# ASEC August 2026 Financial Sector Threat Landscape: LockBit 5.0 Ransomware Activity, Phishing Dominance, and Multiple Unverified Data-Breach Claims

> AhnLab ASEC's August 2026 financial-sector roundup reports phishing as the dominant stage-1 vector (41.9% of samples, HTML the top malicious file type at 29.1%/30.0% of extensions) and Telegram Bot API abuse for exfiltration of domestic financial-account data (3% of August exfil). Named extortion/ransomware actors targeting the sector include LockBit 5.0 (US Bank), CRPx0 (QNB Finansbank), Dysphor1A (Allianz Thailand/Ayudhya TH Insurance), plus forum-based data-broker handles mosad (Alipay), RTX106 (Robinhood), moonfox (Bank of Baroda), Bfpussy and Futanari (bulk stolen card data). ASEC explicitly flags every one of these headline breach numbers as an unverified forum/DLS claim, not a confirmed incident.

- **Published:** 2026-09-28T00:00:00Z
- **Last reviewed:** 2026-09-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2730
- **ID:** TL-2026-2730
- **Severity:** HIGH
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Actor:** LockBit 5.0
- **Detections:** 9 · **IOCs:** 23 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab's ASEC published a monthly threat-landscape roundup for the financial sector covering August 2026 (asec.ahnlab.com/ko/95588 and the English mirror asec.ahnlab.com/en/95589). The report's own telemetry shows phishing as the highest-scoring stage-1 initial-access vector for the month (rated 2.1, up from 1.8 in July) and accounting for 41.9% of all malware samples analyzed — by far the largest single category, ahead of Downloader (17.6%) and Unclassified (12.1%). Malicious-file-type distribution was led by HTML (29.1% of samples, 30.0% of extensions), followed by PE (17.0%), PDF (9.3%), JS (7.6% of samples / 19.4% of extensions), and VBS (4.2%), consistent with HTML-smuggling droppers and script-based (VBS/VBE/BAT/HTA/JS) second-stage delivery. Stage 2 was dominated by Dropper/Downloader activity (rated 1.1, down from 3.2 the prior month) and Stage 3 by Infostealers (0.3, down from 0.4). ASEC also reports that domestic (South Korean) financial-account credentials leaked via Telegram Bot API abuse made up 3% of the month's exfiltration activity, consistent with the platform's known use as a low-friction C2/exfil channel that blends with legitimate HTTPS traffic.

On the ransomware side, LockBit — specifically the 5.0 branch that publicly relaunched in September 2025 with cross-platform Windows/Linux/ESXi support (per Acronis, GBHackers, and LevelBlue SpiderLabs technical writeups) — listed US Bank on its Tor leak site with a public countdown deadline; the actual scope of any US Bank compromise is unverified. LockBit 5.0's technical profile (independently corroborated outside the ASEC report) uses ChaCha20-Poly1305 encryption with X25519+BLAKE2b key exchange, patches Event Tracing for Windows (ETW) to blind defensive telemetry, and deletes volume shadow copies via the VSS Coordinator COM interface instead of noisy vssadmin/WMI commands specifically to evade command-line-based detections — all consistent with the phishing-dominant, LOLBin-heavy, defense-evasive pattern ASEC's August telemetry shows across the sector.

