[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"industry-financial-services":3,"industry-news-financial-services":91,"gb-sectors-industry-financial-services":132},{"name":4,"slug":5,"sub_industries":6,"sub_industry_count":16,"associated_actors":17,"actor_count":71,"related_report_count":72,"created_at":73,"seoMetadata":74,"schemaOrg":78},"Financial Services","financial-services",[7,8,4,9,10,11,12,13,14,15],"Finance","Financial","Banking","Bank","Banks","Cryptocurrency","Bitcoin","Virtual Currencies","Insurance",10,[18,22,27,31,36,39,44,47,50,54,59,62,65,68],{"name":19,"slug":20,"country":21,"sponsor":21},"APT-C-36","apt-c-36","",{"name":23,"slug":24,"country":25,"sponsor":26},"WIZARD SPIDER","wizard-spider","RU","Russian Federation",{"name":28,"slug":29,"country":30,"sponsor":21},"Antlion","antlion","CN",{"name":32,"slug":33,"country":34,"sponsor":35},"Tortoiseshell","tortoiseshell","IR","Iran (Islamic Republic of)",{"name":37,"slug":38,"country":25,"sponsor":21},"TA505","ta505",{"name":40,"slug":41,"country":42,"sponsor":43},"Molerats","molerats","PS","Palestine",{"name":45,"slug":46,"country":21,"sponsor":21},"APT-C-12","apt-c-12",{"name":48,"slug":49,"country":42,"sponsor":43},"AridViper","aridviper",{"name":51,"slug":52,"country":30,"sponsor":53},"APT41","apt41","People's Republic of China",{"name":55,"slug":56,"country":57,"sponsor":58},"POLONIUM","polonium","LB","Lebanon",{"name":60,"slug":61,"country":30,"sponsor":21},"Earth Lusca","earth-lusca",{"name":63,"slug":64,"country":21,"sponsor":21},"NoName057(16)","noname057-16",{"name":66,"slug":67,"country":34,"sponsor":35},"APT42","apt42",{"name":69,"slug":70,"country":34,"sponsor":35},"Cotton Sandstorm","cotton-sandstorm",14,0,"2025-05-19T13:13:41.100324+00:00",{"title":75,"metaDescription":76,"keywords":77},"Financial Services Cybersecurity Threats | Industry Intelligence | EdgeProtect","Explore cybersecurity threats targeting Financial Services. Discover 14 threat actors, attack patterns, and security insights for Finance, Financial, Financial Services and more.","Financial Services, Finance, Financial, Financial Services, Banking, Bank, cybersecurity, threat intelligence, industry threats, cyber attacks, threat actors",{"@context":79,"@type":80,"headline":81,"description":82,"author":83,"publisher":87,"about":88},"https:\u002F\u002Fschema.org","Article","Financial Services - Cybersecurity Threat Landscape","Comprehensive threat intelligence for the Financial Services sector",{"@type":84,"name":85,"url":86},"Organization","EdgeProtect","https:\u002F\u002Fwww.edgeprotect.io",{"@type":84,"name":85,"url":86},{"@type":89,"name":4,"description":90},"Thing","Cybersecurity threats and threat actors targeting Financial Services",{"articles":92},[93,100,106,113,119,125],{"slug":94,"title":95,"summary":96,"hero_image_url":97,"story_type":98,"created_at":99},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Claims Troutman Pepper Locke Leak as Its Site Lists 64 Law Firms","Silent Ransom Group's leak site listed 64 law firms in August 2026, according to DataBreaches.net, and the group claims it leaked data taken from Troutman Pepper Locke. The firm says an employee was targeted by social engineering and sent documents to an unauthorised party, but that no one gained access to its environment.","https:\u002F\u002Fapi.edgeprotect.io\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","ransomware_incident","2026-09-21T17:04:06.647891+00:00",{"slug":101,"title":102,"summary":103,"hero_image_url":104,"story_type":98,"created_at":105},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Extortion Group Has Listed More Than 200 Claimed Victims","CoinbaseCartel, a data-theft extortion group that appeared in September 2025, has 207 claimed victims on ransomware.live, 76 of them in the US; researchers link its access mainly to reused infostealer credentials, while a suggested tie to the Scattered LAPSUS$ Hunters ecosystem remains unconfirmed.","https:\u002F\u002Fapi.edgeprotect.io\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00",{"slug":107,"title":108,"summary":109,"hero_image_url":110,"story_type":111,"created_at":112},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC, with Korea's National Intelligence Service, National Police Agency, KISA and the Financial Security Institute, published 'Operation Double Barrel' on 30 July 2026, describing a state-sponsored actor that has exploited Korean financial security software since 2025 and the overlaps it shares with Gunra ransomware intrusions.","https:\u002F\u002Fapi.edgeprotect.io\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","threat_actor_activity","2026-09-18T07:15:06.272711+00:00",{"slug":114,"title":115,"summary":116,"hero_image_url":117,"story_type":111,"created_at":118},"shinyhunters-bypasses-mfa-with-salesforce-oauth-playbook","Cato CTRL Profiles ShinyHunters: Help-Desk Vishing and Trusted OAuth Apps Sidestep MFA","Cato CTRL's threat actor profile of ShinyHunters, published on 18 June 2026, describes how the UNC6040 campaign talked employees into approving a malicious Salesforce connected app and how the related UNC6395 cluster used stolen Salesloft Drift OAuth tokens, gaining access without compromising passwords or MFA.","https:\u002F\u002Fapi.edgeprotect.io\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fshinyhunters-bypasses-mfa-with-salesforce-oauth-playbook.png?v=cacb0fd7ee","2026-09-05T07:16:15.004025+00:00",{"slug":120,"title":121,"summary":122,"hero_image_url":123,"story_type":111,"created_at":124},"muddywater-disguises-espionage-campaign-as-chaos-ransomware","MuddyWater disguised espionage intrusion as Chaos ransomware, Rapid7 reported in May","In May 2026 Rapid7 reported an intrusion that carried Chaos ransomware branding but, in its assessment, was an espionage operation by the Iranian state-linked group MuddyWater. The attackers gained access through Microsoft Teams social engineering, stole credentials, deployed a custom backdoor and exfiltrated data, and Rapid7 found no file encryption despite the Chaos artefacts.","https:\u002F\u002Fapi.edgeprotect.io\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fmuddywater-disguises-espionage-campaign-as-chaos-ransomware.png?v=db93f0d1eb","2026-09-02T07:19:02.642087+00:00",{"slug":126,"title":127,"summary":128,"hero_image_url":129,"story_type":130,"created_at":131},"attackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ","Attackers Exploit SharePoint Authentication Bypass CVE-2026-55040 Following Public PoC Release","Attackers are using Rapid7's public proof of concept for CVE-2026-55040, a CVSS 9.1 SharePoint Server authentication bypass in JWT token validation that Microsoft patched on 14 July 2026. Honeypot operators reported attempts in August, with some recorded as early as 19 July, and CISA added the flaw to KEV on 18 August.","https:\u002F\u002Fapi.edgeprotect.io\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fattackers-exploit-sharepoint-authentication-bypass-cve-2026-55040-following-publ.png?v=e552a921da","exploitation","2026-08-18T18:47:03.864693+00:00",{"links":133,"canonical":21},[134,138,142],{"name":7,"slug":135,"count":136,"also":137},"finance",7,[],{"name":139,"slug":5,"count":140,"also":141},"Financial services",6,[8],{"name":12,"slug":143,"count":144,"also":145},"cryptocurrency",2,[]]