Threat Actors Targeting Financial Services

Financial institutions face the widest range of adversaries of any sector, from state-run units stealing money for a government to teenagers phoning the help desk, and a threat model that treats them as one "cybercriminal" category will defend the wrong systems. This guide maps the groups that public sources link to attacks on banks, payment firms, insurers, exchanges and crypto-asset businesses, grouped by what they want and which systems they go after. For each cluster it gives the MITRE ATT&CK identifiers, the techniques that matter, and the controls and detections that blunt them. It is written for threat intelligence analysts, CISOs and security architects in financial services who need to prioritise. It complements the general Threat Actor Groups Guide, which explains naming schemes and attribution, and does not repeat it.

Key takeaways

Four motives, four target sets. State-backed theft goes for payment switches, SWIFT terminals and crypto wallets; bank-focused criminal crews go for ATMs and card processing; extortion crews go for identity systems and data; espionage groups go for policy and deal information.
North Korea is the outlier. The US government attributes bank and crypto theft to North Korea's Reconnaissance General Bureau, including the 2016 Bangladesh Bank theft and, per the FBI, the roughly 1.5 billion US dollar Bybit theft in February 2025.
Identity is now the main entry point. Help desk social engineering, SIM swapping and MFA fatigue (CISA and FBI on Scattered Spider) bypass perimeter controls and land directly in single sign-on.
Payment infrastructure needs its own threat model. CISA's FASTCash advisory describes malware on payment switch servers approving fraudulent ATM withdrawals, so switch servers, HSM links and messaging interfaces need segmentation, MFA and transaction baselining.
Insiders and suppliers are part of the actor set. Bribed support staff and compromised developer or vendor sessions have produced some of the largest recent losses, without any perimeter breach.

The actor landscape by motive

The table groups actors that MITRE ATT&CK v20 or government advisories link to financial sector targeting. Names follow ATT&CK; aliases are those ATT&CK lists.

Cluster	Examples (ATT&CK ID, selected aliases)	What they want	Primary targets
State-sponsored theft	APT38 (G0082; BeagleBoyz, Bluenoroff, Sapphire Sleet); Lazarus Group (G0032); AppleJeus (G1049)	Hard currency and crypto-assets for the state	SWIFT terminals, payment switches, ATM networks, crypto exchanges and wallet infrastructure
Bank-focused criminal crews	Carbanak (G0008; Anunak); Cobalt Group (G0080); Silence (G0091); GCMAN (G0036); DarkVishnya (G0105); FIN13 (G1016)	Direct theft from the institution	ATM control, card processing, internal payment systems, account balances
Banking trojan operators	Indrik Spider (G0119; Evil Corp), originally Dridex; Wizard Spider (G0102), originally TrickBot; RTM (G0048); Malteiro (G1026); APT-C-36 (G0099)	Customer and corporate online banking credentials, later ransomware	Bank customers, treasury staff, regional banks in Latin America and Eastern Europe
Payment card and retail-adjacent	FIN7 (G0046; Carbon Spider, Sangria Tempest); FIN6 (G0037); FIN8 (G0061)	Card data and later ransomware or extortion	Card processing, point of sale, merchants, insurers and financial firms
Identity-led extortion	Scattered Spider (G1015; UNC3944, Octo Tempest)	Data theft for extortion, sometimes encryption	Help desks, SSO and identity providers, virtualisation, SaaS data
Espionage	OilRig (G0049) and APT41 (G0096), both of which ATT&CK lists with financial targets	Policy, deal, sanctions and customer intelligence	Executives, policy teams, international payments and trade finance data
Hacktivists	DDoS collectives such as NoName057(16) (see the NoName057 DDoS Hacktivist Group Profile Guide)	Disruption and publicity	Public websites and online banking front ends

ATT&CK descriptions date the clusters: Carbanak has targeted financial institutions since at least 2013, Cobalt Group since at least 2016 (including ATM systems, card processing, payment systems and SWIFT), Silence since June 2016 (mainly Russia, Ukraine, Belarus, Azerbaijan, Poland and Kazakhstan), and APT38 since at least 2014. Europol reported that the Carbanak and Cobalt campaigns hit more than 100 financial institutions in 40 countries, with losses of about 1 billion euros, before a leader was arrested in Spain in an operation supported by Europol and the FBI.

State-sponsored theft: North Korea

North Korean operations are the only state activity in this sector whose main purpose is stealing money. The joint advisory CISA AA20-239A attributes the BeagleBoyz (overlapping with APT38, Lazarus and Bluenoroff) to the Reconnaissance General Bureau and describes three lines of attack.

SWIFT abuse: compromised SWIFT terminals used to send fraudulent transfers since at least 2015, including the 2016 theft of 81 million US dollars from Bangladesh Bank, where the Federal Reserve Bank of New York stopped the rest of an attempted 1 billion US dollar transfer.
FASTCash ATM cash-outs: since 2016, malware on bank payment switch servers (AIX and Windows) intercepts ISO 8583 authorisation requests for chosen accounts and returns fraudulent approvals, so the issuer never sees the transactions. CISA reports one incident producing cash-outs in more than 30 countries.
Crypto-asset theft: exchanges and wallet providers, sometimes hundreds of millions of US dollars per incident. The FBI attributed the theft of about 1.5 billion US dollars from Bybit, around 21 February 2025, to the activity it calls TraderTraitor. The Bybit hack page shows how a developer's live cloud session tokens, not a bank network breach, made it possible.

