The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
Trigona Ransomware's Custom Exfiltration Tool: A 2026 Cyber Threat Analysis
In March 2026, the Trigona ransomware group employed a custom command-line tool named 'uploader_client.exe' to exfiltrate data from compromised environments more efficiently. This tool supports parallel uploads with five simultaneous connections per file, rotates TCP connections after 2GB of traffic to evade monitoring, selectively exfiltrates specific file types, and uses an authentication key to restrict access to stolen data. The shift to proprietary tools indicates the group's effort to maintain a lower profile during critical attack phases. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/trigona-ransomware-attacks-use-custom-exfiltration-tool-to-steal-data/?utm_source=openai)) The development of custom exfiltration tools by ransomware groups like Trigona reflects a broader trend in the cyber threat landscape, where attackers are investing in bespoke malware to enhance operational efficiency and evade detection. Organizations must adapt their security strategies to address these evolving tactics.
5 months ago
Kill Chain
Inside Caller-as-a-Service Fraud: The Scam Economy Has a Hiring Process
In April 2026, cybersecurity researchers uncovered a sophisticated 'Caller-as-a-Service' (CaaS) fraud operation, where cybercriminals have structured their activities to mirror legitimate call centers. These operations involve specialized roles such as malware developers, phishing kit builders, infrastructure operators, and scam callers, all working in concert to execute large-scale social engineering attacks. This professionalization has led to a significant increase in the efficiency and impact of fraudulent phone calls, resulting in substantial financial losses and emotional distress for victims. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/inside-caller-as-a-service-fraud-the-scam-economy-has-a-hiring-process/?utm_source=openai)) The emergence of CaaS highlights a critical evolution in cybercrime, emphasizing the need for enhanced security measures and public awareness. As these fraudulent operations become more organized and effective, individuals and organizations must adopt proactive strategies to detect and prevent such sophisticated social engineering attacks.
5 months ago
Kill Chain
Mustang Panda's LOTUSLITE Variant Targets Indian Banks and South Korean Policy Circles
In April 2026, cybersecurity researchers identified a new variant of the LOTUSLITE malware, attributed to the Chinese state-sponsored group Mustang Panda. This variant targeted India's banking sector and South Korean policy circles. The attack began with spear-phishing emails containing Compiled HTML (CHM) files that, when executed, deployed a backdoor communicating with a dynamic DNS-based command-and-control server over HTTPS. This backdoor facilitated remote shell access, file operations, and session management, indicating espionage-focused objectives rather than financial gain. The malware was disguised as legitimate banking software, notably referencing HDFC Bank, to deceive victims. This incident underscores the evolving tactics of nation-state actors like Mustang Panda, who are expanding their targets beyond traditional government entities to include financial institutions and policy organizations. The use of familiar yet effective techniques, such as DLL side-loading and spear-phishing, highlights the persistent threat posed by such groups and the need for organizations to remain vigilant against sophisticated cyber espionage campaigns.
5 months ago
Kill Chain
NGate Malware Variant Exploits HandyPay App to Steal NFC Data
In November 2025, ESET researchers identified a new variant of the NGate malware family targeting Android users in Brazil. This variant exploits a legitimate NFC payment application called HandyPay by embedding malicious code, likely generated with the assistance of AI. The malware captures NFC data and payment card PINs from victims, enabling attackers to perform unauthorized contactless ATM withdrawals and payments. Distribution methods include fake lottery websites and counterfeit Google Play pages, indicating a coordinated effort by a single threat actor. This incident underscores the evolving sophistication of cyber threats, particularly the integration of AI in malware development. The use of legitimate applications as vectors for malware distribution highlights the need for heightened vigilance and robust security measures to protect sensitive financial information.
