Financial Services Under Pressure: Ransomware, DDoS and the Identity Front

Financial services remain among the most-targeted sectors, facing a multi-vector threat: financially motivated ransomware and data extortion, ideologically motivated hacktivist DDoS tied to geopolitics, business email compromise and AI-enabled fraud, and heavy third-party and supply-chain exposure. FS-ISAC’s 2025 outlook flags AI-enabled fraud, supplier disruption, geopolitical exploitation, and more sophisticated DDoS and ransomware as top concerns, with lone actors, organised crime and nation-states all challenging operational resilience. Crypto and fintech face an additional distinct threat from DPRK state theft.

The Threat Vectors

• Social-engineering-led intrusion: help-desk impersonation/vishing and adversary-in-the-middle phishing to steal session tokens and bypass MFA. T1566 T1557 T1078
• Ransomware/extortion via stolen credentials, VPN/edge vulnerabilities and third-party providers. T1190
• Hacktivist DDoS — typically low lasting impact but reputationally disruptive. T1498 T1499
• BEC and fraud, increasingly AI-assisted. T1534

Who and What

• Scattered Spider / UNC3944: Google Threat Intelligence reported in 2025 it was aware of multiple intrusions against U.S. insurers potentially linked to the group (with the 2023 MGM incident as precedent); individual insurer incidents in 2025 were not officially attributed by the firms.
• Ransomware: Qilin, Akira and Clop featured heavily in financial-sector reporting (vendor telemetry — treat counts as indicative).
• Pro-Russia DDoS: NoName057(16) targeted Italian, Polish and Ukrainian institutions with generally minor impact; a mid-2025 law-enforcement operation disrupted its infrastructure, though activity continued.
• DPRK theft: crypto exchanges face state theft (for example the 2025 Bybit heist attributed by the FBI to a DPRK cluster). See our TraderTraitor profile.

Defensive Priorities

• Harden help desks: callback verification, no credential or MFA resets on inbound calls alone, and manager approval for device enrolment.
• Deploy phishing-resistant MFA (FIDO2/passkeys) and bind/shorten session tokens to blunt AiTM and token theft.
• Run a third-party risk programme: contractual security SLAs, continuous monitoring, segmented vendor access, and edge/MFT patch SLAs.
• Build DDoS resilience (upstream scrubbing, rate limiting, tested failover); patch edge/VPN rapidly; and enforce out-of-band payment verification with DMARC/DKIM/SPF against BEC.