The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
UK Sanctions Xinbi Marketplace Linked to Asian Scam Centers
In March 2026, the United Kingdom's Foreign, Commonwealth and Development Office (FCDO) imposed sanctions on Xinbi, a Chinese-language online marketplace operating via Telegram. Xinbi has been implicated in facilitating the sale of stolen data and satellite internet equipment to scam networks across Southeast Asia. Additionally, the platform is believed to have assisted North Korean threat actors in laundering cryptocurrency obtained from significant cyber heists targeting global companies and individuals. Between 2021 and 2025, Xinbi processed over $19.9 billion, engaging in activities ranging from unlicensed over-the-counter trades and money laundering to the distribution of stolen personal databases. The UK's sanctions aim to sever Xinbi's connections to the legitimate cryptocurrency ecosystem, thereby disrupting its operations and preventing further illicit activities. This action underscores the growing international efforts to combat cybercrime infrastructures that enable large-scale financial fraud and data breaches. The sanctions against Xinbi highlight the necessity for organizations to enhance their cybersecurity measures and remain vigilant against platforms that facilitate cybercriminal activities.
6 months ago
Kill Chain
RedLine Infostealer Developer Extradited to US in 2026
In March 2026, international law enforcement agencies successfully extradited Hambardzum Minasyan, an Armenian national, to the United States for his alleged involvement in the development and administration of the RedLine infostealer malware. RedLine, active since 2020, has been one of the most prevalent data-stealing malware variants, responsible for compromising millions of devices worldwide. Minasyan faces charges including conspiracy to commit access device fraud, conspiracy to violate the Computer Fraud and Abuse Act, and conspiracy to commit money laundering. The indictment alleges that he registered virtual private servers to host RedLine, established repositories for distributing the malware, and managed cryptocurrency accounts to receive payments from affiliates. This extradition marks a significant step in the ongoing efforts to dismantle cybercriminal networks operating on a global scale. The arrest and extradition of Minasyan underscore the persistent threat posed by infostealer malware like RedLine. Despite previous takedown operations, such as Operation Magnus in 2024, which targeted RedLine's infrastructure, the malware continues to be a tool for cybercriminals to steal sensitive information, including login credentials, financial data, and cryptocurrency wallets. Organizations must remain vigilant, as the convergence of infostealers and other cyber threats, like ransomware, has led to rapid extortion chains, emphasizing the need for robust cybersecurity measures and international cooperation to combat these evolving threats.
6 months ago
Kill Chain
TA551 Botnet Manager Sentenced for Ransomware Attacks
In March 2026, Ilya Angelov, a Russian national and co-manager of the cybercriminal group TA551 (also known as Shathak or GOLD CABIN), was sentenced to two years in prison. Angelov's group operated a massive botnet that distributed malware through large-scale phishing campaigns, leading to ransomware attacks on 72 U.S. companies between 2018 and 2019. These attacks resulted in over $14 million in extortion payments. The botnet infected approximately 3,000 computers daily at its peak, facilitating the deployment of ransomware such as BitPaymer. This sentencing underscores the persistent threat posed by sophisticated cybercriminal organizations like TA551, which have been active since at least 2018. Their use of phishing campaigns to distribute malware highlights the critical need for organizations to implement robust email security measures and user awareness training to mitigate such risks.
6 months ago
Kill Chain
Nation-State Exploitation of Internet-Connected Cameras: A 2026 Analysis
In early 2026, nation-state actors, notably from Iran and Russia, intensified cyber operations targeting internet-connected surveillance cameras across the Gulf region and Eastern Europe. These actors exploited known vulnerabilities in IP cameras, such as those from Hikvision and Dahua, to gain unauthorized access. This access enabled real-time intelligence gathering, including monitoring military movements and assessing battle damage. The compromised devices were leveraged to support missile targeting and other strategic operations, significantly impacting regional security dynamics. ([asisonline.org](https://www.asisonline.org/security-management-magazine/latest-news/today-in-security/2026/march/camera-compromise-targeting/?utm_source=openai)) This incident underscores a growing trend where nation-states exploit unsecured IoT devices for espionage and military advantage. The proliferation of internet-connected cameras with inadequate security measures presents a substantial risk, highlighting the urgent need for robust cybersecurity practices and regulatory oversight to mitigate such threats.
6 months ago
Kill Chain
RedLine Infostealer Administrator Extradited to US in 2026
In March 2026, Armenian national Hambardzum Minasyan was extradited to the United States to face charges for his alleged role in managing the RedLine infostealer malware operation. Minasyan is accused of registering virtual private servers and web domains integral to RedLine's infrastructure, establishing cryptocurrency accounts for affiliate payments, and creating file-sharing repositories used to distribute the malware. RedLine, a malware-as-a-service platform, has been responsible for stealing sensitive data from millions of victims worldwide. Minasyan faces charges including access device fraud, conspiracy to commit computer intrusion, and money laundering, with a potential maximum sentence of 30 years in prison. This extradition underscores the ongoing international efforts to dismantle cybercriminal networks and hold perpetrators accountable. The case highlights the persistent threat posed by infostealer malware and the importance of global cooperation in combating cybercrime.
6 months ago
Kill Chain
SmartApeSG Campaign 2026: Unveiling the ClickFix Multi-Stage Malware Attack
In March 2026, the SmartApeSG campaign employed the ClickFix technique to deliver a sequence of malware, including Remcos RAT, NetSupport RAT, StealC, and Sectop RAT (ArechClient2). The attack began with a fake CAPTCHA page that tricked users into executing a malicious script, leading to the staged deployment of these remote access tools and information stealers over several hours. This multi-stage infection allowed attackers to establish persistent access and exfiltrate sensitive data from compromised systems. The SmartApeSG campaign underscores the evolving sophistication of social engineering tactics, particularly the use of ClickFix to bypass traditional security measures. Organizations must remain vigilant against such deceptive techniques, as they continue to be refined and pose significant threats to cybersecurity.
