How to read this report. The material below is drawn from a public breach listing associated with the ransomware group Triple X. Two different kinds of statement appear here and they are kept separate. The actor profile and the techniques are the group’s own characterisation of itself and of its intrusion method. The exposed material is what the group published. Neither has been independently confirmed by the affected organisation, and nothing here should be read as an admission by Bank of Baroda or a confirmed breach finding on its part.
Threat Actor Profile: Triple X
Triple X is a ransomware group that emerged in May 2026, specializing in the exfiltration of sensitive data to extort victims. The group employs a double-extortion model and maintains a leak site on the Tor network to publish stolen data, primarily targeting financial institutions and professional services firms.
Key Insights
- Employs double-extortion tactics, threatening public release of stolen data to pressure victims into payment.
- Primarily targets financial institutions and professional services firms.
- Gains initial access through brute-force attacks on RDP services and exploitation of valid accounts.
- Uses command and scripting interpreters for lateral movement within compromised networks.
- Impairs security tooling and deletes backups to obstruct recovery efforts.
TTPs Utilized by Triple X
Discovery
Credential Access
Execution
Persistence
Lateral Movement
Impact
Recent History
| Victim | Date |
|---|---|
| Law Offices US (immigrationonline.com) | 13 June 2026 |
| Bank of Indonesia (leak) | 21 May 2026 |
Breach Analysis
Exposed/exfiltrated document categories reportedly include:
- Scanned account opening forms
- Scanned NetBanking registration forms
- Audit Reports of various zones
- Scanned Aadhaar Cards, Voter Cards
- Digital signer executable file
Exposure path
The listing pointed at a directory index on the bank’s own infrastructure rather than at a copied file store:
Index of /bankofbaroda.bank.in/AuditBhopalZone2021-22/Shared Documents/General/Read as a technical observation rather than a confirmed compromise: the published material points to an exposed directory index on a web server, and to documents that were publicly reachable through it. Whether access was authorised, misconfigured or obtained by other means is not established by the listing itself.
Observation: CamScanner Usage
A notable point of concern is the continued use of the CamScanner app for document scanning by government-linked entities in 2023 and 2024, despite the app having been flagged and pulled from India's official app stores back in June 2020 over data security concerns.
Source: Breach_Reports → Bank_of_Baroda_Report.md on GitHub.
References: MITRE ATT&CK technique identifiers link to attack.mitre.org.