# Korean & Global Financial Sector Threats, September 2026: Phishing-to-Infostealer Chains with Telegram API Exfiltration and LockBit 5.0 / Qilin / Storm Ransomware Claims (AhnLab ASEC)

> AhnLab ASEC's September 2026 financial-sector report describes phishing as the dominant initial-compromise stage, followed by dropper/downloader delivery and infostealer objectives, with Korean financial-sector credentials exfiltrated via the Telegram API. It also lists ransomware leak-site claims (LockBit 5.0, Qilin, Storm) and forum data-leak posts against financial and insurance organizations; these victim and leak claims are unverified.

- **Published:** 2026-10-28T02:10:04Z
- **Last reviewed:** 2026-10-28T02:10:04Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4587
- **ID:** TL-2026-4587
- **Severity:** MEDIUM
- **Category:** THREAT_INTEL
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 26 (full data via the Threadlinqs MCP server — Purple tier)

## Description

AhnLab ASEC's monthly report on the Korean and global financial sector (published 2026-10-12) summarizes malware telemetry and dark-web activity for September 2026. Telemetry shows a three-stage pattern: phishing is the leading initial-compromise vector (27.0% of observed samples, rate 2.1 vs 1.8 the prior month), dropper/downloader is the leading delivery category (25.3%, rate 1.1 vs 3.2 prior month), and infostealer is the leading objective category (rate 0.3 vs 0.4). Backdoors account for 13.5%; the top three categories together are about 66% of the total.

By file type, HTML is 23.1% (the report attributes this to HTML-based phishing pages and HTML smuggling), PE executables 15.0%, LNK shortcuts 8.5% and ELF64 4.7%. By extension, .html is 31.8%, .exe 12.4%, .js 9.3% and .vbe 5.4%. Script extensions (js, vbe, vbs, bat, hta) were prevalent, which ASEC reads as a continuing trend of LOLBin abuse. Credentials of Korean financial-sector users were leaked through the Telegram API using lure keywords such as "money transfer", "receipt" and "voicemail"; domestic accounts were 1.4% of all credentials leaked in September. The report does not name specific malware families and publishes no hashes, IPs or domains.

On the dark web, ASEC lists: a BreachForums post by ShinyHunters, "Truist Bank Database - Leaked, Download!", claiming 79,000 records (balances, birthdates, emails, credit card data, phone numbers); a DarkForums post by SpaceX claiming 454M insurance contract records allegedly from licindia.in (policy numbers, names, addresses, PAN numbers); and a PwnForums post by exfilsquad claiming Allstate internal data (names, contact and job information). Ransomware leak-site claims: LockBit 5.0 against Taspen Life (Indonesian life insurer, taspenlife.com; insurance policies, tax documents, ID copies), Qilin against Inversiones Bolivar, and Storm against First Secure Bank and Trust, The State Bank, First Secure Community Bank, Insight Credit Union and Johnson Investment Counsel. The report words these conditionally ("If these reports are true") and warns of financial fraud, identity theft, account takeover, BEC and customer-targeted phishing.

Secondary trackers (dexpose, SOCRadar, hendryadrian) independently record the Taspen Life, Inversiones Bolivar and Storm victim postings with dates in 2026-09-15 to 2026-09-24, but these are aggregations of the same leak-site claims; no victim confirmation or data validation was found. The forum claims (Truist, licindia.in, Allstate) could not be corroborated by a second source. No CVEs are involved and no exploitation vector for the ransomware intrusions is stated in the source.

## MITRE ATT&CK

- T1566 Phishing
- T1566.001 Phishing: Spearphishing Attachment
- T1204.002 User Execution: Malicious File
- T1059.007 Command and Scripting Interpreter: JavaScript
- T1059.005 Command and Scripting Interpreter: Visual Basic
- T1059.003 Command and Scripting Interpreter: Windows Command Shell
- T1027.006 Obfuscated Files or Information: HTML Smuggling
- T1218.005 System Binary Proxy Execution: Mshta
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Security Issues in the Korean & Global Financial Sector in September 2026 (AhnLab ASEC)](https://asec.ahnlab.com/en/96155/)
- [LockBit 5.0 Targets Indonesian Insurer Taspen Life (dexpose)](https://www.dexpose.io/lockbit-5-0-targets-indonesian-insurer-taspen-life)
- [Ransom! taspenlife.com (SEP-2026) (hendryadrian)](https://www.hendryadrian.com/?p=114060)
- [LockBit 5.0 Targets Windows, Linux and ESXi (Trend Micro)](https://trendmicro.com/es_mx/research/25/i/lockbit-5-targets-windows-linux-esxi.html)
- [Storm Ransomware Targets First Secure Bank and Trust (dexpose)](https://www.dexpose.io/storm-ransomware-targets-first-secure-bank-and-trust/)
- [Storm Ransomware Hits The State Bank (dexpose)](https://www.dexpose.io/storm-ransomware-hits-the-state-bank/)
- [Storm Ransomware Targets Insight Credit Union (dexpose)](https://www.dexpose.io/storm-ransomware-targets-insight-credit-union/)
- [Storm Ransomware Attacks First Secure Community Bank (dexpose)](https://www.dexpose.io/storm-ransomware-attacks-first-secure-community-bank/)
- [Inversiones Bolivar - Qilin victim record (SOCRadar)](https://socradar.io/free-tools/ransomware-intelligence/victims/inversiones-bol-var-qilin-d1400e7d)
- [Qilin (cybercrime group) (Wikipedia)](https://en.wikipedia.org/wiki/Qilin_(cybercrime_group))

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4587