The build-your-own bank cyberattack: what the underground market has to offer

Intel 471 released a report on threats to the financial sector. The overall picture is as follows: from January 2025 through June 2026, the company recorded 340 victims of ransomware groups in 74 countries and 562 claimed DDoS attacks by hacktivists against financial organizations. Meanwhile, the average cost of a data breach in the financial sector rose to $6.29 million in 2026, compared with $5.56 million the previous year.

The report also mentions statistics and groups that may have appeared earlier in this feed. More interestingly, Intel 471 specializes in monitoring underground platforms and provides examples of which components of an attack can already be purchased as a service.

Access to infrastructure From January 2025 through June 2026, initial access brokers listed access to 159 financial-sector organizations for sale. The offerings varied widely, from simple VPN credentials to administrative access to internal infrastructure. For example, one seller claimed to have access to an insurance company's hypervisor, two NAS devices, and approximately 11 TB of backups.

An insider at the organization Intel 471 observed both criminals looking for insiders and employees offering their services or already involved in criminal schemes. One seller offered to retrieve PayPal user data through employees for $400. Another listing sought an employee of a European financial organization with access to customer databases, offering to split the proceeds from attacks 50-50.

Know Your Customer bypass There is a separate market for this service as well: forged documents, ready-made identities, deepfakes, tools for spoofing a camera video feed such as Verifus, mule services, and already verified accounts. Many of these tools are offered as subscription services, so customers do not need deep technical expertise.

Payment card data Underground payment-card marketplaces are increasingly coming to resemble mainstream marketplaces. WALMART CC offered approximately 93,000 payment-card records with filtering, seller ratings, and 24/7 support, while OceanMarket offered more than 100,000 records searchable by bank, country, BIN, and card type.

Financial cybercrime increasingly operates on the principle of division of labor. Access to infrastructure, an insider, someone else's identity, or payment data can be obtained from different suppliers and combined into a single attack. That is why it is becoming increasingly important for banks to have visibility into what happens beyond their own networks — on underground platforms, among contractors, and around customers' digital identities.