Cyber Threat Landscape, May–October 2026. Identity-driven intrusion, cloud data extortion, infostealers and AI-enabled fraud against banks, insurers and payment providers in Australia and New Zealand
CYFIRMA assessed the threats to the ANZ banking, financial services, insurance and digital payments sector between May and October 2026. Ransomware remains a persistent background threat, led by Qilin and CoinbaseCartel, while data exposures, infostealer-driven credential harvesting and cloud database extortion are assessed, with moderate confidence, to present more immediate operational risks. Generative AI is scaling social engineering and deepfake impersonation against customers and treasury workflows. ASD has confirmed exploitation of Citrix NetScaler, cPanel and TeamCity in Australia; no ANZ financial institution is named as a victim.
BOTTOM LINE
The Banking, Financial Services, and Insurance (BFSI) sector across Australia and New Zealand (ANZ) operates within an increasingly complex and adversarial digital ecosystem. The sector’s reliance on third-party supply chains, cloud-native infrastructure, and real-time payment rails (Australia’s NPP-based Osko and PayTo services among them) has drawn threat actors away from perimeter attacks toward human-centric, identity-driven, and cloud-exfiltration campaigns.
During the May–October 2026 reporting window, intelligence tracking indicates that while traditional ransomware operations remain a persistent background threat (led by groups such as Qilin and CoinbaseCartel), data exposures, infostealer-driven credential harvesting, and cloud database extortion are assessed, with moderate confidence, to present more immediate operational risks to financial institutions. Furthermore, the proliferation of generative AI tools has enabled cybercriminals to scale social engineering, deepfake executive impersonation, and automated phishing campaigns that target retail banking customers and corporate treasury workflows alike.
| ANZ FINANCE DARK WEB CHATTER
67 Unique finance posts (85 instances), May–October 2026; peak of 26 instances in August; 19 in October |
ANZ FINANCE RANSOMWARE LISTINGS
4 Qilin 3, CoinbaseCartel 1; Finance sits below the most-targeted ANZ industries |
MOST-TARGETED ANZ INDUSTRY (RANSOMWARE)
19 Professional Goods & Services victims; Consumer Goods & Services 13, Healthcare 12, Finance 3 |
| UNDERGROUND LISTINGS REVIEWED
5 DarkForums posts, August–October 2026, all unverified: 2.71 million bank-card records, 97,000 Binance Australia users, ledger and hardware-wallet data |
FINANCE SHARE OF ASD CI INCIDENT RESPONSES
30% ASD ACSC critical-infrastructure incident responses, FY2025–26; 6% of all ASD ACSC incidents |
ASD-CONFIRMED EXPLOITATION IN AUSTRALIA
3 Citrix NetScaler, cPanel & WHM and JetBrains TeamCity; no named ANZ finance victim |
CONFIRMED
ASSESSED
NOT ESTABLISHED
CYFIRMA recommends three strategic priorities for ANZ financial-sector leadership (Section 08).
KEY FINDINGS
For ANZ financial sector leadership, navigating this threat environment requires an immediate strategic shift: breaking down legacy silos between cybersecurity, fraud operations, and data privacy teams to build an integrated, resilience-first posture aligned with rigorous regional mandates such as APRA CPS 234 and the New Zealand National Cyber Security Centre (NCSC) guidelines.
| # | PRIORITY | ACTION | OWNER |
| 1 | P1 · 30D | Prioritise exploitation intelligence for patch management: focus vulnerability remediation on assets matching the CISA Known Exploited Vulnerabilities (KEV) catalogue and ASD ACSC/NCSC advisories rather than relying solely on raw CVSS scores. | Vulnerability management |
| 2 | P1 · 90D | Elevate third-party risk to board level: implement rigorous, continuous security validation and real-time posture monitoring for all connected fintech partners, payment processors, cloud hosts and software suppliers. | CISO / Chief Risk Officer |
| 3 | P1 · 90D | Automate API and credential lifecycle management: remove long-lived static API keys and service-account credentials to close a primary exfiltration pathway used by cloud extortion groups. | Cloud platform owner |
| 4 | P1 · 180D | Unify cybersecurity and fraud operations: establish an integrated risk framework that bridges SOC threat detection with Fraud Operations to intercept account takeovers, synthetic identity fraud and unauthorised digital payment flows in real time. | CISO with Head of Fraud |
| 5 | P1 · 180D | Deploy phishing-resistant authentication: move away from SMS and push-notification MFA toward FIDO2/WebAuthn hardware tokens and passkeys to counter credential harvesting and infostealer campaigns. | Identity and access management owner |
9 NOVEMBER 2026 · METHODOLOGY AND DATA SCOPE · DARK WEB CHATTER · REGIONAL RANSOMWARE OVERVIEW
Methodology and data scope
This report provides an overview of the cyber threat landscape affecting the Banking, Financial Services, and Insurance (BFSI) sector, including digital payment services, across Australia and New Zealand during the period May to October 2026.
The assessment is based on CYFIRMA threat intelligence and reporting, supported by the monitoring and analysis of multiple sources across the surface web, deep web and dark web. The assessment covers ransomware activity, data breaches, and leaks, underground-market activities, threat actor operations, financial-sector cyber threats, and vulnerabilities relevant to the ANZ financial ecosystem.
The intelligence collection and analysis encompass the following sources:
The report analyses observed threat activity and relevant developments affecting financial institutions and digital payment services across Australia and New Zealand during the defined reporting period. Findings are assessed within the context of their available evidence and source reliability.
