Threat taxonomy
high activitySupply ChainFirst seen 2023
VendorWedge
Aliases: MSP access broker cluster
Brokers who specialise in compromising managed service providers and core banking integrators, then reselling persistent access into downstream financial institutions.
Attribution
Access brokers serving multiple downstream crews
Primary targets
- — Core banking vendors
- — MSPs
- — Payment integrators
Observed tactics
- Targeting of remote monitoring and management tools
- Abuse of shared maintenance credentials
- Certificate and API token theft
Regional relevance
Concentration on a small number of regional integrators means one vendor compromise can touch many institutions at once.
Detection guidance
- Inventory and time-box all vendor access paths
- Alert on RMM tool execution outside change windows
- Require per-institution vendor credentials, never shared ones
Related feed reporting
- high09 Sept 2026
Core banking vendor discloses compromise of a remote support tool
- high20 Aug 2026
Open-source payment library typosquat targets fintech build pipelines