Bank of Baroda employee email compromised

One of India’s largest public-sector banks, Bank of Baroda, has confirmed a cybersecurity incident after a threat actor claimed to have stolen and published sensitive banking data. The bank said Monday that an employee’s email account was compromised, giving unauthorized access to “certain data.”

The bank said it detected and contained the incident immediately. Core banking systems were not accessed or affected, it added. An investigation is ongoing.

The disclosure follows claims last week by multiple cybersecurity researchers tracking dark web activity. An unidentified hacker breached the bank and leaked what it described as customer information, corporate banking records, internal emails, loan documents and audit files on a darknet forum.

The authenticity of the leaked data could not be independently verified. Bank of Baroda did not comment on the hackers’ claims or say whether any customer data was exfiltrated. It also did not attribute the incident to any specific hacking group.

Researchers said the threat actor, operating under the name “leak-king-F,” advertised the data for sale on a popular darknet marketplace and directed prospective buyers to a Telegram channel.

What was stolen in the Bank of Baroda cyber incident?

The hacker claims to have stolen a trove of sensitive data. The leaked files allegedly include customer information, corporate banking records, internal emails, loan documents and audit files. If confirmed, this would be one of the most significant data breaches at an Indian bank in recent years.

However, the bank’s statement suggests the breach was limited to an email account. That could mean the data accessed was not from core banking databases but from communications and attachments stored in the compromised mailbox.

Still, the potential for customer data exposure is serious. Email accounts often contain sensitive information exchanged with clients, partners and regulators.

leak-king-F: the hacker behind the attack

The threat actor calling themselves “leak-king-F” posted the stolen data on a darknet forum. They advertised it for sale and directed interested buyers to a Telegram channel. The group has not made any ransom demands public, unlike other extortion gangs active in the region.

This is not the first time a hacker has targeted a major Indian financial institution. In 2023, a ransomware attack on a state-owned bank disrupted services for days. But the Bank of Baroda incident stands out because of the volume and sensitivity of the data allegedly stolen.

Researchers are still analyzing the leaked files to verify their authenticity. The bank has not confirmed which specific data was accessed.

Financial institutions under siege across Asia

The Bank of Baroda cyber incident is the latest in a string of attacks on financial institutions across Asia. Last week, Thailand’s Securities and Exchange Commission launched an investigation into a data breach at the Thailand Securities Depository (TSD). Hackers claimed to have stolen investor information after compromising an investor portal.

Trading, settlement and depository systems were not affected, TSD said. But the breach exposed customer data and raised concerns about the security of financial infrastructure in the region.

Earlier this month, the ransomware and extortion group World Leaks published thousands of files it claimed were stolen from contractors working on India’s largest nuclear power project. India’s state-owned nuclear operator said the documents contained no information affecting the safety or security of the plant. The files appeared to originate from a third-party company building conventional infrastructure for new reactors.

World Leaks also claimed responsibility for an attack on Tata Electronics, a key supplier to Apple, Tesla and Qualcomm. The group demanded a $1.5 million ransom before publishing what it said were confidential engineering documents. Tata Electronics allegedly refused to negotiate.

What Bank of Baroda customers should do now

If you are a Bank of Baroda customer, here are a few steps to protect yourself:

• Monitor your account statements for unauthorized transactions.
• Change your online banking passwords and enable two-factor authentication.
• Be cautious of phishing emails that may reference the breach.
• Contact the bank’s customer service if you notice anything suspicious.

The bank has not reported any unauthorized transactions from customer accounts yet. But vigilance is always wise after a breach.

Lessons from the Bank of Baroda cyber incident

This incident highlights a critical vulnerability: employee email accounts. Even if core banking systems are secure, a compromised email can leak sensitive data. Financial institutions must invest in email security, including multi-factor authentication, encryption and employee training.

It also shows how quickly hackers can weaponize stolen data. The files were posted on a darknet forum within days of the breach. That leaves little time for the bank to respond or notify affected customers.

Regulators in India and across Asia will likely scrutinize the incident closely. If customer data was indeed stolen, Bank of Baroda could face fines and reputational damage.

The investigation is ongoing. For now, the bank says its core systems are safe. But the full extent of the damage may not be known for weeks.

How a Rookie Researcher and AI Found a Kernel Hole

A security researcher armed with artificial intelligence has uncovered a years-old Linux kernel 0-Day in the net/sched subsystem. The flaw, disclosed on July 27, lets a local attacker escalate privileges all the way to root.

Lee Jia Jie, from Singapore-based offensive security firm STAR Labs, found the bug during his internship. It was his first real dive into Linux kernel work. The vulnerability is now tracked as CVE-2026-53264.

The issue? A race condition in net/sched — the code that decides when and how network packets get transmitted. One function reads entries under a Read-Copy-Update (RCU) lock. Another path frees an entry without waiting for the RCU grace period. That gap creates a window where the kernel keeps using an object after its memory has been released. A classic use-after-free.

To pull off the exploit, an attacker needs unprivileged user namespaces and two specific kernel options turned on. Jia Jie tested his proof of concept on a CentOS Stream 9 desktop.

AI Did the Heavy Lifting — But Not All of It

Jia Jie didn’t just stumble on the bug. He used AI to identify the problem, produce a crash proof, and improve the reliability of triggering the race. The results are striking: optimization cut the time needed to hit the condition from more than 15 minutes down to about five seconds.

This follows other AI-assisted security work, like Google’s OSS-Fuzz project, which has used AI to expose hidden flaws in open-source software. But Jia Jie’s findings also highlight the limits of automation.

He noted that AI still shows blind spots and reasoning failures. Detailed subsystem knowledge, he concluded, remains critical for finding weaknesses that automated systems miss. The AI found the bug fast — but it didn’t understand why it mattered.

