April 2026 Security Threats Targeting Korean and Global Financial Firms
Summary
AhnLab's April 2026 review describes phishing and malware targeting financial firms, Telegram-based credential theft, real-world exploitation of an Inswave WGear RCE flaw, and dark-web data and access claims.
Key points
- The report identifies phishing, backdoor-downloader-dropper, and infostealer-ransomware activity as leading patterns targeting the financial sector, including Korean-language lures disguised as work, tax, payment, HR, and contract documents.
- It reports that credentials entered through phishing pages were sent to attackers via the Telegram API; accounts from Korea's financial sector made up 2% of the January total cited.
- KISA disclosed an RCE vulnerability affecting Inswave WGear 1.100.7.0205 and earlier. A described real-world attack used mshta to load external HTML and additional payloads before installing GeniexLoader; the report attributes exploitation to Andariel and links GeniexLoader to BlueNoroff.
- Dark-web and forum posts offered financial data and access. ShinyHunters claimed to be selling Santander Bank customer data, while other listings made claims involving Deutsche Bank and Banco do Brasil; the article notes that a Deutsche Bank sample contained many unrelated, generic website entries.
- Ransomware-group posts named Citizens Bank, Standard Bank, and Manulife Wealth & Asset Management as victims. Everest and Prinz Eugen made data-related claims; Qilin named Manulife, but the article says the breach size was not confirmed.
- Access listings included root access to a Linux firewall, a financial transaction firm's core API, and claimed IDOR access to a Latin American financial firm; the listings do not independently establish that the offered access was valid.
Article Details
- Publisher
- asec.ahnlab.com
- Report Period
- April 2026
- Scope
- Phishing, malware, WGear exploitation, ransomware, and dark-web data and access sales involving the financial sector.
- Sample Size
- Not disclosed
- Key Statistics
- The report states that accounts from Korea’s financial sector compromised via Telegram in January accounted for 2% of the total.
- ShinyHunters reportedly claimed to have more than 30 million Santander Bank customers’ records, over 6 million account records and balances, and over 28 million credit card numbers.
- secur3rat claimed to offer approximately 26,554 Deutsche Bank-related combo-list entries; the report notes that the sample included many unrelated and generic website addresses.
- RubiconH4ck claimed to offer a Brazilian financial data set of approximately 2.3 million hits, including Banco do Brasil.
- Prinz Eugen claimed to have taken 1.2 TB and more than 154 million SQL data records from Standard Bank; the report says files were released in phases.
- Recommendations
- Continuously monitor dark web and cybercrime forums for sales of financial data and access.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 15adac4d6fc1bddb0c940cdc0c6605b4 | MD5 hash identified in the report among files distributed in the phishing and malware activity. |
| MD5 | 53636c80d43a3c461dc8a3d2a2f2d4e1 | MD5 hash identified in the report among files distributed in the phishing and malware activity. |
| MD5 | 750173f1b36e502ff17e2c5eec03c602 | MD5 hash identified in the report among files distributed in the phishing and malware activity. |
| MD5 | 8edc77fb36bf80bb52d158cf9043cecd | MD5 hash identified in the report among files distributed in the phishing and malware activity. |
| MD5 | b15a55f9a23998b1976622bd3b9a3ad9 | MD5 hash identified in the report among files distributed in the phishing and malware activity. |
MITRE ATT&CK
T1059.003 · Windows Command ShellA batch file was used as part of malware delivery.T1105 · Ingress Tool TransferThe WGear attack chain used external HTML to download additional payloads.T1204 · User ExecutionThe phishing and malware lures relied on users opening deceptive files.T1218.005 · MshtaA WGear process executed mshta to call external HTML.T1566.001 · Spearphishing AttachmentPhishing attachments and HTML files were disguised as invoices, notices, and work documents.T1566.002 · Spearphishing LinkPhishing emails used malicious links directing recipients to login pages to capture credentials.
Threat Actors
AndarielThe report says Andariel has consistently exploited the WGear RCE vulnerability.APT38The report identifies APT38 as an alternate name for BlueNoroff, which it links to GeniexLoader.BlueNoroffGeniexLoader has been linked to BlueNoroff; the report also identifies CryptoCore and APT38 as names associated with BlueNoroff.EverestEverest posted Citizens Bank as a victim and claimed to possess data and internal transaction-table information.Prinz EugenPrinz Eugen claimed to have taken data from Standard Bank and released files in phases.QilinQilin posted Manulife Wealth & Asset Management as a victim; the report says the specific breach size was not confirmed.Sapphire SleetThe report identifies CryptoCore as an alternate name for BlueNoroff, which it links to GeniexLoader.ShinyHuntersShinyHunters reportedly attempted to sell Santander Bank customer data and claimed to possess large volumes of customer, account, and card information.
Malware
Vendors
Products
Countries
KoreaStolen login IDs and passwords from phishing emails were leaked to attackers through the Telegram API, and January compromises in Korea’s financial sector accounted for 2% of the total.United Statesroot-level access to the Linux-based firewall of a large US-based Financial services firm was sold for $400, while access to the core API of a global financial transaction firm was offered for $80,000 in Monero.