The breach isn’t the problem. The spread is. →The breach isn’t the problem. The spread is. →Measure in 5 min. Free AssessmentFree Assessment
Banking/Mortgage
Breach intelligence, attack campaigns, and threat reports targeting the Banking/Mortgage sector.
Explore Other Sectors
Banking/Mortgage Threat Reports
Microsoft Announces Deprecation of NTLM Authentication Protocol
In June 2024, Microsoft announced the deprecation of the NTLM authentication protocol, ceasing its active development and urging organizations to transition to more secure alternatives like Kerberos. This decision was driven by NTLM's inherent security vulnerabilities, including susceptibility to relay attacks and lack of support for modern cryptographic methods. The deprecation process began in early 2025, with phased reductions in support throughout the year, aiming for complete removal by the end of 2027. Organizations relying on NTLM are advised to assess their authentication mechanisms and plan migrations to more secure protocols to mitigate potential security risks. ([threatdown.com](https://www.threatdown.com/blog/microsoft-calls-time-on-ntlm-so-should-you/?utm_source=openai)) The deprecation of NTLM underscores a broader industry shift towards enhancing authentication security. As cyber threats evolve, legacy protocols like NTLM become prime targets due to their known weaknesses. This move aligns with Microsoft's Secure Future Initiative, emphasizing the importance of adopting robust authentication methods to safeguard against emerging threats. ([microsoft.com](https://www.microsoft.com/en-us/msrc/blog/2024/12/mitigating-ntlm-relay-attacks-by-default?utm_source=openai))
7 months ago
Kill Chain
Bybit's 2025 Security Breach: A Deep Dive into the $1.4 Billion Ethereum Theft
In February 2025, Dubai-based cryptocurrency exchange Bybit suffered a significant security breach, resulting in the theft of approximately 401,000 Ethereum (ETH), valued at over $1.4 billion. The attackers exploited vulnerabilities in Bybit's multi-signature cold wallet system, facilitated by compromised infrastructure at Safe{Wallet}, a third-party provider. This incident stands as the largest cryptocurrency exchange hack to date. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Bybit?utm_source=openai)) The breach was attributed to the North Korean state-sponsored Lazarus Group, known for their sophisticated cyber operations targeting financial institutions. The stolen funds were laundered through various channels, including privacy-focused platforms, complicating recovery efforts. ([en.wikipedia.org](https://en.wikipedia.org/wiki/Lazarus_Group?utm_source=openai))
7 months ago
Kill Chain
How the 2024 Microsoft Office Zero-Day Shaped Urgent Security Responses
In June 2024, Microsoft was compelled to release an emergency patch for a critical zero-day vulnerability affecting Microsoft Office products. The issue allowed attackers to exploit crafted Office documents, enabling remote code execution if a victim opened a malicious file. Attackers leveraged social engineering—including phishing—to trick users into opening infected attachments, bypassing standard email and endpoint defenses. Rapid weaponization of the exploit by criminal groups and likely state-backed actors resulted in significant risk for businesses using vulnerable Office deployments, with potential for data theft, malware infection, and lateral movement across networks. This attack highlights a pervasive trend of adversaries capitalizing on zero-day vulnerabilities in widely used productivity platforms. As seen in recent high-profile breaches, rapid exploitation before patches can be applied increases organizational risk and regulatory scrutiny, necessitating faster detection, patching, and user education across industries.
7 months ago
Kill Chain
Kingdom Market Darknet Takedown: How Law Enforcement Disrupted a Global Cybercrime Hub (2021–2023)
Between March 2021 and December 2023, the Kingdom Market darknet platform operated as a large-scale cybercrime marketplace facilitating the sale of narcotics, cybercrime tools, stolen personal information, and fraudulent documents. Slovakian national Alan Bill, also known as "Vend0r" or "KingdomOfficial," admitted in January 2026 to administering the illicit platform, handling site infrastructure, and orchestrating anonymous cryptocurrency payments. The marketplace boasted over 42,000 illegal listings and tens of thousands of customer accounts. Its takedown culminated in coordinated law enforcement actions, domain seizures, and Bill's arrest in the U.S., where evidence linked him directly to site operations. This case highlights the persistent challenge of global, darknet-enabled cybercrime, the evolution of anonymous payment technologies, and the international scope of enforcement efforts. Cybercrime marketplaces remain a top concern for regulators and enterprises alike, with attackers rapidly adapting business models and operational security to evade detection.
8 months ago
Kill Chain
FBI Takedown of RAMP: Ransomware's Last Open Forum Seized in 2026
In January 2026, the FBI seized control of the notorious Russian-speaking RAMP cybercrime forum, widely used by ransomware gangs to promote operations, recruit affiliates, and trade access to compromised networks. Both its Tor and clearnet domains were confiscated, and a seizure notice was displayed in coordination with U.S. law enforcement agencies. As one of the last prominent ransomware-friendly forums, RAMP had become a hub for multiple groups, facilitated by threat actor Mikhail Matveev (aka Orange/Wazawaka). The FBI now possesses potentially incriminating data on user identities, logins, and private communications, increasing the risk of arrests for those with poor operational security. This takedown reflects a broader law enforcement crackdown on cybercrime infrastructure supporting ransomware attacks. The RAMP seizure is significant amid heightened regulatory and industry focus on disrupting the ransomware ecosystem and demonstrates the ongoing risk of exposure for those operating in or near dark web forums.
8 months ago
Kill Chain
SafePay 2025: Ransomware Double-Extortion Escalates Against SMBs
In late 2024 and throughout 2025, the SafePay ransomware group rapidly escalated its operations, launching a string of highly targeted double-extortion attacks against small and mid-sized businesses (SMBs), particularly in highly regulated markets such as the US and Germany. SafePay affiliates compromised victim networks via common attack vectors, exfiltrated sensitive data, and deployed ransomware to encrypt crucial assets. Victims predominantly included service-based companies lacking the resilience to handle operational downtime or public exposure. Attackers leveraged leak sites and aggressive negotiation tactics, threatening regulatory action, legal liability, and reputational damage to compel payment, creating severe business, legal, and financial impacts. This incident exemplifies a broader trend in ransomware: extortion is no longer just about encrypting files, but about exploiting regulatory frameworks and psychological leverage. The rise of fragmented ransomware ecosystems and pressure-centric extortion highlights the need for organizations to move beyond classic recovery strategies and address emerging risks such as data exposure, legal repercussions, and reputational harm.
8 months ago
Kill Chain
Stanley Malware: Chrome Web Store Defense Bypassed for Phishing – 2026 Breach Analysis
In January 2026, security researchers uncovered 'Stanley', a Malware-as-a-Service (MaaS) operation specializing in the distribution of phishing Chrome extensions designed to bypass Google’s official Chrome Web Store review process. Marketed on underground forums, Stanley provides subscribers with malicious browser extensions capable of injecting full-page phishing iframes, silently installing on Chrome, Edge, and Brave, and maintaining persistent command-and-control communication. The malware enables attackers to manipulate users’ browsing sessions while masking the true origin, collect sensitive credentials, and target victims based on IP and geography. This poses a significant risk of data theft and compromise within organizations that rely on browser-based workflows. This incident underscores the growing trend of abusing trusted extension platforms to deliver targeted phishing and credential theft at scale. The ability for criminal actors to bypass established security vetting processes presents urgent challenges for enterprise security teams and highlights the broader concern over supply chain weakness in browser ecosystems.
8 months ago
Kill Chain
US ATM Jackpotting: Tren de Aragua's Ploutus Malware Heist Exposed
In late 2025 and early 2026, US law enforcement charged 31 additional suspects in a major campaign of ATM jackpotting attacks attributed to the Venezuelan criminal gang Tren de Aragua. The attackers breached numerous ATMs across the United States, installing Ploutus malware by physically accessing internal components and deploying malware to force the machines to dispense large quantities of cash. The sophisticated attacks leveraged swapped hard drives or infected USB devices and allowed the perpetrators to launder stolen funds internationally, inflicting millions of dollars in losses on banks and credit unions. To date, over 87 individuals have been charged in this transnational criminal scheme. This incident highlights the evolving tactics of financially motivated threat groups combining physical access and technical expertise. The designation of Tren de Aragua as a Foreign Terrorist Organization underscores law enforcement’s recognition of cyber-enabled financial crime as a national security threat and signals intensified global scrutiny on such operations.
