FINANCE – Quarterly Threat Landscape : Q3 2026

Published On : 2026-11-13

LANDSCAPE · SECTOR LENS

FINANCE – Quarterly Threat Landscape · Q3 2026

1 July to 30 September 2026, compared with Q2 2026
2026 to date through 31 October · issued 11 November 2026

OVERVIEW

Finance’s busiest ransomware quarter on record, with crypto as the common thread

KEY JUDGMENTS

• Ransomware hit a record. 156 finance victims (+47%), finance share up to 5.3%; 40% came from groups that did not exist in Q1.
• Crypto ties the quarter together. Wallet lures drove finance phishing up 50%, North Korean groups ran a cluster of crypto theft operations, and crypto and payment fraud posts rose 59% underground.
• Finance software flaws nearly doubled. 104 financespecific CVEs (55 in Q2), 73 rated critical or high, led by payment-transaction and core-banking platforms.
• The network edge is still the front door. VPN and firewall flaws are the most reported way in for the leading groups; CISA added 94 exploited flaws to its catalogue (+42%), and 32 more in October, including PHP2Shell, exploited before it was disclosed.
• State actors keep finance in focus. Finance was named in 22% of active campaigns (19% in Q2), led by China-linked espionage and North Korean theft.

Q3 IN NUMBERS

1. Does this affect me? Yes, broadly. Banks, fintech and payments, and investment firms took the biggest rises in leak-site victims; North America and Europe absorbed most of the growth.
2. How exposed am I? Most exposed through internetfacing gateways (Fortinet, Check Point, Citrix NetScaler, Cisco IOS XE), backup and hypervisor platforms, and crypto-facing customer channels.
3. What should I do now? Patch edge devices within days, harden backups and hypervisors, add wallet and brandimpersonation takedowns, and track new ransomware groups, not just the big names.

OVERVIEW · 2026 SO FAR

How Q3 compares with the rest of 2026

Each panel shows the same measure for Q3 2025, the first three quarters of 2026 and October. Counts are used where collection was steady; shares of the whole dataset are used where collection changed (state actor reporting, CVE volumes, underground and research feeds). The dashed outline on October shows the quarter it would make at the same pace.

THE YEAR IN ONE PARAGRAPH
2026 built steadily toward a third-quarter peak. Ransomware against finance rose every quarter (93, 106, 156) and is already +33% ahead of the same months of 2025. Finance phishing grew from 1,079 in Q1 to 2,657 in Q3, carried by cryptocurrency wallet lures. Finance-specific vulnerabilities climbed from 20 to 104, and October (50) suggests Q4 will be higher still.

WHAT OCTOBER TELLS US ABOUT Q4
October finance ransomware victims ran −23% below the Q3 monthly pace while all-sector victims hit a record. Finance’s share of active state-actor campaigns rose to 32%, phishing held its Q3 pace (897), and the finance share of underground posts edged up to 6.0%. Only malware research turned down (16% from 20%).

RANSOMWARE & EXTORTION

Finance leak-site victims hit a record high

WHAT HAPPENED
Ransomware groups named 156 finance organisations on leak sites in Q3, up from 106 in Q2 and the highest quarter in our records. Every month of Q3 (50, 59, 47) beat every month of 2025 except September 2025.

Finance did not just ride the wider increase. All victims rose +26%; finance rose +47%, so its share climbed from 4.6% to 5.3%.

The quarter was driven by new and small groups: 50 different groups hit finance (37 in Q2), and 40% of victims came from groups that first posted after 1 April.

OCTOBER SIGNAL
October posted 40 finance victims, below the Q3 pace of 52 a month, while all-sector victims hit a record 1,184. Finance share fell to 3.4%. The exception is Qilin: 12 finance victims in October, double its previous 2026 monthly high (6).

Right: finance share of each region’s Q3 victims (worldwide 5.3%). Europe more than doubled (13 to 32); the United States alone accounts for 68 of 156. Africa stands out: finance is 19% of its victims (12 of 63, small numbers).

Banks moved to the front. Retail and commercial banks: 28 victims in Q3, three times Q2 (9). Fintech and payments more than doubled.

FINANCE SPECIALISTS
groups where finance is at least twice the worldwide share (5.3%) of their Q3 victims

RANSOMWARE & EXTORTION · CONTINUED

Who is hitting finance, and how they get in

Right: share of the group’s own Q3 victims that are finance. NEW = first leak-site post after 1 April 2026.

KNOWN EXPLOITED FLAWS REPORTED FOR THESE GROUPS

CVE	PRODUCT (CISA KEV)	GROUP	LAST REPORTED
CVE-2026-50751	Check Point Security Gateway	Qilin	2026-10
CVE-2024-55591	Fortinet FortiOS and FortiProxy	Qilin, The Gentlemen	2026-05
CVE-2023-27532	Veeam Backup & Replication	Qilin, The Gentlemen	2026-03
CVE-2025-32463	Sudo	The Gentlemen	2026-03
CVE-2024-37085	VMware ESXi	The Gentlemen	2026-03
CVE-2024-21762	Fortinet FortiOS	Qilin	2025-09

Qilin was reported in October using a Check Point Security Gateway flaw (CVE-2026-50751, added to KEV with known ransomware use). Qilin is a ransomware-as-a-service group; the North Korean group Moonstone Sleet has been reported using it, which does not make Qilin itself state-run.

