Financial services threat intelligence report — 4–10 July 2026

• Reference: TI-2026-0710-001 (public edition)
• Sector: Financial services, banking, fintech and insurance
• Reporting period: 4–10 July 2026
• Issued: 10 July 2026 · Lead analyst: Peter Bassill · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Financial Services, Banking, Fintech and Insurance sector during the period 04 Jul 2026 - 10 Jul 2026. The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets. The collection picture for this period is dominated by three developments: the rapid exploitation of CVE-2026-8451 (CitrixBleed 3 follow-on) within 24 hours of vendor disclosure; the emergence of Qilin-affiliate exploitation of CVE-2026-50751 (Check Point VPN) as a fresh initial-access vector; and the continuing ascent of The Gentlemen ransomware brand, which overtook Qilin in June leak-site volume and has maintained pace into July.

FS-ISAC daily indicator exchange during the period surfaces a consistent set of source ranges probing OWA, NetScaler Gateway and Entra ID sign-in endpoints across peer FS estates. Weighting ISAC intelligence above vendor reporting, the analyst's view is that the Qilin, The Gentlemen and DragonForce / Scattered Spider clusters are the three actors of most operational significance to the vertical over the coming two reporting cycles, with Anubis and BlueNoroff carrying secondary but non-trivial weight.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that CVE-2026-8451 (CitrixBleed 3 follow-on) will drive credentialled intrusion attempts against NetScaler-fronted FS remote-working estates over the next two reporting cycles, given the 24-hour exploitation timeline and residual population of not-yet-session-invalidated deployments (HIGH confidence).
2. It is highly likely that ransomware and pure data-extortion crews - Qilin, Akira, DragonForce and the fast-rising The Gentlemen - will continue to drive the majority of materially-disruptive incidents against UK and EU FS firms during the next two reporting cycles; Qilin's newly-observed exploitation of Check Point VPN CVE-2026-50751 is a specific initial-access risk (HIGH confidence).
3. It is likely that CVE-2026-45659 (SharePoint deserialisation) exposure remains material for FS document-management estates that have not fully audited SharePoint Site Member permissions since the 04 Jul deadline; residual risk sits with mid-market firms without dedicated SharePoint governance (MEDIUM-HIGH confidence).
4. It is likely that AI-driven KYC bypass - deepfake voice and video authorisation of payments and synthetic-identity onboarding - will continue to expand as a fraud-adjacent threat vector through Q3 2026 (MEDIUM-HIGH confidence).
5. It is a realistic possibility that one of the BlueNoroff / Sapphire Sleet sub-clusters will conduct a credentialed intrusion against a UK or EU fintech or crypto-adjacent FS firm within the next two reporting cycles (MEDIUM confidence).

2. Sector threat landscape

The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets. The collection picture for this period is dominated by three developments: the rapid exploitation of CVE-2026-8451 (CitrixBleed 3 follow-on) within 24 hours of vendor disclosure; the emergence of Qilin-affiliate exploitation of CVE-2026-50751 (Check Point VPN) as a fresh initial-access vector; and the continuing ascent of The Gentlemen ransomware brand, which overtook Qilin in June leak-site volume and has maintained pace into July.

FS-ISAC daily indicator exchange during the period surfaces a consistent set of source ranges probing OWA, NetScaler Gateway and Entra ID sign-in endpoints across peer FS estates. Weighting ISAC intelligence above vendor reporting, the analyst's view is that the Qilin, The Gentlemen and DragonForce / Scattered Spider clusters are the three actors of most operational significance to the vertical over the coming two reporting cycles, with Anubis and BlueNoroff carrying secondary but non-trivial weight.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

Qilin (a.k.a. Agenda)

