Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This comprehensive analysis covers cyber threats and security issues affecting financial companies in South Korea and globally. It examines malware and phishing cases targeting the financial sector, including the top 10 malware strains and leaked Korean account statistics on Telegram. The report delves into dark web threats, focusing on credit card data breaches, financial institution database leaks, and ransomware attacks. Notable incidents include the M*** digital payment platform data breach in Indonesia, affecting 44 million users, and the Everest ransomware group's attack on J*** Bank in Jordan, compromising 11.7 GB of internal data. The analysis emphasizes the need for enhanced security measures, including real-time protection systems, account takeover detection, and strengthened internal defense mechanisms in the financial industry.

The June 2025 Security Issues report highlights a range of cyber threats targeting the financial sector in South Korea and globally, with a focus on malware, phishing, ransomware, and data breaches. The report identifies the top 10 malware strains affecting financial institutions and notes the leakage of Korean account statistics on Telegram, indicating active data exfiltration and potential credential abuse. Dark web activities are emphasized, particularly the trade and exposure of credit card data and financial institution database leaks. Noteworthy incidents include a massive data breach of a digital payment platform in Indonesia impacting 44 million users and a ransomware attack by the Everest group on a bank in Jordan, resulting in the compromise of 11.7 GB of internal data. The threat actors employ various tactics, techniques, and procedures (TTPs) such as data destruction (T1489), command and control communication (T1071), data from local system (T1005), data from network shared drive (T1567), exploitation for credential access (T1219), data encrypted for impact (T1486), and account takeover strategies. The report underscores the critical need for real-time protection systems, advanced account takeover detection, and robust internal defense mechanisms tailored for the financial sector to mitigate these evolving threats. Indicators of compromise (IOCs) include multiple malware hashes linked to these campaigns, although no known exploits are currently reported in the wild. The medium severity rating reflects the significant but not yet fully exploited threat landscape.

Detailed information about June 2025 Security Issues in Korean & Global Financial Sector. Get real-time updates, technical details, and mitigation strategies.

June 2025 Security Issues in Korean & Global Financial Sector - Live Threat Intelligence - Threat Radar | OffSeq.com

June 2025 Security Issues in Korean & Global Financial Sector

A series of attacks targeting financial organizations across Africa has been observed since July 2023. The threat actor, tracked as CL-CRI-1014, uses open-source and publicly available tools like PoshC2, Chisel, and Classroom Spy to establish attack frameworks, create tunnels for network communication, and perform remote administration. They forge file signatures to disguise their toolset and mask malicious activities. The attackers are suspected to be acting as initial access brokers, creating footholds in financial institutions to sell access on darknet markets. Their playbook includes lateral movement techniques such as creating remote services, executing through DCOM, and using PsExec. The threat actor also employs evasion methods like using packers and signing tools with stolen signatures.

Since July 2023, a cybercriminal group identified as CL-CRI-1014 has been conducting targeted attacks against financial institutions across Africa. This threat actor leverages open-source and publicly available tools such as PoshC2, Chisel, and Classroom Spy to build flexible attack frameworks. PoshC2 is a well-known post-exploitation framework used for command and control (C2), Chisel is used to create encrypted tunnels for network communication, and Classroom Spy is a remote administration tool. By combining these tools, the attackers establish persistent footholds within victim networks, enabling remote control and data exfiltration. To evade detection, the attackers forge file signatures, making their malicious tools appear legitimate, and use packers and stolen digital signatures to mask their malware binaries. Their operational playbook includes lateral movement techniques such as creating remote services, executing commands via Distributed Component Object Model (DCOM), and leveraging PsExec for remote code execution. These techniques allow the threat actor to move laterally within compromised networks, escalating privileges and expanding access. The group is suspected to act as initial access brokers, compromising financial organizations and then selling access on darknet markets to other malicious actors. The attack chain involves sophisticated evasion and persistence mechanisms, including the use of scheduled tasks (T1053.005), masquerading (T1036.005), and code injection (T1055). Although no known exploits are currently reported in the wild for specific vulnerabilities, the use of legitimate tools and stolen signatures complicates detection and mitigation efforts. The threat is categorized as medium severity, reflecting the moderate but significant risk posed by these targeted intrusions.

Detailed information about Cybercriminals Abuse Open-Source Tools To Target Africa's Financial Sector. Get real-time updates, technical details, and mitigation 

Title	Severity	Type	Source	Date

Threats Tagged 'financial sector'

Filter Threats

Threats Tagged 'financial sector'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility