The double-edged sword of heightened regulation for financial services

Financial services organizations are enticing targets for cybercriminals due to their significant wealth holdings, presenting abundant opportunities for monetary gain through extortion, theft, and fraud, according to Trustwave.

In addition to the money itself, the financial services sector stores large volumes of sensitive data, including customer information, financial records, and intellectual property.

“In a highly competitive B2B and B2C financial services industry, cybersecurity’s role earning and sustaining consumer trust is paramount as a competitive differentiator,” said Trustwave CISO Kory Daniels.

“For financial institutions, it isn’t just about protecting data, it’s about safeguarding the financial well-being and peace of mind of customers, partners, and investors. Our latest threat briefing is a valuable resource for business leaders and cyber defenders within the financial services sector, providing a comprehensive view of the threats observed by our SpiderLabs team, along with specific mitigation strategies to help organizations protect extremely sensitive data and assets,” Daniels continued.

What researchers have found:

• The Cl0p threat group accounted for 39% of ransomware incidents targeting the financial services sector.
• A majority of the targeted financial services companies reporting a breach are from the U.S. (51%) with India (9%), and Russia/Mexico (7%) coming in a far second and third, respectively.
• HTML attachments make up 78% of the file types being used for email-borne malware attachments. 33% of these HTML files employ obfuscation as a means of defense evasion.

Distinct cybersecurity challenges in the financial services sector

Sensitive data: The financial services industry holds a vast amount of sensitive customer data, including names, addresses, Social Security numbers, bank account numbers, and credit card numbers, making the sector a high-value target. Organizations must be vigilant and inventory where this data resides. It’s impossible to protect something without knowing where it is.

Heavily regulated: Heightened regulation is a double-edged sword. While it incentivizes increased protections, it can also make it complex and expensive for financial institutions to implement and maintain effective cybersecurity programs.

Trust as currency: Consumers anchor their financial decisions on trust. If trust is eroded by the compromise of personal data or account information, customers can and will take their money elsewhere. This means they are a prime target for cyber criminals who will try to exploit this dependency on trust.

Partnership complexity: As a byproduct of strict regulations, it can be difficult for financial institutions to partner with vendors or incorporate tools that could improve their security posture. There are unique barriers and requirements for partners, adding complexity to an already complicated landscape.

Interconnectedness: In addition to business partners, the financial services industry is heavily interconnected with other service vendors and financial entities, such as merchants and payment processors, opening it up to supply chain and third-party risk.

Common threat actors and tactics

Threat actors:

• Cl0p
• LockBit
• Alphv / BlackCat
• Black Basta
• 8Base
• Royal

Threat tactics:

• Email-borne malicious attachments (downloaders, HTML smuggling)
• Phishing (IPFS, Google/Cloudflare Services, RPMSG)
• BEC (Payroll diversion, contact request)
• Vulnerability exploitation
• Credential access (brute forcing, abuse of valid accounts)
• Malware (infostealers, ransomware)