Who is targeting financial services organisations?
Public reporting links 14 threat groups to attacks on financial services organisations, including APT-C-36, WIZARD SPIDER and Antlion. 8 of them are thought to have state backing. This page lists them and where they are thought to operate from, so you can see who might come after a business like yours.
Free to readNo account neededBuilt from public reporting
- Threat groups linked
- 14
- Sectors with their own page
- 3
- Suspected state backing
- 8 of 14
- Countries of origin
- 5
Which groups target financial services organisations?
All 14 groups public reporting links to this sector. Open one to see who it is, how it works and the sources behind it.
- ?APT-C-36Origin not known
- RUWIZARD SPIDERThought to operate from Russia · Suspected state backing
- CNAntlionThought to operate from China
- IRTortoiseshellThought to operate from Iran · Suspected state backing
- RUTA505Thought to operate from Russia
- PSMoleratsThought to operate from Palestinian Territories · Suspected state backing
- ?APT-C-12Origin not known
- PSAridViperThought to operate from Palestinian Territories · Suspected state backing
- CNAPT41Thought to operate from China · Suspected state backing
- LBPOLONIUMThought to operate from Lebanon · Suspected state backing
- CNEarth LuscaThought to operate from China
- ?NoName057(16)Origin not known
- IRAPT42Thought to operate from Iran · Suspected state backing
- IRCotton SandstormThought to operate from Iran · Suspected state backing
Financial services in the news
- LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay26 Sept 2026
- Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery25 Sept 2026
- UNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion22 Sept 2026
- Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs21 Sept 2026
- CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors18 Sept 2026
- AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'18 Sept 2026
What counts as financial services?
Public reporting describes victims in many ways. These narrower sectors each have their own list of groups. Names that mean the same thing share one page.
Public reporting links 14 threat groups to attacks on financial services organisations, including APT-C-36, WIZARD SPIDER, Antlion, Tortoiseshell and TA505.
Most are thought to operate from China (3), Iran (3) and Russia (2). 8 of the 14 are thought to have backing from a government.
Public reporting describes financial services victims in several ways. The narrower sectors with groups of their own are finance (7), financial services (6) and cryptocurrency (2).
Create an account and tell us the software you run. We match it against known flaws, rank each one from 0 to 100 using evidence it is being exploited, let you know as soon as something changes that affects you, and show which groups and ransomware gangs are hitting your sector.
Is your business on their list?
This page shows who targets financial services organisations. Your account shows what that means for you: we match the software you run to the flaws threat groups use, rank them 0 to 100 and tell you as soon as we spot something that affects you.
- Over 900 group profiles in the app, every claim backed by a quote and a source link.
- Your sector at a glance: which threat groups and ransomware gangs are hitting it.
- Flaws in the software you run, ranked 0 to 100, with threat group activity counted in.
- A PDF dossier on any group, ready to send to your board or your IT provider.
Know who targets your sector, and what to fix first.
Create a free account and tell us the software you run. We match the software you run against flaws threat groups use, rank them 0 to 100 and keep watching, so you hear about it as soon as we know.
No card neededNothing to installIntelligence and alerts free