CYFIRMA Maps May–October 2026 Cyber Threats to ANZ Financial Sector
Summary
CYFIRMA’s May–October 2026 review assesses identity theft, infostealers, cloud extortion and AI-enabled fraud as key ANZ finance risks. It records four ransomware listings; underground claims remain unverified, and confirmed Australian exploitation names no finance-vict
Key points
- The assessment covers May–October 2026 and draws on dark-web monitoring, open-source reporting, vulnerability sources, ransomware leak sites, forums and Telegram, with findings qualified by evidence and source reliability.
- The report records four ANZ finance ransomware listings: three attributed to Qilin and one to CoinbaseCartel. The listings were observed, but victim claims were not independently verified.
- A ClickFix campaign used compromised Australian websites and fake verification prompts to deliver Vidar Stealer, which the report says can collect credentials, browser information, cryptocurrency-wallet data and system information.
- ASD confirmed exploitation in Australia involving Citrix NetScaler, cPanel & WHM and TeamCity; the report names no ANZ financial institution as a victim.
- Thankyou Payroll disclosed unauthorized access to internal reporting databases after an unpatched Metabase instance was exploited. The company said names, IRD numbers, addresses, bank details and payment records were exposed, but passwords and credit-card details were not.
- AI-enabled vishing, smishing and synthetic-identity fraud are assessed as risks to ANZ customers and onboarding workflows, but the report provides no ANZ-specific measurement.
- Recommendations include rotating static API keys, deploying phishing-resistant authentication, strengthening third-party oversight and coordinating cybersecurity and fraud operations.
Article Details
- Publisher
- CYFIRMA
- Report Period
- May–October 2026
- Scope
- Cyber threats affecting banking, financial services, insurance and digital payments in Australia and New Zealand.
- Key Statistics
- CYFIRMA recorded 85 ANZ Finance dark-web chatter instances representing 67 unique posts during May–October 2026.
- Four ANZ finance-sector leak-site listings were attributed to Qilin (3) and CoinbaseCartel (1); the victim claims were not independently verified.
- Five underground data listings reviewed from August–October 2026 were unverified, including claims concerning 2.71 million bank-card records and 97,000 Binance Australia users.
- Financial and insurance services accounted for around 30% of ASD ACSC critical-infrastructure incident responses and 6% of all ASD ACSC incident responses in FY2025–26.
- ASD notified 340 entities about cPanel exposure and subsequently investigated more than 60 incidents; these were not all finance-sector incidents.
- Recommendations
- Prioritise remediation using known-exploitation intelligence and national advisories, and investigate exposed assets for pre-patch compromise.
- Continuously validate the security and remediation status of fintech partners, payment processors, cloud hosts and software suppliers.
- Rotate API keys and service-account credentials, eliminate long-lived static credentials and enforce least privilege.
- Integrate cybersecurity and fraud operations to detect account takeover, synthetic identity fraud and unauthorised payments.
- Deploy phishing-resistant authentication using hardware tokens and passkeys.
MITRE ATT&CK
T1059.001 · PowerShellThe ClickFix infection chain used an obfuscated PowerShell command to retrieve and launch Vidar Stealer.T1185 · Browser Session HijackingAn unnamed banking browser-extension Trojan manipulated authenticated banking webpages and intercepted authentication information.T1190 · Exploit Public-Facing ApplicationASD reported exploitation of internet-facing Citrix, cPanel and TeamCity deployments in Australia.T1204.002 · Malicious FileThe ClickFix campaign persuaded users to execute a PowerShell command that retrieved Vidar Stealer.T1505.003 · Web ShellASD reported web-shell deployment in a CMS exploitation campaign affecting Australian businesses.T1555.003 · Credentials from Web BrowsersVidar Stealer was reported to collect browser credentials.
CVE
CVE-2008-4128Cisco · IosThe activity also involves exploitation of vulnerable network devices and management services, including known vulnerabilities such as CVE-2018-0171 and CVE-2008-4128.CVE-2018-0171Cisco · IosThe activity also involves exploitation of vulnerable network devices and management services, including known vulnerabilities such as CVE-2018-0171 and CVE-2008-4128.CVE-2024-40766SonicWall · SonicOSSonicWall SSL-VPN — CVE-2024-40766. ASD warned of Australian exploitation and Akira ransomware activity on 10 September 2025, before the May–October 2026 reporting window.CVE-2026-109618PHP Group · PHP; Siemens · AMIS TS; +105 moreCVE-2026-109618 / 109619CVE-2026-72898Metabase · MetabaseThankyou Payroll disclosed on 10 September 2026 that an unpatched Metabase instance (CVE-2026-72898) exposed names, IRD numbers, addresses, bank account details and payment records (Section 02).
Threat Actors
AkiraASD reported Akira ransomware activity in historical Australian exploitation involving SonicWall SSL-VPN, before the reporting window.Cl0pGTIG described global zero-day exploitation of Oracle E-Business Suite in a CL0P-branded data-extortion campaign; no ANZ financial victim was identified.Coinbase CartelCYFIRMA observed one ANZ finance-sector leak-site listing attributed to the group; the claim was not independently verified.CrocoladThe same Telegram handle was used to negotiate sales of alleged Ledger and Binance Australia datasets; both listings were unverified.fulcrumsecThe group claimed to have targeted Australian company youX in a data-extortion case outside the reporting window; the claim and reported negotiations rest on its own posts.HiddenHqA forum user advertised an alleged hardware-wallet customer-order dataset; the dataset and its source were not independently verified.QilinCYFIRMA observed three ANZ finance-sector leak-site listings attributed to the group; the victim claims were not independently verified.Russian FSB Center 16A joint advisory reported exploitation of vulnerable or poorly configured network devices for reconnaissance and credential collection; no ANZ finance victim was named.
Malware
Vendors
JetBrainsCitrix NetScaler, cPanel & WHM and JetBrains TeamCity; no named ANZ finance victimMetabaseThankyou Payroll disclosed on 10 September 2026 that an unpatched Metabase instance (CVE-2026-72898) exposed names, IRD numbers, addresses, bank account details and payment records (Section 02).OracleOracle E-Business Suite
Products
Citrix NetScalerASD has confirmed exploitation of Citrix NetScaler, cPanel and TeamCity in Australia; no ANZ financial institution is named as a victim.cPanel & WHMCitrix NetScaler, cPanel & WHM and JetBrains TeamCity; no named ANZ finance victimJetBrains TeamCityASD has confirmed exploitation of Citrix NetScaler, cPanel and TeamCity in Australia; no ANZ financial institution is named as a victim.MetabaseThankyou Payroll disclosed on 10 September 2026 that an unpatched Metabase instance (CVE-2026-72898) exposed names, IRD numbers, addresses, bank account details and payment records (Section 02).N-centralN-able N-centralSonicWall SSL-VPNSonicWall SSL-VPN — CVE-2024-40766. ASD warned of Australian exploitation and Akira ransomware activity on 10 September 2025, before the May–October 2026 reporting window.
Countries
AustraliaIdentity-driven intrusion, cloud data extortion, infostealers and AI-enabled fraud against banks, insurers and payment providers in Australia and New ZealandNew ZealandIdentity-driven intrusion, cloud data extortion, infostealers and AI-enabled fraud against banks, insurers and payment providers in Australia and New Zealand
Industries
Consumer Goods & ServicesProfessional Goods & Services victims; Consumer Goods & Services 13, Healthcare 12, Finance 3financeANZ FINANCE DARK WEB CHATTERHealthcareProfessional Goods & Services victims; Consumer Goods & Services 13, Healthcare 12, Finance 3Professional Goods & ServicesProfessional Goods & Services victims; Consumer Goods & Services 13, Healthcare 12, Finance 3