Dark web chatter trends by industry in ANZ
Dark-web chatter across ANZ industries from May to October 2026 recorded 514 instances across 14 industry categories, with activity declining sharply after the initial month before gradually increasing towards the end of the reporting period. Consumer Goods & Services recorded the highest overall volume (84), followed by Finance (67), Information Technology (66), Government & Civic (60), and Healthcare (56). These five industries together accounted for approximately 65% of the total chatter.
Consumer Goods & Services remained the leading category overall, peaking at 24 instances in July before declining to 3 in September and recovering slightly to 9 in October. Finance and Information Technology showed renewed activity towards the end of the period, with Finance increasing from 7 instances in September to 18 in October, while IT rose from 12 to 15. Government & Civic also increased to 19 instances in October, its highest monthly level during the reporting period.
Overall, monthly chatter declined from 126 instances in May to 61 in June, before fluctuating through July (75), August (70), and September (85), followed by a further increase to 97 in October. The October rise was particularly evident across Government & Civic, Finance, and Information Technology, while Healthcare declined from 18 instances in September to 10 in October. Transportation & Logistics also showed a temporary increase to 13 instances in September before falling to 2 in October. Other industries, including Education, Professional Goods & Services, Manufacturing, Real Estate & Construction, and Telecommunications & Media, recorded comparatively lower volumes throughout the period.
The overall trend indicates a broad decline after May’s elevated activity, followed by a gradual recovery in the final months, with October showing increased chatter particularly across Finance, Government & Civic, and Information Technology.
Figure 1. Dark-web chatter by industry in ANZ, May–October 2026 (Source: CYFIRMA)
ANZ Finance dark web chatter trends
The ANZ Finance sector recorded 85 total dark-web chatter instances (representing 67 unique finance posts) between May and October 2026, with activity showing considerable variation across the reporting period. Uncategorised activity was the largest category, accounting for 37 instances, followed by Data Breach, and Ransomware, with 16 instances each, and Data Leak with 9.
Data Breach activity fluctuated during the period, increasing from 1 instance in June to 5 in both July and August, before declining to 2 in September and recording zero in October. Ransomware activity peaked at 8 instances in August, following 6 in May, 1 in June, and no recorded instances in July; it subsequently fell to zero in September before reappearing with 1 instance in October. Data Leak activity also reached its highest level in August (5), compared with 1 instance in each of May, June, July, and September, before falling to zero in October.
August marked the peak of Finance-sector chatter, with 26 instances, and was the only month in which all six classified categories — Data Breach, Ransomware, Data Leak, Hacktivism, DDoS, and Web Exploit — recorded activity. Hacktivism appeared in August (2) and October (1), while DDoS and Web Exploit were recorded only in August, with 2 instances each. Overall activity declined sharply from 26 in August to 7 in September, before increasing to 19 in October.
This October increase was primarily driven by Uncategorised activity, which rose from 4 instances in September to 17 in October, while the identified categories remained comparatively limited. No Claimed Hacks were recorded throughout the six-month period. Overall, the trend highlights a concentration of diverse classified activity in August, followed by a shift towards predominantly uncategorised chatter in October.
Figure 2. ANZ Finance dark-web chatter by category, May–October 2026 (Source: CYFIRMA)
Regional ransomware threat overview, ANZ, May–October 2026
Figure 3. Top ransomware groups targeting ANZ Finance, May–October 2026 (Source: CYFIRMA)
Ransomware activity targeting the ANZ Finance sector during the May–October 2026 reporting period was associated with two identified ransomware groups, with Qilin accounting for the majority of observed listings. Qilin recorded 3 identified finance-sector listings, while CoinbaseCartel recorded 1 during the same period. The distribution indicates that Qilin was the more frequently observed group in the dataset, accounting for three-quarters of the recorded activity. Overall, the findings highlight the presence of ransomware-related activity targeting the ANZ financial sector, although the observed listings were concentrated around Qilin.
Figure 4. Industries targeted by ransomware groups in ANZ, May–October 2026 (Source: CYFIRMA)
Across ANZ between May and October 2026, ransomware activity extended beyond the Finance sector, with identified victims distributed across multiple industries. Professional Goods & Services recorded the highest number of identified victims (19), followed by Consumer Goods & Services (13), and Healthcare (12). Finance recorded 3 identified victims in this May–October 2026 dataset, placing it among the affected sectors but below the most heavily impacted industries. Real Estate & Construction recorded 11 victims; Manufacturing, 9; Government & Civic and Education, 6 each; Materials, 5; Automotive and Transportation & Logistics, 4 each; Information Technology, 3; and Telecommunications & Media, 2.
This broader distribution is relevant to the ANZ financial sector because financial institutions operate within an interconnected ecosystem of technology providers, manufacturers, professional services firms, healthcare organisations, and other third parties. A ransomware incident affecting a connected service provider can therefore create indirect operational or data-security risks for financial organisations even when the financial institution itself is not the direct victim.
The group-level count (4 listings: Qilin 3, CoinbaseCartel 1) and the industry-level count (3 Finance victims) are different views of the same May–October 2026 period and are not in conflict.
Together, these findings highlight the need for ANZ financial organisations to monitor both direct ransomware activity targeting financial entities and ransomware incidents affecting critical third parties and technology providers that support financial operations.
9 NOVEMBER 2026 · BANKING TROJANS · MOBILE RATS · CLICKFIX AND VIDAR · FSB CENTER 16 · FINTECH SUPPLY CHAIN
Australian Banking Browser-Extension Trojan Manipulating Authenticated Banking Sessions
A sophisticated browser-extension-based banking Trojan targeting Australian banking customers was reported in May 2026. Unlike conventional banking malware that primarily steals login credentials, this malware operates within authenticated banking sessions by manipulating the browser environment. Multiple extension variants were identified with similar capabilities.