▲
Q4 2026 OUTLOOK
STAYS HIGH
Volume easing, Qilin rising

If October’s pace holds, Q4 ends near 120 finance victims: below Q3 but above every 2025 quarter. Two things could push it back up: Qilin’s October surge, and the steady flow of new groups, four of which (Storm, CRPxO, Global Secret Group, Wallstreet) put finance well above average in their target mix.

WHAT TO DO NOW

1. Patch the edge first. VPN and firewall flaws are the most reported way in for Qilin and The Gentlemen.
2. Protect backups and hypervisors. Veeam and VMware ESXi flaws recur across the leading groups.
3. Watch new groups, not just big names. 40% of Q3 finance victims came from groups that did not exist in Q1.

Risk score 8.7 = 35% momentum (finance leak-site victims, Q3 vs Q2 +47%, scored 8.8) + 35% level (Q3 vs the Q1 to Q2 average, 1.57x, scored 8.4) + 30% impact weight (9 of 10). Measured as a count. Victims are organisations named on leak sites, dated by post date (not attack date), from CYFIRMA’s curated ransomware log; Q3 classification confidence: 93 high, 59 medium, 4 low.

RANSOMWARE & EXTORTION · BY SECTOR

Banks, fintech and lenders drive the rise; wealth advisers are the exception

New groups = share of the sub-sector’s Q3 victims posted by groups first seen after 1 April 2026. 2026 = January to October. Sub-sector counts under 10 are indicative only.

• Storm is a bank hunter. The new group (first post August 2026) posted 9 of the 36 banking victims in Q3, more than any other group, and banking victims more than doubled (16 to 36). 15 of 28 retail bank victims came from groups new since April.
• Lenders and collectors are a rising soft target. Lending and credit victims rose +69% (13 to 22), led by small groups such as Krybit and Coinbase Cartel. These firms hold rich personal and financial data with leaner security teams.
• The Gentlemen lean on insurers. 9 of 41 insurance victims, with property and casualty insurers and brokers its main targets. Qilin leads investment and wealth firms.
• The one decline: wealth advisers. Financial advisory and wealth management fell from 17 to 10, after a busy Q2. Asset managers and investment firms rose instead, so the investment segment as a whole still grew.

RANSOMWARE & EXTORTION · GEOGRAPHY

The United States carries the load; Europe and Africa punch above their weight

Over-representation shown only where a country posted at least 30 victims of all sectors and 3 finance victims in Q3. Above 1.5x (red) finance is hit noticeably more often than elsewhere.

The United States had 68 of 156 finance victims (44%), close to its share of all victims, so finance is not singled out there. The concentration is in the groups: Storm and CRPxO hit North American banks, while Europe saw a broader spread of groups.

RANSOMWARE & EXTORTION · HOW THEY OPERATE

MITRE ATT&CK: in through the edge, out with the backups

Techniques, tools and access methods reported for the groups that hit finance in Q3, weighted by each group’s finance victims. Profiles cover 14 of 50 groups (71 of 156 victims, 46%); most small new groups have none yet.

FAMILY TIES

• Qilin is reported partnering with DragonForce and LockBit 3.0, and shares toolkits with The Gentlemen (a lead for analyst review, not attribution).
• LockBit 5.0 continues the LockBit 3.0 family.
• Storm, the bank specialist, is a candidate successor of the Sinobi group (unconfirmed).

TOOLS THEY USE

finance victims of groups using the tool

• System tools vssadmin · 39
• Remote access AnyDesk · 37
• Lateral movement PsExec · 33
• ESXi tooling esxcli · 32
• System tools Impacket · 31
• ESXi tooling esxcfg-advcfg · 31
• ESXi tooling vmkfstools · 31
• Lateral movement NetExec · 31
• Discovery Advanced IP Scanner · 30
• Exfiltration WinSCP · 28
• Credential theft Mimikatz · 26
• System tools bcdedit · 24

What the pattern says. Data encryption (T1486) and backup deletion (T1490) appear for almost every profiled group, and ESXi tools (esxcli, vmkfstools) for the groups behind 32 finance victims. Remote-access software (AnyDesk) and PsExec are the most common ways to move once inside.

STATE & ORGANISED ACTORS

Finance draws a larger share of state activity, and North Korea is stealing

MOST-USED TECHNIQUES IN FINANCE CAMPAIGNS

• T1190 Exploit Public-Facing Application · 5
• T1595 Active Scanning · 4
• T1090 Proxy · 3
• T1528 Steal Application Access Token · 3

North Korea’s September theft cluster. Four reports in one week described UNC1069 (CryptoCore), Jade Sleet and IT-worker schemes against crypto and fintech firms, while Lazarus’ Binance heist activity ran from June to October.

▲
Q4 2026 OUTLOOK
STAYS HIGH
DPRK crypto theft continues

Finance was named in 32% of campaigns active in October, the highest share this year. Expect North Korean theft against exchanges, wallets and fintech payroll (IT-worker fraud) to continue, and China-linked espionage to keep targeting banks in Asia, North America and Europe. Totals for recent months will rise as late reports arrive.

