March 2026 Report Details Threat Activity Targeting Financial Institutions
Summary
A March 2026 review of Korean and global financial-sector activity describes phishing, Lazarus watering-hole exploitation of AnySign4PC, Telegram API account compromises, dark-web breach claims, ransomware, and DDoS incidents.
Key points
- The report observed phishing, web shells, backdoors, droppers, downloaders, infostealers, and CoinMiner targeting financial organizations.
- Phishing campaigns often used Korean-language attachment names and executable HTML/JS files.
- The report says Lazarus exploited an AnySign4PC vulnerability for remote code execution in watering-hole attacks, and that some distribution sites were reused.
- Telegram API account-compromise campaigns were described as confirmed; internal estimates put the financial sector at about 4% of compromised accounts.
- Dark-web and forum posts claimed large data sets involving NR Capital, Ameriprise, Nu Colombia, and Agrobanco; the reported volumes and records remain claims.
- The report describes ransomware cases involving groups including Apt73, PayoutsKing, and WorldLeaks; data release or exfiltration was reported. Hacktivist DDoS incidents disrupted some banking websites, alongside customer-data claims.
- Recommended measures include stronger logging, patching, backups, access controls, intelligence sharing, and incident disclosure and law-enforcement cooperation.
Article Details
- Publisher
- asec.ahnlab.com
- Report Period
- March 2026
- Scope
- Malware distribution, account compromise, watering-hole exploitation, data-disclosure claims, ransomware, and DDoS incidents involving Korean and global financial institutions.
- Sample Size
- Not disclosed
- Key Statistics
- Internal estimates placed the financial sector at approximately 4% of accounts affected by Telegram account-compromise campaigns.
- Dark-web posts claimed approximately 2 TB of data from NR Capital.
- Dark-web posts claimed 200 GB from Ameriprise.
- Dark-web posts claimed 30,000 documents from Nu Colombia and 250,000 records from Agrobanco.
- Recommendations
- Strengthen log monitoring, patching, backups, and access controls.
- Share threat intelligence across the financial industry.
- Maintain continuous monitoring and promptly disclose incident information; cooperate with law enforcement when incidents occur.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| MD5 | 04f1f6e2d8a0cfb58c9dab5546bbd13f | Malware sample hash listed among samples distributed in campaigns targeting the financial sector. |
| MD5 | 3fc3962721c62a7352fb4230e36a6089 | Malware sample hash listed among samples distributed in campaigns targeting the financial sector. |
| MD5 | 6e7a2aa1a62c90dc31e2b4fda1a7ad00 | Malware sample hash listed among samples distributed in campaigns targeting the financial sector. |
| MD5 | 94c75cdb38a51621b8c8255db24b45a1 | Malware sample hash listed among samples distributed in campaigns targeting the financial sector. |
| MD5 | b285748d5b50658b50fd974f034872f0 | Malware sample hash listed among samples distributed in campaigns targeting the financial sector. |
| URL | hxxp[:]//www[.]kimeye[.]com/kimeye | Listed among watering-hole/distribution sites and phishing pages associated with the reported financial-sector campaigns. |
| URL | hxxps[:]//chonanrent[.]co[.]kr/include/menu0206[.]php?id=20260123015897 | Listed among watering-hole/distribution sites and phishing pages associated with the reported financial-sector campaigns. |
| URL | hxxps[:]//dominoworld[.]co[.]kr/ | Listed among watering-hole/distribution sites and phishing pages associated with the reported financial-sector campaigns. |
| URL | hxxps[:]//myonlinestatus[.]net/list/dashboard/?id=20260123 | Listed among watering-hole/distribution sites and phishing pages associated with the reported financial-sector campaigns. |
| URL | hxxps[:]//quordtechservice[.]com/www/bbs/?id=20260123015897 | Listed among watering-hole/distribution sites and phishing pages associated with the reported financial-sector campaigns. |
MITRE ATT&CK
T1041 · Exfiltration Over C2 ChannelThe report describes stolen data being exfiltrated and posted to data leak sites or offered for sale.T1078 · Valid AccountsThe report describes confirmed account-compromise campaigns leveraging the Telegram API.T1189 · Drive-by CompromiseThe report says Lazarus exploited AnySign4PC in a watering-hole attack and that watering-hole distribution sites were reused.T1190 · Exploit Public-Facing ApplicationThe report says exploitation of the AnySign4PC vulnerability in the watering-hole attack resulted in remote code execution.T1486 · Data Encrypted for ImpactThe report describes ransomware cases involving encryption and double-extortion tactics with data disclosed to leak sites.T1499 · Endpoint Denial of ServiceThe report describes pro-political DDoS attacks reducing the availability of banking websites.T1505 · Server Software ComponentThe report identifies web shells among observed malware and describes their deployment to maintain access on compromised servers.T1566 · PhishingThe report describes phishing using Korean-language attachments and executable HTML/JS files as delivery funnels.
Threat Actors
Apt73Named among ransomware groups in reported financial-sector breach and data-leak-site disclosure cases; the report says such cases were confirmed but does not detail this group's specific case.LazarusThe report says Lazarus exploited the AnySign4PC vulnerability in a watering-hole attack that resulted in remote code execution.payoutskingNamed among ransomware groups in reported financial-sector breach and data-leak-site disclosure cases; the report says such cases were confirmed but does not detail this group's specific case.worldleaksNamed among ransomware groups in reported financial-sector breach and data-leak-site disclosure cases; the report says such cases were confirmed but does not detail this group's specific case.
Products
AnySign4PCNotable incidents included a Lazarus wateringâhole exploit of AnySign4PC causing RCE, Telegram API account compromises (~4% financial sector impact), large darkâweb breach claims (e.g., NR Capital), andTelegramNotable incidents included a Lazarus wateringâhole exploit of AnySign4PC causing RCE, Telegram API account compromises (~4% financial sector impact), large darkâweb breach claims (e.g., NR Capital), and