CISA estimates the group attempted to steal nearly 2 billion US dollars since at least 2015. Defensively the lesson is that the money movement systems themselves (switch, messaging interface, signing workflow) are the target, so they need monitoring at transaction level, not only at network level. See the APT38 Threat Actor Profile Guide and the Lazarus Group Threat Actor Profile.

Criminal crews: from ATM jackpots to identity-led extortion

Bank-focused crews

Carbanak, Cobalt Group and Silence typified the 2013 to 2019 model: spearphishing bank staff (T1566.001), months of reconnaissance inside the network, then theft through ATM dispensing, inflated balances or fraudulent internal transfers (T1657 Financial Theft). ATT&CK describes DarkVishnya attacking at least eight Eastern European banks in 2017 and 2018. These crews show that a bank's own operations staff and back-office tools are the attack surface. See the ATM Security Guide.

Banking trojans that became ransomware

Indrik Spider started with the Dridex banking trojan and Wizard Spider with TrickBot, both stealing online banking credentials, before both groups moved to ransomware. Regional operators continue the original model: ATT&CK lists Malteiro (Mispadu, Brazil), RTM (remote banking users in Russia) and APT-C-36 (Colombia and Latin America). See the Evil Corp Threat Actor Profile Guide.

Identity-led extortion

The joint FBI and CISA advisory AA23-320A (published 16 November 2023, updated 21 November 2023) describes Scattered Spider impersonating IT and help desk staff by phone and text (T1566.004), SIM swapping to intercept codes, prompting MFA fatigue (T1621), registering its own MFA devices (T1556.006), adding a federated identity provider to the victim's SSO tenant (T1484.002) and installing legitimate remote access tools (T1219). These groups do not need a banking-specific technique: a financial firm's help desk is the target. See the Scattered Spider Threat Actor Profile and the Help Desk Social Engineering Incident Playbook.

Card and payment crews

FIN7, FIN6 and FIN8 began with point of sale and card data and moved into ransomware partnerships. ATT&CK lists financial services and insurance among FIN7 and FIN8 targets. See the FIN7 Threat Actor Profile and the FIN6 Threat Actor Profile Guide.

What they target: systems and techniques

Target system	Actor clusters	Key ATT&CK techniques	Control that blunts it
Payment messaging (SWIFT and similar)	State theft, bank crews	T1078 Valid Accounts; T1657 Financial Theft; T1565.002 Transmitted Data Manipulation	Swift CSP controls, isolated secure zone, operator MFA, out-of-band confirmation of high-value transfers
Payment switch and ATM authorisation	State theft (FASTCash), bank crews	T1565.003 Runtime Data Manipulation; T1657	CISA AA20-239A: MFA on switch access, isolate payment infrastructure, mutual TLS to payment engines, validate cryptograms and MACs, baseline switch transactions
Crypto wallets and signing	State theft	T1195.002 Compromise Software Supply Chain; T1539 Steal Web Session Cookie; T1657	Independent transaction verification at signing, short-lived developer sessions, pipeline-only publishing rights
Help desk, SSO and MFA	Identity-led extortion	T1566.004; T1621; T1556.006; T1484.002	Phishing-resistant MFA, verified caller identity before resets, alerts on new federation trusts
Employee and treasury endpoints	Banking trojans, card crews	T1566.001; T1078; T1219 Remote Access Tools	Macro and script blocking, application allowlisting for remote access tools, EDR
Customer channels	Banking trojans, hacktivists	T1498 Network Denial of Service; credential replay	DDoS protection, risk-based customer authentication, transaction monitoring
Third parties and outsourced staff	All clusters	T1199 Trusted Relationship	Least-privilege vendor access, session recording, supplier assessments

For channel and customer-side fraud see the Fraud and Cyber Convergence Guide and the DDoS Protection Guide.

Where identity fits

Almost every cluster above ends up using a legitimate identity, human or machine, to move money or data.

Operator accounts on payment systems: SWIFT and switch operators are privileged users. Put them behind privileged access management with session recording, dual control for releases and no standing access. See the Financial Services Identity Security Guide.
Machine identities in payment flows: service accounts, HSM credentials, API keys for payment engines and certificates for mutual TLS are what FASTCash-style malware and supply chain attacks abuse. Inventory them, scope them to one system and rotate them.
Developer and cloud sessions: the Bybit case shows that a session token on a developer laptop can be a privileged machine credential in all but name.
Support and contractor accounts: the Coinbase insider breach shows bribed support staff copying customer records using access they already had, which no perimeter control would stop. Limit support tools to the records a live case needs and alert on bulk access.

