Financial Services threat landscape
Banks, insurers, fintech and payment infrastructure — perennial targets for banking trojans, ransomware crews and state-aligned theft.
Matched automatically by keyword — not by AI or analyst judgement. Rebuilt daily. Last rebuilt 2026-10-20.
- Threat actors
- 19
- Actively-attacked vulnerabilities (CISA KEV)
- 1
- Ransomware victims, last 90 days
- 156
- Ransomware victims, since 2026-06
- 204
Threat actors
Actors whose feed descriptions reference this sector, ranked by graph connectivity. Showing 15 of 19.
| Actor | What the feeds say | Connections in our data |
|---|---|---|
| GCMAN | GCMAN is a threat group that focuses on targeting banks for the purpose of transferring money to e-currency services.… | 576 |
| APT38 | APT38 is a North Korean state-sponsored threat group that specializes in financial cyber operations; it has been attributed to the Reconnaissance General Bureau.(Citation: CISA AA20-239A BeagleBoyz A… | 378 |
| FIN7 | FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, fin… | 366 |
| Water Galura | Water Galura are the operators of the Qilin Ransomware-as-a-Service (RaaS) who handle payload generation, ransom negotiations, and the publication of stolen… | 294 |
| Silence | Silence is a financially motivated threat actor targeting financial institutions in different countries. The group was first seen in June 2016. Their main targets reside in Russia, Ukraine, Belarus,… | 251 |
| Andariel | Andariel is a North Korean state-sponsored threat group that has been active since at least 2009. Andariel has primarily focused its operations--which have in… | 195 |
| Cobalt Group | Cobalt Group is a financially motivated threat group that has primarily targeted financial institutions since at least 2016. The group has conducted intrusions to steal money via targeting ATM system… | 173 |
| FIN6 | FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in t… | 173 |
| FIN8 | FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology,… | 166 |
| Carbanak | Carbanak is a cybercriminal group that has used Carbanak malware to target financial institutions since at least 2013. [Carbanak](https://attack.mitre.org/g… | 146 |
| RedCurl | RedCurl is a threat actor active since 2018 notable for corporate espionage targeting a variety of locations, including Ukraine, Canada and the United Kingdom, and a variety of industries, including… | 135 |
| Indrik Spider | Indrik Spider is a Russia-based cybercriminal group that has been active since at least 2014. Indrik Spider initially started with the [Dridex](https://attack… | 124 |
| RTM | RTM is a cybercriminal group that has been active since at least 2015 and is primarily interested in users of remote banking systems in Russia and neighboring countries. The group uses a Trojan by th… | 121 |
| GALLIUM | GALLIUM is a cyberespionage group that has been active since at least 2012, primarily targeting telecommunications companies, financial institutions, and government entities in Afghanistan, Australia… | 115 |
| APT19 | APT19 is a Chinese-based threat group that has targeted a variety of industries, including defense, finance, energy, pharmaceutical, telecommunications, high tech, education, manufacturing, and legal… | 80 |
Campaigns
Campaigns and intel pulses mentioning this sector, most recent first. Showing 15 of 144.
