VORANT. Threat Intelligence Sign in Get the full feed

BlackX ransomware claims FE Credit breach

elevated threat financial-services

Ransomware group BlackX lists Vietnamese lender FE Credit as a victim on its leak site, per ransomware.live tracking.

The source is a ransomware.live victim-tracking entry rather than a full technical report. It records that a ransomware group operating under the name "Black X" has listed FE Credit (a consumer finance company, likely VPBank FE Credit in Vietnam) as a victim on its data-leak site. The entry includes aggregate statistics apparently sourced from Hudson Rock's infostealer intelligence platform: 1,002 compromised employee credentials, 3,423 compromised user credentials, 480 third-party employee credentials, and 192 external attack-surface findings associated with the victim's domain, suggesting infostealer-derived credential exposure may have contributed to initial access or been used to enrich the leak-site posting.

No technical indicators, exploited CVEs, malware samples, or TTP details are provided in this record — it functions purely as a victim notification/tracking entry. Defenders at FE Credit or affiliated financial institutions should treat this as an indicator that credential exposure (via infostealer logs) may be present in their environment and should prioritize credential resets, monitoring for anomalous authentication from leaked accounts, and reviewing third-party/vendor access given the noted third-party credential exposure.

Mentioned in this report

Threat actors Black X

Detection guidance

Suspicious Authentication from Known Infostealer Credential

ATT&CK T1078

Detects authentication attempts using credentials previously exposed in infostealer logs or data breaches, identified through credential intelligence feeds or post-breach monitoring. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Suspicious Authentication from Known Infostealer Credential
description: Detects logon events using credentials that have been compromised and
  tracked in infostealer intelligence platforms or breach databases. Monitors for
  use of exposed employee or user credentials post-breach notification.
tags:
- attack.initial-access
- attack.t1078
logsource:
  category: authentication
  product: windows
detection:
  selection:
    EventID: 4624
    LogonType:
    - 2
    - 3
    - 10
  filter_system_accounts:
    User|contains:
    - $
    - SYSTEM
    - LOCAL SERVICE
    - NETWORK SERVICE
  condition: selection and not filter_system_accounts
falsepositives:
- Legitimate users authenticating after credential resets
- Automated system processes using service accounts
level: medium
id: 38beddf2-7bfb-572c-b44e-682ae6ee2821
status: experimental
author: Vorant

Anomalous Third-Party or Vendor Account Authentication

ATT&CK T1078

Detects authentication events from third-party employee or vendor accounts that show unusual patterns (time-of-day, source IP, geographic anomaly) consistent with credential compromise exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

title: Anomalous Third-Party or Vendor Account Authentication
description: Detects logon events from third-party or vendor accounts (identified
  by naming convention or group membership) exhibiting behavioural anomalies such
  as off-hours access, unusual source IPs, or geographic inconsistencies.
tags:
- attack.initial-access
- attack.t1078
logsource:
  category: authentication
  product: windows
detection:
  selection_thirdparty:
    User|contains:
    - vendor
    - contractor
    - partner
    - external
    LogonType:
    - 3
    - 10
  selection_anomaly:
    EventID: 4624
  filter_legitimate_hours:
    EventTime|re: 09:00:00|10:00:00|11:00:00|12:00:00|13:00:00|14:00:00|15:00:00|16:00:00|17:00:00
  condition: selection_thirdparty and selection_anomaly and not filter_legitimate_hours
falsepositives:
- Legitimate vendor support accessing systems outside standard business hours
- Third-party contractors with pre-approved off-hours access
level: medium
id: 34314a09-35ee-5c55-8164-f1d11abf107a
status: experimental
author: Vorant

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://www.ransomware.live/id/RkUgQ1JFRElUQEJsYWNrIFg=

This is the public brief

Subscribers see the full picture: extracted IOCs, ready-to-deploy detections (Sigma, Splunk, KQL, Elastic, YARA, Suricata), the entity graph, TAXII 2.1 feed and real-time alerts matched to your sectors.

Start free