Risk score 6.5 = 35% momentum (finance share of active campaigns, Q3 vs Q2 +17%, scored 6.4) + 35% level (Q3 vs the Q1 to Q2 average, 1.07x, scored 5.4) + 30% impact weight (8 of 10). Measured as a share. Campaigns count when active in the quarter. APT reporting is delayed by nature, so recent counts are incomplete; shares are compared. 67% of Q3 finance campaigns come from CYFIRMA early-warning collection.

STATE & ORGANISED ACTORS · GEOGRAPHY

Asia-Pacific and the US are where state actors aim at finance

COUNTRIES NAMED IN FINANCE CAMPAIGNS
Q3 · vs Q2 · 2026

COUNTRY	REGION	Q3	VS Q2	2026
United States	N. America	31	-4	51
Japan	East Asia	27	-2	36
United Kingdom	Europe	21	-1	25
South Korea	East Asia	20	-1	32
India	South Asia	20	-3	28
Australia	Oceania	17	-2	21
Thailand	SE Asia	14	-1	20
Taiwan	East Asia	14	-1	20
Saudi Arabia	Middle East	9	0	19
Singapore	SE Asia	9	-3	15
Germany	Europe	9	-2	11
Vietnam	SE Asia	8	0	12
Indonesia	SE Asia	7	0	11
Malaysia	SE Asia	7	+1	9
United Arab Emirates	Middle East	6	+1	14

MOST ACTIVE ACTORS AGAINST FINANCE IN 2026

Actor	Origin	Q3	2026	Motive
Lazarus Group	North Korea	7	12	Theft, Unassessed
Winnti Group	China	3	3	Unassessed
Emissary Panda	China	3	3	Espionage
UNC5267	North Korea	2	4	Theft
Stone Panda	China	2	4	Espionage
UNC1069	North Korea	2	3	Theft
Cozy Bear	Russia	2	2	Espionage
APT43	North Korea	1	2	Unassessed, Espionage
Stardust Chollima	n/a	1	2	Theft
UNC1549	Iran	1	2	Espionage
Mustang Panda	China	1	2	Espionage
Earth Estries	China	1	2	Unassessed, Espionage

Campaigns active in the period. Lazarus Group alone ran 12 finance campaigns in 2026, the most of any actor.

China-linked actors focus on East and Southeast Asia and North America; North Korean actors reach every region because crypto and fintech targets are global. A campaign that names several regions counts once in each.

STATE & ORGANISED ACTORS · HOW THEY OPERATE

MITRE ATT&CK: phishing, malicious files and stolen browser secrets

Techniques reported for finance campaigns active in 2026 (40 of 96 campaigns have technique detail). Counts are campaigns using the technique.

MALWARE AND TOOLS IN FINANCE CAMPAIGNS
campaigns, 2026

• Winnti 7
• Artex 6
• Cobalt Strike 5
• NukeSped RAT 4
• Dindoor 3
• Fakeset 3
• Mirai 3
• Sugarloader 3
• Volt 3
• AppleJeus 2
• CosmicDuke 2
• Darkcomp 2

AI as an attack tool. The open-source ARTEX attack agent appears in 6 finance campaigns, and commercial AI services are named as tooling in 9 more mentions. TAG217 used ARTEX against South Korean banks.

LIVING-OFF-THE-LAND BINARIES
campaigns, 2026

• sysctl LOOBins · 2
• softwareupdate LOOBins · 2
• osascript LOOBins · 2
• unityplayer.dll HijackLibs · 1
• Msedge.exe LOLBAS · 1
• system_profiler LOOBins · 1
• NetSupport Manager LOLRMM · 1
• sspicli.dll HijackLibs · 1

macOS utilities (osascript, softwareupdate, sysctl) point to North Korean campaigns against crypto and fintech developers, who mostly work on Macs. Windows entries (Certutil, Msedge, DLL hijacks) belong to Chinalinked espionage.

WHAT TO HUNT FOR

• Malicious attachments and links (T1566, T1204) are still the main way in.
• Browser and keychain credential theft (T1555) and screen capture (T1113) aim at wallets and payment sessions.
• Scheduled tasks and start-up items (T1053, T1547) for persistence.

PHISHING & BRAND ABUSE

Wallet lures push finance phishing to its highest level of the year

WHO THE LURES COPY

Crypto brands made up 78% of finance phishing in Q3. Hardware-wallet lures (Ledger, Trezor) target recovery phrases, which give attackers irreversible access to funds. US bank lures rose (Chase, Bank of America, Wells Fargo); Brazilian ones fell back. In October, MetaMask lures (267) already exceeded its whole Q3 total (174).

Target country follows the brand’s home market, so France (Ledger) leads with 1,306 URLs

▲
Q4 2026 OUTLOOK
STAYS HIGH
Wallet lures shift to MetaMask

Expect wallet and exchange lures to stay dominant, with attackers rotating brands (Ledger in Q3, MetaMask in October). Volumes from November include two new phishing feeds, so Q4 counts will rise partly from collection; compare shares.

