Crédit Mutuel Arkéa $133 Million Heist: Third-Party Service Provider Compromise — Detection & Hardening Guide for Financial Institutions

---
title: Suspicious Third-Party Service Provider Authentication Outside Business Hours
id: 8a2f4c91-3b7d-4e5a-9f1c-2d8e6a4b5c7d
status: experimental
description: Detects authentication events from known third-party service provider accounts or systems occurring outside of approved maintenance windows or business hours. This may indicate compromised vendor credentials being used to access banking systems.
references:
  - https://attack.mitre.org/techniques/T1078/
  - https://attack.mitre.org/techniques/T1199/
author: Security Arsenal
date: 2026/04/30
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1078
  - attack.t1199
logsource:
  category: authentication
  product: windows
detection:
  selection:
    TargetUserName|contains:
      - 'svc_'
      - 'vendor_'
      - 'thirdparty_'
      - 'partner_'
    LogonType:
      - 3
      - 10
  filter_business_hours:
    - field: EventTime
      type: time_range
      start: '08:00'
      end: '18:00'
      timezone: 'UTC'
  condition: selection and not filter_business_hours
falsepositives:
  - Legitimate after-hours maintenance by service providers
  - Automated batch jobs running outside business hours
level: high
---
title: Large-Value Financial Transaction Initiated from Non-Standard Workstation
id: 4b1e7d3a-9c2f-4a8b-b6d5-1e3f7a9c2d4e
status: experimental
description: Detects initiation of high-value financial transactions (wire transfers, SWIFT messages, payment batches) from workstations or servers that do not normally perform such operations. This may indicate attackers using compromised vendor access to execute fraudulent transactions.
references:
  - https://attack.mitre.org/techniques/T1059/
  - https://attack.mitre.org/techniques/T1021/
author: Security Arsenal
date: 2026/04/30
tags:
  - attack.execution
  - attack.lateral_movement
  - attack.t1021
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'swift'
      - 'wire_transfer'
      - 'payment_batch'
      - 'ach_upload'
      - 'finacle'
      - 'temenos'
  filter_known_systems:
    Image|endswith:
      - '\\known_payment_server_01\\*'
      - '\\known_payment_server_02\\*'
  condition: selection and not filter_known_systems
falsepositives:
  - New payment processing systems not yet added to the allowlist
  - Emergency payment operations from backup systems
level: critical
---
title: Credential Dumping Activity on Systems with Banking Application Connectivity
id: 7c3a9f2e-5d1b-4e8a-a3c6-9b2d4f7e1a5c
status: experimental
description: Detects execution of credential dumping tools (Mimikatz, ProcDump targeting LSASS, comsvcs.dll abuse) on systems that have established network connections to banking application servers or SWIFT infrastructure.
references:
  - https://attack.mitre.org/techniques/T1003/
author: Security Arsenal
date: 2026/04/30
tags:
  - attack.credential_access
  - attack.t1003.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'sekurlsa::'
      - 'lsadump::'
      - 'procdump'
      - 'comsvcs.dll'
      - 'MiniDump'
      - 'lsass'
  condition: selection
falsepositives:
  - Legitimate memory dump operations by administrators
  - EDR or forensic tools performing memory analysis
level: critical

// Hunt 1: Service provider accounts authenticating outside normal patterns
SecurityEvent
| where EventID == 4624
| where LogonType in (3, 10)
| where TargetUserName has_any ("svc_", "vendor_", "thirdparty_", "partner_")
| extend Hour = datetime_part("hour", TimeGenerated)
| where Hour < 8 or Hour > 18
| summarize Count = count(), DistinctSources = dcount(IpAddress), DistinctTargets = dcount(Computer) by TargetUserName, IpAddress, Computer, bin(TimeGenerated, 1h)
| where Count > 5 or DistinctTargets > 3
| project TimeGenerated, TargetUserName, IpAddress, Computer, Count, DistinctSources, DistinctTargets
| order by TimeGenerated desc

// Hunt 2: Process execution related to payment or SWIFT systems from unusual hosts
DeviceProcessEvents
| where ProcessCommandLine has_any ("swift", "wire_transfer", "payment_batch", "ach_upload")
| join kind=leftanti (
    DeviceInfo
    | where DeviceName has_any ("payment-srv-01", "payment-srv-02", "swift-gateway")
    | summarize by DeviceId
) on DeviceId
| project TimeGenerated, DeviceName, AccountName, ProcessCommandLine, FileName, FolderPath, SHA256
| order by TimeGenerated desc

// Hunt 3: Network connections to banking infrastructure from non-standard source IPs
DeviceNetworkEvents
| where RemotePort in (443, 8443, 22, 3389)
| where RemoteUrl has_any ("swift", "banking", "payment", "core-banking")
| join kind=leftanti (
    DeviceNetworkEvents
    | where TimeGenerated > ago(30d)
    | where RemoteUrl has_any ("swift", "banking", "payment", "core-banking")
    | summarize by LocalIP
) on LocalIP
| project TimeGenerated, DeviceName, LocalIP, RemoteIP, RemoteUrl, RemotePort, InitiatingProcessAccountName
| order by TimeGenerated desc

