Comisión Nacional Bancaria y de Valores · 2016-10
The CNBV-related activity was part of a broader financial-sector watering-hole campaign in which compromised regulator and banking websites in Poland, Mexico, and Uruguay redirected selected visitors toward malicious infrastructure. Reporting connected the campaign to sap.misapor[.]ch, eye-watch[.]in, a Silverlight exploit path, Ratankba malware, encrypted C2, and tooling traits overlapping with Lazarus-linked malware, while retaining caution around definitive attribution.
Comisión Nacional Bancaria y de Valores · 2016-10
Reported: 2016-10; Victims: Comisión Nacional Bancaria y de Valores; Motivations: Wateringhole; Sectors: Finance; Countries: Uruguay
Watering hole via website of a Mexican financial regulator; IP addresses of three Mexican banks connected · November 8, 2016
Multiple private cyber security research companies reported discovering evidence indicating that the website of a Mexican financial regulator had also referred traffic to one of the domains redacted in the previous paragraph ... on November 8, 2016. [Case No. 2:18-mj-01479, U.S. District Court for the Central District of California; filing: COMPLAINT filed as to Defendant Park Jin Hyok in violation of 18:371; 18:1349. Approved by Magistrate Judge Rozella A. O]