| Campaign | Description | Linked actors | Seen |
|---|---|---|---|
| Operation Wocao | Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and th… | — | — |
| Operation Spalax | Operation Spalax was a campaign that primarily targeted Colombian government organizations and private companies, particularly those associated with the energy and metallurgical industries. The [O… | — | — |
| CostaRicto | CostaRicto was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. [CostaRicto](https://attack.mitre… | — | — |
| The extension you never installed: KREMLIN forges Chrome's own integrity checks to steal banking sessions | Brazilian banking malware operation REF9334 has been deploying KREMLIN toolkit since May 2025, targeting Brazilian financial institutions through malicious browser extensions. The operation uses multi-stage JavaScript loaders, custom C++ in… | — | 2026-10-16 |
| The banana stand: brokering and managing infections across Asia using MQTT | BambooToken is an emerging multiplatform malware family active since at least February 2023, utilizing the Message Queueing and Telemetry Transport (MQTT) protocol for covert command and control operations. The campaign targets Windows and… | — | 2026-10-16 |
| Variola: From ClickFix to a Modular Implant | Blackpoint's Adversary Pursuit Group traced a ClickFix intrusion to a previously unclassified modular Windows implant designated Variola. The malware establishes persistent host identity through encrypted storage, maintains configuration an… | — | 2026-10-16 |
| Aoki: Infostealer Targets AI Coding Assistant Credentials | The Aoki infostealer has evolved to target credentials from AI coding assistants including Claude, OpenAI's Codex, Cursor, Codeium and Gemini. This capability represents a recent addition, as earlier versions did not target AI-related files… | — | 2026-10-15 |
| Hirudo: From Fake Updates to Patched Banking Apps | A new Android banking remote access trojan named Hirudo has been identified, combining credential theft with live remote control. It is delivered through shopping and entertainment apps that act as droppers, installing the trojan as a separ… | — | 2026-10-15 |
| Disruption Targets Major Chinese-Language Phishing Kits with Japanese Focus | A coordinated disruption action targeted Chinese-speaking cybercriminals operating three major phishing kits: CoGUI, CoAceV, and CoFish_Ws, which collectively distributed hundreds of millions of credential phishing messages primarily target… | — | 2026-10-15 |
| Iron Man & YamStore: Powering a Global Phishing-as-a-Service Ecosystem | Resecurity identified and mapped infrastructure supporting a commercial Phishing-as-a-Service operation marketed as 'Iron Man System.' The kit is sold to criminal buyers as a self-hosted package deploying pre-built lure pages impersonating… | — | 2026-10-15 |
| Casbaneiro: A Banking Trojan with Distributed Data-Receiving Servers | In August 2026, a Casbaneiro campaign targeted Latin American users through phishing emails and PDFs themed as fake invoices and legal notices. The multi-stage infection chain includes HTA downloaders and AutoIt loaders, employing geofencin… | — | 2026-10-10 |
| Unknown Threat Actor Uses AI-Driven ARTEX to Target South Korean Finance | An unidentified threat actor, likely Chinese-speaking and financially motivated, conducted targeted attacks against South Korean financial institutions between late September and early October 2026, successfully exfiltrating data. The adver… | — | 2026-10-09 |
| Bypassing the Gatekeepers: How a Global Phishing Campaign Turns Google's Infrastructure into a Trust Proxy | Cybercriminals are exploiting legitimate Google infrastructure in a sophisticated phishing operation that bypasses email security gateways and enterprise firewalls. The attack chains together six distinct Google properties including Meet, S… | — | 2026-10-09 |
| StyleSmuggler: Magento and Adobe Commerce 0-day RCE under active attack | An unpatched zero-day vulnerability dubbed StyleSmuggler affects all current versions of Magento and Adobe Commerce, including 2.4.9, enabling unauthenticated remote code execution. Active exploitation began on September 4th, 2026. The atta… | — | 2026-10-07 |
| Caught in 4K: The Gentlemen Files | A Russian-speaking affiliate of the Gentlemen ransomware group, identifying as Azazel, compromised over two dozen organizations across six countries while simultaneously betraying the RaaS operator. The threat actor deployed independent lea… | — | 2026-10-05 |
ATT&CK techniques
Techniques used by the actors above — what to detect for, ranked by how many of them use it. Showing 15 of 226.
Known-exploited CVEs
CISA KEV entries whose vendor, product or description matches this sector — 1 total, latest below.
| CVE | Vulnerability | Vendor / product | KEV added |
|---|---|---|---|
| CVE-2026-46817 | Oracle E-Business Suite Improper Privilege Management Vulnerability | Oracle · E-Business Suite | 2026-07-15 |
High-severity CVEs
Vulnerabilities whose descriptions reference this sector, by CVSS.
| CVE | CVSS | Description | KEV |
|---|---|---|---|
| CVE-2026-81648 | 10.0 | The CryptoPayment Gateway WordPress plugin from 1.2.1 to 1.2.2 does not apply an authorization check on one of its AJAX endpoints, allowing unauthenticated users to invoke administrative operations, including deleting ar… | |
| CVE-2025-53037 | 9.8 | Vulnerability in the Oracle Financial Services Analytical Applications Infrastructure product of Oracle Financial Services Applications (component: Platform). Supported versions that are affected are 8.0.7.9, 8.0.8.7 an… | |
| CVE-2026-31843 | 9.8 | The goodoneuz/pay-uz Laravel package (<= 2.2.24) contains a critical vulnerability in the /payment/api/editable/update endpoint that allows unauthenticated attackers to overwrite existing PHP payment hook files. The endp… | |
| CVE-2026-85531 | 9.8 | Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. OpenCart Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects OpenCar… | |
| CVE-2025-14156 | 9.8 | The Fox LMS – WordPress LMS Plugin plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 1.0.5.1. This is due to the plugin not properly validating the 'role' parameter when cre… | |
| CVE-2026-86405 | 9.8 | Improper verification of cryptographic signature vulnerability in Sipay Electronic Money and Payment Services Inc. PrestaShop Virtual POS Module allows Signature Spoofing by Improper Validation. This issue affects Prest… | |
| CVE-2026-46817 | 9.8 | Oracle E-Business Suite contains an improper privilege management vulnerability that allows an unauthenticated attacker with network access via HTTP to compromise Oracle Payments. Successful attacks of this vulnerability… | KEV |
| CVE-2026-14205 | 9.8 | The WP Events Manager WordPress plugin before 2.2.5 does not validate the requested quantity when registering for a paid event and computes the price from the attacker-controlled quantity, allowing any authenticated user… | |
| CVE-2026-18467 | 9.8 | The Paytium: Mollie payment forms & donations plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 5.0.3. The 5.0.3 patch introduced a wp_hash()/hash_equals() signature gate on… | |
| CVE-2026-61097 | 9.6 | Vulnerability in the Oracle Banking Trade Finance Process Management product of Oracle Financial Services Applications (component: Common). Supported versions that are affected are 14.6.0-14.8.0. Easily exploitable vuln… | |
| CVE-2026-17738 | 9.6 | Insufficient validation of untrusted input in Payments in Google Chrome prior to 151.0.7922.72 allowed a remote attacker who had compromised the renderer process to potentially perform a sandbox escape via a crafted HTML… | |
| CVE-2026-18872 | 9.3 | IBM Financial Transaction Manager (FTM) for RedHat OpenShift is vulnerable to stored cross-site scripting (CWE-79) in the FTM UI NetworkAcknowledgement React component (NetworkAcknowledgement.jsx:42). A malicious actor c… | |
| CVE-2026-14851 | 9.2 | A vulnerability relating to the exposure of confidential information in the customer invoicing web application, which exposes personally identifiable information (PII) and financial data – including customer names, addre… | |
| CVE-2026-39353 | 9.1 | InvoicePlane is a self-hosted open source application for managing invoices, clients, and payments. Prior to 1.7.2-rc-1, InvoicePlane builds its permitted template list by scanning a PHP template directory that can be wr… | |
| CVE-2025-61922 | 9.1 | PrestaShop Checkout is the PrestaShop official payment module in partnership with PayPal. Starting in version 1.3.0 and prior to versions 4.4.1 and 5.0.5, missing validation on the Express Checkout feature allows silent … |
Ransomware victims
Named leak-site victims classified into this sector (ransomware.live taxonomy: Financial Services), latest 15 shown.
| Victim | Crew | Discovered |
|---|---|---|
| CREDIN | qilin | 2026-10-19 |
| Merit Financial Group | Storm | 2026-10-19 |
| Finzly Corp | N0n | 2026-10-19 |
| WSBI-ESBG | play | 2026-10-16 |
| Pure Options | play | 2026-10-16 |
| Macfarlan Capital Partners | pear | 2026-10-16 |
| North Bridge Venture Partners | thegentlemen | 2026-10-16 |
| Europ Assistance South Africa | thegentlemen | 2026-10-16 |
| Via Credit Union | qilin | 2026-10-16 |
| www.coopecaja.fi.cr | incransom | 2026-10-15 |
| Telcoe Federal Credit Union | qilin | 2026-10-15 |
| FINANCIAMENTO LTDA | incransom | 2026-10-14 |
| The Golden Legacy Financing | qilin | 2026-10-13 |
| YYC Advisors | HYFLOCK | 2026-10-13 |
| Interseguro | direwolf | 2026-10-13 |
Most active crews · since 2026-06
watch this sector
Get a daily email when something new touches financial services — or your own vendors, products and suppliers. Deterministic graph matches, one email a day, one-click unsubscribe.