Herman | Financial Security @finsecguy
Tracking how financially motivated threat actors target banking infrastructure and internal tooling blind spots. Deep dives: https://t.co/AiQNouCm0A Joined May 2026-
Tweets13
-
Followers0
-
Following39
-
Likes1
@noor36758 Fair, however, languages like Kobol and Fortran may pay surprisingly well due to unmet demand - a lot of massive legacy systems still run on those.
Settlement cut-offs create a structural blind spot across payment operations. Treasury teams log off for the holiday weekend. Operations desks rush batch approvals to clear pending queues. Correspondent rails clear before Monday. The recall window is closed.
Most banks isolate security operations from transaction monitoring. SOC resets passwords and closes phishing tickets. Fraud checks velocity anomalies days later. Compromise is treated as IT hygiene, the drain as fraud. Nobody connects the dots until settlement.
@fintechjunkie When agents move from advisory to autonomous execution, the threat model flips. The risk isn't credential theft anymore. It's delegating payment routing and liquidity dispersion to automated workflows without out-of-band controls on destination changes.
@Dexerto The actual breakdown is workflow: an internal authorization process that allows nine figures to move offshore on conversational authority alone, rather than enforced dual-control cryptographic sign-off.
Cash-out is a supply chain problem, and rentable mule accounts are the choke point. Defenders watch the originating side: phishing, session theft, payment alerts. But the receiving side, mule onboarding and liquidity dispersion, is where the loss becomes unrecoverable.
@IRONSCALES Authentication vs authorization in practice. The mail server proved the session was legitimate, but the breakdown was downstream: AP acting on altered payment details without out-of-band verification. Attackers don't need exploits when business logic trusts the session.
@coinbureau The real risk of instant cross-border rails isn't currency competition, it's the fraud recall window. Instant settlement compresses response time to zero. Once an attacker routes funds across borders on real-time rails, the money hits foreign mule before anyone notices.
Banks put heavy authentication on login and light friction on changing payment instructions. Once an attacker controls a session, the bank just sees a legitimate user moving money. No malware executes, zero alerts trigger, and instant rails make it irreversible.
Security budgets go to endpoint telemetry and malware hunts, but financially motivated attackers treat cashing out as a logistics problem. The actual theft happens in beneficiary changes, limit increases, and batch payout queues that the SOC never monitors.
@cyber_razz Bypassing KYC with camera injection gets an attacker in, but moving liquidity without tripping fraud velocity rules is where operations usually stall. The bottleneck is downstream logistics: the mule networks and settlement rails needed to cash out.
@rseroter The overlooked angle in finance is that CI/CD pipelines often deploy the internal tools handling balance checks, reconciliation, and payment batching. Attackers don't need to break prod encryption if they can poison a pipeline that builds the internal ops dashboard.
A lot of internal financial tools wouldn't pass a basic OWASP Top 10 check. Security teams spend months hardening the perimeter, but internal apps get trusted purely because they sit behind the firewall. Once an attacker gets inside, basic missing auth does the rest.
Group-IB Global @GroupIB
10K Followers 641 Following A leading creator of cybersecurity technologies to investigate, prevent, and fight digital crime. Combating cybercrime since 2003
Group-IB Threat Intel... @GroupIB_TI
17K Followers 182 Following Official account of the @GroupIB Threat Intelligence Unit. Latest research, analytics, IOCs and threat alerts.
DarkFeed @ido_cohen2
48K Followers 0 Following DarkFeed: Cyber Threat Intelligence Platform, Putting things at order in the ransomware crazy world #OSINT | #Ransomware | #Cyberattacks | #Hacktivism
Coldzer0 @Coldzer0x0
1K Followers 393 Following Co-Founder @ XENOM-X LLC | Senior Offensive security engineer @EG_CERT { Opinions are my own }🦠
fouad @fouadmatin
10K Followers 942 Following @openai cyber preparedness lead // formerly codex, post training, security
rekdt @rekdt
17K Followers 840 Following // malware degenerate // sr cybersecurity leader, megacorp usa // @sec_defcon daemon // misery @despairware // take sincerely at your own risk
Vix @VixWizzer
668 Followers 986 Following cybersec as passion, shitpost in fashion Cloud security thingy / Researching n poking stuff
Unit 42 @Unit42_Intel
71K Followers 81 Following The latest research and news from Unit 42, the Palo Alto Networks (@paloaltontwks) Threat Intelligence and Security Consulting Team covering incident response.
Dark Reading @DarkReading
358K Followers 49 Following One of the most widely read and trusted cybersecurity news sites, providing IT security professionals informed insights into the latest news and trends.
