Client Login
Select a platform below to log in
vCISO Cybersecurity Intelligence Brief: August 2026
Executive Summary
This month’s brief addresses the August Microsoft Patch Tuesday release (400+ vulnerabilities including a zero-day being exploited by North Korean state-sponsored attackers), the Akira ransomware group’s ongoing campaign against SonicWall firewalls that has hit dozens of financial institutions, the accelerating threat of deepfake voice and video fraud targeting bank executives and finance staff, and a Picus Security report showing financial institutions’ defensive posture dropped 9 points year-over-year.
We provide staff training on verifying high-value requests in the age of AI-generated impersonation, and outline best practices leadership and IT teams can use together to strengthen defenses.
40%
of BEC Attacks Now Involve
AI-Generated Deepfake Content
73%
of Ransomware Attacks Now
Start at a VPN Appliance
67%
The following threats have been identified as having significant relevance to community banks, credit unions, and savings institutions during the current reporting period.of FIs Have Exposure to a
Vendor-Related Breach
Emerging Threat Landscape
The following threats have been identified as having significant relevance to community banks, credit unions, and savings institutions during the current reporting period.
CRITICAL: Microsoft Patch Tuesday Zero-Day Being Exploited by Nation-State Attackers
On August 12, Microsoft released security updates for over 400 vulnerabilities, including one flaw that was already being exploited when the patch was released—meaning attackers were using it before institutions had a chance to protect themselves. Security researchers at Check Point identified North Korean state-sponsored attackers as one of the groups exploiting this flaw as part of the long-running “Operation Dream Job” campaign, which specifically targets financial and technology organizations. CISA added the flaw to its Known Exploited Vulnerabilities catalog and required federal agencies to patch it by August 25.
The vulnerability allows an attacker who has already gained a foothold on a Windows computer to elevate their access to the highest system level. In practical terms, this converts a small compromise (like a single employee’s workstation) into full control of the institution’s network.
What this means for your institution: Every institution running Windows systems needs to apply this month’s updates urgently. The nation-state involvement makes this a higher-priority patch than a typical monthly release. Because the flaw requires an attacker to already have some access, it is often used in combination with other attacks (like phishing) to expand a small compromise into a major breach.
For Leadership: Ask your IT team or TSP for confirmation that the August 12 Patch Tuesday updates have been applied across all Windows systems, with priority on CVE-2026-68820. Ask specifically whether the CISA August 25 deadline was met. Document the response in your risk register and reference it in your next Board update on cybersecurity.
For IT/Operations: Prioritize CVE-2026-68820 (WinSock AFD elevation of privilege, actively exploited, on CISA KEV catalog). Also address CVE-2026-62832 (Windows User Profile Service, publicly disclosed, “Exploitation More Likely”) and CVE-2026-72971 (Windows Container Isolation FS Filter, publicly disclosed). Review 42 additional Critical rated flaws including RCE bugs in Windows DNS server (CVE-2026-62878), Windows Deployment Services TFTP (CVE-2026-62893), Microsoft QUIC (CVE-2026-62815), Exchange Server EoP (CVE-2026-62911), and Microsoft HPC Pack (CVE-2026-59124). Document patch timing for examination evidence.
CRITICAL: Akira Ransomware Continues to Exploit SonicWall Firewalls at Scale
The Akira ransomware group—the second-most-active ransomware operation globally in 2026, behind only Qilin—has continued its aggressive campaign against SonicWall firewalls that began in July 2025. The group specifically targets community banks, credit unions, and other small-to-medium financial institutions. According to At-Bay’s 2026 InsurSec Report, SonicWall firewalls appear in 86% of Akira’s confirmed breaches, and 73% of all ransomware attacks in 2025 began at a VPN appliance. Between April 2024 and April 2025, Akira attacked 34 financial organizations.
The attacks exploit a SonicWall flaw (CVE-2024-40766) originally disclosed in August 2024, along with configuration errors. Even institutions that patched the original flaw remain vulnerable if the associated credential resets were not completed. In September 2025, SonicWall also disclosed a separate breach of its MySonicWall.com cloud backup service, which may have exposed firewall configuration files and credentials for customers using that service.
What this means for your institution: If your institution uses SonicWall firewalls—very common in community banks and credit unions—this is a direct and immediate threat. Average Akira ransom demands are now $1.2 million, and attacks progress from initial VPN access to full data encryption in as little as one hour. Even institutions with strong internal controls have been compromised because the attackers exploit the perimeter device directly.