Separately, ASEC catalogs a cluster of dark-web/DLS extortion claims against named financial institutions, explicitly caveated as unverified in authenticity and scale: CRPx0 claimed theft of 2.3GB of HR/recruitment data from QNB Finansbank's (qnbfinansbank.com) evaluation system on 2026-07-31, part of a broader CRPx0 campaign that has also targeted other Turkish and multinational enterprises (per DeXpose/SOCRadar tracking). Dysphor1A claimed on 2026-08-20 to have compromised the internal batch-control system underpinning Allianz Thailand's customer-facing platform (branded AYUDHYA TH Insurance, allianz.co.th), publishing a login screenshot and an admin credential pair (TBH2CASH:AAbb1234) as proof — the only concrete technical artifact in this cluster of claims. moonfox advertised a Bank of Baroda database for sale with only screenshots as proof, in the same window as Bank of Baroda's own confirmed (and separately reported) July 2026 breach via a compromised employee email account, attributed by outside researchers to a different actor ("Triple X"); the two reports may describe overlapping or entirely distinct incidents and ASEC does not resolve the discrepancy. A forum actor tracked by ASEC as "mosad" advertised a 820-million-record Alipay database (names, phone numbers, gender; a roughly 5GB archive per independent reporting) starting around 2026-08-27; Alipay/Ant Group has not confirmed the breach. A June 2026 forum post — attributed by ASEC to "RTX106" and, in independent reporting from ThreatMon, to a handle "DuckDB" — claimed a 14,521,975-record Robinhood user database including names, emails, phone numbers, SSNs, bank account data, KYC status and 2FA details; this is separate from Robinhood's confirmed November 2021 breach of ~7 million users and remains unverified by Robinhood or third parties. Finally, bulk stolen payment-card listings appeared on BreachForums (Bfpussy, ~2.7 million card records) and RaidForums (Futanari, 2.5+ million card records), both with sample data shown but total authenticity/scale unconfirmed.

No CVE, CVSS score, or software vulnerability underlies this report — it is a threat-trends/TTP and dark-web-claims roundup, and no hash, IP, or domain IOCs were published by ASEC for the month.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1059.005 Visual Basic
- T1059.007 JavaScript
- T1218 System Binary Proxy Execution
- T1027.006 HTML Smuggling
- T1685 Disable or Modify Tools
- T1497 Virtualization/Sandbox Evasion
- T1027 Obfuscated Files or Information
- T1552.001 Credentials In Files
- T1005 Data from Local System
- T1567 Exfiltration Over Web Service
- T1490 Inhibit System Recovery
- T1489 Service Stop

## Sources

- [2026년 8월 국내외 금융권 관련 보안 이슈](https://asec.ahnlab.com/ko/95588/)
- [Security Issues in the Korean & Global Financial Sector in August 2026](https://asec.ahnlab.com/en/95589/)
- [In-Depth Analysis Report on LockBit 5.0: Operation and Countermeasures](https://asec.ahnlab.com/en/91945/)
- [LockBit strikes with new 5.0 version, targeting Windows, Linux and ESXI systems](https://www.acronis.com/en/tru/posts/lockbit-strikes-with-new-50-version-targeting-windows-linux-and-esxi-systems/)
- [LockBit 5.0 Introduces New Features: ChaCha20 Encryption, Stealthy Installation, and Anti-Analysis](https://www.levelblue.com/blogs/spiderlabs-blog/lockbit-5.0-introduces-new-features-chacha20-encryption-stealthy-installation-and-anti-analysis-to-target-windows-linux-and-esxi-environments)
- [LockBit Ransomware: Attack Chain, MITRE ATT&CK Mapping, IOCs & Detection](https://www.manageengine.com/malware-protection/adversaries/lockbit-ransomware.html)
- [LockBit (5.0)](https://www.halcyon.ai/threat-group/lockbit)
- [CRPxO Strikes Turkish Banking Leader FINANSBANK](https://www.dexpose.io/crpxo-strikes-turkish-banking-leader-finansbank/)
- [FINANSBANK Ransomware Attack by CRPxO](https://socradar.io/free-tools/ransomware-intelligence/victims/finansbank-crpxo-343cbfa5)
- [DYSPHOR1A Targets AYUDHYA TH Insurance in Thailand](https://www.dexpose.io/dysphor1a-targets-ayudhya-th-insurance-in-thailand/)
- [AYUDHYA Ransomware Attack by DYSPHOR1A](https://socradar.io/free-tools/ransomware-intelligence/victims/ayudhya-dysphor1a-f015e207)
- [Ransomware.live: DYSPHOR1A](https://www.ransomware.live/group/DYSPHOR1A)
- [Alipay 820M Data Leak Claim: Still Unconfirmed 2026](https://tech-insider.org/alipay-820-million-data-leak-claim-2026/)
- [Hacker puts data of 820 million Alipay users up for sale](https://www.escudodigital.com/en/cybersecurity/hacker-puts-data-of-820-million-alipay-users-up-for-sale.html)
- [ThreatMon: Alleged Robinhood Breach Exposes 14.5 Million User Records on Darkweb](https://x.com/MonThreat/status/2070090236676211003)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2730