[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"industry-financial-services":3,"industry-news-financial-services":93,"gb-sectors-industry-financial-services":134},{"name":4,"slug":5,"sub_industries":6,"sub_industry_count":16,"associated_actors":17,"actor_count":71,"related_report_count":72,"created_at":73,"seoMetadata":74,"schemaOrg":78},"Financial Services","financial-services",[7,8,4,9,10,11,12,13,14,15],"Finance","Financial","Banking","Bank","Banks","Cryptocurrency","Bitcoin","Virtual Currencies","Insurance",10,[18,22,27,31,36,39,44,47,50,54,59,62,65,68],{"name":19,"slug":20,"country":21,"sponsor":21},"APT-C-36","apt-c-36","",{"name":23,"slug":24,"country":25,"sponsor":26},"WIZARD SPIDER","wizard-spider","RU","Russian Federation",{"name":28,"slug":29,"country":30,"sponsor":21},"Antlion","antlion","CN",{"name":32,"slug":33,"country":34,"sponsor":35},"Tortoiseshell","tortoiseshell","IR","Iran (Islamic Republic of)",{"name":37,"slug":38,"country":25,"sponsor":21},"TA505","ta505",{"name":40,"slug":41,"country":42,"sponsor":43},"Molerats","molerats","PS","Palestine",{"name":45,"slug":46,"country":21,"sponsor":21},"APT-C-12","apt-c-12",{"name":48,"slug":49,"country":42,"sponsor":43},"AridViper","aridviper",{"name":51,"slug":52,"country":30,"sponsor":53},"APT41","apt41","People's Republic of China",{"name":55,"slug":56,"country":57,"sponsor":58},"POLONIUM","polonium","LB","Lebanon",{"name":60,"slug":61,"country":30,"sponsor":21},"Earth Lusca","earth-lusca",{"name":63,"slug":64,"country":21,"sponsor":21},"NoName057(16)","noname057-16",{"name":66,"slug":67,"country":34,"sponsor":35},"APT42","apt42",{"name":69,"slug":70,"country":34,"sponsor":35},"Cotton Sandstorm","cotton-sandstorm",14,0,"2025-05-19T13:13:41.100324+00:00",{"title":75,"metaDescription":76,"keywords":77},"Financial Services Cybersecurity Threats | Industry Intelligence | Precursor","Explore cybersecurity threats targeting Financial Services. Discover 14 threat actors, attack patterns, and security insights for Finance, Financial, Financial Services and more.","Financial Services, Finance, Financial, Financial Services, Banking, Bank, cybersecurity, threat intelligence, industry threats, cyber attacks, threat actors",{"@context":79,"@type":80,"headline":81,"description":82,"author":83,"publisher":87,"about":90},"https:\u002F\u002Fschema.org","Article","Financial Services - Cybersecurity Threat Landscape","Comprehensive threat intelligence for the Financial Services sector",{"@type":84,"name":85,"url":86},"Organization","Precursor Security","https:\u002F\u002Fwww.precursorsecurity.com",{"@type":84,"name":88,"url":89},"Precursor Intelligence","https:\u002F\u002Fwww.precursorintelligence.com",{"@type":91,"name":4,"description":92},"Thing","Cybersecurity threats and threat actors targeting Financial Services",{"articles":94},[95,102,109,116,122,128],{"slug":96,"title":97,"summary":98,"hero_image_url":99,"story_type":100,"created_at":101},"lockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay","LockFile Ransomware Hijacks Windows Domains via PetitPotam NTLM Relay","LockFile ransomware gang is leveraging the PetitPotam NTLM relay attack (CVE-2021-36942) to take over Windows domain controllers, with initial access gained through ProxyShell on Exchange servers.","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Flockfile-ransomware-hijacks-windows-domains-via-petitpotam-ntlm-relay.png?v=3ebd8c1c3f","ransomware_incident","2026-09-26T07:06:42.867972+00:00",{"slug":103,"title":104,"summary":105,"hero_image_url":106,"story_type":107,"created_at":108},"gen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for","Gen Digital Researchers Unveil WordlistLoader and SynkLoader Malware