WHAT TO DO NOW

1. Register and monitor look-alike domains for your brand and app names; most lures use domains under a month old.
2. Run takedown and customer-warning playbooks for wallet and payment brands you integrate with.
3. Treat requests for recovery phrases, one-time codes or remote access in customer channels as fraud by default.

Risk score 8.7 = 35% momentum (finance phishing URLs, Q3 vs Q2 +50%, scored 9.0) + 35% level (Q3 vs the Q1 to Q2 average, 1.86x, scored 10.0) + 30% impact weight (7 of 10). Measured as a count. URLs from public phishing feeds classified by brand and sector; about 70% of all phishing URLs carry no brand, so finance counts are a lower bound.

VULNERABILITIES & EXPOSURE

Flaws in finance software nearly double as exploitation broadens

WHAT KIND OF FINANCE TECHNOLOGY
Q3 · vs Q2

PRODUCTS WITH THE MOST NEW FINANCE CVES
Jul to Oct

Product	CVEs	Crit/High	Max CVSS
Financial Transaction Manager (FTM) for RedHat OpenShift	46	31	9.9
Zebra (Zcash node)	32	10	9.3
Klever blockchain (klever-go)	17	15	9.6
Vyper smart-contract language	13	2	8.6
Apache Fineract	5	5	9.8
CoinEx crypto exchange app	4	0	5.3
OpenVM	3	2	8.7

WHAT IT MEANS
The jump is concentrated: IBM Financial Transaction Manager (the platform many banks use to run payment and SWIFT message flows) received 46 CVEs, 31 of them critical or high. Apache Fineract, an open-source core-banking system used by microfinance and digital lenders, had five critical or high flaws. Oracle banking modules (origination, trade finance, lending) also appear.

Crypto infrastructure is the second cluster: Zcash’s Zebra node, Klever and the Vyper smart-contract language. October added 50 finance CVEs, 45 of them in crypto wallets and exchanges.

EXPLOITED FLAWS ADDED TO KEV
Jul to Oct, by vendor

Microsoft, Cisco, Fortinet and Citrix lead. Finance runs all four at its perimeter; only one KEV entry so far is finance-specific software.

Product	KEV Added	Exposed Instances	Countries	Ransomware Use
MikroTik RouterOS ×3	09/10	134,438	193
WordPress Core ×3	07/21	91,718	100
Microsoft SharePoint ×7	04/14	17,910	92	Known
cPanel & WHM	04/30	9,671	32	Known
ConnectWise ScreenConnect ×2	04/28	7,961	38	Known
JetBrains TeamCity ×2	04/20	4,235	37	Known
Gitea	08/25	3,680	71

Internet hosts whose software version carries the flaw, counted once per product (largest of its flaws); version-based, so some may already be mitigated. MikroTik routers and WordPress sites dominate: both are common in small lenders, brokers and fintech marketing estates.

VULNERABILITIES & EXPOSURE · CONTINUED

What attackers can reach: exposed products and finance hosts

Hosts seen per month. Hollow dots mark July 2026, a collection gap. The .bank footprint grew from 28.6k (June) to 35.2k (October).

Single snapshot (2026-11-08). Hosts whose organisation or domain identifies a bank, insurer or credit union. Exposure counts are per vulnerability and can repeat for one machine.

▲
Q4 2026 OUTLOOK
RISING
October finance CVEs above Q3 pace

October’s 50 finance CVEs, 32 new KEV entries and the Black October disclosure wave (PHP2Shell, Ivanti, AhsayCBS) point to a busier Q4. 55 exploited products are visible on internet hosts today, led by routers, web servers and content platforms that smaller finance firms run, so the risk is shifting to newly disclosed flaws in gateways, collaboration servers and AI or web frameworks that finance adopted quickly.

WHAT TO DO NOW

1. Patch KEV-listed edge and collaboration flaws (NetScaler, Cisco IOS XE, SharePoint, MikroTik) within days, not cycles.
2. Put IBM FTM, Fineract and Oracle banking modules on an accelerated patch track and review their internet reachability.
3. Add AI gateways and React-based customer portals to vulnerability scanning scope.

Risk score 6.9 = 35% momentum (finance share of new CVEs, Q3 vs Q2 +6%, scored 5.5) + 35% level (Q3 vs the Q1 to Q2 average, 1.42x, scored 7.5) + 30% impact weight (8 of 10). Measured as a share. Finance CVEs: high- or medium-confidence finance tag. Exposure figures are one snapshot of internet hosts whose software version carries a KEV-listed flaw (CYFIRMA internet exposure monitoring), counted once per product; aggregate counts only, never IP addresses.

VULNERABILITIES · GEOGRAPHY AND SPEED

Flaws reach the exploited list twice as fast; the US, Brazil and China carry the most exposure

PRODUCTS DRIVING IT

Product	Flaws	Exposed	Countries
PHP (PHP-CGI flaw)	1	154,251	182
MikroTik RouterOS	3	134,413	193
WordPress Core	2	91,574	113
MongoDB Server	1	37,172	100
Microsoft SharePoint	11	18,032	92
Cisco IOS and IOS XE	2	3,409	105

Finance-relevant = flaws used by ransomware groups that hit finance this year, or seen on finance-labelled hosts. One count per product and country (largest of its flaws), by software version. PHP, MikroTik routers and WordPress make up most of it.