• Aliases: Agenda, Qilin.B, Water Galura
• Suspected Origin: Russian-speaking (unattributed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Financial services, healthcare, manufacturing, retail, professional services, logistics
• Geographic Focus: Global; UK and EU disproportionately represented in H1 2026 leak-site postings
• Signature TTPs: Initial access via brokered credentials, Check Point VPN CVE-2026-50751 exploitation, RMM abuse (AnyDesk, SplashTop), PowerShell + Rust ransomware payload; ESXi Linux variant
• Tooling / Malware Families: Qilin.B ransomware (Rust), Cobalt Strike, Rclone-to-Mega, Mimikatz, SharpHound
• Recent Activity: 1,496 leak-site victims across trailing 12 months (dominant RaaS); 78 postings in June 2026 (temporarily overtaken by The Gentlemen at 115); continued CVE-2026-50751 exploitation reported this period
• Assessed Threat to Vertical: HIGH - dominant RaaS operator across UK/EU
• Analytic Confidence: HIGH

DragonForce / Scattered Spider cluster

• Aliases: Scattered Spider, UNC3944, Octo Tempest, Muddled Libra, 0ktapus, DragonForce affiliate
• Suspected Origin: Anglophone (UK/US); further four arrests 10 Jul 2026 per NCA
• Suspected Sponsor: Organised criminal alliance / RaaS
• Primary Motivation: Financial (ransomware + data extortion)
• Sector Targeting: Retail, hospitality, telecoms, technology, real estate, manufacturing, construction, FS (payments)
• Geographic Focus: Anglophone western targets
• Signature TTPs: Voice-phishing IT service desk to reset MFA, help-desk social engineering, EDR bypass via legitimate RMM tooling, DragonForce Linux/ESXi ransomware, aggressive cloud-tenant pivot
• Tooling / Malware Families: DragonForce ransomware, Ngrok, AnyDesk, SplashTop, Impacket, Chisel
• Recent Activity: 7 leak-site postings in trailing 24h (Real Estate, Manufacturing, Construction focus); 4 additional UK arrests connected to M&S/Co-op/Harrods case 10 Jul 2026; alliance-affiliate operations continue
• Assessed Threat to Vertical: HIGH - social-engineering methodology transfers directly across verticals
• Analytic Confidence: HIGH

The Gentlemen

• Aliases: The Gentlemen (single-name RaaS brand)
• Suspected Origin: Unattributed (Russian-speaking assessed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Broad mid-market; disproportionately professional services, retail, healthcare, manufacturing
• Geographic Focus: Global; western Europe and North America dominant in June-July 2026 tally
• Signature TTPs: Initial access via brokered credentials, LOTL tooling, aggressive leak-site publication cadence, PowerShell + custom Rust payload
• Tooling / Malware Families: The Gentlemen ransomware (Rust), Rclone, PsExec, Cobalt Strike
• Recent Activity: 115 leak-site postings in Jun 2026 - highest of any single brand and first month above Qilin in over a year; sustained cadence into 04-10 Jul 2026
• Assessed Threat to Vertical: HIGH - fastest-growing RaaS brand
• Analytic Confidence: MEDIUM-HIGH

BlueNoroff / Sapphire Sleet (DPRK)

• Aliases: APT38, BlueNoroff, Sapphire Sleet, Dangerous Password, CryptoCore
• Suspected Origin: Democratic People's Republic of Korea (Lazarus umbrella)
• Suspected Sponsor: Nation state (DPRK Reconnaissance General Bureau)
• Primary Motivation: Financial (regime revenue generation, especially cryptocurrency theft)
• Sector Targeting: Cryptocurrency exchanges, Web3, DeFi, fintech, cross-border payments, VC / investment firms
• Geographic Focus: Global with heavy Anglophone and Japanese targeting
• Signature TTPs: Social engineering via LinkedIn / Telegram / X, fake job offers, fake investment approaches, macOS-focused implants, signed installer chains
• Tooling / Malware Families: RustBucket, KANDYKORN, ObjCShellz, TodoSwift, DPRK signed installer chains
• Recent Activity: Ongoing campaigns against cross-border payments and crypto-adjacent FS firms; NCSC / CISA joint reporting continues to flag active LinkedIn recruitment
• Assessed Threat to Vertical: MEDIUM-HIGH - moderate volume but very high per-incident impact where successful
• Analytic Confidence: MEDIUM

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Detection engineering should treat CVE-2026-8451 CitrixBleed 3 follow-on session-token replay as the principal hunting hypothesis for the next reporting cycle. Retain SharePoint w3wp.exe / cmd.exe / powershell.exe / rundll32.exe process-tree hunts under the SharePoint app pool identity. Deploy hunts around the Anubis-affiliate RMM tooling (ScreenConnect, Zoho Assist, MeshAgent, Remotely, UltraVNC, Total Software Deployment) - the NCSC advisory this week provides a clean baseline. Continue Qilin / Akira / DragonForce / The Gentlemen initial-access playbook hunts (RMM install, PsExec / SMBExec, DCSync, Rclone-to-Mega). Deploy IP Insights critical-tail block / alert lists to WAF and Entra ID Conditional Access.

Defend

Preventive priorities follow Section 6 directly. Complete Citrix NetScaler patching for CVE-2026-8451 and re-run the session-invalidation commands ('kill icaconnection -all', 'kill pcoipConnection -all', 'kill aaa session -all') on every patched appliance. Verify CVE-2026-45659 SharePoint patching has been applied and Site Member permissions audited. Apply Check Point R81.20 / R81.10 / R80.40 hotfixes to address CVE-2026-50751 given the Qilin-affiliate exploitation report. Complete Ivanti Sentry patching against CVE-2026-10520 and restrict admin interfaces to a management VLAN. Address FortiSandbox exposure (CVE-2026-25089 / -26083) as part of the wider FortiBleed remediation. Enforce phishing-resistant MFA on all privileged FS accounts including finance-function payment approvers.

Disrupt

Disruption activity within client lawful authority should focus on: (i) sustained participation in the FS-ISAC daily indicator exchange, with this week's IP Insights critical / block tail submitted as the highest-value contributable; (ii) honeypot deployment fronting NetScaler Gateway and Check Point management paths, with capture routed to the disruption workflow and shared with FS-ISAC and NCSC CiSP; (iii) coordinated take-down requests to bulletproof-hosting providers (dmzhost, serverion, PPTECHNOLOGY, UAB Host Baltic) for the IP Insights critical tail, submitted via the NCSC Takedown Service where the tail intersects with UK-hosted infrastructure; (iv) continued participation in the FS-ISAC AI Cybersecurity Hardening working group covering deepfake payments-fraud detection.

10. Forward outlook

Looking forward to the next reporting period (11 Jul - 17 Jul 2026), it is likely that at least one UK FS firm will publicly disclose a CitrixBleed 3 follow-on (CVE-2026-8451) intrusion, given the 24-hour exploitation cadence observed on disclosure and the residual population of appliances that have been patched but not fully session-invalidated. It is likely that Qilin-affiliate exploitation of CVE-2026-50751 will extend to at least one UK FS victim within the next two cycles. Ransomware leak-site cadence from Qilin, Akira, DragonForce and The Gentlemen is expected to remain steady week-on-week; the 10 Jul NCA arrests are unlikely to materially reduce the operational threat given the alliance-affiliate model.

Trigger conditions that would prompt revision of this outlook include: (a) a UK FS firm publicly attributing a breach to CVE-2026-8451 or CVE-2026-50751, which would warrant immediate out-of-cycle reporting; (b) emergence of an unauthenticated variant of any current SharePoint or Ivanti Sentry chain; (c) further CISA KEV additions materially affecting FS infrastructure (particularly Fortinet, Ivanti or SonicWall gateways); (d) any confirmed intrusion against a monitored FS client attributable to the actors profiled in Section 3, which would warrant a case-linked addendum to this product.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.