26,000+ Discussions on Dark Web Forums Towards Hacking Financial Organizations

The cybersecurity landscape is experiencing a significant transformation as threat actors adopt increasingly sophisticated approaches to bypass security measures. A comprehensive analysis of 46 deep-web hacker forums and over 26,000 threat actors’ forum threads has revealed alarming trends in cyber threats specifically targeting the financial services industry. This extensive research, conducted throughout 2024, provides unprecedented […] The post 26,000+ Discussions on Dark Web Forums Towards Hacking Financial Organizations appeared first on Cyber Security News.

Apr 9, 2025 - 09:20

26,000+ Discussions on Dark Web Forums Towards Hacking Financial Organizations

The cybersecurity landscape is experiencing a significant transformation as threat actors adopt increasingly sophisticated approaches to bypass security measures.

A comprehensive analysis of 46 deep-web hacker forums and over 26,000 threat actors’ forum threads has revealed alarming trends in cyber threats specifically targeting the financial services industry.

This extensive research, conducted throughout 2024, provides unprecedented insights into the evolving tactics, techniques, and procedures employed by cybercriminals seeking to compromise financial institutions.

The investigation uncovered a thriving underground economy centered around information-stealing malware, with an average of 3-4 daily mentions of unique “infostealer-as-a-service” across each monitored deep web forum.

The content analysis showed a distinct division in the ecosystem, with developers targeting both individual threat actors and more sophisticated APT groups.

These services often feature enhanced UIs, technical support, and specialized modules for stealing corporate credentials.

Radware researchers identified a concerning trend in how these attack tools are being marketed and distributed.

Their analysis revealed that infostealer developers are increasingly offering tailored solutions with dedicated features specifically designed to target corporate accounts.

For example, Mystic Stealer provides specialized functionality to extract passwords from Outlook, a common application in corporate environments, indicating a strategic focus on financial institutions.

Perhaps most concerning is the democratization of attack capabilities, with virtually anyone possessing basic technical knowledge now able to launch sophisticated attacks against financial organizations.

Decentralization of cybercrime

This decentralization of cybercrime has reached unprecedented levels, with threat actor forums facilitating complete separation between attack developers and executors, making attribution and law enforcement intervention increasingly challenging.

The most significant development of 2024 has been the rise of “OTP (One-Time Password) bots” – underground services operated via Telegram that enable threat actors to automate social engineering attacks.

These bots function by first leveraging credential stuffing attacks using previously leaked username-password combinations.

When login attempts fail due to two-factor authentication requirements, the attackers target these accounts using OTP bots that impersonate legitimate entities through pre-recorded or AI-generated voice calls and SMS messages.

The technical workflow of these OTP bots is particularly sophisticated. When victims receive urgent requests to provide the OTP sent to their device (often disguised as fraud prevention measures), many unwittingly disclose the authentication code.

The threat actors then retrieve the 2FA code, change the password and associated phone number, effectively locking out the legitimate account holder.

According to forum advertisements, at least 38 different OTP bot services are currently available, priced between $10 and $50 per attack, with mentions increasing by 31% between 2023 and 2024.

OTP Bot Advertisement showing GhostOTP interface and pricing plans (Source – Radware)

This evolution in attack methodology represents a fundamental shift in how financial organizations must approach cybersecurity, requiring a move from traditional defensive postures to more proactive threat intelligence gathering from deep and dark web platforms.

Investigate Real-World Malicious Links & Phishing Attacks With Threat Intelligence Lookup - Try 50 Request for Free

The post 26,000+ Discussions on Dark Web Forums Towards Hacking Financial Organizations appeared first on Cyber Security News.