The malware uses JavaScript-based Document Object Model (DOM) and CSS manipulation to modify banking webpages. It identifies account-balance fields, stores legitimate values and replaces displayed balances with inflated amounts. It also modifies transaction histories by inserting synthetic transactions and recalculating displayed balances to maintain a consistent appearance. A MutationObserver continuously monitors webpage changes and reapplies these modifications when necessary.
The Trojan also intercepts authentication information, including one-time passwords (OTPs), by monitoring banking authentication fields and manipulating form submissions. It can display fake authentication errors to persuade victims to enter another OTP, while stealing active session cookies to facilitate session hijacking. A persistent WebSocket connection enables command-and-control (C2) communication and transmission of stolen information. The malware also monitors banking-page navigation and transaction patterns to identify opportunities for fraudulent activity.
IOCs: Browser-extension hashes are documented in the technical research.
Rokarolla Android Banking Trojan Enabling Device Takeover and Financial Credential Theft
Rokarolla is an Android banking Trojan identified in June 2026, designed to compromise mobile devices and target banking and cryptocurrency applications. Its infection chain begins with malicious websites distributing applications disguised as legitimate software. A dropper impersonating a security application installs the secondary payload containing the main Trojan. Following installation, the malware abuses Android Accessibility Services and requests permissions to access SMS messages and notifications.
Rokarolla communicates with its C2 infrastructure over HTTPS, initially transmitting device information to generate a unique bot identifier. It supports multiple fallback domains and can dynamically update its active C2 endpoint through remote configuration. The malware targets banking and cryptocurrency applications using remotely supplied application lists. When a targeted application is opened, it downloads a corresponding fake HTML login page, stores it locally, and displays it as an overlay to capture banking credentials and payment-card information.
The Trojan also abuses Accessibility Services to capture keystrokes, monitor screen activity and steal SMS messages, including banking OTPs. It can send SMS messages on behalf of victims, block incoming calls, capture screenshots, and manipulate clipboard contents. Additional capabilities include harvesting device lock-screen credentials, hiding its application icon, displaying fraudulent installation screens, and attempting to disable security protections.
IOCs: Refer to the available technical research for associated indicators.
Android RAT Campaign Using Brand-Impersonation Lures in Australia
An Android Remote Access Trojan (RAT) campaign active in Australia was reported in August 2026. The campaign uses SMS messages, messaging applications, and social media to distribute malicious applications through impersonation of familiar retail, airline, social security and tax-related services. The malicious applications are designed to appear legitimate and persuade users to install them on Android devices.
Following installation, the RAT operates in the background and can remain active after device restarts. It requests extensive permissions, including access to SMS messages, contacts, call logs, camera, and audio. Access to SMS messages enables interception of OTPs sent by banks and other financial services. The malware also provides remote access to compromised devices, allowing attackers to monitor device activity and access sensitive information.
The campaign uses rotating domains and disposable domain extensions to distribute malicious applications and maintain its infrastructure. More than 100 associated domains were reportedly identified. The available reporting does not identify a specific malware-family name or threat actor.
IOCs: Associated infrastructure indicators are documented in the available campaign reporting.
ClickFix Campaign Delivering Vidar Stealer Through Compromised Websites
A ClickFix-associated campaign observed in Australia uses compromised websites to distribute Vidar Stealer malware. The activity, reported in June 2026, targets Australian infrastructure and organisations across multiple sectors. The infection begins when attackers inject a malicious payload-delivery domain into a compromised website. Injected JavaScript modifies the webpage and displays a fraudulent verification prompt designed to convince visitors that additional verification is required.
When users interact with the fake verification page, the malicious script retrieves an obfuscated PowerShell command and copies it to the clipboard. The victim is then instructed to execute the command manually with administrative privileges. Once executed, the command retrieves and launches Vidar Stealer.
The malware can collect credentials, browser information, cryptocurrency-wallet data, and system information. It also employs defence-evasion techniques, including deleting its initial executable and operating primarily in memory. For C2 discovery, Vidar retrieves infrastructure details through dead-drop URLs hosted on publicly accessible online services. Subsequent communication primarily uses HTTP/S POST requests to transmit stolen information to attacker-controlled infrastructure.
Russian FSB Center 16 Exploiting Internet-Facing Network Devices
Russian FSB Center 16 cyber actors were reported exploiting poorly configured and vulnerable internet-facing networking devices during the reporting period. A joint advisory published in July 2026 (co-sealed by ASD’s ACSC and New Zealand’s NCSC) identified activity involving exposed management services, weak security configurations, and known vulnerabilities to obtain network information and user credentials. Financial services were identified among the critical-infrastructure sectors at risk.
The actors scan IP addresses for network devices responding to SNMP version 1 and 2 requests and attempt access using default or commonly used SNMP community strings. Following successful access, specially crafted Object Identifiers (OIDs) instruct compromised routers to copy their configurations into files. These files may contain sensitive network information and credentials and are subsequently transferred through TFTP to attacker-controlled or compromised infrastructure.
The activity also involves exploitation of vulnerable network devices and management services, including known vulnerabilities such as CVE-2018-0171 and CVE-2008-4128. The documented operations primarily focus on network reconnaissance, unauthorised device access, configuration theft, and credential collection, potentially supporting further intrusion activity.
IOCs: Refer to the joint advisory for the associated indicators and technical detection details.