CISA Cyber @CISACyber
303K Followers 76 Following Part of @CISAgov, we respond to major incidents, analyze threats, and exchange critical cybersecurity information with partners around the world.
Reuters World @ReutersWorld
1.3M Followers 160 Following Your source for top international news and analysis.
Bellingcat @bellingcat
717K Followers 75 Following Support our charity https://t.co/XMTKIEDiTB Buy our book: https://t.co/2JiuWFfTpO Follow us: https://t.co/LPUEQI8TdZ
War on the Rocks @WarOnTheRocks
179K Followers 87 Following Experience. Conflict. Commentary. Join our community: https://t.co/OtnJ9e6Eck
GeoInsider @InsiderGeo
76K Followers 559 Following Independent geopolitical & military analysis. Conflicts, strategy, and the forces shaping them. https://t.co/AAJCKoiL4M
Department of War �... @DeptofWar
7.5M Followers 642 Following Official U.S. Department of War X account.
SentinelOne @SentinelOne
58K Followers 1K Following ONE autonomous platform to prevent, detect, respond, and hunt. Do more, save time, secure your enterprise: https://t.co/N75g1HAnCs 🐱💻
ippsec @ippsec
125K Followers 373 Following
GuidedHacking @GuidedHacking
59K Followers 417 Following Reverse Engineering & Game Hacking Courses @ https://t.co/Dl5ED4o7YS
BleepingComputer @BleepinComputer
259K Followers 207 Following Breaking cybersecurity and technology news, guides, and tutorials that help you get the most from your computer. DMs are open, so send us those tips!
MalwareHunterTeam @malwrhunterteam
257K Followers 39 Following Official MHT Twitter account. Check out ID Ransomware (created by @demonslay335). More photos & gifs, less malware.
CTI Updates @CTI__Updates
3K Followers 3K Following Updates about all things threat intelligence & updates about stuffs going on in the cybersec, ransomware, OSINT, SOCMINT, and hacking communities #threatintel
Swift @swiftcommunity
122K Followers 456 Following We’re on a mission to make international transactions instant, frictionless and interoperable.
HackerOne @Hacker0x01
343K Followers 3K Following HackerOne makes security continuous. We unite AI and human insight through a unified platform to expose risk and eliminate it.
Intigriti @intigriti
216K Followers 670 Following Bug bounty & VDP platform trusted by the world’s largest organisations! 🌍
The DFIR Report @TheDFIRReport
70K Followers 0 Following Real Intrusions by Real Attackers, the Truth Behind the Intrusion
PortSwigger Research @PortSwiggerRes
124K Followers 7 Following Web security research from the team at @PortSwigger
Black Hat @BlackHatEvents
428K Followers 2K Following The World's Premier Technical Cybersecurity Conference Series
Ctf Enjoyer @ctfstudent
15 Followers 4 Following CTF student researching LLM jailbreaks & defenses. AI security, reverse engineering and dry hacker humor. Sources included.
Hacking Articles @hackinarticles
310K Followers 491 Following House of Pentesters Join us: https://t.co/Y6XOlSP7YA
John Hammond @_JohnHammond
327K Followers 3K Following Cybersecurity Researcher @HuntressLabs Just Hacking Training @JustHackingHQ w/ @ethicalhacker https://t.co/UtsNJiyiEk && https://t.co/narO3syzIy
Hack The Box @hackthebox_eu
251K Followers 227 Following Cyber Mastery: Community Inspired. Enterprise Trusted.
Florian Roth ⚡️ @cyb3rops
225K Followers 3K Following Head of Research @nextronsystems #DFIR #YARA #Sigma | detection engineer | creator of @thor_scanner, Aurora, Sigma, LOKI, YARA-Forge | always busy ⌚️🐇 | vi/vim
OccupytheWeb @three_cube
270K Followers 3K Following Pentester, Forensic investigator, and former college professor. Trained hackers at each US military and intelligence. Visit me at https://t.co/G478wug0p4
vx-underground @vxunderground
451K Followers 382 Following The largest collection of malware source code, samples, and papers on the internet. Password: infected
Dark Web Intelligence @DailyDarkWeb
206K Followers 0 Following We work in the dark to bring clarity to the light. Contact via 051068fee6cdbbdaf0d7bff81e8e90b073abfd04d5bc574ce0dd93a7a41fc8a773
Richard Seroter @rseroter
37K Followers 2K Following Sharing tech ideas from people smarter than me. Senior Director and Chief Evangelist @googlecloud, writer, speaker.You might like
