Indian banks, NBFCs and insurers are contending with a fresh round of edge-appliance compromise: an unattributed actor rooting SonicWall remote-access gateways, a Citrix NetScaler flaw feeding ransomware, and a listed NBFC's own ransomware disclosure, just as RBI names AI-enabled cyberattacks the top risk facing the sector and SEBI's half-yearly cyber-audit cycle comes due.
1. Sector snapshot
#1
AI-enabled cyber threats ranked the top expected risk over the next 12 months
67%
of institutions raised cybersecurity headcount, Mar 2025 to Mar 2026
71%
raised the cybersecurity share of IT spend over the same period
RBI's Financial Stability Report for June 2026 surveyed 33 scheduled commercial banks and 10 upper-layer NBFCs; respondents ranked AI-enabled cyber threats ahead of ransomware, phishing and third-party supply-chain exposure. Investment is rising alongside the threat. Source (with date): Reserve Bank of India Financial Stability Report; Business Standard (1 Jul 2026).
2. Threats targeting BFSI
1CriticalCVSS 10.0
SonicWall SMA1000 zero-days rooted before disclosure
CVE-2026-15409 (unauthenticated SSRF, CVSS 10.0) and CVE-2026-15410 (command injection, CVSS 7.2) on SMA1000 6210/7210/8200v appliances were exploited from around 22 June 2026, weeks ahead of SonicWall's patch. The actor Volexity tracks as UTA0533 abused the /wsproxy endpoint to reach internal services, then used a dropper called KNUCKLEBALL to install the open-source proxy tool suo5 and a custom Java webshell, ORANGETAIL, for persistent covert access and credential capture. CISA added both CVEs to KEV on 14 July 2026.
India exposureany Indian bank, NBFC or insurer using SMA1000 for branch, vendor or remote-staff access.
Actionpatch to 12.4.3-03453/12.5.0-02835 immediately and treat logs since 22 June as investigation scope, not just a patch checklist.
SourceVolexity (17 Jul 2026); Help Net Security (21 Jul 2026); CISA KEV (14 Jul 2026).
2
Listed NBFC discloses ransomware; Blacknevas claims the intrusion
Abans Financial Services told the BSE on 2 July 2026 that a ransomware attack had hit the IT infrastructure of its overseas subsidiaries, following a CERT-In alert around 30 June 2026; the company said its domestic systems were unaffected and operations continued without disruption. The Blacknevas ransomware group listed Abans Group and Abans Finserv on its leak site around 29 June 2026, a claim, not yet independently confirmed responsibility.
India exposuregroup entities with overseas subsidiaries sharing IT/vendor links back to the Indian parent.
Actionverify subsidiary network segmentation and confirm no shared credentials or trust relationships reach domestic systems.
CitrixBleed 2 keeps feeding ransomware via NetScaler
CVE-2025-5777 (CVSS 9.3) harvests NetScaler heap memory for live session cookies, letting attackers replay authenticated sessions and bypass MFA entirely. Huntress tracked roughly six unrelated intrusions between January and June 2026 using a consistent chain. Post-compromise, rogue admin accounts (ctxsvc, CtxAppVCOMService) and ScreenConnect/Zoho Assist installers calling out to attacker infrastructure preceded DragonForce ransomware deployment. Huntress assesses an initial-access broker, not a single named group, is selling this access.
India exposureIndian BFSI running NetScaler as Gateway or AAA virtual servers for VPN or application access.
Actionpatch, then terminate and re-issue all active sessions. A patch alone does not invalidate already-stolen tokens.
SourceHuntress (9 Jul 2026); IT Security Guru (9 Jul 2026).
4
RedHook Android RAT resurfaces with silent, no-root device takeover
Group-IB documented an upgraded RedHook that abuses Android's Wireless Debugging (ADB) feature alongside Shizuku-derived code to grant itself system-level privileges without user prompts, then streams the screen, intercepts input and automates on-device actions across 53 attacker commands. Current campaigns target Vietnam and Indonesia via fake bank or government calls steering victims to lookalike Play Store pages. India is not reported as targeted yet, but the technique directly threatens SMS/OTP-based UPI authentication wherever it spreads next.
India exposuremobile-banking and UPI customers if the campaign expands regionally.
Actionbrief fraud teams now on ADB-abuse indicators; block sideloaded APKs from non-store sources at the MDM/EMM layer.
- Identity infrastructure under active attack: Microsoft's July 2026 Patch Tuesday included CVE-2026-56164 (SharePoint Server, unauthenticated privilege elevation used toward RCE and IIS machine-key theft) and CVE-2026-56155 (AD FS, a Distributed Key Management ACL flaw allowing local privilege escalation to the token-signing certificate), both added to CISA KEV on 14 July 2026. AD FS underpins federated identity for many bank single-sign-on estates; SharePoint on-prem often hosts audit evidence and board materials. Source (with date): Microsoft MSRC; CISA KEV (14 Jul 2026). - FortiSandbox command injection, CVSS 9.1: CVE-2026-39808 and CVE-2026-25089 (also affecting FortiSandbox Cloud/PaaS) allow unauthenticated OS command execution via crafted HTTP requests; CISA added both to KEV on 16 July 2026. Relevant wherever FortiSandbox sits inline with mail gateways or malware-analysis pipelines in a bank SOC. Source (with date): Fortinet PSIRT (FG-IR-26-100); CISA KEV (16 Jul 2026). - One compromised MSP, 28 financial victims: Qilin ransomware used standing privileged access from a single South Korean MSP, GJTec, to move into 28 asset-management and financial firms in three waves between September and October 2025, exfiltrating over 1 million files and 2TB of data. Black Kite's 2026 Financial Services report cites the case as the model for fourth-party concentration risk, the same MSP-dependency pattern common in Indian BFSI vendor ecosystems. Source (with date): Bitdefender; The Hacker News (27 Nov 2025).
4. Regulatory & compliance watch
- SEBI CSCRF cyber-audit cycle: Qualified and Mid-size SEBI-regulated entities (brokers, MIIs, capital-market arms of banks) had a 30 June 2026 deadline for half-yearly cyber-audit-report submission; entities not yet compliant risk daily penalties in the Rs 1,500-5,000 range plus exchange action. Source (with date): NSE/NSDL CSCRF circular summaries (2026). - IRDAI Information & Cyber Security Guidelines, 2026: effective from the current financial year for insurers, foreign reinsurance branches and intermediaries; the CISO can no longer report to the IT head or carry business targets, and a new IT Strategy Committee must oversee cybersecurity decisions. Non-compliance carries penalties reported in the Rs 10 lakh-1 crore per-violation range. Source (with date): IRDAI circular, 6 Apr 2026, as reported by TaxGuru and Security Boulevard. - RBI's supervisory signal: naming AI-enabled cyber threats the top expected risk in the June 2026 Financial Stability Report puts examiners on notice to probe AI-specific controls at the next inspection cycle, not just legacy ransomware/phishing readiness. Source (with date): Reserve Bank of India Financial Stability Report (Jun 2026); Business Standard (1 Jul 2026).
Volexity has not linked this actor to any known group. Its post-exploitation discipline (root-level implants, encrypted webshell access gated on a specific user-agent string, credential harvesting for lateral movement) reads to researchers as closer to state-sponsored tradecraft than opportunistic crime. No confirmed Indian victim has been named publicly, but SMA1000 is a standard remote-access appliance in Indian BFSI estates, making the exposure real regardless of who is behind the keyboard.
Confidence: MEDIUM on the more APT-like than criminal assessment (Volexity's own hedge)
Source (with date): Volexity (17 Jul 2026).
6. IOC pack
Only public, attributed indicators; no leaked data reproduced, no MISP references.
Board: Ask for a one-page status covering SonicWall/NetScaler/FortiSandbox KEV exposure, the SEBI CSCRF audit submission status, and IRDAI governance-structure compliance (CISO reporting line, ITSC formation) where applicable.
CISO: Patch SMA1000, NetScaler, FortiSandbox, SharePoint and AD FS on an emergency basis; on NetScaler, terminate and re-issue all active sessions post-patch, not just apply the update; run a fourth-party/MSP access review modelled on the Qilin-GJTec pattern; confirm overseas-subsidiary network segmentation following the Abans disclosure.
SOC: Hunt SMA1000 logs from 22 June 2026 for /wsproxy anomalies and the KNUCKLEBALL/suo5/ORANGETAIL indicators; check NetScaler for the named rogue accounts and relay domains; monitor mobile fraud telemetry for ADB-wireless-debugging abuse patterns consistent with RedHook; watch AD FS DKM container ACLs for unauthorized changes.
8. Source index
Volexity · Help Net Security · CISA KEV · BSE disclosure coverage · ransomware.live · Huntress · IT Security Guru · Group-IB · BleepingComputer · Microsoft MSRC · Fortinet PSIRT · Bitdefender · The Hacker News · Reserve Bank of India (Financial Stability Report) · Business Standard · NSE/NSDL (SEBI CSCRF circular summaries) · IRDAI · TaxGuru · Security Boulevard.