Core NZ FinTech Platform Compromise: Thankyou Payroll Metabase Vulnerability (CVE-2026-72898)
On 10 September 2026, New Zealand-based payroll and fintech provider Thankyou Payroll disclosed a significant data security incident resulting from the exploitation of an unpatched vulnerability in its self-hosted Metabase business intelligence platform. The compromise stemmed from CVE-2026-72898, a critical SQL injection vulnerability (CVSS 10.0) originally disclosed and patched by Metabase on 6 August 2026. Thankyou Payroll’s unpatched instance remained exposed between 6 August and 10 September 2026, during which unauthorised access was gained to internal reporting databases.
According to the company’s public disclosure, the incident exposed sensitive personal and financial data belonging to affected individuals, including names, IRD numbers (New Zealand tax identifiers), email addresses, physical addresses, bank account details, and historical payment records. The company stated that user passwords and credit card details were not exposed. Thankyou Payroll notified the Office of the Privacy Commissioner (OPC) New Zealand under the Privacy Act 2020 mandatory breach-notification regime (the Office of the Privacy Commissioner expects notification within 72 hours of an agency becoming aware).
Financial Sector Implication & Supply Chain Risk
This breach underscores the critical operational risks associated with third-party software dependencies and delays in patching critical-severity vulnerabilities (CVSS 10.0) within core financial processing tools. For the ANZ fintech and digital payments sector, the exposure of IRD numbers and bank account details directly elevates the risk of secondary identity theft, fraudulent payment routing, and targeted social engineering attacks against financial institution customers.
9 NOVEMBER 2026 · UNDERGROUND LISTINGS AND EXTORTION CLAIMS INVOLVING ANZ ASSETS
Figure 5. DarkForums country-wise data leakage index naming Australian entities, 6 August 2026 (Source: CYFIRMA underground monitoring)
On 6 August 2026, a consolidated country-wise data leakage index was published on DarkForums by an underground threat actor, explicitly highlighting targeted datasets associated with Australian entities. The compiled index listed compromised corporate and financial identifiers under the Australia category — specifically referencing entities such as Forex platforms and major regional corporate brands such as Qantas; the listing indexes previously circulated data and does not evidence a new compromise of the named entities. While the listing serves as an index of aggregated underground database distribution rather than a direct breach disclosure by the named entities themselves, such compilations typically aggregate credentials and customer personally identifiable information (PII) from prior third-party compromises, automated infostealer campaigns, or previous data dumps. Confidence: Low — the index aggregates previously circulated data and has not been independently verified.
For Australia’s BFSI and digital payment sector, the ongoing circulation and indexing of national corporate and financial datasets on underground forums heighten the risk of targeted credential harvesting, corporate identity abuse, and downstream phishing campaigns. Financial institutions and digital service providers must maintain continuous dark-web monitoring for brand-related mentions and ensure strict credential hygiene to prevent secondary account takeovers.
Figure 6. DarkForums listing of an alleged hardware-wallet customer-order dataset, 3 October 2026 (Source: CYFIRMA underground monitoring)
On 3 October 2026, a forum user named “HiddenHq” advertised an alleged customer-order dataset associated with hardware-wallet brands Trezor, Ledger, and Tangem. The seller claimed that the data covered orders placed during 2025–2026 and included customers in Australia, the UK, the US, Canada, and other countries. The sample described in the available observation contained customer names, email addresses, phone numbers, shipping addresses, order dates, purchased products, and transaction amounts. Interested buyers were directed to Telegram.
The available evidence does not independently establish the authenticity or source of the complete dataset, when any underlying compromise occurred, or whether the named companies experienced a breach. The advertised customer-order information also does not establish exposure of wallet private keys, seed phrases, or cryptocurrency funds. Confidence: Low — authenticity not established.
For Australia’s BFSI and digital-payment ecosystem, such exposure, if genuine, could increase the risk of targeted phishing, customer impersonation, social engineering, and cryptocurrency-related fraud. Details about purchased hardware wallets could help attackers tailor fraudulent support messages or recovery requests to affected customers. The observation does not establish exposure of New Zealand customers.
For ANZ financial organisations, this type of alleged exposure reinforces the importance of monitoring relevant underground claims, validating potentially affected customer information through authorised channels, and coordinating cybersecurity, fraud, and privacy responses. Customer awareness should emphasise verifying support communications and never disclosing wallet seed phrases or private keys.
Figure 7. DarkForums listing of an alleged 2.71 million bank-card record dump, 28 August 2026 (Source: CYFIRMA underground monitoring)
On 28 August 2026, a threat actor advertised on an underground forum (DarkForums) a database dump allegedly containing over 2.71 million (2,714,500+) bank card records. The post claimed to offer a PostgreSQL database dump containing detailed card information and invited prospective buyers to direct-message their price offers. The post included a reference link highlighting Australian card data. The available evidence confirms the forum listing date and post details but does not independently verify the authenticity of the dataset or confirm when the underlying compromise occurred. Confidence: Low — authenticity not established.
For the financial services and banking sector, the potential compromise and sale of millions of payment card records poses a severe risk of fraudulent transactions, card cloning, unauthorised online purchases, and targeted social engineering against cardholders. Such exposure underscores the vital need for robust database security configurations, end-to-end encryption of sensitive payment data, continuous monitoring for unauthorised access to backend databases, and proactive fraud-monitoring controls across card-issuing networks.
