1. Basic Information

2. Executive Summary

Attackers reached Crédit Mutuel Arkéa through a third-party service provider platform and executed unauthorized transfers from the bank's own accounts to other financial institutions, rather than from customer accounts. Regarding the reported figure of approximately 118 million euros, the bank acknowledged only the scale of the incident and has not confirmed it as a final amount. Some funds were intercepted, and the initial access vector remains under investigation.

3. Attack Flow

  1. Attackers leveraged a platform operated by a third-party service provider of Crédit Mutuel Arkéa. The vendor name and initial vector have not been disclosed.
  2. The attackers reached Crédit Mutuel Arkéa directly through this pathway. The bank stated that Fortuneo and customer accounts were not used as entry points.
  3. The attackers used the bank's own accounts to execute transactions with other financial institutions.
  4. Part of the funds may have been converted into cryptocurrency via specialized platforms.
  5. The bank detected suspicious activity, temporarily halted the transactions, and contained the incident. Some funds were blocked, and recovery efforts are ongoing.

4. Attacker Position and Execution Location

  • External attackers reached the bank via a third-party service provider platform.
  • It remains unknown which third-party systems, credentials, or connection privileges were abused.
  • Unauthorized operations were executed as transactions from the bank's own accounts to other financial institutions.

5. Perspective for Victims and Administrators

  • From the bank's perspective, investigation targets include suspicious transactions from its own accounts and external access via the service provider.
  • Some transfer processing was delayed, and specific transactions were temporarily halted as a preventive measure.
  • The bank stated there is no impact on customer assets. Phishing warnings issued to customers are a precaution against secondary threats and do not confirm customer data exposure.

6. Success and Failure Conditions

Success Conditions

  • The availability of connections or permissions that allow access from the service provider platform to the bank environment.
  • The establishment of operational permissions to initiate transfers from the bank's own accounts, along with conditions allowing transactions to be approved and executed.

Failure Conditions and Mitigations

  • Sever the service provider connection and revoke related sessions, credentials, and delegation privileges.
  • Detect and halt transactions from the bank's own accounts, and coordinate with recipient financial institutions to freeze funds.
  • Apply the principle of least privilege to service provider connections, require out-of-band approval for transfer operations, and implement anomaly detection for amounts and destinations.

7. What Happens Upon Success

  • Unauthorized transfers are executed from the bank's own accounts to other financial institutions.
  • If funds are converted to cryptocurrency after transfer, recovery may become difficult.
  • Public information has not confirmed theft from customer accounts, any impact on customer assets, or customer data leakage.

8. Observable Logs

The following items are potential investigation candidates to check if logs are collected and retained in the target systems. The authentication and connection methods used in this incident, as well as the exact logs collected, have not been disclosed.

  • Service Provider / SaaS: Check connection source IP addresses, authentication, sessions, privilege changes, and API or administrative operations. The scope of logs provided by the service provider is undisclosed.
  • Identity / IdP: Check service provider identities, service accounts, administrator authentication, MFA, and token issuance or revocation.
  • Banking Operations Systems: Check transaction creation, approval, modification, execution, cancellation, and recipient details for the bank's own accounts.
  • Network: Check communications from the service provider connection source to the bank environment, as well as access outside normal operating hours or to unusual targets.
  • Email: Check for secondary phishing campaigns impersonating the service provider or the bank. This does not indicate that the initial access vector was phishing.

9. Attack Success Determination

Confirmed in Public Information

  • Subsequent Compromise Confirmed: The bank confirmed that attackers executed transactions from the bank's own accounts to other financial institutions.
  • Regarding the reported amount of approximately 118 million euros, the bank acknowledged only the scale of the incident and has not confirmed it as a final amount. Some funds were intercepted.

Determination Criteria for Your Organization

  • Correlate service provider authentication and sessions with transaction creation, approval, and execution records on the bank side in chronological order to determine whose privileges were used to establish each transaction.
  • Judge impacts on customer accounts and data using evidence separate from the unauthorized transfers from the bank's own accounts.

10. Investigation Playbook

  1. Trigger: Initiate based on abnormal transactions from the bank's own accounts, abnormal connections from service providers, or service provider compromise notifications.
  2. Initial Verification: Identify and document the transactions in scope, amounts, recipients, creators and approvers, service provider pathways, and the last known normal timestamp.
  3. Authentication and Privileges: Preserve service provider identities, service accounts, API keys, tokens, MFA, and privilege change records.
  4. Transactions: Cross-reference audit records from creation to execution or cancellation, along with movements to recipient financial institutions and cryptocurrency platforms.
  5. Impact Scope: Separately check access from the same pathway to customer data, customer accounts, and other business systems.
  6. Containment: Terminate service provider connections, revoke credentials, sessions, and delegation privileges, and freeze unauthorized transactions.
  7. Determination: Record service provider compromise, bank access, transaction creation, transfer success, and fund recovery in separate stages.

11. Defense and Detection Ideas

  • Correlate events where high-value or new-destination transactions from the bank's own accounts are created following service provider identity authentication.
  • Monitor deviations from normal operational baselines regarding service provider connection times, connection sources, operation targets, and transaction volumes.
  • Separate transfer creators and approvers, and design workflows so high-value transactions cannot be completed solely through a service provider pathway.
  • Verify emergency contact channels with financial institutions and cryptocurrency service providers and establish procedures for freezing funds in advance.

12. Facts, Inference, and Hypothesis

Facts

  • The bank stated that attackers reached Crédit Mutuel Arkéa directly via a third-party service provider platform.
  • Attackers executed transactions from the bank's own accounts to other financial institutions, rather than customer accounts.
  • The bank stated there was no impact on customer assets, while some transactions experienced delays and temporary suspensions.
  • The bank did not confirm the reported 118 million euros as a final amount, acknowledging only the scale of the incident.

Inference

  • If third-party connection privileges and transfer privileges are insufficiently segregated, service provider compromises can directly lead to financial operations, requiring monitoring of transaction approval boundaries in addition to authentication.

Hypothesis

No additional hypotheses. Unconfirmed items are listed under 'Unknowns and Further Investigation'.

13. MITRE ATT&CK Mapping

ID Technique Confidence Basis
T1199 Trusted Relationship High The bank stated that attackers reached it directly via a third-party service provider platform. The initial access method at the service provider is undisclosed.
T1657 Financial Theft High Unauthorized transactions from the bank's own accounts to other financial institutions were confirmed.

14. Unknowns and Further Investigation

  • The name of the service provider, compromised products or accounts, initial access method, authentication mechanisms, and how the attackers obtained privileges within the bank remain undisclosed.
  • The final amount of unauthorized transactions, recovered funds, and amounts converted to cryptocurrency are undetermined.
  • Access to customer data or other banking systems cannot be fully determined from public statements alone.

15. Impact on SOCs and Organizations

Unconditionally trusting service provider connections as legitimate operational traffic causes organizations to overlook financial operations performed after authentication. Monitoring service provider identity usage in correlation with high-value transactions, new destinations, and changes in approval pathways is essential, along with implementing controls that prevent fund movements based solely on service provider privileges. SOCs should treat transactions executed on business systems as evidence of success rather than focusing solely on entry points, and incorporate fund-freezing communication procedures into incident response.

16. Summary by Role

  • For SOCs: Correlate service provider sessions with transaction records from the bank's own accounts, and separately determine transfer success and customer impact.
  • For Administrators: Minimize service provider privileges, and verify out-of-band approvals for high-value transfers, session revocations, and emergency stops.
  • For Users: Since communications impersonating the bank may increase, avoid sharing sensitive information via email or phone, and verify through official channels.