TyphoonPwn 2026: A Competition Miss and a Surprise

Jia Jie prepared his exploit for TyphoonPwn 2026’s Linux local privilege escalation category. The prize pool was generous: $70,000 for first, $35,000 for second, $17,500 for third. He drew position eight out of 11 competitors. But the category closed after three winners were announced, so his entry was never demonstrated.

Here’s the twist: KyleBot, an AI system, had independently reported the same bug two days before the competition started. Jia Jie said the defect had existed for two to three years. He described this as evidence that AI can make zero-day work feel more like n-day analysis — the bug was old enough that automated tools could catch it.

More Than One Hole: Perf Events Flaws Found

Jia Jie also reported two exploitable flaws in the perf events subsystem. One got the identifier CVE-2026-64300. These issues were reachable on Intel bare-metal systems under a permissive performance-monitoring setting. They affected RHEL-based and Arch systems, but not Debian-based distributions. Jia Jie noted they were mainly relevant to desktop Linux.

Both flaws could be exploited for privilege escalation, though the attack surface is narrower than the net/sched bug.

Patch Released: What Linux Users Should Do

The good news: CVE-2026-53264 has been patched upstream. The fix defers freeing the affected object until after the RCU grace period, closing the use-after-free window entirely.

Linux users and administrators should obtain fixed kernels through their distribution’s security update channels. If you’re running CentOS Stream, RHEL, or a distro that pulls from the mainline kernel, update now. The patch is also likely backported to stable kernels.

This incident shows that AI-assisted bug hunting is real and growing. But it also proves that human intuition — knowing where to look and why — still matters. The best results come from pairing both.

EDR-Kill Is No Longer a Niche Trick

Shutting down endpoint detection and response (EDR) tools before deploying ransomware has moved from a specialist capability to standard operating procedure. That’s the headline finding from Halcyon‘s Q2 2026 Ransomware Evolution Report, published July 27.

The practice — often called EDR kill techniques — is now baked into the attack chains of most major ransomware groups. Researchers at Halcyon say this leaves defenders with even less time to spot and contain an intrusion. The window between initial access and encryption keeps shrinking.

One group, The Gentlemen, has made EDR and antivirus shutdown a core part of its playbook. That group has quickly become one of the most prolific ransomware threats around.

How The Gentlemen Builds Its Arsenal

Halcyon’s Ransomware Research Center previously documented how The Gentlemen’s developers reverse-engineer ransomware code from other gangs. They systematically pull apart samples from Babuk, Qilin, LockBit 5.0 and Medusa. The goal? Cherry-pick the strongest encryption routines, best code-obfuscation tricks and most effective EDR evasion methods.

It’s a modular, mix-and-match approach to building ransomware. The Gentlemen doesn’t start from scratch. It assembles a custom toolkit from proven components. That makes its attacks harder to predict and harder to block.

Attack Numbers Are Down — But Don’t Celebrate

Halcyon recorded 1,988 publicly claimed ransomware attacks in Q2 2026, carried out by 89 active groups across 101 countries. That’s a 5.7% drop quarter-on-quarter. Sounds like good news, right?

Not really. The underlying tactics got significantly more advanced. Halcyon describes a “shift towards faster, more automated and harder-to-detect operations.” Fewer attacks, but each one is more dangerous.

The top groups by claim count were:

• Qilin — 293 claims
• The Gentlemen — 214 claims
• DragonForce — 143 claims
• Akira — 119 claims
• LockBit 5.0 — 102 claims

DragonForce and LockBit 5.0 both ramped up activity in Q2. The Gentlemen overtook Qilin for the top spot in June alone. Several new or returning groups also surfaced: KryBit, Payload, PEAR and World Leaks.

Manufacturing Takes the Biggest Hit

Manufacturing was the most targeted sector, accounting for 19.8% of all cyber extortion attacks. Construction came second, followed by business services, retail and software.

Attackers are also exploiting vulnerabilities in enterprise edge devices at scale. The most abused flaws during Q2 included Citrix NetScaler ADC and Gateway (CVE-2025-5777), SonicWall SSL VPN (CVE-2024-40766) and Fortinet‘s FortiOS (CVE-2024-55591).

Some groups — DragonForce and Akira among them — moved from initial breach to ransomware deployment in under an hour in certain attacks. That’s terrifyingly fast.

AI Is Moving From Experiment to Operations

Halcyon’s report found that AI is no longer just a toy for ransomware groups. It’s being operationalized across the attack chain. Threat actors are using malware disguised as fake AI productivity tools, AI-assisted victim negotiations, and what researchers believe is the first agentic ransomware — capable of autonomously conducting key stages of an intrusion.

One example: the LLM-developed malware EvilAI. It masquerades as AI productivity apps while secretly providing ransomware actors with initial access.

Ross Asquith, solutions engineering director for Europe at Halcyon, put it bluntly: “The democratization of EDR-kill techniques and the generalization of the use of AI in ransomware attack chains show that the ransomware ecosystem is becoming faster, more automated and far more effective at neutralizing the security tools organizations rely on.”

His advice to defenders: focus on cyber resilience. “No longer assume traditional controls will buy them the time they need to respond.”

Ransomware as a Cover for State Operations

The report also flagged a troubling trend: growing evidence of ransomware being used to support state objectives. Iran-linked actors, in particular, are increasingly disguising espionage campaigns as criminal ransomware operations. It’s a convenient cover — and one that blurs the line between cybercrime and cyberwar even further.

For defenders, the takeaway is clear. The old playbook — detect, contain, respond — is breaking. Attackers have automated EDR-kill, accelerated their timelines and started using AI. Defenders need to rethink their assumptions about how much time they actually have.