Six Months. Every Vector. The Bank Held.

The Customer

The customer is one of Ukraine's five largest commercial banks by assets, with more than 5,000 employees and a national retail and corporate banking footprint. The bank operates a significant digital presence — mobile banking, web banking, and a large internal technology estate — and has maintained operations continuously since the full-scale invasion began in February 2022, including periods of significant infrastructure stress.

The bank's security function is mature by Ukrainian standards: a dedicated SOC, an established vulnerability management programme, regular external penetration tests, mandatory security awareness training for all staff, and a formal physical security programme across all branches and data centres.

The engagement was initiated by the bank's CISO following a board-level request for independent validation of the security programme — not to find vulnerabilities, but to test whether the programme would hold under sustained, intelligent adversarial pressure.

The Challenge

The bank's existing annual penetration tests were point-in-time assessments — typically two to three weeks, scoped to specific systems, executed by a rotating roster of vendors. They reliably produced findings, which were remediated. But the CISO had a specific concern: the testing was predictable. Vendors knew the scope. The bank's defences were optimised for the kind of testing they typically received.

The specific question driving the engagement was not "are there vulnerabilities?" but "what happens when an adversary who knows what they are doing applies sustained, multi-vector pressure over months?"

AmonSul was engaged to conduct a continuous red team assessment using the full range of adversary techniques — technical, physical, and human — over a six-month period, with no predefined scope limitations.

The Approach

Scope and Ground Rules

The engagement was structured as a continuous operation with a small, rotating AmonSul red team. The rules of engagement were negotiated with the CISO and legal counsel and excluded only two constraints: no disruption to live banking services or customer transactions, and no use of zero-day vulnerabilities requiring purchase from third-party brokers.

The bank's board and senior leadership were briefed that an assessment was underway. Day-to-day operations — including the SOC and security team — were not informed of the engagement timeline or scope, to preserve the authenticity of detection and response testing.

Network and Infrastructure

AmonSul's initial reconnaissance established the bank's external attack surface: internet-facing systems, exposed management interfaces, third-party integrations, and DNS/certificate intelligence. This was followed by a sustained vulnerability identification and exploitation attempt across the full external perimeter.

Network segmentation was specifically targeted. AmonSul identified several jump-station configurations — legacy administrative access paths used for remote management — and attempted to use them as lateral movement vectors. In all cases, network segmentation controls blocked onward movement from the jump-station to core banking infrastructure. The segmentation architecture held completely.

Internally, AmonSul social-engineered physical access to a branch location and connected a testing device to a network port in a back-office area. Attempts to pivot from the branch network to corporate infrastructure were blocked by VLAN controls and 802.1X port authentication.

Web and Mobile Applications

The bank's web banking portal and mobile applications were tested across the full OWASP Top 10, OWASP Mobile Application Security, and extended to business logic attacks specific to financial applications: parameter manipulation, transaction replay, session management abuse, and privilege escalation across account types.

Several low-severity findings were identified in secondary administrative interfaces — primarily information disclosure issues with no direct exploitation path. No authentication bypass, privilege escalation, or direct data access vulnerability was found in any customer-facing or core banking system. The mobile application's certificate pinning and root detection held against standard bypass techniques.

Physical Premises

Physical access testing covered three branch locations and one data centre facility over the six-month period. Methods included tailgating, pretexting as vendor technicians, and social engineering of reception and facilities staff.

In two of the three branch locations, physical access attempts were challenged by staff within minutes. In the third, AmonSul was able to access a back-office area briefly before being challenged and asked for identification. No access was gained to secure areas, server rooms, or network infrastructure in any location.

Human Attack Surfaces: Phishing and Social Engineering

AmonSul ran three phishing campaigns over the six-month period, each using a different pretext and delivery mechanism:

• Campaign 1: Credential harvesting via a spoofed internal IT portal notification
• Campaign 2: A malware delivery email using a trojanised Office document, timed to coincide with a real industry conference the bank was attending

In all campaigns, staff either did not click the link or reported the suspicious email to the security team. No credentials were harvested. No payload executed on a bank-managed device.

Fake Recruitment Interview

AmonSul conducted a targeted attack using a fake recruitment interview scenario — a vector increasingly used by state-aligned threat actors to deliver malware to specific individuals. A bank employee was contacted through a professional networking platform and invited to participate in a "technical interview" for a senior role at a fictitious firm. The interview included a coding exercise distributed as a compressed archive containing a bait payload.

The payload executed — on the employee's personal device, not a bank device. This demonstrated exceptional security discipline: the employee had correctly separated work and personal activity and had not used a bank-managed system for a personal recruitment process. The payload did not reach the bank's corporate environment.

The Findings

After six months of continuous testing, AmonSul's findings were:

• Critical vulnerabilities: 0
• High vulnerabilities: 0
• Medium vulnerabilities: 3 (all in non-production administrative tooling with no direct exploitation path to core banking systems)
• Low vulnerabilities: 8 (information disclosure, minor configuration issues)
• Human vectors: 0 successful compromises

Each finding was documented with full technical detail, exploitation path analysis, and the specific control that had prevented escalation.

The Outcome

The engagement produced a comprehensive validation report documenting every test case, technique, vector, and outcome across the six-month period — including explicit mapping of which controls stopped which attacks.

The report was presented to the bank's board as evidence that years of security investment had been stress-tested under genuine adversarial conditions and had held. The findings were used to support the security budget request for the following year — not to fix critical vulnerabilities, but to demonstrate programme maturity and identify the areas where further investment would build resilience rather than close existing gaps.

Three medium findings in administrative tooling were remediated within 30 days of the report. The human attack surface assessment validated the effectiveness of the bank's security awareness programme and provided specific behavioural data — the fake interview scenario outcome, in particular — that was used to update training content covering personal device hygiene.

The bank has since engaged AmonSul for an annual red team assessment as a standing programme — treating continuous adversarial validation as an operational discipline rather than a one-time exercise.