Q3 2022 Financial Sector: Quarterly Threat Landscape Scorecard

Q3 2022 Financial Sector: Quarterly Threat Landscape Scorecard

Product Serial: A-2022-10-31a

TLP: CLEAR

ZeroFox Intelligence is excited to announce the release of our Financial Quarterly Threat Landscape Scorecard for Q3 of 2022.

Standing Intelligence Requirements

For the most up-to-date list of ZeroFox Threat Research’s Intelligence Requirements, please visit:

https://cloud.zerofox.com/intelligence/advisories/14956

Link to Download

View the full report here.

Scope Note

ZeroFox Intelligence is derived from a variety of sources, including—but not limited to—curated open-source accesses, vetted social media, proprietary data sources, and direct access to threat actors and groups through covert communication channels. Information relied upon to complete any report cannot always be independently verified. As such, ZeroFox applies rigorous analytic standards and tradecraft in accordance with best practices and includes caveat language and source citations to clearly identify the veracity of our Intelligence reporting and substantiate our assessments and recommendations. All sources used in this particular Intelligence product were identified prior to 12:00 PM (EDT) on October 10, 2022; per cyber hygiene best practices, caution is advised when clicking on any third-party links.

Executive Summary

The threat to financial sector organizations remained broadly consistent in Q3 2022, with the ongoing war in Ukraine continuing to shape the cyber threat landscape. There were increases in particular aspects of the social engineering threat to financial organizations, including from smishing, callback phishing, and threat actors leveraging techniques to bypass multi-factor authentication (MFA). ZeroFox Intelligence recommends implementing phishing-resistant MFA methods that support Fast ID Online v2. (FIDO2) and certificate-based authentication. The sustained high pace of vulnerability disclosures, particularly in software commonly-used by financial organizations, will very likely strain out-of-cycle patch management processes and increase the likelihood of vulnerabilities not being patched in a timely manner. Financial organizations should note an ongoing shift in the Initial Access Broker (IAB) market, with a fall in advertisements pertaining to financial organizations likely reflecting an ongoing move towards brokers making sales in private channels rather than advertising in open forums. Botnet and malware deployment remained high, including infostealers and banking trojans. Digital extortion attempts against financial victims remain below 2021 levels, likely caused in part by difficulty eliciting victims’ payments. While there have been fewer attacks against “big game” financial sector organizations, incidents in Q3 2022 highlighted the high threat of attacks against third-party providers that could implicate multiple downstream customers.

Key Findings

• Financial organizations likely face an increased threat of smishing, callback phishing (vishing), and phishing techniques that bypass MFA.
• Vulnerabilities in software commonly-used by financial organizations were added to CISA’s Known Exploited Vulnerabilities (KEV) catalog.
• Illicit access to large financial entities was increasingly being sold via private or direct communication channels.
• While there were fewer ransomware and digital extortion attempts against “big game” financial sector targets, incidents highlighted the high threat of attacks against third-party providers.