For Leadership: Ask your IT team or TSP three specific questions: (1) Do we use SonicWall firewalls with SSL VPN enabled? (2) Was the CVE-2024-40766 patch applied AND were all local firewall and VPN credentials rotated as SonicWall required? (3) Are our SonicWall configuration backups stored in MySonicWall.com cloud service, and if so, were credentials rotated after the September 2025 disclosure? Document responses for your records and examination evidence.
For IT/Operations: Verify SonicOS is updated to 7.3.0+ (which includes brute-force mitigation improvements). Confirm all local firewall accounts, VPN accounts, LDAP service accounts, and AD credentials of VPN users have been rotated per SonicWall guidance. If MySonicWall.com cloud backups were used, follow SonicWall’s credential reset playbook. Enforce phishing-resistant MFA on all SSL VPN accounts. Review VPN authentication logs for anomalous geolocations. Reference CISA Advisory AA24-109A for current Akira IOCs and MITRE ATT&CK mappings. Consider whether Nutanix AHV and VMware ESXi environments are properly segmented—Akira encrypts these hypervisors.
HIGH: Deepfake Voice and Video Fraud Now in 40% of Business Email Compromise Attacks
Deepfake-enabled fraud has moved from a theoretical threat to a leading attack vector against financial institutions. The FBI’s 2025 Internet Crime Report logged 24,768 business email compromise (BEC) complaints totaling $3.05 billion in losses, with AI-assisted deepfake involvement growing from under 5% of incidents in 2023 to 40% of incidents in Q1 2026—an eight-fold increase in two years. In August 2026, the EU AI Act’s deepfake disclosure obligations came fully into force, and CISA/NCSC updated their joint advisory on synthetic media threats to corporate finance staff.
The attack pattern has evolved beyond email. Attackers now clone the voices of CEOs and CFOs (as little as three seconds of audio from a podcast, earnings call, or public speech is enough) and place phone calls to finance staff requesting urgent wire transfers. In one widely reported case, a finance worker at a multinational firm transferred $25 million after a video call where every participant—including the CFO and colleagues—was an AI-generated deepfake. The attack surface has moved into Teams, Zoom, WhatsApp, and Slack.
What this means for your institution: Financial institutions of every size are at risk. Community banks and credit unions are particularly exposed because their executives often make public appearances at community events, industry conferences, and on podcasts—providing ample training data for voice cloning. The typical warning signs (poor grammar, urgency) do not apply when the attacker sounds exactly like your CEO. This is now a business continuity and reputational risk, not just an IT issue.
For Leadership: Establish and document a code-word verification process for any high-value transaction requested by phone or video, no matter who appears to be requesting it. Update your incident response plan to include deepfake scenarios. Brief your Board and executive team specifically on this threat—they are the primary impersonation targets. Review your dual-authorization procedures for wires and ACH; consider whether they can withstand a call from a “trusted executive” instructing staff to bypass them. Include deepfake scenarios in your next tabletop exercise.
For IT/Operations: Deploy voice biometric authentication or liveness detection tools where available. Implement out-of-band verification workflows for high-value transactions (e.g., callback to a pre-registered number, not one provided by the caller). Consider Pindrop, McAfee Deepfake Detector, or similar tools for elevated-risk workflows. Review collaboration platform settings (Teams, Zoom) to restrict external participants in sensitive meetings. Update security awareness training to specifically cover synthetic media threats.
HIGH: Financial Sector Defensive Posture Dropped 9 Points Year-Over-Year
The Picus Blue Report 2026, released August 21, documented that the banking, financial services, and insurance sector’s attack prevention effectiveness fell from 76% in 2025 to 67% in 2026—a nine-point decline that represents one of the largest sector-wide security drops observed in the report’s history. Even more concerning: financial institutions logged 65% of simulated attacks in their monitoring tools, but generated alerts for only 16%. This means fewer than one in six attacks reached the security team as an actionable alert. The report attributes the decline to “configuration drift” and new attacker techniques that erode security controls that were once effective.
What this means for your institution: The financial services sector is not investing less in cybersecurity—the sector is spending more than ever. But controls that worked six or twelve months ago may not be effective against current attacker techniques. Regular validation of security controls is now as important as deploying them in the first place. Examiners are beginning to ask not just “do you have this control” but “have you tested that it still works?”
