CYFIRMA’s Q3 2026 Finance Threat Report Finds Record Ransomware Leak-Site Listings
Summary
CYFIRMA reports 156 finance organizations named on ransomware leak sites in Q3 2026, alongside 2,657 finance phishing URLs, 104 finance-tagged CVEs and a rising share of state campaigns. It recommends rapid edge patching and stronger backup defenses.
Key points
- The report counts 156 finance organizations named on ransomware leak sites in Q3, up 47% from Q2; these listings are not independent confirmation of compromise.
- Finance phishing reached 2,657 URLs, up 50% quarter over quarter, with cryptocurrency brands accounting for 78% of the reported lures.
- The report identified 104 finance-specific CVEs, including 73 rated critical or high, and says 94 flaws were added to CISA’s Known Exploited Vulnerabilities catalogue.
- Finance was named in 22.4% of active state-actor campaigns, up from 19.1% in Q2; the report highlights China-linked espionage and North Korean theft activity.
- Its recommendations include prioritizing patches for internet-facing gateways and PHP, protecting backups and hypervisors, and monitoring wallet-brand impersonation.
- The report uses multiple data sources and notes limitations, including delayed campaign reporting, changing collection coverage, and leak-site post dates that may differ from attack dates.
Article Details
- Publisher
- CYFIRMA Research
- Report Period
- Q3 2026 (2026-07-01 to 2026-09-30), compared with Q2 2026; data through 2026-10-31
- Scope
- Quarterly threat landscape for the finance sector, covering ransomware, state activity, vulnerabilities, phishing, underground chatter, malware, and regulation.
- Sample Size
- Not disclosed as a single sample; the report combines multiple datasets and collection sources.
- Key Statistics
- 156 finance organizations were named on ransomware leak sites in Q3, up 47% from Q2; dates reflect post dates, not attack dates.
- 2,657 finance phishing URLs were identified in Q3, up 50% from Q2.
- 104 finance-specific CVEs were recorded in Q3; 73 were rated critical or high.
- Finance was named in 22.4% of active campaigns in Q3, compared with 19.1% in Q2.
- 89 malware research reports were tagged to finance in Q3, up 27% from Q2.
- Recommendations
- Patch internet-facing gateways and PHP vulnerabilities within days.
- Keep offline backup copies, protect hypervisors, and test restores.
- Accelerate patching of core payment and banking platforms, and restrict their internet reachability.
- Monitor lookalike wallet and brand domains and use takedown and customer-warning playbooks.
- Hunt for stealer infections, revoke exposed sessions and tokens quickly, and verify remote hires while protecting signing keys.
MITRE ATT&CK
T1027 · Obfuscated Files or InformationObfuscation appeared in finance malware reports.T1053 · Scheduled Task/JobScheduled tasks were identified as a persistence behavior to hunt for.T1071.001 · Web ProtocolsWeb protocols appeared in finance malware reports.T1082 · System Information DiscoverySystem information discovery appeared in finance malware reports.T1090 · ProxyProxy use was reported in finance campaigns.T1113 · Screen CaptureScreen capture was reported in finance campaigns and malware research.T1190 · Exploit Public-Facing ApplicationExploitation of public-facing applications was reported in finance campaigns.T1204.002 · Malicious FileMalicious files were reported in finance malware research.T1486 · Data Encrypted for ImpactData encryption for impact was reported for almost every profiled ransomware group.T1490 · Inhibit System RecoveryBackup deletion was reported for almost every profiled ransomware group.T1528 · Steal Application Access TokenStealing application access tokens was reported in finance campaigns.T1547 · Boot or Logon Autostart ExecutionStartup-item persistence was identified as a behavior to hunt for.T1555 · Credentials from Password StoresBrowser and keychain credential theft was described as targeting wallets and payment sessions.T1566 · PhishingPhishing attachments and links were identified as a main initial-access route.T1595 · Active ScanningActive scanning was reported in finance campaigns.
CVE
Threat Actors
CRPxOA ransomware group named among those hitting North American banks; it was also listed as having a finance-heavy target mix.DragonForceQilin was reported to partner with DragonForce; the article presents this as a reported relationship.Jade SleetNamed in reports describing the September theft cluster targeting crypto and fintech firms.Lazarus GroupThe report attributes 12 finance campaigns in 2026 to Lazarus Group and describes its Binance heist activity as running from June to October.Moonstone SleetThe report describes Moonstone Sleet as a North Korean group and says it was reported using Qilin.QilinThe report identifies Qilin as a ransomware-as-a-service group hitting finance organizations and says it was reported using CVE-2026-50751 in October.StormA new ransomware group reported posting 9 of 36 Q3 banking victims. Its possible succession of Sinobi is explicitly described as unconfirmed.TAG-217The report says TAG-217 used the ARTEX attack agent against at least seven South Korean financial institutions.The GentlemenThe report identifies The Gentlemen among ransomware groups hitting finance and lists exploited flaws reported for the group.UNC1069Named in reporting about a September cluster of theft activity against crypto and fintech firms.