Figure 8. DarkForums listing of an alleged global ledger dataset, 4 October 2026 (Source: CYFIRMA underground monitoring)
On 4 October 2026, a threat actor advertised on the underground platform DarkForums an alleged data sale titled “Selling Ledger global e” targeting multiple countries, explicitly referencing the United States, Australia, and Belgium (“USA-Australia-Belgium”). The threat actor set a sale price of USD 8,000 and directed interested buyers to a Telegram handle (hxxps://t[.]me/Crocolad) for negotiations. The listing suggests potential exposure of global e-commerce, transaction, or customer ledger datasets associated with entities in these geographic regions. The available evidence confirms the forum disclosure date and post metadata but does not independently verify the authenticity, exact nature, or total record count of the underlying data. Confidence: Low — authenticity not established.
For organisations operating across cross-border e-commerce, retail, and financial service sectors, the exposure of transactional ledgers or customer databases presents substantial risks of targeted phishing, supply-chain social engineering, credential stuffing, and identity fraud. Incidents involving global cross-border identifiers highlight the necessity for rigorous vendor data management, strict end-to-end access controls, automated data loss prevention (DLP), and continuous dark-web monitoring to detect and mitigate third-party or enterprise data exposure.
Figure 9. DarkForums listing of an alleged Binance Australia user dataset, 19 September 2026 (Source: CYFIRMA underground monitoring)
On 19 September 2026, a threat actor advertised on the underground platform DarkForums an alleged dataset titled “Selling Binance Australia data”. The listing claimed to contain records belonging to 97,000 (97k) users associated with Binance in Australia, with the threat actor setting an asking price of USD 12,000 and directing communications to a Telegram handle (hxxps://t[.]me/Crocolad). The available evidence confirms the forum listing date and post details but does not independently establish when the underlying compromise occurred or confirm the authenticity and specific data fields contained within the advertised dataset. The same Telegram handle appears in the Ledger listing of 4 October 2026 above, indicating a common seller. Confidence: Low — authenticity not established.
For the cryptocurrency, digital asset, and financial services sector in Australia, the exposure of user data associated with major trading exchanges presents critical risks of targeted phishing, credential stuffing, identity theft, SIM-swapping, and social-engineering attacks aimed at compromising digital wallets and trading accounts. This incident highlights the imperative for exchanges and digital financial services to enforce robust multi-factor authentication (MFA), implement stringent DLP controls, continuously monitor underground forums for brand and user exposure, and educate users on anti-phishing safeguards.
Figure 10. DarkForums post by FulcrumSec regarding youX, 23 February 2026 (Source: CYFIRMA underground monitoring)
Historical context (outside the May–October 2026 reporting window): on 23 February 2026, an updated operational disclosure was published on the underground forum DarkForums regarding a data extortion campaign targeting youX (formerly known as Drive IQ), an Australian technology company specialising in connected vehicle telematics and mobility intelligence. According to the forum post attributed to the threat actor group FulcrumSec, corporate representatives from youX reportedly initiated contact to negotiate the removal of extortion threads and leaked data listings. The threat actor claimed that following a communication received on 16 February 2026, they temporarily deleted the extortion posts across their leak platforms in the spirit of active discussion.
Subsequent dark-web monitoring through May 2026 indicated continued visibility and tracking of the entity within underground extortion repositories, reflecting persistent operational and reputational exposure following the initial incident.
Public threat-intelligence reporting describes FulcrumSec as an active extortion group specialising in high-speed exfiltration of cloud-hosted databases by exploiting unrotated API keys and misconfigured cloud permission models rather than deploying ransomware file encryption. Given that youX collects and analyses driver behaviour, vehicle telematics, and usage-based risk metrics for insurance and fleet management clients, the compromise of backend infrastructure poses severe risks of sensitive IoT data leaks, targeted supply-chain phishing, identity exposure, and regulatory scrutiny. Confidence: Low — the extortion claim and the negotiation account rest on the threat actor’s own posts.
For organisations in the insurtech, automotive data, and cloud-native sectors, this incident highlights the following key operational security requirements:
9 NOVEMBER 2026 · EMERGING RISK VECTORS · HOW THREAT ACTORS USE AI · INCIDENT REPORTING REQUIREMENTS
Emerging threats and future risks to ANZ’s BFSI sector
The ANZ BFSI sector is confronting a convergence of frontier technology exploitation and sophisticated financial crime. The Australian Signals Directorate’s 2025–26 Annual Cyber Threat Report records financial and insurance services as around 30% of ASD ACSC critical-infrastructure incident responses in Australia. The primary emerging risk vectors include:
AI-Driven Phishing, Vishing, and Deepfake Exploitation
The democratisation of generative AI has lowered the technical barrier for advanced social engineering. Threat actors target ANZ banking customers and call-centre operations with hyper-personalised smishing and voice-cloning (vishing) attacks. High-net-worth individuals and corporate finance officers face targeted deepfake audio/video impersonations designed to override dual-authorization payment workflows and manipulate wire transfer approvals.
Mobile Banking Malware & Overlay Attacks
With mobile banking adoption at an all-time high across Australia and New Zealand, sophisticated Android banking Trojans (such as Rokarolla) and browser-extension malware actively manipulate authenticated web and app sessions. By abusing accessibility services, injecting DOM/CSS modifications to display false account balances, and intercepting real-time OTPs, these Trojans can complete device takeovers that conventional bank-side anomaly filters may not detect.
Third-Party Ecosystem and FinTech Dependencies
Modern ANZ banking experiences rely on deep integration with open banking APIs, third-party KYC providers, cloud infrastructure hosts, and fintech aggregators. A security failure or misconfiguration at a peripheral software vendor or supply-chain partner (such as managed service providers or build-pipeline tools) can expose internal banking identifiers and customer PII, bypassing primary institutional defences.