WEAKNESS TYPES IN NEW KEV ENTRIES
Jul to Oct

• CWE-78 OS command injection · 7
• CWE-94 Code injection · 6
• CWE-287 Broken authentication · 6
• CWE-22 Path traversal · 6
• CWE-502 Unsafe deserialisation · 5
• CWE-89 SQL injection · 5
• CWE-288 Auth bypass (alternate path) · 4
• CWE-306 Missing authentication · 4

VULNERABILITIES · NEWLY EXPLOITED IN OCTOBER

Black October and PHP2Shell: the exploitation window now opens before disclosure

WHY IT MATTERS FOR FINANCE
PHP runs most of the web, including bank marketing sites, customer portals, WordPress and Magento storefronts and payment plugins. Two AI-assisted teams found the flaws in August; the fix took over two months, the embargo broke early, and public exploit code appeared on 18 October, three days before disclosure.

29 underground posts (20 to 29 Oct), none naming finance; beyond software version tags there is no measurement of PHP2Shell exposure yet. On finance hosts, 53 of 352 .bank hosts running PHP carry a PHP2Shell version tag (an upper bound), and Ivanti or Pulse VPN portals sit on 74 insurernamed hosts (52 in the US).

BLACK OCTOBER INCIDENTS THAT TOUCH FINANCE

• South Korean banks: TAG-217 used the open-source ARTEX AI attack agent against at least seven financial institutions (our data: active August to 16 October).
• Crypto exchange: breached through a zero-day in two security appliances it had bought.
• Brazilian bank: attacked with still-valid client certificates from a payment provider it had left months earlier.
• LLM gateway compromised: LiteLLM, the gateway many firms put between staff, apps and AI models, has a flaw on CISA’s exploited list since June.

Incidents as reported in CYFIRMA Threat Horizon, 3 November 2026.

Exposure: internet hosts whose software version carries the flaw, snapshot 8 Nov. * version-banner match, upper bound. –: not tagged. Finance hosts (10 to 11 Nov): hosts running the product on .bank or insurance domains or insurer-named hosts; PHP figures are upper bounds; 0 = none found; single numbers come from the 8 Nov snapshot.

UNDERGROUND & DARK WEB CHATTER

Talk is quieter, but leak posts and fraud chatter are up

Russia (+60%) and Ukraine rose with war-related hacktivist and fraud chatter; Thailand jumped from 7 to 33; Israel fell back after a Q2 spike.

Reading the decline correctly. The number of monitored channels discussing finance fell from 82 to 59 (all channels 168 to 117), so raw totals understate activity. Finance’s share held near 5.5%, and the categories that signal real harm (victim posts, fraud) grew.

→
Q4 2026 OUTLOOK
STABLE
Leak posts steady, fraud talk up

Expect finance share to hold between 5% and 6%, with fraud services (card and crypto cash-out, account takeover kits) and leak posts driving it. Hacktivist DDoS claims track geopolitical events and can spike at short notice.

Risk score 5.1 = 35% momentum (finance share of underground posts, Q3 vs Q2 −4%, scored 4.7) + 35% level (Q3 vs the Q1 to Q2 average, 0.95x, scored 4.7) + 30% impact weight (6 of 10). Measured as a share. Chatter volumes reflect collection coverage; shares are compared, not totals. Posts can mention several sectors and countries.

UNDERGROUND & DARK WEB CHATTER · GEOGRAPHY

Where finance is discussed underground, and what about

Right: finance share of all posts naming the region. Europe and North America dominate; the Middle East is mostly hacktivist chatter.

Posts about finance by category and the region they name. Fraud and data-breach claims cluster in North America and Europe; hacktivism and DDoS in the Middle East and South Asia.

VULNERABILITY TALK UNDERGROUND
all sectors
Posts naming CVEs tripled from 157 in Q2 to 502 in Q3 (330 distinct CVEs), and October alone had 223. None named finance directly, but the most discussed flaws sit in software finance runs.

CVE	Product	Posts
CVE-2026-109618	PHP Group PHP	28
CVE-2026-109619	PHP Group PHP	27
CVE-2026-63030	WordPress Core	18
CVE-2026-87902	WordPress Core	10
CVE-2026-82222	not in KEV	9
CVE-2026-32475	not in KEV	8

MALWARE INTELLIGENCE

Remote-access tools, stealers and bankers lead finance reporting

Public research reports tagged finance, by malware named. A report can name several families.

Indicator collection doubled between Q2 and Q3, so shares are compared. Credential stealers feed account takeover and initial access for ransomware.

HOW THE MALWARE WORKS
techniques in Q3 finance reports

• T1027 Obfuscation · 44
• T1071.001 Web Protocols · 43
• T1082 System Information Discovery · 34
• T1140 Decode payload · 33
• T1204.002 Malicious File · 26
• T1113 Screen Capture · 24

Why this matters for finance. Commodity remote-access tools (AsyncRAT, Remcos, XWorm) and stealers (Vidar, Stealc) harvest session cookies and banking credentials; Latin American bankers (Ousaban, Metamorfo, Grandoreiro) and Android bankers (Hook, Coper, ToxicPanda) attack customers directly.