For Leadership: Ask your IT team when your institution last tested its security controls against realistic attack scenarios (not just penetration testing, which finds vulnerabilities, but attack simulation, which tests whether existing controls detect and stop attacks). If the answer is “never” or “over a year ago,” schedule this validation. Discuss with your Board whether your institution’s risk assessment reflects the reality that security controls degrade over time.
For IT/Operations: Implement continuous security control validation using breach and attack simulation tools or purple team exercises. Focus on validating the specific attack techniques currently used by ransomware groups targeting financial services (Akira, Qilin, DragonForce—see CISA advisories). Ensure your SIEM/EDR platform generates alerts (not just logs) for suspicious activity. Review alert triage workflows to ensure timely investigation. Establish a documented cadence for control validation aligned with your risk assessment updates
MEDIUM: Cyber Insurance Coverage Gaps Widening for Deepfake and Data-Theft Extortion
As attacker tactics evolve, cyber insurance coverage terms are struggling to keep pace. Recent industry reporting indicates that many cyber insurance policies contain exclusions or coverage limitations for social engineering losses (including deepfake-enabled BEC), pure data-theft extortion (where no encryption occurs), and losses stemming from vendor breaches. Some carriers now require specific security controls—phishing-resistant MFA, EDR deployment, offline backups, executive verification procedures—as conditions of coverage, and are actively denying claims where those controls were not in place at the time of the incident. Community banks and credit unions with policies from three or more years ago may have significantly different coverage than they assume.
What this means for your institution: Cyber insurance is not a substitute for security controls, and increasingly it is not a reliable recovery mechanism either without proactive review. Institutions that assume their coverage protects them may face uncovered losses. This is a governance issue as much as a security one—the Board and executive leadership need to understand exactly what is covered and what is not.
For Leadership: Schedule a policy review with your cyber insurance broker specifically to discuss coverage for: (1) social engineering and BEC, including deepfake-enabled attacks; (2) pure data-theft extortion (no encryption); (3) vendor-caused breaches and business interruption from vendor outages; (4) coverage conditions and warranties, including required security controls. Ask your broker for a written summary of coverage and exclusions. Bring this to your next Board risk committee meeting. Document any coverage gaps in your risk register.
For IT/Operations: Work with the risk management function to identify which security controls are currently required as conditions of your cyber insurance coverage. Document that these controls are in place and operating effectively. If any required controls are gaps, prioritize remediation. Coordinate with the broker to provide evidence of control effectiveness during policy renewals.
Verifying High-Value Requests in the Age of AI Impersonation
The rise of deepfake voice and video technology has fundamentally changed the rules of workplace verification. Attackers can now sound exactly like your CEO, look exactly like your CFO on a video call, and know enough about internal operations to sound convincing. The old advice—“watch for bad grammar” or “be suspicious of unusual language”—no longer works. This training module is designed to be shared with all staff, especially those involved in wire transfers, ACH origination, credential resets, or executive support.
What We Used to Rely On
- Recognizing the caller’s voice as a trusted
person - Reading email carefully for suspicious wording
- Trusting video calls to confirm someone’s
identity - Assuming an urgent tone meant the request
was real
What We Rely On Now
- Voices and faces can be perfectly cloned by AI
- Even flawless communication can be fraudulent
- Video calls with familiar people can be entirely
fake - Urgency is the #1 warning sign, not a reason to
hurry
5 Actions Every Employee Can Take
Information Security Best Practices
The following practices should be continuously reinforced across your organization. These recommendations are aligned with FFIEC IT Examination Handbook guidance and represent foundational controls that examiners expect to see in every financial institution. Each section includes guidance for both leadership oversight and IT/operations implementation.
Deepfake and Social Engineering Defenses
With 40% of BEC attacks now involving AI-generated deepfake content, technology-based defenses alone are
insufficient. Preventing financial loss requires disciplined verification procedures that assume the attacker can
convincingly impersonate any executive.
For Leadership:
- Establish and document code-word or callback verification procedures for all high-value transactions requested by phone, video, or messaging
- Personally participate in a deepfake-scenario tabletop exercise—executives are the primary impersonation targets
- Update your dual-authorization procedures to require verification through a separate, known channel
- Brief the Board specifically on deepfake risk and your institution’s verification procedures
For IT/Operations:
- Deploy voice biometric or liveness detection tools for elevated-risk transaction workflows
- Restrict external participant access in collaboration platforms (Teams, Zoom) for sensitive meetings
- Update security awareness training to specifically cover AI-generated audio, video, and text threats
- Implement out-of-band callback verification for wire transfer and ACH origination workflows
VPN and Remote Access Security
With 73% of ransomware attacks now starting at a VPN appliance and Akira actively targeting SonicWall
firewalls at community financial institutions, hardening perimeter remote access is the most impactful single
defense against ransomware.