-- Hunt for credential dumping artifacts and suspicious processes on banking-connected systems
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime,
       hash(path=Exe) as ExeHash
FROM pslist()
WHERE CommandLine =~ 'sekurlsa|lsadump|procdump|comsvcs|MiniDump|lsass'
   OR Name =~ 'mimikatz|procdump|nanodump|dumpert'
ORDER BY CreateTime DESC

-- Hunt for recently executed processes with payment or SWIFT-related names
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ 'swift|payment|wire|ach|finacle|temenos'
   OR CommandLine =~ 'swift|payment_batch|wire_transfer|ach_upload'
ORDER BY CreateTime DESC

-- Check for suspicious scheduled tasks or services (persistence)
SELECT Name, CommandLine, Path, User, Schedule
FROM Windows.System.TaskScheduler.Tasks()
WHERE CommandLine =~ 'powershell|cmd|wscript|cscript|rundll32'
  AND NOT Path =~ 'Microsoft|Windows|Adobe|Google|Mozilla'
ORDER BY Name

# Audit and harden third-party service provider accounts
# Run as Domain Admin or equivalent privileged account

Import-Module ActiveDirectory

# 1. Identify all service accounts with "svc_", "vendor_", or "thirdparty_" prefixes
Write-Host "[*] Identifying third-party service accounts..." -ForegroundColor Cyan
$ThirdPartyAccounts = Get-ADUser -Filter {Name -like "svc_*" -or Name -like "vendor_*" -or Name -like "thirdparty_*"} -Properties LastLogonDate, PasswordLastSet, Enabled, MemberOf

# 2. Flag accounts that haven't logged in for 90+ days
Write-Host "[*] Checking for dormant accounts (90+ days)..." -ForegroundColor Cyan
$DormantAccounts = $ThirdPartyAccounts | Where-Object {$_.LastLogonDate -lt (Get-Date).AddDays(-90) -and $_.Enabled -eq $true}
if ($DormantAccounts) {
    Write-Host "[!] Found $($DormantAccounts.Count) dormant third-party accounts:" -ForegroundColor Yellow
    $DormantAccounts | Format-Table Name, LastLogonDate, Enabled
    
    # Optionally disable dormant accounts (uncomment to execute)
    # $DormantAccounts | Disable-ADAccount
    # Write-Host "[+] Dormant accounts disabled." -ForegroundColor Green
}

# 3. Flag accounts with passwords older than 180 days
Write-Host "[*] Checking for stale passwords (180+ days)..." -ForegroundColor Cyan
$StalePasswords = $ThirdPartyAccounts | Where-Object {$_.PasswordLastSet -lt (Get-Date).AddDays(-180)}
if ($StalePasswords) {
    Write-Host "[!] Found $($StalePasswords.Count) accounts with stale passwords:" -ForegroundColor Yellow
    $StalePasswords | Format-Table Name, PasswordLastSet
}

# 4. Audit privileged group membership
Write-Host "[*] Auditing privileged group membership..." -ForegroundColor Cyan
$PrivilegedGroups = @("Domain Admins", "Enterprise Admins", "Administrators", "Account Operators")
foreach ($Group in $PrivilegedGroups) {
    $Members = Get-ADGroupMember -Identity $Group -ErrorAction SilentlyContinue
    $ThirdPartyMembers = $Members | Where-Object {$_.Name -like "svc_*" -or $_.Name -like "vendor_*" -or $_.Name -like "thirdparty_*"}
    if ($ThirdPartyMembers) {
        Write-Host "[!] Third-party accounts in privileged group '$Group':" -ForegroundColor Red
        $ThirdPartyMembers | Format-Table Name, SamAccountName
    }
}

# 5. Enforce password rotation for active third-party accounts
Write-Host "[*] Forcing password change at next logon for active third-party accounts..." -ForegroundColor Cyan
$ActiveAccounts = $ThirdPartyAccounts | Where-Object {$_.Enabled -eq $true -and $_.LastLogonDate -gt (Get-Date).AddDays(-30)}
foreach ($Account in $ActiveAccounts) {
    Set-ADUser -Identity $Account.SamAccountName -ChangePasswordAtLogon $true
    Write-Host "[+] Password change enforced for: $($Account.SamAccountName)" -ForegroundColor Green
}

# 6. Generate report
$ReportPath = "C:\Temp\ThirdPartyAccountAudit_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
$ThirdPartyAccounts | Select-Object Name, SamAccountName, Enabled, LastLogonDate, PasswordLastSet, @{Name="MemberOf";Expression={($_.MemberOf | ForEach-Object {(Get-ADGroup $_).Name}) -join "; "}} | Export-Csv -Path $ReportPath -NoTypeInformation
Write-Host "[+] Audit report saved to: $ReportPath" -ForegroundColor Green

Write-Host "[*] Audit complete. Review findings and take appropriate action." -ForegroundColor Cyan