Loaders for ClickFix Infostealer Delivery","Gen Digital researchers identified two new malware loaders, WordlistLoader and SynkLoader, that deliver infostealers and phishing credentials through the ClickFix technique and are sold to ransomware affiliates.","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fgen-digital-researchers-unveil-wordlistloader-and-synkloader-malware-loaders-for.png?v=ea5de72eef","threat_actor_activity","2026-09-25T12:05:45.613962+00:00",{"slug":110,"title":111,"summary":112,"hero_image_url":113,"story_type":114,"created_at":115},"unc6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor","UNC6671 Rebrands as Redact, Pink, Helix, and Falcon After Millions in Vishing Extortion","UNC6671, a data extortion group that rebranded from BlackFile in May 2026, has expanded into four new leak site brands — Redact, Pink, Helix, and Falcon — after raking in millions in extortion via vishing campaigns targeting enterprise employees.","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Func6671-rebrands-as-redact-pink-helix-and-falcon-after-millions-in-vishing-extor.png?v=bbab46fe3b","campaign","2026-09-22T07:04:26.729885+00:00",{"slug":117,"title":118,"summary":119,"hero_image_url":120,"story_type":100,"created_at":121},"silent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s","Silent Ransom Group Leaks Data from 64 Law Firms, Exposing Tens of Thousands of SSNs","Silent Ransom Group has published data from 64 law firms on its data leak site, including Troutman Pepper Locke, exposing tens of thousands of client SSNs and privileged legal documents.","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fsilent-ransom-group-leaks-data-from-64-law-firms-exposing-tens-of-thousands-of-s.png?v=0c6f6f75f0","2026-09-21T17:04:06.647891+00:00",{"slug":123,"title":124,"summary":125,"hero_image_url":126,"story_type":100,"created_at":127},"coinbasecartel-ransomware-group-claims-190-victims-across-17-sectors","CoinbaseCartel Ransomware Group Claims 190 Victims Across 17 Sectors","CoinbaseCartel, a data-exfiltration ransomware group that debuted in September 2025, has accumulated 190 claimed victims across 17 industry verticals, with recent hits on Turner & Townsend, Serruya PE, Sweet Water Holdings, Hitachi High-Tech, CEN\u002FCenelec, MIM Fertility, M.B. Kahn, Xs Cad, Accesso, Caterpillar, Colliers, PanasonicAero, Axiom Global, Demand.io, and Cambridge Mobile Telematics.","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fcoinbasecartel-ransomware-group-claims-190-victims-across-17-sectors.png?v=ad90ff5f5f","2026-09-18T17:05:03.820479+00:00",{"slug":129,"title":130,"summary":131,"hero_image_url":132,"story_type":107,"created_at":133},"ahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-","AhnLab ASEC Links Gunra Ransomware to State-Sponsored Actor in 'Operation Double Barrel'","AhnLab ASEC and four Korean government agencies jointly published 'Operation Double Barrel,' revealing a state-sponsored actor that has continuously distributed malware through Korean financial security software vulnerabilities since 2025 and linking it to the Gunra ransomware group through shared initial access, backdoors, SSH fingerprints, and C2 infrastructure.","https:\u002F\u002Fapi.precursorintelligence.com\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Fnews-heroes\u002Fahnlab-asec-links-gunra-ransomware-to-state-sponsored-actor-in-operation-double-.png?v=579bc98ad5","2026-09-18T07:15:06.272711+00:00",{"links":135,"canonical":21},[136,140,144],{"name":7,"slug":137,"count":138,"also":139},"finance",7,[],{"name":141,"slug":5,"count":142,"also":143},"Financial services",6,[8],{"name":12,"slug":145,"count":146,"also":147},"cryptocurrency",2,[]]