How threat actors are using AI against ANZ’s BFSI sector
CYFIRMA assesses with moderate confidence that threat actors targeting the financial services sector are using AI at several stages of the cyber kill chain:
Regulatory response and incident reporting requirements (ANZ)
Financial institutions operating in Australia and New Zealand must navigate stringent regulatory reporting frameworks following any suspected material security incident:
9 NOVEMBER 2026 · EVIDENCE CLASSIFICATION · AUSTRALIAN AND NZ ACTIVITY · EXPLOITATION ASSESSMENT · KEY PATTERNS
Scope. The shortlist below is prioritised by reported exploitation and relevance to the financial-services technology stack. It is not a statistically measured ranking of vulnerabilities exploited against ANZ financial institutions.
Evidence limitation. Reviewed public sources did not establish a named Australian or New Zealand financial institution as a confirmed victim of any specific priority CVE. Regional exploitation, reported attempts, global campaigning, and plausible financial-sector impacts are distinguished throughout. The prioritised cases focus on current-period exploitation reported by Australian cybersecurity authorities or credible national and vendor sources. SonicWall activity from before the reporting window and the non-CVE FortiBleed campaign are presented separately to avoid inflating the current-period CVE findings.
| EVIDENCE LEVEL | CRITERIA | PERMITTED INTERPRETATION |
| Australian exploitation | ACSC reports exploitation affecting Australian organisations, without publicly naming the industry. | Australian exploitation signal; not proof of a finance-sector compromise. |
| Australian targeting | Australian targeting or attack attempts are reported; downstream compromise is not established. | Exposure/attack activity; not equivalent to confirmed compromise. |
| Global exploitation / NZ alert | Credible global exploitation, or a New Zealand national alert referencing exploitation reports. | Applicable finance-sector exposure; no identified ANZ finance victim. |
| Historical / contextual | Authoritative cases occurring before the May–October 2026 reporting window, or campaigns that do not involve a newly exploited CVE. | Illustrative pattern only, not an additional in-period exploited CVE. |
Australian activity: exploited platforms and observed targeting
| PLATFORM AND CVE(S) | VERIFIED AUSTRALIAN OBSERVATION | FINANCIAL-SERVICES IMPLICATION |
| Citrix NetScaler CVE-2026-88771 / CVE-2026-88772 |
Following its September 2026 advisory, ASD reported receiving Australian reports confirming exploitation. The individual CVE used in each report was not publicly specified. [S01] | Remote-access and application-delivery exposure; do not assert named bank or insurer victims. |
| cPanel & WHM CVE-2026-41940 |
ASD confirmed active exploitation in Australia. The flaw affects authentication/session handling and can enable control-panel takeover and remote code execution. [S02] | Outsourced web hosting, customer portals, and digital-service providers may introduce dependencies. |
| JetBrains TeamCity On-Premises CVE-2026-63077 |
ASD reported active exploitation of Australian TeamCity deployments. JetBrains published fixes and remediation advice. [S03][S04] | Compromised build infrastructure could expose credentials, code, or artefact integrity. |
| N-able N-central CVE-2026-18556 / CVE-2026-18577 |
ASD observed Australian targeting of the remote monitoring and management (RMM) platform. The public warning does not establish a named financial customer compromise. [S05] | Concentrated MSP privileges can increase possible downstream access pathways. |
| CMS and plug-in campaign 17 listed vulnerabilities |
ASD reported a large-scale campaign including Australian businesses and observed web-shell deployment. Examples: Craft CMS CVE-2025-32432, Ninja Forms CVE-2026-0740 and WPvivid CVE-2026-1357. [S06] | Web-hosting and supplier-operated customer-facing sites may be affected; no verified ANZ finance outcome tied to the campaign. |
Other exploited technologies of relevance to ANZ finance
| TECHNOLOGY / CVE | SUPPORTED FINDING | SCOPE BOUNDARY |
| PHP core CVE-2026-109618 / 109619 |
NCSC New Zealand reported awareness of active-exploitation reports and advised urgent patching. [S07] | No published evidence in the cited alert of compromise at a NZ bank, insurer, or fintech. |
| Brotli decoder CVE-2026-111497 |
NCSC New Zealand reported awareness of active exploitation and public proof-of-concept (PoC) code. [S08] | Potential relevance to financial applications and APIs; not verified local financial-sector exploitation. |
| Oracle E-Business Suite CVE-2025-61882 |
Oracle issued a security alert for unauthenticated remote-code-execution risk; the Google Threat Intelligence Group (GTIG) described zero-day exploitation in a CL0P-branded data-extortion campaign. [S09][S10] | Global exploitation is established; no verified ANZ financial institution victim in reviewed sources. |
Historical and non-CVE context
SonicWall SSL-VPN — CVE-2024-40766. ASD warned of Australian exploitation and Akira ransomware activity on 10 September 2025, before the May–October 2026 reporting window. A later ASD case study described almost 1,000 potentially vulnerable devices and around 40 potentially vulnerable organisations; these numbers are exposure findings, not confirmed compromises. [S11][S15]
FortiBleed — credential reuse, not a newly disclosed CVE. Fortinet described the use of credentials previously exposed in earlier incidents, together with brute-force activity. The campaign is useful for explaining why password resets, session revocation, and MFA matter after device remediation, but it should not appear in an exploited-CVE ranking. [S16]
Additional Citrix patching context. ASD also discussed CVE-2026-107406 in certain SAML configurations. This is a separate patching consideration, not evidence that the CVE itself was exploited against an ANZ financial institution. [S01]
Vulnerability exploitation assessment
The reviewed activity highlights externally accessible management and enterprise platforms, plus dependency risk at technology suppliers. Financial-sector operational effects below are scenario-based assessments unless an incident is explicitly identified.