For Leadership:
- Require quarterly reporting on VPN patch status and MFA coverage; make this a Board-level metric
- Confirm your institution has phishing-resistant MFA on all remote access (SMS-based MFA is no longer sufficient for VPN)
- Include VPN compromise scenarios in your annual ransomware tabletop exercise
- Review whether legacy remote access technologies can be retired in favor of Zero Trust alternatives
For IT/Operations:
- Verify all VPN and firewall devices are patched for KEV-listed vulnerabilities within 72 hours of KEV addition
- Enforce phishing-resistant MFA (hardware tokens, passkeys, FIDO2) on all VPN access—not SMS or push notifications
- Rotate all firewall administrator, VPN, and LDAP service credentials on a documented schedule
- Review VPN session logs weekly for anomalous geolocations, hostnames, or session patterns
Security Control Validation
With the Picus Blue Report 2026 showing financial sector prevention rates dropping nine points year-over-year
and only 16% of attacks generating alerts, regular validation of security controls is now as important as
deploying them. Controls degrade over time due to configuration drift, environmental changes, and evolving
attacker techniques.
For Leadership:
- Ask your IT team when security controls were last validated against realistic attack scenarios (distinct from penetration testing)
- Establish a Board-approved cadence for control validation, at least annually and ideally quarterly for critical controls
- Include control validation results in your annual IT risk assessment update
- Ensure your cybersecurity framework (NIST CSF 2.0, CRI Profile, CISA CPGs, or CIS Controls) has been updated within the past 12 months
For IT/Operations:
- Implement breach and attack simulation (BAS) or purple team exercises for regular control validation
- Focus initial validation on attack techniques used by financial-sector ransomware groups (Akira, Qilin, DragonForce)
- Review SIEM/EDR alert rules to ensure suspicious activity generates timely actionable alerts (not just logs)
- Document control validation results and remediation for examination evidence
Deepfake and Social Engineering Defenses
With 40% of BEC attacks now involving AI-generated deepfake content, technology-based defenses alone are
insufficient. Preventing financial loss requires disciplined verification procedures that assume the attacker can
convincingly impersonate any executive.
For Leadership:
- Establish and document code-word or callback verification procedures for all high-value transactions requested by phone, video, or messaging
- Personally participate in a deepfake-scenario tabletop exercise—executives are the primary impersonation targets
- Update your dual-authorization procedures to require verification through a separate, known channel
- Brief the Board specifically on deepfake risk and your institution’s verification procedures
Regulatory & Compliance Corner
FFIEC Updates & Examination Focus Areas
Based on recent examination trends, published guidance, and the current threat environment, examiners are placing heightened focus on the following areas during IT examinations. Use these to prepare for your next exam and to brief your Board:
- Deepfake and Social Engineering Preparedness: Following CISA/NCSC joint guidance and the FBI’s reporting on deepfake-enabled BEC, examiners are asking whether institutions have specific verification procedures for high-value transaction requests. Expect questions about code-word or callback procedures, executive training, and deepfake scenarios in tabletop exercises.
- VPN and Remote Access Controls: With 73% of ransomware attacks starting at VPN appliances and Akira actively targeting SonicWall in the community financial sector, examiners are asking detailed questions about VPN patching, MFA implementation (phishing-resistant, not SMS), and session monitoring. SMSbased MFA on VPN is being cited as a weakness.
- Security Control Validation: As industry data shows control effectiveness declining, examiners are moving from “do you have this control” to “have you validated that it still works.” Be prepared to discuss control validation results, remediation timelines, and how your risk assessment reflects control effectiveness.
- Emergency Patching Programs: Given ongoing high-volume patch releases and nation-state exploitation of zero-days, examiners want to see risk-based prioritization frameworks and evidence of KEV-tracked patch application. Institutions relying on monthly patch cycles alone are at increasing risk of MRA findings.
- Cyber Insurance Coverage: Some regulators are beginning to inquire about cyber insurance coverage as part of overall operational resilience. Be prepared to discuss your coverage in general terms, any known gaps, and how those gaps are addressed in your incident response plan.
Quick Reference: Key Dates & Deadlines
| Date | Action Item |
|---|---|
| Immediate | Apply August 12 Microsoft Patch Tuesday updates; prioritize CVE-2026-68820 |
| Immediate | Verify SonicWall firewall patch status (CVE-2024-40766) and credential rotation |
| Immediate | Confirm phishing-resistant MFA on all VPN access |
| This Quarter | Establish code-word or callback verification procedure for high-value transactions |
| This Quarter | Conduct deepfake scenario tabletop exercise with executive team participation |
| Ongoing | Confirm Nacha Phase 2 ACH fraud monitoring compliance (effective June 22, 2026) |
| Monthly | Review and update incident response contact lists and vendor emergency contacts |
| Monthly | Review vulnerability scan results and confirm fixes are applied |
| Quarterly | Conduct social engineering awareness refresh training for all staff |
| Quarterly | Review and update IT risk assessment and risk register |
| Annually | Conduct full BCP/DR tabletop or functional test |
| Annually | Independent penetration test (internal and external) |
| Annually | Comprehensive review of all IT policies for Board approval |
| Ongoing | Monitor CISA KEV catalog, FS-ISAC, and vendor advisories for emerging threats |
Glossary: Common Cybersecurity Terms
For non-technical readers, here is a plain-language reference for terms used in this bulletin and in your
conversations with IT and examiners:
- BAS: Breach and Attack Simulation—software that automatically tests your security controls against real-world attack techniques, showing what would work and what wouldn’t.
- BEC: Business Email Compromise—a class of fraud where attackers impersonate executives, vendors, or trusted parties to trick employees into transferring money or sensitive information.
- BFSI: Banking, Financial Services, and Insurance—a common industry grouping used in cybersecurity research and reporting.
- CISA: Cybersecurity and Infrastructure Security Agency—the federal agency that publishes cybersecurity guidance and threat warnings.
- CVE / CVSS: Common Vulnerabilities and Exposures / Common Vulnerability Scoring System—the global identifier for a specific software flaw, and its 0-10 severity score (10 is most severe).
- Deepfake: AI-generated audio, video, or images that convincingly impersonate a real person’s voice, face, or appearance.
- EDR: Endpoint Detection and Response—advanced security software installed on computers that watches for and responds to suspicious activity.
- FFIEC: Federal Financial Institutions Examination Council—the interagency body that establishes uniform standards and examination guidance for U.S. financial institutions.
- FIDO2 / Passkeys: The current standard for phishing-resistant authentication—hardware keys or biometric-backed credentials that can’t be tricked out of a user.
- FS-ISAC: Financial Services Information Sharing and Analysis Center—an industry group that shares cyber threat intelligence among financial institutions.
- GLBA: Gramm-Leach-Bliley Act—the federal law that requires financial institutions to protect customer information, including breach notification requirements.
- KEV: Known Exploited Vulnerabilities catalog—CISA’s list of vulnerabilities being actively exploited by attackers; the highest-priority list for patching.
- MFA: Multi-Factor Authentication—requiring more than just a password. “Phishing-resistant MFA” uses hardware keys or passkeys, which are stronger than SMS or push notifications.
- MRA: Matters Requiring Attention—examiner findings that require corrective action; MRBAs are Matters Requiring Board Attention.
- Nacha: The National Automated Clearing House Association—the organization that writes the rules for the ACH payment network.
- RaaS: Ransomware-as-a-Service—a criminal business model where a ransomware group rents its tools to affiliates who conduct the attacks and share the profits.
- RCE: Remote Code Execution—a type of vulnerability that lets an attacker run their own software on your system from a distance, often without you doing anything.
- SIEM: Security Information and Event Management—software that collects and analyzes logs from across the institution to detect suspicious activity.
- SOC 2 Type II: An independent audit report that documents a service provider’s security controls over a period of time.
- TSP: Technology Service Provider—a third-party vendor that provides technology services to financial institutions (e.g., core processing).
- VPN: Virtual Private Network—a secure way for remote employees to connect to the institution’s internal network.
- Zero Trust: A security model that assumes no user or device is automatically trusted, and requires verification for every access attempt regardless of location.
Resources
CISA Akira Ransomware Advisory (AA24-109A): cisa.gov/news-events/cybersecurity-advisories/aa24-109a
Microsoft August 2026 Patch Tuesday: msrc.microsoft.com/update-guide
SonicWall Security Advisories: psirt.global.sonicwall.com
CISA/NCSC Deepfake Threat Advisory: cisa.gov/news-events/cybersecurity-advisories
FS-ISAC Threat Intelligence: fsisac.com
TraceSecurity: tracesecurity.com