▼
Q4 2026 OUTLOOK
EASING
Finance share back to 16%

Finance’s share of malware reporting eased in October. Expect stealer families to keep rotating after Lumma’s disruption (Vidar and Stealc filled the gap) and Android banking trojans to keep growing in Latin America, Europe and Southeast Asia.

WHAT TO DO NOW

1. Hunt for stealer infections on staff devices and revoke exposed sessions and tokens quickly.
2. Use device and session risk signals in mobile banking to catch overlay and remote-access trojans.
3. Block unapproved remote-management tools; ConnectWise appears in Q3 finance reports.

Risk score 6.1 = 35% momentum (finance share of malware reports, Q3 vs Q2 +23%, scored 6.9) + 35% level (Q3 vs the Q1 to Q2 average, 1.07x, scored 5.4) + 30% impact weight (6 of 10). Measured as a share. Research reports are public threat-sharing pulses tagged with the finance sector; IOC figures are new indicators from malware feeds, capped per family and week.

MALWARE INTELLIGENCE · GEOGRAPHY AND ATT&CK

Finance malware steals credentials, hides well and talks over the web

Android banking malware nearly tripled in finance reporting (3 to 8).

Command-and-control servers identified by banner. AdaptixC2, named in three Q3 finance reports, has 70 live servers.

SHARED WITH STATE ACTORS
actors reported using the family

• PlugX 19 actors
• Cobalt Strike 17 actors
• ShadowPad 8 actors
• Ghost RAT 6 actors
• Quasar RAT 4 actors
• 9002 RAT 3 actors

Families seen in finance reports this quarter that state actors also use, so a hit can mean either crime or espionage.

COMPARISON · SUB-SECTORS

Fintech and payments are hit on every front; banks take the ransomware surge

Finance sub-sectors grouped into five segments, Q3 2026 with the change from Q2. Sub-sector detail exists for ransomware, state campaigns, phishing and CVEs; underground posts and malware reports name the sector but rarely the sub-sector. A campaign or CVE can cover several segments.

State campaigns: 34 further campaigns name finance without a sub-sector. Phishing sub-sector comes from the impersonated brand (wallets and payment apps count as fintech). Internet hosts: single snapshot, .bank domains and credit union hosts for banking, .insurance domains for insurance.

COMPARISON · REGIONS

How the threat to finance differs by region

Finance-related activity per region in Q3 2026 across five datasets, with the change from Q2 where the base is large enough. Colour depth is relative within each column. A campaign, post or report can name several regions.

North America
Most ransomware victims (74, +42%) and the most state campaigns naming finance. US megabank lures rose in phishing.

Europe
The fastest ransomware growth (13 to 32). Phishing totals are inflated by French and Czech wallet brands (Ledger, Trezor), which target customers worldwide.

Latin America
Stable ransomware (13 to 12) but persistent bank phishing (Bradesco, Itaú, Banco do Brasil) and home-grown banking trojans.

East and South Asia
Heavy state-actor focus (31 and 21 active campaigns) from China- and North Korea-linked groups, with fewer leak-site victims than internet size suggests.

Southeast Asia and Oceania
Ransomware up modestly (7 to 10 in Southeast Asia); CYFIRMA early-warning collection shows sustained espionage against regional banks.

Africa and Middle East
Small numbers, but finance is 19% of Africa’s ransomware victims, more than three times the worldwide share.

COMPARISON · TOP COUNTRIES

Which countries lead each region, dataset by dataset

The three countries with the most finance-related activity in each region in Q3 2026: ransomware victims, state campaigns naming the country, phishing URLs by target country and underground posts naming the country with finance.

WHAT STANDS OUT

• The United States leads North America on every dataset and holds 68 of 156 finance ransomware victims.
• After the US, Japan (27), the UK (21), South Korea and India (20 each) are the countries state campaigns name most, yet Japan and Korea post very few leak-site victims.
• The United Kingdom leads Europe for ransomware victims and state campaigns; Russia and Ukraine lead underground chatter.

READ WITH CARE

• Phishing target country follows the impersonated brand’s home market (France and Czechia host Ledger and Trezor).
• State campaigns often list many countries; CYFIRMA earlywarning campaigns name about six each, which lifts Asia-Pacific counts.
• Counts under 10 are indicative only.

REGULATION & COMPLIANCE

Resilience, supplier oversight and AI threats top the regulatory agenda

Regulators in Q3 focused less on new cyber rules and more on enforcing resilience: oversight of cloud and technology suppliers, recovery testing and board accountability. Four of them issued warnings about frontier-AI cyber threats in about two months. The EU AI Act is the exception, with high-risk obligations for lenders and insurers pushed back.

European Union & United Kingdom

27 Jul 2026
EU AI Act Digital Omnibus in force
Regulation (EU) 2026/1744 moves high-risk obligations for Annex III systems, including credit scoring and life and health insurance pricing, to 2 Dec 2027 (product-embedded AI to 2 Aug 2028).

18 Nov 2025 →
DORA: first critical ICT providers under direct oversight
The EBA, EIOPA and ESMA published the first list of critical ICT third-party providers; 2026 is the first full year of direct oversight, with annual review of the list.