5 months ago
Kill Chain
NGate Malware Exploits HandyPay App to Steal NFC Payment Data
In April 2026, ESET researchers identified a new variant of the NGate malware targeting Android users in Brazil. This malware is embedded within a trojanized version of HandyPay, a legitimate NFC payment application. Once installed, the malicious app prompts users to set it as the default NFC payment application, requests their card PIN, and instructs them to tap their card on the device. The malware then captures and transmits the NFC payment data and PIN to attackers, enabling unauthorized transactions and ATM withdrawals. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ngate-android-malware-uses-handypay-nfc-app-to-steal-card-data/?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals who exploit trusted applications to distribute malware, highlighting the need for heightened vigilance among Android users regarding app sources and permissions. The use of generative AI in developing such malware indicates a concerning trend towards more sophisticated and accessible cyber threats. ([bleepingcomputer.com](https://www.bleepingcomputer.com/news/security/ngate-android-malware-uses-handypay-nfc-app-to-steal-card-data/?utm_source=openai))
5 months ago
Kill Chain
Emerging Enterprise Security Risks of AI in 2026
Between December 2025 and February 2026, a sophisticated cyberattack targeted nine Mexican government agencies, resulting in the exfiltration of approximately 195 million identity and tax records, 15.5 million vehicle registrations, and other sensitive data. The attackers utilized advanced AI tools, including Anthropic's Claude Code and OpenAI's GPT-4.1, to automate and streamline the breach, employing over 1,000 AI prompts to create custom scripts for infiltrating and extracting data from 305 internal servers. This incident underscores the escalating use of AI in cybercrime, enabling small groups to execute large-scale operations with unprecedented efficiency. ([livescience.com](https://www.livescience.com/technology/artificial-intelligence/hackers-used-ai-to-steal-hundreds-of-millions-of-mexican-government-and-private-citizen-records-in-one-of-the-largest-cybersecurity-breaches-ever?utm_source=openai)) The breach highlights a dangerous evolution in cyber threats, where AI's capabilities are harnessed to amplify the scale and speed of attacks. Organizations must recognize the urgency of implementing robust AI governance frameworks, enhancing identity and access management, and adopting zero-trust principles to mitigate the risks posed by autonomous AI agents in their environments.
5 months ago
Kill Chain
Chinese APT Mustang Panda's Cyber-Espionage Campaign Against Indian Banks and Korean Policy Circles
In April 2026, the Chinese state-sponsored advanced persistent threat (APT) group known as Mustang Panda initiated a cyber-espionage campaign targeting India's banking sector and U.S.-Korea policy circles. The attackers employed spear-phishing emails, often disguised as IT help desk communications, to deliver malicious files. Upon opening, these files executed DLL sideloading attacks, establishing persistence via the Windows Registry. The campaign deployed a variant of the LotusLite backdoor, enabling remote access for espionage activities. Notably, the malware was camouflaged to resemble legitimate banking software, such as that of HDFC Bank, India's largest private bank. ([darkreading.com](https://www.darkreading.com/cyberattacks-data-breaches/chinese-apt-indian-banks-korean-policy/?utm_source=openai)) This incident underscores the persistent threat posed by state-sponsored cyber actors utilizing well-known tactics to infiltrate critical sectors. Organizations must remain vigilant, as even unsophisticated methods can be effective if basic security controls are inconsistently applied. The targeting of financial institutions for intelligence gathering highlights the strategic value placed on economic data in geopolitical contexts.
5 months ago
Kill Chain
NGate Malware Exploits HandyPay App to Steal NFC Data in Brazil
In April 2026, ESET researchers identified a new variant of the NGate Android malware targeting users in Brazil. This malware abuses a legitimate application called HandyPay by injecting malicious code, likely generated with AI assistance. The campaign, active since November 2025, distributes the trojanized app through fake lottery websites and counterfeit Google Play pages. Once installed, the app prompts users to set it as the default NFC payment application, enter their payment card PIN, and tap their card against the device. The malware then relays the NFC data and PIN to attacker-controlled devices, enabling unauthorized contactless transactions and ATM withdrawals. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/04/21/3277653/0/en/eset-research-new-ngate-hides-in-nfc-payment-app-possibly-built-with-ai.html?utm_source=openai)) This incident underscores the evolving tactics of cybercriminals, who are now leveraging AI-generated code to enhance malware capabilities and employing sophisticated social engineering techniques to distribute malicious applications. The focus on NFC payment data highlights the increasing targeting of mobile payment systems, necessitating heightened vigilance and security measures for both users and financial institutions. ([globenewswire.com](https://www.globenewswire.com/news-release/2026/04/21/3277653/0/en/eset-research-new-ngate-hides-in-nfc-payment-app-possibly-built-with-ai.html?utm_source=openai))
5 months ago
Kill Chain
Nexcorium Botnet's Exploitation of CVE-2024-3721 in TBK DVRs
In April 2026, cybersecurity researchers identified a new variant of the Mirai botnet, named Nexcorium, actively exploiting CVE-2024-3721—a command injection vulnerability in TBK DVR-4104 and DVR-4216 devices. By sending specially crafted HTTP POST requests to the vulnerable endpoint, attackers gained remote control over these devices, integrating them into a botnet used for large-scale Distributed Denial-of-Service (DDoS) attacks. The campaign, attributed to a group known as 'Nexus Team,' highlights the persistent threat posed by unpatched IoT devices in critical environments. ([fortinet.com](https://www.fortinet.com/blog/threat-research/tracking-mirai-variant-nexcorium-a-vulnerability-driven-iot-botnet-campaign?utm_source=openai)) This incident underscores the ongoing risks associated with IoT vulnerabilities, particularly in devices that are often overlooked in security protocols. The exploitation of CVE-2024-3721 by Nexcorium serves as a stark reminder of the importance of timely patching and robust security measures to protect against evolving botnet threats.
5 months ago
Kill Chain
Microsoft's April 2026 Update Causes Domain Controller Reboot Loops
In April 2026, Microsoft released security update KB5082063, which led to unexpected reboot loops in non-Global Catalog domain controllers utilizing Privileged Access Management (PAM). The issue stemmed from crashes in the Local Security Authority Subsystem Service (LSASS) during startup, rendering authentication and directory services inoperable and potentially making the domain unavailable. Affected systems included Windows Server versions 2025, 2022, 23H2, 2019, and 2016. Microsoft acknowledged the problem and advised administrators to contact Microsoft Support for mitigation measures. This incident underscores the critical importance of thorough testing and validation of security updates, especially in environments with complex configurations like PAM. Organizations should implement robust update management processes, including staged rollouts and comprehensive monitoring, to swiftly identify and address such issues, thereby minimizing operational disruptions.
5 months ago
Kill Chain
Inside an Underground Guide: How Threat Actors Vet Stolen Credit Card Shops
In April 2026, cybersecurity analysts uncovered an underground guide titled 'The Underground Guide to Legit CC Shops: Cutting Through the Bullshit,' which provides insight into how cybercriminals evaluate and select stolen credit card marketplaces. The guide emphasizes a structured approach to vetting suppliers, focusing on factors such as operational longevity, data quality, transparency, and community validation to mitigate risks associated with scams and law enforcement infiltration. This discovery highlights the increasing sophistication and discipline within the cybercriminal ecosystem, as threat actors adopt more methodical strategies to ensure the reliability and security of their illicit operations. Understanding these evolving tactics is crucial for developing effective countermeasures and disrupting fraudulent activities in the digital landscape.
5 months ago
Kill Chain
Grinex Exchange Blames 'Western Intelligence' for $13.7M Crypto Hack
In April 2026, Grinex, a Kyrgyzstan-based cryptocurrency exchange with strong Russian ties, suffered a cyberattack resulting in the theft of approximately $13.7 million from Russian users' wallets. The exchange attributed the sophisticated attack to Western intelligence agencies, citing the advanced nature of the breach. The stolen funds were converted into TRX and ETH through decentralized trading protocols. Grinex, believed to be a rebranded version of the previously sanctioned Garantex exchange, had been under U.S. sanctions since August 2025 for facilitating illicit transactions and money laundering. This incident underscores the persistent vulnerabilities in cryptocurrency exchanges, especially those operating under sanctions. The attribution to state-sponsored actors highlights the escalating geopolitical tensions manifesting in cyber warfare. Organizations must bolster their cybersecurity measures and remain vigilant against increasingly sophisticated threats targeting financial platforms.
5 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports