As cited
Copy frozen at (site build).
threat intel
Unmasking a Financial Services Intrusion: REF0657
Elastic Security Labs documented an intrusion campaign targeting financial services organizations in South Asia that employed open-source tools and multiple post-exploitation techniques. The threat actor, tracked as REF0657, demonstrates a methodical approach to establishing and maintaining access within the sector.
Why it matters: Financial services firms in South Asia face active targeting by this threat group; practitioners should review post-exploitation artifacts and open-source tool execution signatures in their environments to detect similar activity.
- Source published
- First seen by Cybersecurity Tracker