasury sanctioned two North Korean banks and eight individuals believed to be heavily involved in high-profile cryptocurrency laundering operations linked to state-sponsored cybercrime. The sanctioned parties allegedly laundered millions of dollars in digital assets stolen through cyberattacks and IT worker fraud, often hiding illicit proceeds to evade international detection. North Korean operatives reportedly posed as legitimate IT contractors for Western firms to gain unauthorized access to sensitive systems and divert funds, fueling further malicious operations and funding government programs in Pyongyang. This incident exemplifies shifting tactics in cyber-enabled financial crime, where attackers exploit advanced laundering techniques and foggy compliance areas around cryptocurrency. The urgency of improved detection and policy enforcement is fueled by growing international regulatory pressure and the adaptation of state-sponsored groups to exploit digital infrastructure.
6 months ago
Kill Chain
Global Credit Card Fraud Rings Dismantled in Europol-Led €300M Operation
In 2024, international law enforcement agencies, coordinated by Europol, dismantled three interconnected credit card fraud and money laundering rings responsible for more than €300 million in losses, impacting 4.3 million cardholders worldwide across 193 countries. The sophisticated criminal groups orchestrated large-scale thefts using stolen and counterfeit credit card data, leveraging advanced technology and vast dark web networks to execute fraudulent transactions on a global scale. Their activities spanned several years, with victims spread across multiple financial institutions, highlighting significant vulnerabilities in payment security and international collaboration. The bust resulted in arrests, asset seizures, and cut off a major underground economy impacting consumers and businesses. This case illustrates the increasing scale and complexity of financially motivated cybercrime, as threat actors use digital platforms and cross-border tactics to avoid detection. Ongoing regulatory and industry attention to payment fraud and anti-money-laundering measures underscores the need for improved threat detection and international cooperation.
6 months ago
Kill Chain
US Sanctions North Korean Network for $12.7M Crypto Laundering and IT Fraud
In November 2025, the U.S. Treasury Department sanctioned ten North Korean individuals and entities after uncovering a multi-year scheme involving crypto laundering and IT-related financial fraud totaling $12.7 million. These actors, linked to North Korea’s state-sponsored cyber operations, leveraged encrypted and unencrypted channels to move illicit funds across international financial systems. Their activities supported North Korea’s nuclear weapons ambitions and exploited gaps in network segmentation, egress controls, and threat detection processes. This incident underscores an escalation in nation-state cryptocurrency laundering methods and demonstrates continued exploitation of global IT workforce outsourcing, heightening regulatory focus and increasing the cyber risk to organizations transacting digitally or hiring remote technical staff.
6 months ago
Kill Chain
U.S. Treasury Sanctions North Korean Firms for Cryptocurrency Crime and IT Fraud (2024)
In June 2024, the U.S. Treasury Department sanctioned eight individuals and two companies linked to North Korea for laundering proceeds from cybercrime and IT worker schemes. These sanctioned parties allegedly funneled over $3 billion in stolen cryptocurrency and hundreds of millions in illicitly earned IT wages to the North Korean regime, supporting its weapons programs. Entities sanctioned include North Korean banking officials, an IT company operating in China, and financial institution representatives in both China and Russia, all accused of violating international sanctions, managing illicit funds, and enabling large-scale money laundering through sophisticated cyber and identity subterfuge. This incident underscores the advanced capabilities of North Korea’s cyber operations and their direct link to geopolitical threats, as well as the ongoing shift towards state-sponsored cryptocurrency theft and IT fraud as major funding sources for sanctioned regimes.
6 months ago
Kill Chain
European Crypto Fraud Ring Dismantled in €600M Money Laundering Bust (2024)
In early 2024, European law enforcement agencies dismantled a sophisticated cryptocurrency fraud ring responsible for laundering over €600 million across multiple countries. Nine suspects were arrested as part of coordinated raids targeting a network that deceived victims via fake crypto investment platforms. The ring used professional call centers and complex money laundering techniques, including anonymized cryptocurrency transfers and shell companies, to obfuscate financial trails. Victims were drawn in via social engineering and manipulated into making significant deposits, resulting in substantial financial losses for businesses and individuals. This incident highlights the escalation of large-scale crypto-based fraud and the growing cross-border collaboration required to counter such threats. The bust underlines the increased scrutiny and regulation of digital asset markets, as attackers adapt fraud and laundering methods to evade detection.
6 months ago
Kill Chain
Malicious Android Apps on Google Play Downloaded 42 Million Times: 2024–2025 Mobile Malware Breach
Between June 2024 and May 2025, a widespread mobile malware campaign was uncovered in which hundreds of malicious Android applications were distributed via the official Google Play Store. According to Zscaler, these apps managed to bypass Google’s initial security checks, amassing over 42 million downloads before removal. The attackers embedded various forms of malware—including adware, information stealers, and spyware—into seemingly legitimate apps ranging from utilities to lifestyle tools. Victims experienced invasive ads, data theft, and privacy breaches, affecting both consumers and businesses relying on Android devices within their enterprise environments. This breach underscores mounting challenges in mobile application vetting and the growing sophistication of threat actors targeting official app marketplaces. The scale and reach highlight the ongoing risk of mobile malware, urging organizations and users alike to adopt enhanced threat detection, segmentation, and zero trust practices to mitigate emerging mobile threats.
6 months ago
Kill Chain
Inside the 2025 Cybercrime Merger: Scattered Spider, LAPSUS$, and ShinyHunters Unite
In August 2025, a powerful new cybercrime collective emerged from the merger of Scattered Spider, LAPSUS$, and ShinyHunters—three of the most notorious threat groups involved in high-profile data theft, ransomware, and extortion. This unified entity quickly established 16 Telegram channels to coordinate attacks, evade platform moderation, and amplify operations. Leveraging advanced social engineering and data exfiltration techniques, the collective launched a string of multinational breaches targeting enterprises, exposing sensitive information and causing significant financial and reputational harm to victims. Security teams observed an uptick in lateral movement, exploitation of hybrid/cloud environments, and sophisticated policy evasion tied to these actors. This incident exemplifies a growing trend where cybercriminal syndicates combine resources and expertise, accelerating the pace and scale of attacks. The merger highlights the urgent need for organizations to adapt to evolving threat actor alliances and reinforces the importance of advanced segmentation, zero trust, and robust monitoring frameworks.
6 months ago
Kill Chain
European Authorities Bust €600M Crypto Fraud Network in Pan-European Operation
In late October 2025, European authorities led by Europol and Eurojust dismantled a sophisticated cryptocurrency money laundering network responsible for stealing €600 million (around $688 million) through large-scale crypto fraud schemes. The coordinated operation spanned Cyprus, Spain, and Germany, resulting in the arrest of nine suspects linked to elaborate investment scams, phishing, and online fraud. The network leveraged complex cross-border laundering methods, making use of encrypted digital transactions and a web of services to obfuscate stolen funds, ultimately victimizing thousands of individuals across multiple nations. The case spotlights the emergence of organized crime groups exploiting cryptocurrency platforms for large-scale financial fraud and money laundering. It underscores the urgent need for robust regulatory frameworks and advanced monitoring tools, as law enforcement agencies worldwide face growing challenges combating tech-enabled fraud tied to the volatile, largely unregulated crypto sector.
6 months ago
Kill Chain
Android BankBot-YNRK: 2024 Indonesian Mobile Wallets Targeted by Muting Malware
In 2024, a variant of the Android/BankBot malware known as YNRK targeted mobile users in Indonesia by disguising itself as legitimate applications, often distributed via third-party app stores or phishing campaigns. Once installed, the malware muted system alerts and abused accessibility services to perform unauthorized actions, including theft of credentials and the draining of cryptocurrency and mobile banking wallets. The attack leveraged overlays to capture user inputs and bypassed security mechanisms, resulting in significant financial losses for affected users, with widespread impacts across consumer mobile banking apps in the country. This incident highlights the ongoing evolution and sophistication of mobile banking malware, which increasingly targets emerging markets and exploits weak security controls on non-official app stores. The rapid adoption of mobile wallets and cryptocurrency platforms has made these attacks more lucrative and frequent, intensifying the need for proactive mobile security, user awareness, and regulatory oversight.
6 months ago
Kill Chain
Balancer DeFi Protocol Hit by $128M Crypto Heist: How the 2023 Breach Happened
In August 2023, the Balancer DeFi protocol suffered a sophisticated cyberattack when unidentified hackers exploited vulnerabilities in its v2 pools’ smart contract logic. By manipulating pool configurations and utilizing flash loans, attackers drained over $128 million worth of cryptocurrency assets. Balancer immediately paused affected pools, notified users, and worked to contain losses. The exploit drew industry-wide concern due to the depth and speed of the attack, which bypassed several security checks and resulted in substantial losses for protocol users and liquidity providers. This incident underscores the growing security challenges facing decentralized finance platforms, as attackers increasingly target smart contracts and protocol logic. The Balancer breach highlights the need for advanced anomaly detection, smart contract auditing, and zero trust security controls in Web3 environments as DeFi adoption accelerates.
6 months ago
Kill Chain
BankBot-YNRK and DeliveryRAT: Sophisticated Android Trojans Targeting Financial Data
In November 2025, cybersecurity researchers discovered the active deployment of two advanced Android trojans, BankBot-YNRK and DeliveryRAT, targeting users across multiple financial and delivery service platforms. The trojans infiltrated devices primarily through deceptive apps and phishing schemes, with BankBot-YNRK leveraging anti-analysis techniques to evade detection by testing for emulated and virtualized environments before unleashing its data theft capabilities. DeliveryRAT, meanwhile, provided attackers with remote access for layered exploitation. Both malware families are capable of harvesting sensitive personal and financial data, making banking credentials and payment details accessible to threat actors, potentially leading to significant financial losses and privacy violations for affected users and organizations. This incident highlights the evolving sophistication of Android-targeted infostealers, which increasingly combine stealth, anti-analysis, and remote access tactics. The attack underscores the urgent need for organizations and end-users to enhance mobile threat defenses and rapidly adapt to emerging malware targeting the growing mobile financial ecosystem.
6 months ago
Kill Chain
Jabber Zeus Coder 'MrICQ' Arrested: Lessons from a Banking Trojan Empire
In October 2025, U.S. authorities took into custody Yuriy Igorevich Rybtsov, known online as "MrICQ," a key developer for the infamous Jabber Zeus cybercrime group. The group, active between 2009 and 2013, leveraged a custom version of the ZeuS banking trojan to compromise small and mid-sized business accounts, bypass multi-factor authentication, and orchestrate elaborate money-laundering schemes across multiple countries. MrICQ's primary role involved monitoring real-time breaches, facilitating payroll fraud via money mules, and supporting the laundering of illicit gains through electronic exchanges. This arrest follows years of cross-border law enforcement collaboration, building upon indictments and intelligence from forensic chat intercepts and international extraditions. This case highlights the evolving tactics of financially motivated threat actors, especially their capacity to defeat strong authentication and automate large-scale financial theft. The longevity and operational sophistication demonstrated by groups like Jabber Zeus underscore persistent vulnerabilities in online banking and underscore the need for adaptive security controls across sectors.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Breach Lock helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports