Financial services threat intelligence report — 13–19 June 2026

• Reference: TI-2026-0619-001 (public edition)
• Sector: Financial services, banking, fintech and insurance
• Reporting period: 13–19 June 2026
• Issued: 19 June 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Financial Services, Banking, Fintech and Insurance sector during the period 13 Jun 2026 - 19 Jun 2026. All assessments use estimative language and confidence ratings per Section 11.

During the reporting period the principal observations affecting this vertical were the addition of six further vulnerabilities to the CISA Known Exploited Vulnerabilities catalogue across 09, 15 and 16 June, three of them confirmed under active in-the-wild exploitation and at least two (Cisco Catalyst SD-WAN Manager CVE-2026-20245 and CVE-2026-20262, Arista EOS CVE-2026-7473) carrying material relevance to FS perimeter and core-routing estates. NCSC has reissued advisories on Citrix NetScaler ADC / Gateway (CVE-2026-3055 and CVE-2026-4368). FS-ISAC continues to flag the Scattered Spider / DragonForce cluster as the dominant initial-access-broker risk for UK consumer-banking and retail-fintech estates following the 2025 M&S / Co-op / Harrods campaign. Ransomware leak-site activity for the period was led by Qilin and DragonForce, both directly active against finance-adjacent victims. Cred-dump, C2 framework (Cobalt Strike / Sliver / Havoc / Mythic), lateral-movement (EID 4624-3/10, schtasks, sc create, WMIC remote, PsExec) and Defender-tampering / Blackbit envelopes returned zero hits across the full seven days. One Defender-disable watchlist item (DESKTOP-S8SUGSF, UAT-lab) carried forward without destructive follow-on.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that ransomware and pure data-extortion crews - Qilin, TheGentlemen, Akira, DragonForce and the Lynx / ShinyHunters cluster - will continue to drive the majority of materially-disruptive incidents against UK and EU FS firms during the next reporting cycle. [HIGH]
2. It is highly likely that CVE-2026-20245 and CVE-2026-20262 (Cisco Catalyst SD-WAN Manager) will produce at least one publicly disclosed exploitation event affecting a UK or EU FS firm within the next two reporting cycles, given confirmed in-the-wild exploitation, the absence of an upstream patch for the highest-severity CLI defect and the prevalence of SD-WAN Manager in the FS WAN-edge estate. [HIGH]
3. It is likely that the Arista EOS tunnel-decap defect (CVE-2026-7473) will be repurposed by initial-access brokers as a lateral-movement primitive against FS data-centre estates where Arista is deployed, since the no-patch mitigation-only posture forces configuration discipline that will not be uniformly applied. [MEDIUM-HIGH]
4. It is likely that AI-driven KYC bypass - real-time deepfake voice and video, synthetic-identity generation and automated spear-phish targeting C-suite finance functions - will continue to expand as a fraud-adjacent threat vector through Q3 2026, consistent with the FS-ISAC AI advisory of April 2026. [MEDIUM]

2. Sector threat landscape

The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets. The collection picture for this period is dominated by edge-appliance and identity-provider exposure - specifically Cisco Catalyst SD-WAN Manager, Arista EOS, Citrix NetScaler ADC / Gateway, and LiteSpeed cPanel - against a steady backdrop of ransomware leak-site posting led by Qilin, DragonForce, Akira and the relatively young TheGentlemen group. The Scattered Spider / DragonForce cluster that materially disrupted M&S, Co-op and Harrods through April and May 2025 continues to define the operational threat picture for FS-adjacent retail banking, payment processing and insurance-quote platforms, with social-engineering of IT service desks and outsourced helpdesk staff the principal initial-access mechanism.

Edge-appliance and identity-provider exposure remains the most operationally consequential collection theme this week. CISA added the Cisco Catalyst SD-WAN Manager defect CVE-2026-20245 to the KEV catalogue on 09 June with confirmed in-the-wild exploitation; a second SD-WAN Manager defect (CVE-2026-20262, path traversal) was added on 15 June. The Arista EOS tunnel-decap defect (CVE-2026-7473) was added on 09 June. CISA's 16 June addition (CVE-2026-48907, Joomla Widget Factory editor improper access control) is relevant to FS marketing / consumer-facing micro-sites where Joomla remains in use. On 15 June, CISA also added the LiteSpeed cPanel plugin symlink-following defect (CVE-2026-54420), relevant to FS-adjacent SaaS and hosting providers in scope under DORA outsourced-ICT controls.

Ransomware leak-site activity over the period was led, in volume terms, by Qilin (multiple posts targeting manufacturing and energy, with at least one finance-adjacent victim posted on 16 June) and DragonForce (seven posts during the period including a 16 June fastening-systems manufacturer in EMEA that supplies FS-aligned facilities). Akira, TheGentlemen and the Lynx / ShinyHunters cluster rounded out the leading set.

NCSC continues to flag CVE-2026-3055 and CVE-2026-4368 in Citrix NetScaler ADC / Gateway as immediate mitigation priorities for UK organisations and the FS estate inherits this directly: NetScaler Gateway sits in front of remote-working and contractor-VDI access across most UK retail banks and a significant share of UK insurance firms. FS-ISAC sector risk advisories from April 2026 continue to underline AI-driven fraud (deepfake KYC bypass, automated spear-phish) as a strategic risk that should drive controls investment, with the global sector strategy refresh announced at the FS-ISAC Americas Spring Summit in March 2026 explicitly naming supply-chain risk, geopolitical shifts and fraud as the principal collection priorities for the rest of the year.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (a.k.a. Agenda)

• Aliases: Agenda, Qilin.B
• Suspected Origin: Russian-speaking criminal underground
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - encryption + leak-site extortion
• Sector Targeting: Manufacturing, energy, financial services, healthcare, professional services
• Geographic Focus: Global; sustained EU and UK targeting through 2026
• Signature TTPs: Initial access via phishing and exposed VPN / RDP; lateral movement via valid accounts; rapid escalation and AD-wide encryption; data exfiltration via Rclone to Mega / Backblaze prior to encryption
• Tooling / Malware Families: Qilin / Agenda ransomware (Rust and Go builders), Cobalt Strike, AnyDesk, Rclone, PsExec
• Recent Activity: Active leak-site posting through the reporting period including a 16 June FS-adjacent post; broad volume leadership across manufacturing and energy with at least one finance-adjacent victim
• Assessed Threat to Vertical: HIGH - dominant volume across FS-adjacent verticals during the reporting period
• Analytic Confidence: HIGH

DragonForce / Scattered Spider cluster

• Aliases: Scattered Spider, UNC3944, Octo Tempest, Muddled Libra, 0ktapus, DragonForce affiliate
• Suspected Origin: Western (UK / US) English-speaking criminal cluster + DragonForce RaaS infrastructure
• Suspected Sponsor: Criminal
• Primary Motivation: Financial - extortion via encryption and data leak
• Sector Targeting: Retail, financial services, hospitality, telecoms, BPO / outsourced helpdesk providers
• Geographic Focus: UK and US primary; spreading EMEA
• Signature TTPs: IT-service-desk social engineering for MFA reset and password reset; Okta / Entra session hijack; rapid AD compromise; data theft via Rclone; deployment of DragonForce affiliate ransomware
• Tooling / Malware Families: Okta admin abuse, Teleport, Ngrok, Mimikatz, Cobalt Strike, DragonForce ransomware
• Recent Activity: Continued leak-site activity during the period; reporting indicates ongoing UK targeting in retail-banking and insurance ahead of summer-trading peaks
• Assessed Threat to Vertical: HIGH - direct UK FS targeting with proven business-disruption capability from the 2025 M&S / Co-op campaign
• Analytic Confidence: HIGH

Akira

• Aliases: Akira, Storm-1567 (some Microsoft attribution overlaps)
• Suspected Origin: Russian-speaking criminal underground
• Suspected Sponsor: Criminal (RaaS)
• Primary Motivation: Financial - encryption + extortion
• Sector Targeting: Financial services, professional services, manufacturing, education
• Geographic Focus: Global; consistent UK / EU presence
• Signature TTPs: Initial access via Cisco ASA / FTD SSL VPN brute force and exposed admin panels; abuse of valid accounts; rapid network mapping; data exfiltration; ChaCha20 ransomware encryption
• Tooling / Malware Families: Akira ransomware (Linux and Windows variants), AnyDesk, RustDesk, WinSCP, Mimikatz
• Recent Activity: Continued leak-site activity through the reporting period including 16 June FS-adjacent posts
• Assessed Threat to Vertical: HIGH - persistent direct FS leak-site activity
• Analytic Confidence: HIGH

BlueNoroff / Sapphire Sleet (DPRK)

• Aliases: APT38, BlueNoroff, Sapphire Sleet, Dangerous Password, CryptoCore
• Suspected Origin: Democratic People's Republic of Korea
• Suspected Sponsor: Nation-state (DPRK Reconnaissance General Bureau, Lab 110)
• Primary Motivation: Revenue generation for the DPRK regime - crypto theft, SWIFT-style fraud, fintech and FS targeting
• Sector Targeting: Cryptocurrency exchanges, fintech, banking, defi platforms, FS sub-contractors
• Geographic Focus: Global; FS-aligned firms in UK, US, EU, JP, KR
• Signature TTPs: Social-engineering pretext (recruiter / venture-capitalist), LinkedIn / Telegram targeting of FS staff, malicious macOS / Windows installers, credentialed cloud access, in-memory tooling
• Tooling / Malware Families: RustBucket, KandyKorn, ObjCShellz, custom Go / Rust loaders
• Recent Activity: Continuing DPRK fintech targeting consistent with reporting trends through Q1-Q2 2026
• Assessed Threat to Vertical: MEDIUM-HIGH for crypto / fintech sub-vertical, MEDIUM for traditional retail banking
• Analytic Confidence: MEDIUM

[Repeat the profile block above for each additional threat actor. A typical monthly report will profile between two and four actors in detail; quarterly reports may profile more.]

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Defend

Preventive priorities follow Section 6 directly: there is no vendor patch for CVE-2026-20245 or CVE-2026-7473 as at issue date, so mitigation-only postures must be enforced - restrict netadmin role membership, rotate netadmin credentials, restrict management plane to jumpbox-only access, enforce ACLs on Arista tunnel-decap interfaces, harden BGP / OSPF authentication. Apply NCSC mitigation for NetScaler ADC / Gateway (CVE-2026-3055 and CVE-2026-4368) and rotate gateway session secrets / service accounts. Patch LiteSpeed cPanel plugin (CVE-2026-54420), the Joomla Widget Factory editor (CVE-2026-48907) and force-update Chrome / Edge across the workstation estate for the V8 defect CVE-2026-11645. Reinforce helpdesk MFA-reset playbooks against Scattered Spider-style social-engineering: mandatory callback to directory-verified number, mandatory manager attestation, mandatory cooling-off period for high-privilege accounts. Validate deepfake-resistant out-of-band authorisation for high-value payments per the April 2026 FS-ISAC AI advisory.

Disrupt

10. Forward outlook

Looking forward to the next reporting period (20-26 Jun 2026), it is likely that at least one UK FS firm will publicly disclose an incident traceable to one of the Cisco SD-WAN Manager, Arista EOS, Citrix NetScaler or LiteSpeed cPanel defects in Section 6, given the combination of confirmed in-the-wild exploitation, no-patch mitigation-only postures on the two most severe defects, and the prevalence of these products in the UK FS WAN / edge estate. We assess it is highly likely that Qilin, DragonForce and Akira will maintain leak-site volume leadership, with at least one further FS-adjacent leak-site posting expected within the period. We assess it is a realistic possibility that Scattered Spider will conduct at least one helpdesk-engineered intrusion against a UK retail-banking or insurance firm; the M&S / Co-op / Harrods template remains operationally proven and continues to be reused.

Trigger conditions that would prompt revision of this outlook include: (a) a UK FS firm publicly attributing a breach to Cisco SD-WAN Manager or Arista EOS exploitation, which would warrant immediate out-of-cycle reporting; (b) emergence of a vendor patch for CVE-2026-20245 or CVE-2026-7473, which would shift the risk profile substantially; (c) a UK retail-banking helpdesk compromise matching the Scattered Spider / DragonForce template, which would warrant immediate FS-ISAC and CISP trust-group escalation; (d) observation of any IP Insights 'critical' tail indicator showing successful authentication into a client FS estate.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.