Financial services threat intelligence report — 11–17 July 2026

• Reference: TI-2026-0717-001 (public edition)
• Sector: Financial services, banking, fintech and insurance
• Reporting period: 11–17 July 2026
• Issued: 17 July 2026 · Lead analyst: EmilyAI · Reviewed by: SOC Duty Senior Analyst

This is the public (TLP:CLEAR) edition of an intelligence product written by the UK Cyber Defence Security Operations Centre for its clients. Observations specific to individual client environments have been removed. Clients receive the full edition, including estate-specific indicators and detection content.

1. Executive summary

This report provides an assessment of the threat landscape affecting the Financial Services, Banking, Fintech and Insurance sector during the period 11 Jul 2026 - 17 Jul 2026. It is intended to support security leadership and operational defenders within client organisations operating in the named vertical, and to inform decisions on detection priorities, defensive investment, and risk acceptance.

Sources are graded throughout against the Admiralty system, and analytic judgements are accompanied by an explicit confidence rating. The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets. During this reporting period the collection picture is dominated by four developments: the disclosure and immediate exploitation of SonicWall SMA1000 zero-days CVE-2026-15409 (CVSS 10.0 SSRF) and CVE-2026-15410 (post-auth code injection), for which Rapid7 MDR has assessed the attacker objective as ransomware; the Microsoft AD FS elevation-of-privilege CVE-2026-56155, added to the CISA KEV catalogue on the day of disclosure with active exploitation confirmed and a specific concern for identity federation into Microsoft 365 tenants; the 19-agency joint advisory of 13 Jul 2026 attributing systematic router compromise at the perimeter of critical national infrastructure to FSB Centre 16, together with a paired APT28 "FrostArmada" campaign hijacking DNS on approximately 18,000 SOHO routers to steal Microsoft 365 credentials and OAuth tokens; and the continued dominance of The Gentlemen ransomware brand, which held first place among leak-site postings in June 2026 (121 postings) and continued its cadence into this reporting period.

FS-ISAC daily indicator exchange during the period surfaces a consistent set of source ranges probing OWA, NetScaler Gateway, Entra ID sign-in endpoints, AD FS federation paths and SharePoint /_layouts/15 uploader paths across peer FS estates. Weighting ISAC intelligence above vendor reporting, the analyst's view is that The Gentlemen, Qilin and the DragonForce / Scattered Spider cluster are the three actors of most operational significance to the vertical over the next two reporting cycles. FS-ISAC AI Cybersecurity Hardening working-group output continued to flag deepfake voice and video authorisation of payments and synthetic-identity onboarding as expanding fraud-adjacent vectors.

Key Judgements

The following key judgements represent the lead analyst’s assessed view at the time of issue. Each is qualified by an analytic confidence rating in line with the conventions described in Section 11.

1. It is highly likely that Microsoft AD FS CVE-2026-56155 will drive credential-federation intrusion attempts against UK and EU FS estates over the next two reporting cycles, given the same-day CISA KEV listing on 14 Jul 2026, the confirmed active exploitation, and the very high value of federation-server compromise as a route into cloud-tenant control (HIGH confidence).
2. It is highly likely that SonicWall SMA1000 CVE-2026-15409 and -15410, chained, will drive ransomware initial-access intrusions against UK and EU FS firms during the next two reporting cycles; Rapid7 MDR has confirmed the attacker objective is ransomware and the exploitation curve began before public disclosure (HIGH confidence).
3. It is highly likely that The Gentlemen and Qilin will continue to drive the majority of materially-disruptive ransomware incidents against UK and EU FS firms during the next two reporting cycles; The Gentlemen's 90 per cent affiliate profit share is materially accelerating recruitment away from other brands (HIGH confidence).
4. It is likely that AI-driven KYC bypass — deepfake voice and video authorisation of payments and synthetic-identity onboarding — will continue to expand as a fraud-adjacent threat vector through Q3 2026; FS-ISAC AI Cybersecurity Hardening working group output through this period continues to prioritise this scenario (MEDIUM-HIGH confidence).
5. It is a realistic possibility that a targeted spear-phishing or router-compromise operation attributable to FSB Centre 16 or APT28 will affect a UK or EU FS firm within the next two reporting cycles, given the 13 Jul 2026 19-agency joint advisory and the scale of the FrostArmada router campaign (MEDIUM confidence).