Malware
AsyncRATCommodity remote-access tools (AsyncRAT, Remcos, XWorm) and stealers (Vidar, Stealc) harvest session cookies and banking credentials; Latin American bankers (Ousaban, Metamorfo, Grandoreiro) and Android bankers (Hook,GrandoreiroStealc) harvest session cookies and banking credentials; Latin American bankers (Ousaban, Metamorfo, Grandoreiro) and Android bankers (Hook, Coper, ToxicPanda) attack customers directly.Hookand banking credentials; Latin American bankers (Ousaban, Metamorfo, Grandoreiro) and Android bankers (Hook, Coper, ToxicPanda) attack customers directly.Lumma2,071 new indicators in Q3; Lumma collapsedOusabanand stealers (Vidar, Stealc) harvest session cookies and banking credentials; Latin American bankers (Ousaban, Metamorfo, Grandoreiro) and Android bankers (Hook, Coper, ToxicPanda) attack customers directly.Remcos RATCommodity remote-access tools (AsyncRAT, Remcos, XWorm) and stealers (Vidar, Stealc) harvest session cookies and banking credentials; Latin American bankers (Ousaban, Metamorfo, Grandoreiro) and Android bankers (Hook,StealCCommodity remote-access tools (AsyncRAT, Remcos, XWorm) and stealers (Vidar, Stealc) harvest session cookies and banking credentials; Latin American bankers (Ousaban, Metamorfo, Grandoreiro) and Android bankers (Hook,ToxicPandacredentials; Latin American bankers (Ousaban, Metamorfo, Grandoreiro) and Android bankers (Hook, Coper, ToxicPanda) attack customers directly.VidarCommodity remote-access tools (AsyncRAT, Remcos, XWorm) and stealers (Vidar, Stealc) harvest session cookies and banking credentials; Latin American bankers (Ousaban, Metamorfo, Grandoreiro) and Android bankers (Hook,XWormCommodity remote-access tools (AsyncRAT, Remcos, XWorm) and stealers (Vidar, Stealc) harvest session cookies and banking credentials; Latin American bankers (Ousaban, Metamorfo, Grandoreiro) and Android bankers (Hook,
Vendors
Check PointMost exposed through internetfacing gateways (Fortinet, Check Point, Citrix NetScaler, Cisco IOS XE), backup and hypervisor platforms, and crypto-facing customer channels.CiscoMost exposed through internetfacing gateways (Fortinet, Check Point, Citrix NetScaler, Cisco IOS XE), backup and hypervisor platforms, and crypto-facing customer channels.CitrixMost exposed through internetfacing gateways (Fortinet, Check Point, Citrix NetScaler, Cisco IOS XE), backup and hypervisor platforms, and crypto-facing customer channels.FortinetMost exposed through internetfacing gateways (Fortinet, Check Point, Citrix NetScaler, Cisco IOS XE), backup and hypervisor platforms, and crypto-facing customer channels.IBM27 in Q2 · top score 9.9 (IBM transaction manager)MicrosoftMicrosoft, Cisco, Fortinet and Citrix lead.MikroTikMikroTik RouterOS ×3OracleOracle banking modules (origination, trade finance, lending) also appear.VeeamVeeam Backup & ReplicationVMwareVMware ESXi
Products
Apache FineractApache Fineract, an open-source core-banking system used by microfinance and digital lenders, had five critical or high flaws.Check Point Security GatewayQilin was reported in October using a Check Point Security Gateway flaw (CVE-2026-50751, added to KEV with known ransomware use).Cisco IOS XEMost exposed through internetfacing gateways (Fortinet, Check Point, Citrix NetScaler, Cisco IOS XE), backup and hypervisor platforms, and crypto-facing customer channels.FortiOSFortinet FortiOS and FortiProxyPHPPHP (PHP-CGI flaw)VMware ESXiVeeam and VMware ESXi flaws recur across the leading groups.
Tools
AdaptixC2AdaptixC2, named in three Q3 finance reports, has 70 live servers.Advanced IP ScannerDiscovery Advanced IP Scanner · 30AnyDeskRemote access AnyDesk · 37ARTEXArtex 6Cobalt StrikeCobalt Strike 5esxcliESXi tooling esxcli · 32ImpacketSystem tools Impacket · 31MimikatzCredential theft Mimikatz · 26NetExecLateral movement NetExec · 31PsExecLateral movement PsExec · 33
Countries
BrazilFlaws reach the exploited list twice as fast; the US, Brazil and China carry the most exposureChinaFinance was named in 22% of active campaigns (19% in Q2), led by China-linked espionage and North Korean theft.FranceTarget country follows the brand’s home market, so France (Ledger) leads with 1,306 URLsIndiaAfter the US, Japan (27), the UK (21), South Korea and India (20 each) are the countries state campaigns name most, yet Japan and Korea post very few leak-site victims.Indonesia78k instances; Brazil, China and Indonesia followJapanAfter the US, Japan (27), the UK (21), South Korea and India (20 each) are the countries state campaigns name most, yet Japan and Korea post very few leak-site victims.North KoreaFinance draws a larger share of state activity, and North Korea is stealingSouth KoreaAfter the US, Japan (27), the UK (21), South Korea and India (20 each) are the countries state campaigns name most, yet Japan and Korea post very few leak-site victims.United KingdomThe United Kingdom leads Europe for ransomware victims and state campaigns; Russia and Ukraine lead underground chatter.United StatesEurope more than doubled (13 to 32); the United States alone accounts for 68 of 156.
Industries
Banking104 financespecific CVEs (55 in Q2), 73 rated critical or high, led by payment-transaction and core-banking platforms.Financial ServicesThe Protection of Critical Infrastructures (Computer Systems) Ordinance makes cyber duties statutory; a banking and financial services code of practice has been issued.Fintech and paymentsBanks, fintech and payments, and investment firms took the biggest rises in leak-site victims; North America and Europe absorbed most of the growth.Insurance9 of 41 insurance victims, with property and casualty insurers and brokers its main targets.