Skip to navigation

Threat reportSupply ChainTL-2026-5513

Attackers Exploit Third-Party Service Provider Platform to Conduct Fraudulent Transfers Against French Bank Crédit Mutuel Arkéa (~€100–118M, Laundered via Stablecoins to Monero)

highACTIVE

Attackers reached Crédit Mutuel Arkéa through a service provider's platform and used the bank's own proprietary account to send fraudulent transfers to other banking organizations, which were converted to cryptocurrency. Reuters/Arkéa cite roughly €100 million; ZachXBT estimates up to €118 million ($133 million) withdrawn as USDC/USDT, with about $30 million laundered by November 3, 2026.

Key facts

IdentifiersTL-2026-5513
SeverityHIGH
First disclosed
Affected productsCrédit Mutuel Arkéa Bank proprietary account / interbank transfer operations (accessed via an unnamed third-party service provider platform)
MalwareKraken
MITRE ATT&CK techniquesT1078 Valid Accounts, T1199 Trusted Relationship, T1565.002 Transmitted Data Manipulation, T1585 Establish Accounts, T1657 Financial Theft
MotivationFINANCIAL
Target sectorsfinance, banking
Target regionsEurope, france
Detection rules9 (1 shown free)
Sources7 cited sources

Detection coverage

As of 2026-11-09, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5513 across Splunk SPL, Microsoft KQL and Sigma, covering 12 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5513 Third-Party Provider Account Sign-In From Multiple Sources (T1199 / T1078.004) — Exploitation Phase

Detects successful Entra ID sign-ins by guest, vendor or service-provider style accounts that come from 3+ distinct IPs or 2+ countries within 24 hours. In the Crédit Mutuel Arkéa incident (TL-2026-5513) the attackers entered through an unnamed service provider's platform (Trusted Relationship, T1199) and abused valid provider access (Valid Accounts, T1078; cloud-identity variant T1078.004) to reach the bank's proprietary account. Provider identities that suddenly appear from several networks are a leading indicator of that access path being hijacked. No provider, IP or domain was published, so the logic is behaviour-first.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1199, T1078, T1078.004
  • Data sources: azure_ad_signin_logs, splunk:azure:aad:signin, sentinel:SigninLogs
  • Severity: high
  • Confidence: medium

Splunk SPL

index=azure sourcetype=azure:aad:signin status.errorCode=0 (userType=Guest OR userPrincipalName=*svc* OR userPrincipalName=*vendor* OR userPrincipalName=*prestataire* OR userPrincipalName=*partner*) earliest=-24h | stats dc(ipAddress) as src_ip_count dc(location.countryOrRegion) as country_count values(ipAddress) as src_ips values(location.countryOrRegion) as countries values(appDisplayName) as apps min(_time) as first_seen max(_time) as last_seen by userPrincipalName | where src_ip_count>=3 OR country_count>=2 | eval risk=case(country_count>=2 AND src_ip_count>=3,"high", true(),"medium") | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

SigninLogs | where TimeGenerated > ago(24h) | where ResultType == 0 | where UserType == 'Guest' or UserPrincipalName has_any ('svc', 'vendor', 'prestataire', 'partner') | summarize SrcIpCount = dcount(IPAddress), CountryCount = dcount(tostring(LocationDetails.countryOrRegion)), SrcIps = make_set(IPAddress, 20), Countries = make_set(tostring(LocationDetails.countryOrRegion), 10), Apps = make_set(AppDisplayName, 20), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by UserPrincipalName | where SrcIpCount >= 3 or CountryCount >= 2 | extend Risk = iff(CountryCount >= 2 and SrcIpCount >= 3, 'high', 'medium')

Sigma

title: Third-Party Provider Account Sign-In To Payment Or Treasury Application
id: 3f6b1c52-8a4d-4e0b-9d57-2c1a7e94b3a1
status: experimental
description: Detects successful sign-ins by guest or provider-named accounts to payment, treasury or SWIFT related applications. Models the trusted-relationship access path used against Credit Mutuel Arkea (TL-2026-5513).
references:
    - https://securityaffairs.com/202628/cyber-crime/attackers-exploit-third-party-provider-to-raid-french-bank-credit-mutuel-arkea.html
    - https://www.bleepingcomputer.com/news/security/hackers-pull-off-133-million-french-bank-heist-via-service-provider/
author: Threadlinqs Team
date: 2026/11/09
tags:
    - attack.initial-access
    - attack.t1199
    - attack.t1078
    - attack.t1078.004
logsource:
    product: azure
    service: signinlogs
detection:
    selection_status:
        ResultType: 0
    selection_app:
        AppDisplayName|contains:
            - payment
            - treasury
            - swift
    selection_guest:
        UserType: Guest
    selection_name:
        UserPrincipalName|contains:
            - svc
            - vendor
            - prestataire
            - partner
    condition: selection_status and selection_app and (selection_guest or selection_name)
falsepositives:
    - Legitimate provider staff accessing payment applications during contracted support
    - Approved integration or batch accounts
level: medium

Known false positives:

  • Legitimate provider support staff travelling or using multiple corporate VPN egress IPs
  • Shared integration service accounts that legitimately authenticate from several datacenter IPs

Tuning notes: Replace the name patterns (svc, vendor, prestataire, partner) with your actual provider account naming or an Entra group lookup. Allowlist known provider egress IP ranges and raise or lower the src_ip_count and country_count thresholds. Verify field names against your Splunk Add-on for Microsoft Cloud Services version. The Sigma form is an event-level variant that focuses on payment/treasury app access; the SPL and KQL forms add multi-source aggregation.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • TL-2026-5513 Provider Accounts Logging On To Multiple Servers (T1078.002 / T1199) — Exploitation Phase · unlock with TL Creds
  • TL-2026-5513 Payment Control Changes Preceding Transfers: Limits Raised Or Dual Approval Disabled (T1565.002 / T1078) — Post-Exploitation Phase · unlock with TL Creds
  • TL-2026-5513 Corporate Endpoint Egress To Instant Exchanges And Swap Services Linked To Arkéa Laundering (T1657) — Laundering Phase · unlock with TL Creds
  • TL-2026-5513 Authentication Method Changes On Provider Accounts (T1098.005 / T1078.004) — Exploitation Phase · unlock with TL Creds
  • TL-2026-5513 Provider-Channel Transfers From Proprietary Accounts (T1657 / T1199) — Post-Exploitation Phase · unlock with TL Creds
  • TL-2026-5513 Account Opening Clusters Sharing Device Or KYC Artifacts (T1585 / T1656) — Resource Development Phase · unlock with TL Creds
  • TL-2026-5513 High-Value Or High-Velocity Outbound Transfers From Bank Proprietary Account (T1657 / T1565.002) — Post-Exploitation Phase · unlock with TL Creds
  • TL-2026-5513 Newly Opened Accounts Sending Funds To Crypto Exchange Beneficiaries (T1585 / T1656 / T1657) — Laundering Phase · unlock with TL Creds

Indicators of compromise

As of 2026-11-09, Threadlinqs Intelligence tracks 12 indicators of compromise for TL-2026-5513.

12 indicators of compromise · unlock with TL Creds. Compare plans

Technical analysis

The actor is unidentified and the provider has not been named.

Crédit Mutuel Arkéa, a Brest-headquartered French cooperative bank and insurance group (Crédit Mutuel de Bretagne, Crédit Mutuel du Sud-Ouest, Fortuneo, Suravenir; roughly 5.6-5.8 million customers, €211.5 billion in assets), disclosed on 4 November 2026 that it had been the victim of a cyberattack enabling fraudulent operations. According to the bank, the attackers entered through a service provider's platform and reached Arkéa directly; the bank explicitly denies entry through Fortuneo and denies human error, calling it a 'sophisticated attack from outside'. The provider has not been named by the bank or by the press.

The attackers used Arkéa's own proprietary account, not customer accounts of its federations or subsidiaries, to send transfers to other banking organizations, which the bank says may have allowed the funds to be converted into cryptocurrency. Arkéa says customer assets were unaffected, security systems detected the suspicious activity quickly, crisis procedures were activated, some transactions were temporarily suspended (delaying some transfers), some funds were blocked, and recovery efforts are ongoing. Arkéa does not confirm the €118 million figure and says it can only validate the order of magnitude; Reuters cites about €100 million.

On-chain investigator ZachXBT first reported on 2 November 2026 that an unnamed EU entity lost over $106 million in USDC and USDT withdrawn from multiple centralized exchange accounts (theft reported as occurring the previous day), raised the total to above $133 million on 3 November after tracing an additional ~$27 million, and named Arkéa that evening. He noted the real total could be higher once OTC trades are counted. Bitquery analysis relayed by IT-Connect indicates $108.8 million in USDC left Kraken, Crypto.com and OKX in 21 hours on 1-2 November to about 15 wallets (Kraken ~95%); $62.98 million in stablecoins was swapped for 27,553 ETH via UniswapX in about four hours; 11 of the 15 receiving wallets had earlier received payments from those platforms (oldest in May), suggesting the thief may have controlled those exchange accounts; about $61 million remained on Ethereum on 3 November; Tether froze only about 1.14 million USDT and Circle did not freeze USDC. An unconfirmed analysis by Grégory Raymond (cited by IT-Connect) hypothesizes that fiat was moved out of the bank to crypto accounts opened with fake identities passing KYC, via money mules; the bank has not confirmed this.

Laundering per ZachXBT: USDC swapped to ETH, funds sent to instant exchanges (WellWallet, Kyrrex), converted to XMR via Wagyu, and bridged across multiple chains. ZachXBT says with a high degree of confidence that the actor is not Lazarus Group, based on laundering indicators; no actor is otherwise named. ZachXBT also alleges lack of prompt public disclosure let ~$30 million be laundered before EU authorities could freeze funds. The Paris prosecutor's cybercrime unit opened an investigation after Arkéa's complaint (reported charge: unauthorized access to an automated data processing system by an organized gang), led by the Office anticybercriminalité (OFAC). Arkéa warned customers of elevated phishing risk. No CVEs, malware, wallet addresses, transaction hashes, or network IOCs (IPs/domains) have been published; BeaconBeagle correlation is not applicable as no network IOCs exist.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1199 Trusted Relationship

Impact

T1565.002 Transmitted Data Manipulation; T1657 Financial Theft

Resource Development

T1585 Establish Accounts

Remediation

Immediate actions

  • Audit and restrict service-provider platform access to payment, treasury and proprietary-account functions; rotate provider credentials and API keys
  • Review outbound interbank transfers from proprietary/nostro accounts for anomalous beneficiaries, volumes and timing; add out-of-band dual approval for high-value transfers
  • Notify law enforcement and regulators promptly and engage exchange/stablecoin issuers (Tether, Circle) and EU authorities early to enable freezes
  • Warn customers of follow-on phishing and fake 'fraud service' advisor calls; advise verifying via the known bank adviser number

Workarounds

  • Temporarily suspend or throttle provider-initiated transfers until provider access paths are verified

Longer-term hardening

  • Apply third-party risk management: least-privilege, network segmentation and just-in-time access for provider connectivity
  • Monitor provider-originated sessions with behavioral analytics and transaction-velocity limits on proprietary accounts
  • Maintain pre-arranged incident disclosure and asset-freeze playbooks with exchanges and stablecoin issuers

Affected and fixed versions

  • Crédit Mutuel Arkéa — Bank proprietary account / interbank transfer operations (accessed via an unnamed third-party service provider platform)
    Vulnerable versions: Not disclosed
    Fixed in: Not disclosed

Timeline

  • Unauthorized withdrawals of USDC/USDT from multiple centralized exchange accounts begin; Bitquery sees $108.8M USDC leave Kraken, Crypto.com and OKX within 21 hours on 1-2 November to ~15 wallets.
  • ZachXBT publicly reports an unnamed EU entity lost over $106M in stablecoins; laundering via ETH swaps, instant exchanges, Monero and bridges begins to be traced.
  • ZachXBT raises the total above $133M (~€118M) after tracing ~$27M more, states ~$30M already laundered, rules out Lazarus Group, and names Crédit Mutuel Arkéa as the victim that evening.
  • Arkéa confirms a cyberattack enabling fraudulent operations via a service provider's platform, states it is contained, some funds blocked, and informs supervisors; Paris prosecutor's cybercrime unit opens an investigation after the bank's complaint.
  • Reuters reports Arkéa says about €100M is missing after the cyberattack; the bank validates only the order of magnitude of ZachXBT's €118M estimate.
  • BleepingComputer reports the $133M heist via a service provider; provider remains unnamed and no actor is attributed.
  • Security Affairs publishes analysis of the third-party-provider compromise; investigation by French cybercrime police continues and the actor remains unidentified.

Sources cited

Previous and next in supply chain

Further reading

Drafted by the Threadlinqs research pipeline from 7 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats