Recorded Future's Insikt Group (report of October 16) tracks a suspected Chinese-speaking actor, TAG-217, linked to attacks on South Korean financial institutions. The actor used Claude Code, DeepSeek, Grok and Zhipu AI alongside ARTEX, an open-source Chinese-language AI penetration testing framework. Public reporting cited in the investi…
CrowdStrike reports that the cybercriminal group SLIM SPIDER breached a Brazilian financial institution in late March 2026 to obtain credentials and information tied to digital assets. The group did not attack Pix or the Central Bank directly. It targeted the cloud environments that banks and fintechs use. CrowdStrike also recorded a 171%…
Recorded Future's Insikt Group tracks the actor behind the October 2026 AI-assisted intrusions into South Korean financial institutions as TAG-217. The group was testing infrastructure and assembling attack tools as early as August 2026, weeks before the campaign became public. South Korea's Financial Services Commission (FSC) disclosed t…
A disruption in Google Cloud's europe-west2 region in London took several Google Cloud services offline on Tuesday. Digital bank Revolut reported a widespread outage at about the same time, including card payments and ATM withdrawals. A person familiar with the matter told Reuters the two events were connected. ING Germany also reported o…
Check Point Exposure Management researchers uncovered a large, multi-region phishing infrastructure that conceals active campaigns behind domains that look inactive. Root domains return blank or generic "Not Found" pages, while the phishing content is served only through concealed regional paths (for example /it, /de, /pa) and under speci…