Turning the actor map into defence

Build a sector threat profile: pick the clusters relevant to your business lines (a retail bank with ATMs, a custodian, a crypto exchange and an insurer have different lists) and record them with ATT&CK IDs (NIST CSF 2.0 ID.RA-03).
Map crown-jewel money flows: document every path that can move value (payment messaging, switch, treasury, wallet signing, card issuing) with the human and machine identities on each.
Join sector sharing: consume FS-ISAC or national CERT feeds and government advisories (ID.RA-02) and turn each advisory into detection or control work items with an owner.
Prioritise techniques, not groups: count how many relevant actors use each technique; help desk resets, valid accounts and remote access tools usually rank first.
Test against the profile: run threat-led tests (TIBER-EU, CBEST or iCAST style) scoped to the actors you selected. See the Threat-Led Penetration Testing Guide.
Review twice a year: retire stale actors, add new ones and record the decision.

Small and large institutions

A small credit union or payments start-up cannot track 40 groups. It should focus on three things that cover most clusters: phishing-resistant MFA with a verified help desk process, strict control of remote access tools, and its payment provider's security obligations (such as Swift's Customer Security Programme, which Swift describes as mandatory and which requires an annual attestation and an independent assessment). A large bank should run a dedicated intelligence function with actor-specific detection content, purple teaming against named groups and transaction-level monitoring on payment systems.

Detection and measurement

Signal	Source	Actor cluster
Payment switch approvals with no matching issuer authorisation, or unusual approval patterns for specific card ranges	Switch transaction logs baselined per CISA AA20-239A	State theft (FASTCash)
Payment messages outside business hours, to new beneficiaries or above normal values; gaps in message sequence	Messaging interface journals, reconciliation	State theft, bank crews
MFA method registered shortly after a help desk reset; new federated identity provider or domain trust	Identity provider audit logs	Identity-led extortion
New remote access tool installed on a workstation or server	EDR, software inventory	Identity-led extortion, card crews
Bulk record access by support or contractor accounts	Application audit logs, UEBA	Insiders and recruited staff
Session token use from a new device or location for cloud admin or code publishing roles	Cloud audit logs	State theft (crypto)

Metrics:

Percentage of prioritised actor techniques with at least one tested detection.
Time from a government advisory being published to detection content deployed and controls checked.
Percentage of payment operator and help desk accounts using phishing-resistant MFA.
Number of standing privileged accounts on payment systems, trending to zero.
Help desk reset requests verified by a second channel, as a percentage of all resets.

Framework mapping

Framework	Reference	How it applies
NIST CSF 2.0	ID.RA-02, ID.RA-03, DE.CM-01, GV.SC-07	Receive threat intelligence, record threats, monitor networks, manage supplier risk
NIST SP 800-53 Rev. 5	PM-16 Threat Awareness Program; RA-3 Risk Assessment; SI-4 System Monitoring; IR-4 Incident Handling; AC-17 Remote Access; SR-6 Supplier Assessments and Reviews	Threat programme, risk assessment against named actors, monitoring and response
ISO/IEC 27001:2022 Annex A	A.5.7 Threat intelligence; A.5.19 Information security in supplier relationships	Collecting and acting on actor intelligence; third-party controls
Swift Customer Security Programme	Customer Security Controls Framework, annual attestation	Baseline for institutions on the Swift network
MITRE ATT&CK v20	Groups and techniques listed above	Common language for the profile and detections

For the regulatory side (DORA, NYDFS, FFIEC and others) see the Financial Services Cyber Regulation Map.

Common failure patterns

One "cybercrime" bucket: treating Scattered Spider and APT38 as the same kind of risk leads to perimeter spending when the real exposures are help desk and payment switch.
Payment systems outside the SOC: switch and messaging logs never reach the SIEM, so the transaction anomalies CISA describes go unseen.
Trusting the authenticated session: controls stop at login, while stolen session tokens and approved MFA prompts carry the attacker straight through, as in the Bybit case.
Help desk resets without proof: a caller who knows an employee number and manager name gets a new MFA device. The fix is a second verified channel.
Insider access sized for convenience: outsourced support staff see every customer record, so a bribe is all an attacker needs, as the Coinbase case showed.
Intelligence without action: advisories are read and filed without a tracked control or detection change.

Practitioner checklist

Write a sector threat profile naming 8 to 15 relevant actors with ATT&CK IDs and a reason each is in scope.
Map every value-moving system and the human and machine identities that can act on it.
Feed payment switch, messaging and signing logs into monitoring with transaction baselines.
Apply the CISA AA20-239A controls to payment switch servers: MFA, isolation, mutual TLS, cryptogram and MAC validation.
Require phishing-resistant MFA for payment operators, administrators and help desk staff.
Require second-channel verification for every MFA or password reset requested by phone or chat.
Block unapproved remote access tools and alert on new federation trusts and MFA registrations.
Limit support and contractor access to case-scoped records and alert on bulk access.
Track time from advisory to deployed detection as a standing metric.

Threat Actors Targeting Financial Services Guide: Who attacks banks and how to defend