simplysecuregroup.com • 6h
Commerzbank $30M Supply Chain Fraud via Service Provider Exploitation
In November 2023, an international cybercrime syndicate executed a four-day fraud campaign resulting in a $30 million loss for Commerzbank customers. The attackers bypassed primary banking controls by exploiting vulnerabilities—specifically API insecurities or broken access controls—within a trusted third-party service provider's infrastructure. By pivoting from the service provider to the banking transaction layer, the syndicate implemented rapid-fire withdrawal logic to exfiltrate funds within a 96-hour window. The campaign culminated in "Operation First Light," a coordinated effort by the BKA, Brazilian Federal Police, and Interpol, leading to seven arrests across Germany and Brazil.