| ATTACK SURFACE | OBSERVED INTELLIGENCE | POTENTIAL FINANCE-SECTOR EFFECT (INFERENCE) |
| Remote access / edge | Australian reports of Citrix exploitation; historical SonicWall/Akira evidence. [S01][S11] | Unauthorised connectivity, session access and possible disruption of internal services. |
| Hosting / CMS | ASD confirmed cPanel exploitation and documented an Australian-relevant CMS web-shell campaign. [S02][S06] | Customer portals, insurance broker sites, form submissions and third-party managed web environments. |
| DevOps / RMM | TeamCity exploitation and N-central targeting were reported in Australia; sectors were not identified. [S03]–[S05] | Software delivery integrity, privileged management channels and outsourced IT dependency. |
| Application runtimes / enterprise resource planning (ERP) | NCSC NZ PHP/Brotli alerts and global Oracle EBS extortion campaign. [S07]–[S10] | Fintech web/API resilience, application integrity and confidentiality of high-volume records. |
| REPORTED INDICATOR | FIGURE | WHAT THE FIGURE ACTUALLY MEASURES |
| Financial and Insurance Services | 30% | Share of ASD ACSC critical-infrastructure incident responses, FY2025–26; not all cyber incidents. [S13] |
| Financial and Insurance Services | 6% | Share of all cyber security incidents responded to by ASD ACSC, FY2025–26. [S12] |
| Critical infrastructure incidents | 154; 10% | 154 responses, comprising around 10% of all ASD ACSC incident responses. [S13] |
| cPanel notifications and follow-up | 340 entities notified; 60+ incidents | ASD notification and subsequent investigation outcome in 2026; these are not 60 financial-sector incidents. [S12] |
| Mandiant M-Trends 2026 | 32%; 14.6% | Global 2025 Mandiant investigations: exploits as an initial infection vector; finance share of casework. Neither is an ANZ-specific statistic. [S17] |
Exploitation response for financially significant services
Fast exploitation windows require response based on exposed assets and confirmed abuse rather than CVSS scores alone. ASD reports that many vulnerabilities are exploited within two weeks of disclosure, with some seeing exploitation within 48 hours after patching or mitigation guidance. [S14]
Key exploitation patterns
| TECHNIQUE / PATTERN | SOURCE-SUPPORTED EXAMPLE | MITRE ATT&CK |
| Exploitation of internet-facing technology | Citrix, cPanel, and TeamCity activity, together with the CMS exploitation campaign. [S01]–[S06] | T1190 — Exploit Public-Facing Application [S18] |
| Web-shell installation | ASD’s CMS campaign documented web-shell deployment following exploitation. [S06] | T1505.003 — Server Software Component: Web Shell [S19] |
| External access and account reuse | ASD SonicWall history and Fortinet credential-reuse reporting show the value of exposed remote access and usable credentials. [S11][S16] | T1133 — External Remote Services; T1078 — Valid Accounts [S20][S21] |
| Data-theft extortion after exploitation | GTIG and Oracle reported the Oracle EBS exploit and CL0P-branded extortion activity globally. [S09][S10] | T1190 relates to the initial exploitation; other stages must not be assigned to ANZ incidents without evidence. |
| EVIDENCE STATUS | WHAT IS ACTUALLY SUPPORTED | WHAT CANNOT BE CLAIMED |
| Australian exploitation | Active cPanel and TeamCity exploitation, Citrix exploitation reports, CMS web-shell campaign. [S01]–[S04][S06] | Confirmed compromise of a named Australian financial institution, sector-wide impact, or the specific Citrix CVE used in each incident. |
| Australian targeting | N-central vulnerability targeting in Australian environments. [S05] | A successful takeover of a specific MSP or its financial-institution customers. |
| International and NZ reports | Global Oracle EBS extortion campaign and NZ advisories referencing PHP/Brotli exploitation reports. [S07]–[S10] | Successful attacks against NZ banks or insurers through those CVEs. |
| Impact assessment | Finance relies on remote access, suppliers, build pipelines, and data-rich business systems. | A specific payment outage, fraudulent transaction, settlement compromise or systemic banking disruption caused by these CVEs. |
Monitoring and defensive priorities
Analyst synthesis
During the assessment period, Australian public reporting identifies exploitation or targeting of internet-facing management, hosting and software-development platforms. Financial organisations face direct exposure when operating those technologies and indirect exposure through MSPs, hosting providers and software delivery partners. However, public national advisories do not demonstrate CVE-specific compromise at a named ANZ financial institution in this reviewed sample. [S01]–[S06]
The New Zealand PHP/Brotli alerts demonstrate that reported exploitation extends to software components commonly embedded in web services, while the Oracle EBS campaign illustrates how exploitation can underpin data-theft extortion without a demonstrated ANZ finance victim. Evidence-based prioritisation should therefore combine attack-surface inventory, exploitation reporting, third-party access and incident investigation, rather than treat this shortlist as a measured ranking. [S07]–[S10][S14]
9 NOVEMBER 2026 · ADVERSARIES OBSERVED · CONFIDENCE SCALE: HIGH, MODERATE, LOW
The table below summarises the adversaries observed against the ANZ BFSI sector in the material reviewed, their motivation and the confidence attached to each observation. Confidence is expressed on a three-level scale: High (multiple independent or authoritative sources), Moderate (a credible source or direct observation, not independently corroborated), and Low (a single unverified source, typically a threat-actor claim).