13 Jul 2026
UK designates its first critical third parties
HM Treasury named AWS, Google Cloud, Microsoft and Oracle; the Bank of England, PRA and FCA now oversee their services to UK finance.

United States

10 Sep 2026
NYDFS guidance on cyber risk assessments
Explains how Part 500 firms should run and use risk assessments, flagging incomplete asset inventories (cloud, third parties) and weak methods. Follows a 21 May letter on frontier-AI cyber risk.

3 Jun 2026
SEC Regulation S-P: smaller firms now in scope
Incident response programmes and customer breach notification now apply to smaller brokerdealers, advisers, funds and transfer agents (larger firms since 3 Dec 2025).

Pending
CIRCIA final rule still not published
CISA held new town halls in June 2026; until the final rule takes effect, the proposed 72-hour incident and 24-hour ransom-payment reports are not required.

Hong Kong & Japan

1 Jun 2026
HKMA: all banks met the OR-2 resilience deadline
Every authorised institution reached operational resilience by end-May; on 2 Jun the HKMA warned of AI-empowered attacks and announced a Cyber Resilience Testing Framework.

1 Jan 2026
Hong Kong critical infrastructure law in force
The Protection of Critical Infrastructures (Computer Systems) Ordinance makes cyber duties statutory; a banking and financial services code of practice has been issued.

30 Jul 2026
Japan FSA IT resilience report
Second annual report covering cyber, cloud and operational resilience; on 15 Jun the FSA also asked firms to take short-term measures against frontier-AI threats.

Singapore, Australia & India

Jun–Jul 2026
MAS consults on tougher technology risk notices
Proposes a 4-hour recovery time objective and at most 4 hours of unplanned downtime a year for critical systems, plus immutable or offline backups. MAS and the banks set up an AI-driven cyber risk taskforce in July.

1 Jul 2026
APRA CPS 230 amendments take effect
Narrow exemption for some non-traditional service providers; pre-existing service provider contracts had to comply by 1 Jul 2026 at the latest.

31 Jul 2026
RBI issues cyber security directions per entity type
Separate directions for commercial, payments and small finance banks, NBFCs, co-operative banks and AIFIs: separate cyber policy, a security operations centre, fast incident reporting.

REGULATION & COMPLIANCE · WHAT IT MEANS

Incident clocks, recovery targets and AI warnings

INCIDENT NOTIFICATION CLOCKS FINANCE MUST MEET

Regime	Deadline	What
EU · DORA	4 hours	initial notice after a major ICT incident is classified (no later than 24 hours from awareness)
Singapore · MAS	1 hour	relevant IT incidents, under the technology risk notice
India · CERT-In / RBI	6 hours	cyber incidents; RBI’s 2026 directions keep the 6-hour clock
Hong Kong · CI law	12 / 48 hours	serious / other incidents at designated critical infrastructure
US · bank regulators	36 hours	notification incidents at banks
US · NYDFS Part 500	72 hours	cybersecurity incidents; extortion payments within 24 hours
Australia · APRA CPS 234	72 hours	material information security incidents
US · SEC	4 business days	material incidents of listed companies (Form 8-K)
US · CIRCIA	pending	proposed 72 hours, ransom payments 24 hours

Simplified; scope, triggers and thresholds differ by rule. A multinational bank hit by ransomware may face the 1-hour and 4-hour clocks before it has finished triage.

REGULATORS WARN ABOUT FRONTIER-AI THREATS
21 May 2026
NYDFS
letter on heightened cyber risk from frontier AI models

2 Jun 2026
HKMA
circular on AI-empowered cyber threats; testing framework

15 Jun 2026
Japan FSA
request for short-term measures against frontier-AI threats

Jul 2026
MAS and ABS
AI-driven cyber and technology risk taskforce

Four warnings in about two months, matching what our data shows: AI attack agents (ARTEX) in six finance campaigns, and an AI gateway among the most-attacked exploited flaws.

WHAT THIS MEANS FOR FINANCE CISOS

• Prove recovery, not just prevention. DORA, HKMA’s new testing framework, APRA and MAS’s proposed 4-hour recovery target all test the scenario ransomware creates.
• Keep backups offline and immutable. MAS proposes to require it; the leading ransomware groups delete or encrypt reachable backups.
• Map supplier concentration. EU and UK critical-provider regimes put cloud suppliers under direct oversight, but the firm still owns its exit and incident plans.
• Use the AI Act delay well. Credit-scoring and pricing models now have until December 2027.

LINK TO THIS QUARTER’S THREATS

• Ransomware against banks tripled, and most leading groups enter through edge devices: the incident clocks above start at detection.
• Flaws in IBM FTM, Oracle banking modules and edge vendors sit inside the supplier risk regulators now supervise.
• NYDFS flags incomplete cloud and third-party asset inventories, the same gap that slows response to disclosures like PHP2Shell.

