AhnLab Reports September 2026 Threat Trends in the Financial Sector
Summary
AhnLab’s September 2026 review highlights phishing and downloader activity, Telegram-based theft of financial-sector credentials, and dark-web data-leak and ransomware claims involving financial organizations.
Key points
- Stage 1 phishing had a rate of 2.1, up from 1.8 the previous month; Stage 2 dropper/downloader activity was 1.1, down from 3.2; Stage 3 infostealer activity was 0.3, down from 0.4.
- Across malware types, phishing ranked first at 27.0%, followed by dropper/downloader at 25.3% and backdoor at 13.5%; the article describes multi-stage attack chains as prominent.
- HTML was the leading malicious attachment file type at 23.1%, while the html extension accounted for 31.8%. The report also notes frequent script-based extensions and use of LOLBins.
- AhnLab reports that financial-sector account credentials collected through malware infections and phishing emails were leaked to threat actors via the Telegram API; these accounts represented 1.4% of the reported domestic total for September.
- Dark-web forum posts claimed to offer 454 million insurance-contract records related to LIC India, a 79,000-record Truist Bank database, and internal Allstate data; the article attributes the claims to the named posters and does not establish them as confirmed breaches.
- LockBit 5.0 listed Taspen Life, with samples appearing to contain insurance and customer documents. Qilin listed Inversiones Bolívar, but samples and breach scale were not confirmed.
- Storm listed First Secure Bank and Trust, The State Bank, First Secure Community Bank, Insight Credit Union, and Johnson Investment Counsel; the article says sample documents included financial, tax, banking, insurance, and identification records.
Article Details
- Publisher
- ASEC Ahnlab
- Report Period
- September 2026
- Scope
- Korean and global financial sector; malware distribution, phishing, Telegram-based account exfiltration, and reported dark-web data leaks and ransomware incidents.
- Key Statistics
- Attack-stage rates: phishing was 2.1 in September 2026, up from 1.8 the previous month; dropper/downloader was 1.1, down from 3.2; infostealer was 0.3, down from 0.4. The source does not specify units.
- By malware type, phishing accounted for 27.0%, dropper/downloader 25.3%, and backdoor 13.5%; the three types together represented approximately 66%.
- Attachment file types included HTML at 23.1%, PE at 15.0%, LNK at 8.5%, and ELF64 at 4.7%. The top 10 file extensions accounted for over 80%; HTML was the leading extension at 31.8%.
- Domestic financial-sector accounts leaked via Telegram during September accounted for 1.4% of the total; the source does not specify the denominator.
- DarkForums posts included a claim of 454M insurance-contract data related to licindia.In and a separate claim of 79,000 Truist Bank records; these figures are claims, not confirmed breach totals.
MITRE ATT&CK
T1056.003 · Web Portal CaptureThe report says users entered account IDs and passwords into identified login pages, after which the credentials were leaked to threat actors.T1566.001 · Spearphishing AttachmentThe report describes phishing emails containing attached HTML files used in attacks against financial-sector users.T1566.002 · Spearphishing LinkThe report describes malicious links in phishing emails that led users to login pages.
Threat Actors
ExfilSquadClaimed on PwnForums to be releasing internal data related to Allstate.LockBit 5.0Listed Taspen Life as a victim; the report describes disclosed samples but does not independently establish the group's claims.QilinListed Inversiones Bolívar as an insurance-related company, but the report says no samples or breach scale had been confirmed.ShinyHuntersClaimed in a BreachForums post to share a database related to Truist Bank; the reported contents and record count are claims.StormListed First Secure Bank and Trust, The State Bank, First Secure Community Bank, Insight Credit Union, and Johnson Investment Counsel as victims; the report says sample documents and file structures were confirmed.
Products
Countries
Industries
Bankingfile structure and sample documents were confirmed to include financial documents, tax records, loan and banking documents, insurance and contract materials, copies of identification documents, and spreadsheets relatedInsuranceOn DarkForums, SpaceX posted what it claimed was 454M insurance contract data related to licindia.In.