| ADVERSARY AND MOTIVATION | OBSERVED ACTIVITY RELEVANT TO ANZ BFSI | CONFIDENCE |
| Qilin (ransomware-as-a-service; financially motivated) | Three finance-sector leak-site listings in the ANZ dataset, May–October 2026; the most frequently observed group. | Moderate — listings observed directly; victim claims not independently verified. |
| CoinbaseCartel (extortion; financially motivated) | One finance-sector listing in the ANZ dataset, May–October 2026. | Moderate — listing observed directly; claim not independently verified. |
| FulcrumSec (data extortion without encryption; financially motivated) | Extortion claim against Australian telematics firm youX (February 2026), still tracked in underground repositories to May 2026. | Low — rests on the actor’s own posts; outside the reporting window. |
| Russian FSB Center 16 (state-sponsored; espionage and pre-positioning) | July 2026 joint advisory on exploitation of internet-facing network devices; financial services named among at-risk critical-infrastructure sectors. No ANZ finance victim named. | Moderate — authoritative advisory; ANZ finance-sector impact not established. |
| ClickFix / Vidar Stealer operators (credential theft; financially motivated) | Compromised Australian websites delivering Vidar via fake verification prompts, reported June 2026. | Moderate — public technical reporting; victim organisations not identified. |
| Rokarolla and Android RAT operators (mobile banking fraud; financially motivated) | Rokarolla identified June 2026; brand-impersonation Android RAT campaign in Australia reported August 2026. | Low to Moderate — Australian targeting established for the RAT campaign; Rokarolla targeting of ANZ banks not specifically established. |
| Underground data sellers (“HiddenHq”, the Telegram handle Crocolad) | DarkForums listings of alleged hardware-wallet, bank-card, Ledger and Binance Australia datasets, August–October 2026. | Low — authenticity of every listing unverified. |
Evidence and confidence summary
| INTELLIGENCE QUESTION | CURRENT ASSESSMENT | CONFIDENCE |
| Is ransomware actively targeting ANZ financial organisations? | Yes, at low volume: four finance-sector listings across two groups, with Finance below the most-targeted industries. | Moderate |
| Is cloud data extortion without encryption displacing ransomware in ANZ? | One reported case (FulcrumSec/youX); a trend is not established on the material reviewed. | Low |
| Are ANZ finance credentials being harvested by infostealers? | Yes: ClickFix/Vidar activity and underground credential listings; scale not quantified in the material reviewed. | Moderate |
| Is AI materially scaling fraud against ANZ BFSI customers? | Assessed yes on observed social-engineering tradecraft; no ANZ-specific measurement in reviewed sources. | Moderate |
| Have the listed CVEs been exploited against a named ANZ financial institution? | Not established: Australian exploitation is confirmed by ASD for Citrix, cPanel and TeamCity, but no finance-sector victim is named. | Low |
| Are the underground listings (bank cards, Binance Australia, Ledger, hardware wallets) genuine? | Unverified; each is a threat-actor claim. | Low |
9 NOVEMBER 2026 · SECTOR LENS · ANZ BFSI & DIGITAL PAYMENTS
The cyber threat landscape facing Australia and New Zealand’s BFSI and digital payments sector is defined by rapid evolution away from basic malware toward identity theft, cloud database exfiltration, and AI-amplified fraud. Because attackers routinely exploit legitimate tools, compromised employee credentials, and connected third-party suppliers, traditional network perimeter defences are no longer sufficient.
Achieving long-term resilience requires ANZ financial institutions to treat cybersecurity and fraud prevention as a unified business risk discipline. By embedding robust identity governance, real-time behavioural analytics, rigorous cloud posture management, and comprehensive third-party risk assurance, regional BFSI organisations can safeguard critical payment rails, protect customer trust, and maintain strict compliance with regulatory mandates.
9 NOVEMBER 2026 · STRATEGIC · TACTICAL · OPERATIONAL · OWNERS, PRIORITIES AND TIMEFRAMES
Each recommendation carries a suggested owner, a priority (Priority 1 or Priority 2), and a timeframe. Owners are suggested functions; assign named owners on receipt. The Priority 1 items are repeated in the executive summary.
Strategic Recommendations
Tactical Recommendations
Operational Recommendations
HANDLING · BASIS OF ASSESSMENT · WHAT TO WATCH NEXT · VERSION HISTORY · ABOUT CYFIRMA
Handling and contact
| HANDLING
TLP:AMBER. This report is intended for designated recipients and may be shared within the recipient’s organisation and with its clients only on a need-to-know basis, in accordance with TLP:AMBER handling requirements. Not for publication or onward distribution beyond that scope. |
BASIS OF ASSESSMENT
Findings are based on the intelligence available at the time of writing and should be assessed against the organisation’s existing controls, monitoring coverage and risk appetite. The assessment is at sector and regional level; a confirmed rating needs an internal check against the organisation’s own assets, identities and third parties. Absence from the data does not prove absence of compromise. |
| CYFIRMA THREAT INTELLIGENCE
[email protected] · Quote: CYF-SL-2026-1109-ANZ-BFSI · SECTOR LENS – ANZ BFSI & Digital Payments Cyber Threat Landscape, May–October 2026 · 9 November 2026 |
WHAT TO WATCH NEXT
Underground listings naming ANZ banks, exchanges, fintechs and their customers; infostealer logs carrying ANZ finance credentials; ASD ACSC and NCSC New Zealand exploitation alerts for Citrix, cPanel, TeamCity, N-able and CMS platforms; cloud data-extortion claims such as FulcrumSec; mobile banking malware (Rokarolla and brand-impersonation RATs); AI-enabled vishing and deepfake impersonation against treasury and call-centre workflows. |
