API
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [CRIME]

2 clusters · 2 sources · 11 days · First seen · Last updated

Global financial sector cyberattacks

Overview

Various cyberattacks have targeted financial institutions and businesses across multiple regions, employing diverse methods ranging from AI-driven exploitation to direct system intrusions.

In South Korea, the group TAG-217 reportedly used artificial intelligence tools, such as Claude Code and DeepSeek, to target at least seven financial institutions, potentially exposing the personal data of 68,000 individuals. Meanwhile, in Brazil, the group Slim Spider targeted a financial institution using custom scripts to access cloud credentials and prepare for unauthorized Pix transfers.

In Spain, a Business Email Compromise (BEC) attack led to a loss of 46,801 euros for a company in Salamanca after criminals falsified invoice bank details. In Argentina, a digital intrusion into three mutual associations in the Santa Fe province resulted in unauthorized transfers totaling approximately 150 million pesos. Authorities noted that the Argentine incident appeared to be a direct hack into systems rather than a social engineering scam.

Entities

DeepSeek · Recorded Future · Slim Spider · CrowdStrike · Incibe

Timeline

  1. [CRIME] 2 sources
    Cyberattacks target businesses and mutuals in Spain and Argentina

    Cybercriminals have executed sophisticated attacks in Spain and Argentina, causing significant financial losses through email compromise and direct system intrusions.

  2. [TECHNOLOGY] 2 sources
    Cyberattacks target financial institutions in South Korea and Brazil

    Cyberattacks targeting banks in South Korea and Brazil have been identified, involving the use of AI tools like Claude and DeepSeek in Korea, and attempts to facilitate mass Pix transfers in Brazil.

Sources

lacronicadesalamanca.com · radiomhumahuaca.com.ar