Checked against regulator publications on 11 November 2026: EUR-Lex (Regulation 2026/1744); EBA/ESMA/EIOPA joint press release (18 Nov 2025); HM Treasury and Bank of England (Jul 2026); NYDFS industry letters (21 May, 10 Sep 2026); SEC Regulation S-P small entity compliance guide; CISA CIRCIA page; HKMA circulars (1 and 2 Jun 2026); Hong Kong Government press release (27 Jun 2025); FSA Japan (15 Jun, 30 Jul 2026); MAS consultation paper and media release (2026); APRA CPS 230 (Jul 2026); RBI master directions (31 Jul 2026). Notification clocks reflect the rules as generally applied and should be confirmed for each entity’s scope. Regulation varies by country; a dedicated regulatory tracking dataset is recommended for future editions.

PRIORITIES & OUTLOOK

What to expect in Q4 2026, and what to do first

SECTOR OUTLOOK
Q4 should stay at a high level of risk, with the mix shifting. Ransomware volume against finance is easing from its Q3 peak but remains above any 2025 quarter, and Qilin is accelerating. Finance’s share of state activity is the highest of the year, driven by North Korean theft. October’s finance CVE count is already half of Q3’s, and new exploited flaws are appearing faster than old ones are patched. Phishing will look higher from November because of new feeds; its real trend is a steady, crypto-heavy plateau.

PRIORITIES FOR FINANCE CISOS

P1 now · P2 this quarter · P3 next · number = report section

P1

02 · 05
Patch internet-facing gateways and PHP within days
VPN and firewall flaws are the top access route for Qilin and The Gentlemen; October added Ivanti, PAN-OS, Cisco ASA and PHP2Shell, exploited before disclosure.

P1

02
Make backups and hypervisors ransomware proof
Veeam and VMware ESXi flaws recur across the leading groups, and bank victims tripled. Keep offline copies and test restores.

P1

05
Fast-track core payment and banking platform patches
IBM FTM (46 CVEs, max CVSS 9.9), Apache Fineract and Oracle banking modules; restrict their internet reachability.

P2

04
Fight wallet and brand impersonation
78% of finance phishing copies crypto brands, mostly on domains under 30 days old. Monitor lookalikes and run takedowns.

P2

03
Harden crypto, treasury and payroll against North Korea
September theft cluster and IT-worker fraud: verify remote hires, separate signing keys, watch wallet movements.

P2

02
Track new ransomware groups
40% of Q3 finance victims came from groups new since April; five groups put finance at twice the normal share or more.

P3

07
Revoke stolen sessions quickly
Vidar and Stealc lead stealer indicators; stolen cookies bypass MFA and feed ransomware access.

P3

09
Rehearse recovery against regulatory clocks
Notification clocks run from 1 hour (MAS) and 4 hours (DORA) to 72 hours; MAS proposes a 4-hour recovery target for critical systems.

METHOD & SOURCES

How this report was built

PERIODS
Last quarter = Q3 2026 (1 July to 30 September), compared with Q2 2026 (1 April to 30 June). Context: Q1 2026, Q3 2025 and October 2026. Data cut-off 31 October 2026; extracted 11 November 2026 from the CYFIRMA threat warehouse.

RISK SCORES Each section score (0 to 10) = 35% momentum (Q3 vs Q2), 35% level (Q3 vs the average of Q1 and Q2) and 30% impact weight for the threat type. Momentum score = 5 + 8 x change; level score = 5 + 6 x (ratio − 1), both capped at 0 and 10. Where collection volume changed, the finance share of the dataset replaces counts. The overall score is the impactweighted average. Bands: 8 and above critical, 6 to 8 high, 4 to 6 moderate, below 4 low

Section	Measure	Impact	Mom.	Level	Score
Ransomware	finance leak-site victims	9	8.8	8.4	8.7
State	share of active campaigns	8	6.4	5.4	6.5
Vulnerabilities	share of new CVEs	8	5.5	7.5	6.9
Phishing	finance phishing URLs	7	9.0	10.0	8.7
Underground	share of underground posts	6	4.7	4.7	5.1
Malware intelligence	share of malware reports	6	6.9	5.4	6.1

OUTLOOKS
Q4 outlooks are analyst judgments based on the October reading against the Q3 pace and on the qualitative evidence in each section.

DATA SOURCES

• Ransomware: CYFIRMA’s curated ransomware leak-site log, group profiles and published reporting on access methods and CVEs.
• State and organised actors: CYFIRMA early-warning campaigns plus public vendor and government reporting, merged into one campaign record.
• Phishing: public phishing URL feeds classified by brand, sector and target country; domain registration lookups.
• Vulnerabilities: CVE records with sector tagging, CISA KEV and CYFIRMA internet exposure monitoring (software-version snapshot, aggregate counts only).
• Underground & dark web chatter: CYFIRMA monitoring of underground forums, dark web sites and messaging channels.
• Malware: public threat-sharing research pulses and malware indicator feeds.
• Regulation: regulator publications, checked on 11 November 2026 (section 09).

READ WITH CARE

• Leak-site posts are dated by post date, not attack date. Victim names are not published in this report.
• APT reporting is delayed by nature: recent quarters will rise as reports arrive. 67% of Q3 finance campaigns come from CYFIRMA collection.
• Underground and dark web collection shrank during 2026; compare shares, not totals.
• Exposure counts are per vulnerability and can repeat for one machine; never add them as machines.
• Phishing target country follows the brand’s home market. Volumes from November 2026 include two new feeds.
• Small numbers (under 10) are indicative only.