The threat actor claims to be selling multiple attack vectors targeting the BOC Travels payment gateway and billing system, a subsidiary of Bank of Ceylon. The actor claims the vulnerabilities include price tampering, admin panel authentication bypass, and injection points.