8 months ago
Kill Chain
How 2024 Romance Scams Use WhatsApp Social Engineering: An Inside Look
In early 2024, security researchers investigated the initial phases of romance scams conducted over WhatsApp, where attackers use social engineering tactics to engage targets. Scammers made initial contact using 'wrong number' messages, then rapidly built rapport through flattering responses and fabricated personal stories. Over the span of several weeks, operators established credibility by sharing career details, transitioning conversations to new phone numbers, and sharing lifestyle photos to lay groundwork for future financial scams. The observed campaigns were early-stage but designed to emotionally manipulate victims for eventual financial exploitation. This incident spotlights the refined playbooks, multi-operator approaches, and psychological grooming now typical in romance scams. With surges in digital-first communication and persistent threat actor innovation, such social engineering exploits pose a significant and evolving risk to individuals and businesses alike.
8 months ago
Kill Chain
US ATM Jackpotting 2024: Venezuelan Hackers Steal Hundreds of Thousands Using Malware
In early 2024, federal prosecutors in South Carolina uncovered a sophisticated ATM jackpotting scheme perpetrated by two Venezuelan nationals. Employing financial malware, the attackers compromised U.S. bank ATM networks and extracted hundreds of thousands of dollars in cash. The scheme involved the unauthorized installation of malware on ATM machines, which enabled the criminals to override withdrawal limits and rapidly dispense large sums of money. Following their arrest, both individuals were convicted and will be deported after serving their sentences, highlighting significant vulnerabilities in ATM security and network segmentation. This incident reflects a growing trend in financial crime, where cybercriminals target banking infrastructure using advanced malware and physical access techniques. Regulators and banks are increasingly focused on hardening ATM systems and tightening controls to prevent similar attacks as cyber-enabled fraud remains a persistent and evolving threat.
8 months ago
Kill Chain
Kimwolf Botnet: How Residential Proxy Infections Fueled a 2025 IoT Crisis
In late 2025, the Kimwolf botnet rapidly infected over 2 million IoT devices—primarily unofficial Android TV streaming boxes—by exploiting insecure residential proxy networks, notably those operated by IPIDEA. Kimwolf used these proxies to scan and compromise additional devices on local networks, enabling attackers to conscript them for distributed denial-of-service (DDoS) attacks and other forms of malicious activity, such as ad fraud and data scraping. Investigations by Infoblox and other security firms found Kimwolf infections active across diverse industry sectors worldwide, including healthcare, finance, utilities, and notably, dozens of sensitive government networks. The Kimwolf incident highlights persistent weaknesses in IoT device security, the risks of unmanaged devices on enterprise networks, and the danger posed by residential proxy services abused for malicious purposes. As threat actors increasingly exploit lateral movement via proxy endpoints, organizations in all industries must strengthen segmentation, east-west traffic monitoring, and endpoint visibility to mitigate future outbreaks.
8 months ago
Kill Chain
Russian Ransomware Leader Brought to Justice: Lessons from the Antropenko Case
Between 2018 and August 2022, Ianis Aleksandrovich Antropenko led a prolific ransomware operation targeting at least 50 victims across various sectors, causing losses exceeding $1.5 million. Operating from both Russia and later the United States, Antropenko leveraged variants like Zeppelin and GlobeImposter, coordinating with co-conspirators—including his ex-wife—to deploy ransomware, extort victims, and launder proceeds through a network of global accounts and crypto wallets. His arrest and subsequent guilty plea follow a multi-year investigation by U.S. federal authorities, resulting in the seizure of more than $3 million in assets. This case highlights the growing trend of ransomware group leaders operating internationally and even within U.S. borders, challenging traditional law enforcement approaches. It underscores persistent ransomware risk, ongoing challenges in detecting coordinated laundering activity, and the critical need for comprehensive security controls and compliance vigilance.
8 months ago
Kill Chain
Stop Active Cloud Data Exfiltration
Aviatrix Rapid Containment helps teams instantly identify what data is leaving the environment, from which workload, and where it’s going — during an active breach.
Looking for threats in a different sector?
Browse All Threat Reports