739 incidents in 2025. The most targeted sector — and the most regulated.
Lazarus Group on SWIFT, reverse-engineered mobile banking apps, drained smart contracts. DORA now mandates formal offensive testing (TLPT) every 3 years for systemic financial entities. Quarkslab is qualified to carry them out.
WHY FINANCE REMAINS TARGET NUMBER 1
OUR SERVICES
QREDTEAM
ADVERSARY SIMULATION
- DORA / TIBER-EU TLPT — simulation of real financial APTs (Lazarus, TA505, Scattered Spider)
- Mobile-banking Red Team — jailbreak bypass, certificate pinning, key exfiltration
- Open Banking PSD2/PSD3 API testing — BOLA, IDOR, injection
- SWIFT-infrastructure Red Team — simulation of documented Lazarus vectors
- ATM and POS terminal pentest — firmware extraction, software skimming.
QLAB
DEEP SECURITY RESEARCH
- ATM/POS firmware audit — binary extraction, manufacturer proprietary protocols
- Binary analysis of mobile banking apps (APK/IPA) — full reverse engineering
- Smart-contract and DeFi-protocol audit — reentrancy, logic bugs, oracle manipulation
- HSM and cryptographic-component evaluation (SCA/FIA) — physical resistance
- Audit of third-party SDKs integrated into banking apps.
QSHIELD
SOFTWARE PROTECTION
- Protection of mobile banking apps against reverse engineering and cloning
- Obfuscation of scoring and fraud-detection algorithms
- Protection of POS/ATM firmware against extraction and fraudulent modification
- Anti-tamper for mobile-payment applications
- IP protection of AI fraud-analysis models.
QUARKSLAB DIFFRENCIATOR
Large firms coordinate TLPTs but often subcontract the technical work; other players lack the offensive dimension. Quarkslab brings offensive technical depth (ATM firmware, app binary RE, smart contracts, HSM SCA/FIA) combined with the institutional qualification for DORA TLPTs — and QShield to protect what has been identified as exposed.
WHAT WOULD WE SAY TO EACH OTHER, FACE TO FACE
Is your next DORA TLPT scheduled — and who will actually run it?
DORA mandates TLPTs every 3 years. But a TIBER-EU TLPT is not a classic pentest: it requires genuine threat intelligence on the adversaries targeting your institution, a simulation of their documented TTPs, and a structured report for your regulator. The difference between a compliant TLPT and a re-labeled pentest is what your regulator will see in your file.