6 months ago
Kill Chain
TeamPCP's Compromise of litellm via Trivy CI/CD: A Wake-Up Call for Supply Chain Security
In March 2026, the threat actor known as TeamPCP executed a supply chain attack by compromising the Continuous Integration/Continuous Delivery (CI/CD) pipeline of the Trivy project. This breach enabled them to inject malicious code into the litellm Python package, specifically versions 1.82.7 and 1.82.8. The tampered versions included a credential harvester, a Kubernetes lateral movement toolkit, and a persistent backdoor, posing significant risks to developers and organizations utilizing these packages. This incident underscores the escalating trend of sophisticated supply chain attacks targeting open-source ecosystems. It highlights the critical need for organizations to implement stringent security measures within their CI/CD pipelines and to conduct thorough integrity checks on third-party packages to mitigate potential threats.
6 months ago
Kill Chain
Trivy Supply Chain Attack Exposes Critical CI/CD Vulnerabilities
In March 2026, a sophisticated supply chain attack exploited the open-source security tool Trivy to infiltrate Continuous Integration/Continuous Deployment (CI/CD) pipelines. Attackers leveraged Trivy's integration within these pipelines to deploy an infostealer, exfiltrating sensitive assets such as cloud credentials, SSH keys, and API tokens. This breach underscores the vulnerabilities inherent in CI/CD environments, where trusted tools can become vectors for significant data exfiltration. This incident highlights a growing trend of adversaries targeting CI/CD pipelines to compromise software supply chains. As organizations increasingly rely on automated deployment processes, ensuring the security of these pipelines becomes paramount to prevent unauthorized access and data breaches.
6 months ago
Kill Chain
Russian Access Broker Sentenced to 81 Months for Facilitating Ransomware Attacks
In March 2026, Russian national Aleksei Volkov was sentenced to 81 months in a U.S. federal prison for his role as an initial access broker for ransomware groups, notably Yanluowang. Operating between July 2021 and November 2022, Volkov exploited vulnerabilities in corporate networks, selling access to ransomware operators. His activities led to over $9 million in confirmed losses and more than $24 million in intended losses across multiple U.S. businesses, including an engineering firm and a bank. Two victims paid a combined $1.5 million in ransom. This case underscores the evolving tactics of ransomware groups, which now include harassment and distributed denial of service attacks to pressure victims. The sentencing highlights the increasing legal consequences for cybercriminals and the importance of robust cybersecurity measures to prevent such breaches.
6 months ago
Kill Chain
Tycoon2FA Phishing Platform Resurfaces After Law Enforcement Takedown
In early March 2026, an international law enforcement operation coordinated by Europol disrupted Tycoon2FA, a major phishing-as-a-service (PhaaS) platform responsible for tens of millions of phishing emails monthly. The operation led to the seizure of 330 domains integral to Tycoon2FA's infrastructure, including control panels and phishing pages. Despite this significant intervention, the platform resumed its operations within days, returning to pre-disruption activity levels. Tycoon2FA employs adversary-in-the-middle techniques to bypass multi-factor authentication (MFA), enabling cybercriminals to compromise accounts across various sectors, including government institutions, schools, and healthcare organizations. The platform's resilience underscores the challenges in permanently dismantling sophisticated cybercrime services. The swift resurgence of Tycoon2FA highlights the adaptability of cybercriminal networks and the limitations of infrastructure-focused takedown efforts. This incident emphasizes the need for comprehensive strategies that include legal actions against operators and continuous monitoring to effectively combat persistent cyber threats.
6 months ago
Kill Chain
Exploitation of Microsoft Azure Monitor in Sophisticated Phishing Attack
In March 2026, cybercriminals exploited Microsoft Azure Monitor to send phishing emails that appeared as legitimate security alerts from Microsoft. These emails, originating from azure-noreply@microsoft.com, warned recipients of unauthorized charges and urged them to call a provided phone number. By leveraging Azure Monitor's legitimate alerting system, attackers bypassed standard email security checks, making the phishing attempts more convincing. This method highlights a sophisticated abuse of trusted cloud services to execute social engineering attacks. The incident underscores the evolving tactics of threat actors who manipulate legitimate platforms to enhance the credibility of their phishing campaigns. Organizations must remain vigilant, as such techniques can lead to credential theft, financial fraud, or unauthorized access to sensitive systems.
6 months ago
Kill Chain
LeakNet Ransomware's 2026 Campaign: Exploiting ClickFix and Deno Runtime for Stealthy Attacks
In March 2026, the LeakNet ransomware group initiated a sophisticated campaign leveraging the ClickFix social engineering technique to gain initial access to target systems. By compromising legitimate websites, they presented users with deceptive prompts instructing them to execute malicious PowerShell commands under the guise of resolving non-existent errors. This method effectively bypassed traditional security measures, leading to the deployment of an in-memory loader utilizing the Deno JavaScript runtime. This loader facilitated the execution of the CastleRAT malware directly in memory, thereby evading detection by conventional endpoint security solutions. The campaign resulted in significant data breaches and operational disruptions across multiple sectors. This incident underscores a concerning evolution in ransomware tactics, highlighting the increasing sophistication of social engineering methods and the exploitation of novel technologies like the Deno runtime for stealthy malware deployment. The use of in-memory execution techniques poses a substantial challenge to traditional security defenses, emphasizing the need for advanced detection mechanisms and comprehensive user education to mitigate such threats.
6 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports