Threat video1:00
Crédit Mutuel Arkéa Supply-Chain Heist: Detection & IOCs
Attackers moved Crédit Mutuel Arkéa's own funds via a provider's platform; 9 detection rules, 12 IOCs and a free Splunk SPL rule.
Read the full threat intel for Crédit Mutuel Arkéa Supply-Chain Heist: Detection & IOCs →
Chapters
- 0:00The hookFrench bank reportedly lost about $133 million.
- 0:05The storyUSDC left three exchanges in 21 hours.
- 0:11Attack pathReportedly, attackers entered through a service provider.
- 0:27AttributionNo threat actor is attributed.
- 0:32Indicators of compromiseNo malicious indicators were published.
- 0:38MITRE ATT&CK techniques5 ATT&CK techniques, from resource development to impact.
- 0:43Remediation4 steps now: Audit and restrict service-provider platform access to payment, treasury.
- 0:50Detection rules9 detection rules, in SPL, KQL and Sigma.
Transcript
0:00French bank reportedly lost about $133 million.
0:05USDC left three exchanges in 21 hours.
0:08The bank disclosed the attack.
0:11Reportedly, attackers entered through a service provider.
0:15They reached the bank directly.
0:17Fraudulent transfers went to other banking organizations.
0:20Funds swapped to ETH, then turned into Monero.
0:27No threat actor is attributed. Confidence: low.
0:32No malicious indicators were published.
0:385 ATT&CK techniques, from resource development to impact.
0:434 steps now: Audit and restrict service-provider platform access to payment, treasury.
0:519 detection rules, in SPL, KQL and Sigma.
0:56Threadlinqs. The unified security engineering platform.