We’re thrilled to unveil our latest threat landscape report for the finance and insurance sector, offering in-depth analysis of the evolving cyber threats facing this industry.
In this blog, we’ll preview the report’s highlights and give insights into social engineering campaigns leveraging impersonating domains and our predictions for the threats shaping 2025.
Phishing Remains Top Tactic, Fueled by Teams Abuse
Figure 1: Top attack techniques in true-positive customer incidents for finance & insurance sector, H2 2024 vs H2 2023
Phishing dominated cyber attacks in H2 2024, accounting for over 90% of incidents across industries due to its simplicity and effectiveness. Attackers exploited misconfigured Microsoft Teams instances using tools like “TeamsPhisher” to bypass email defenses, with groups like “Black Basta” leveraging this method for months. GreyMatter Phishing Analyzer submissions revealed finance-related keywords such as “request,” “account,” and “payment” as common phishing lures, highlighting the sector’s vulnerability. In this industry, a single compromised account can trigger large-scale phishing campaigns, causing reputational damage, financial losses, and regulatory penalties.
Domain Impersonation: Low-Cost, High-Reward
Figure 2: Top true-positive alerts for finance and insurance sector, H2 2024 vs H2 2023
Impersonating domains and subdomains remain a persistent threat, especially for GreyMatter Digital Risk Protection (DRP) customers in the finance and insurance sector. In H2 2024, 20–25% of “Scattered Spider’s” impersonating domains targeted finance and insurance sectors, while 25–30% mimicked cryptocurrency platforms, representing 50–55% of their activity. By replicating platforms like single sign-on (SSO) portals or VPNs, hosting the fake sites with bulletproof providers, and using personalized phishing lures, attackers bypass security defenses and gain unauthorized access to critical systems.
The One to Watch: RansomHub
By H2 2024, “RansomHub” surpassed “LockBit” as the most active ransomware group targeting the finance and insurance sector, responsible for 15% of the 150 named victims in the industry. Known for its lucrative 90/10 profit-sharing model, RansomHub exploits the sector’s interconnected systems, sensitive data, and trust-based operations as vulnerabilities. It employs tools like AnyDesk and ScreenConnect for remote access, Nmap and Angry IP Scanner for reconnaissance, and RClone for data exfiltration. Stolen data is weaponized in double-extortion schemes, with ransom demands averaging $6–9 million.
To defend against RansomHub:
- Audit and monitor remote-access tools—often used by IT teams in the finance and insurance sector but exploited by RansomHub affiliates—to detect unauthorized use. Limit access to approved applications, enforce strict controls, and set alerts for suspicious activity to protect financial systems.
- Deploy advanced data exfiltration controls to block high-value data transfers to cloud platforms in double-extortion schemes. Use DLP tools to flag unusual data flows, restrict cloud storage access, and monitor for exfiltration attempts to prevent fines and reputational damage.
- Harden your network against reconnaissance attacks by isolating high-value assets like databases and payment systems. Use early detection tools like honeypots or CanaryTokens to counter attackers using tools like Nmap and Angry IP Scanner.
What’s Next
Impersonating domains, ransomware campaigns by groups like RansomHub and Scattered Spider, and phishing via Microsoft Teams highlight how attackers refine tactics to exploit trust and evade defenses. These methods enable unauthorized access, credential theft, and ransomware deployment, severely disrupting operations and eroding customer trust. With a 152% rise in exploited network-edge vulnerabilities, securing unpatched systems has never been more critical.
Looking ahead to 2025, adopting proactive measures will help organizations address these evolving threats:
Social Engineering Surge
Social engineering attacks are expected to rise, fueled by the use of impersonating domains to steal credentials and infiltrate systems. Scattered Spider has shown the profitability of these tactics, inspiring others to scale them. Organizations should implement domain monitoring, enforce DMARC policies, and train employees to recognize social engineering methods.
Escalating State-Sponsored Threats
With tougher sanctions anticipated, North Korean groups like “Lazarus” are likely to intensify attacks on financial services. To counter these threats, organizations should adopt defense-in-depth strategies with MFA, network segmentation, endpoint protections, and continuous monitoring.
AI Model Poisoning Risks
AI-driven fraud detection systems will face increasing threats from model poisoning attacks aimed at enabling large-scale fraud. To mitigate this, organizations should employ robust data validation, adversarial testing, and real-time monitoring to detect and respond to anomalies.
