July 2026 Report Details Malware, Phishing and Data-Leak Risks in the Financial Sector
Summary
A July 2026 review of financial-sector threats reports phishing-led malware chains, credentials leaked through Telegram, dark-web data-sale claims involving financial organizations, and hacktivist DDoS claims that remain unverified.
Key points
- Phishing led initial-stage malware detections at 1.7, while droppers and downloaders were most prevalent in the second stage at 1.7.
- Phishing, loaders and backdoors made up about 68% of detections; the report describes common multi-stage chains progressing from phishing to malware installation and information theft.
- HTML was the most common malicious attachment format; script extensions including JS, VBE, VBS, BAT and HTA were prominent.
- Phishing pages and HTML attachments were used to steal account credentials and send them to Telegram; Korean financial-sector accounts represented 5% of accounts leaked via Telegram in June.
- Dark-web posts claimed to offer financial and customer records associated with Santander, Alfa-Bank, Liberty Mutual and Fiserv, among others; the report says the claims and data scale were not officially confirmed.
- The UnSafe group claimed a Deutsche Bank breach and released credentials and file-transfer records; Everest claimed Liberty Mutual and Fiserv as victims.
- Gorz_Rostam claimed DDoS attacks targeting Gulf-region banking systems, but the report found no concrete evidence confirming damage from the claimed Bahrain attack.
Article Details
- Publisher
- Asec Ahnlab
- Report Period
- July 2026
- Scope
- Malware distribution, phishing, Telegram account leaks, deep web and dark web claims, and cyberattack cases affecting the Korean and global financial sectors.
- Key Statistics
- Phishing accounted for 31.6% of detections; loaders (19.9%) and backdoors (16.6%) brought the top three categories to approximately 68%.
- HTML was the most common malicious attachment type at 24.4%; the top eight file extensions accounted for 80% of the total.
- In June, domestic financial-sector accounts leaked via Telegram accounted for 5% of the total.
- A seller reportedly claimed to have over 5,000 Santander-related records; the claim was not confirmed in the report.
- A post related to Alfa-Bank claimed a CSV file containing 1,032,464 records; the report says the exact scale and official verification of cases were not confirmed.
Threat Actors
EverestRansomware group that posted Liberty Mutual Insurance and Fiserv as victims; the reported data claims were not confirmed in the report.Gorz_RostamClaimed to be continuing a service-disruption campaign targeting banking systems in the UAE and Gulf region, and claimed an attack on Bahrain's banking sector; the report found no concrete evidence confirming damage.UnSafeRansomware group that claimed responsibility for a breach at Deutsche Bank and released data it said was related to the breach; the claim was not confirmed in the report.
Products
Countries
BahrainAlfa-Bank Amelia America Attachment Bahrain Banco bank Blackrock BreachForums DarkForums DarkWeb DeepWeb DeutscheBank Deutsche_Bank DNI Email Everest 러시아 랜섬웨어 독일 미국 바레인 금융권 블랙록 딥웹 다크웹 financial Fiserv German GORZ-ROSTAMUnited Arab EmiratesOn Hasan’s BreachForums, Gorz_Rostam claimed to be continuing a service disruption campaign targeting banking systems in the United Arab Emirates and the Gulf Region.