2. Sector threat landscape

The financial-services vertical continues to absorb a disproportionate share of organised criminal cyber activity directed at UK and European markets. During this reporting period the collection picture is dominated by four developments: the disclosure and immediate exploitation of SonicWall SMA1000 zero-days CVE-2026-15409 (CVSS 10.0 SSRF) and CVE-2026-15410 (post-auth code injection), for which Rapid7 MDR has assessed the attacker objective as ransomware; the Microsoft AD FS elevation-of-privilege CVE-2026-56155, added to the CISA KEV catalogue on the day of disclosure with active exploitation confirmed and a specific concern for identity federation into Microsoft 365 tenants; the 19-agency joint advisory of 13 Jul 2026 attributing systematic router compromise at the perimeter of critical national infrastructure to FSB Centre 16, together with a paired APT28 "FrostArmada" campaign hijacking DNS on approximately 18,000 SOHO routers to steal Microsoft 365 credentials and OAuth tokens; and the continued dominance of The Gentlemen ransomware brand, which held first place among leak-site postings in June 2026 (121 postings) and continued its cadence into this reporting period.

FS-ISAC daily indicator exchange during the period surfaces a consistent set of source ranges probing OWA, NetScaler Gateway, Entra ID sign-in endpoints, AD FS federation paths and SharePoint /_layouts/15 uploader paths across peer FS estates. Weighting ISAC intelligence above vendor reporting, the analyst's view is that The Gentlemen, Qilin and the DragonForce / Scattered Spider cluster are the three actors of most operational significance to the vertical over the next two reporting cycles. FS-ISAC AI Cybersecurity Hardening working-group output continued to flag deepfake voice and video authorisation of payments and synthetic-identity onboarding as expanding fraud-adjacent vectors.

3. Key threat actors

The following actors are assessed to pose the most significant threat to organisations within the named vertical during the reporting period. The profile block below should be repeated, in full, for each actor profiled. Prioritise actors for whom new or sector-relevant activity has been observed within the reporting period; established actors with no recent activity may be referenced briefly without a full profile.

The Gentlemen

• Aliases: The Gentlemen (single-name RaaS brand); Qilin-affiliate lineage per Halcyon
• Suspected Origin: Unattributed (Russian-speaking assessed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Broad mid-market; disproportionately professional services, legal, healthcare, manufacturing, retail, trade bodies
• Geographic Focus: Global; western Europe and North America dominant in June-July 2026 tally; Germany over-represented
• Signature TTPs: Initial access via brokered credentials and public-facing exploitation (SharePoint CVE-2026-45659 chains this period), LOTL tooling, aggressive leak-site publication cadence, PowerShell + custom Rust payload
• Tooling / Malware Families: The Gentlemen ransomware (Rust), Rclone, PsExec, Cobalt Strike
• Recent Activity: 121 leak-site postings in Jun 2026 (revised up from initial 115) - first month above Qilin in over a year; 300 postings across Q2 2026 (Qilin 289); 90% affiliate profit share; sustained cadence into 11-17 Jul 2026
• Assessed Threat to Vertical: HIGH - fastest-growing RaaS brand
• Analytic Confidence: HIGH

Qilin (a.k.a. Agenda)

• Aliases: Agenda, Qilin.B, Water Galura
• Suspected Origin: Russian-speaking (unattributed)
• Suspected Sponsor: Organised criminal RaaS
• Primary Motivation: Financial (double extortion)
• Sector Targeting: Financial services, healthcare, manufacturing, retail, professional services, legal, logistics
• Geographic Focus: Global; UK and EU disproportionately represented in H1 2026 leak-site postings; Germany over-represented
• Signature TTPs: Initial access via brokered credentials, Check Point VPN CVE-2026-50751 exploitation, RMM abuse (AnyDesk, SplashTop), PowerShell + Rust ransomware payload; ESXi Linux variant
• Tooling / Malware Families: Qilin.B ransomware (Rust), Cobalt Strike, Rclone-to-Mega, Mimikatz, SharpHound
• Recent Activity: 1,496 leak-site victims across trailing 12 months (dominant RaaS by lifetime volume); 78 postings in June 2026 (overtaken by The Gentlemen); 289 postings across Q2 2026; Max Fordham (UK, 06 Jul 2026) leak-site claim
• Assessed Threat to Vertical: HIGH - dominant RaaS operator across UK/EU by lifetime volume
• Analytic Confidence: HIGH

DragonForce / Scattered Spider cluster

• Aliases: Scattered Spider, UNC3944, Octo Tempest, Muddled Libra, 0ktapus, DragonForce affiliate
• Suspected Origin: Anglophone (UK/US); further four arrests 10 Jul 2026 per NCA
• Suspected Sponsor: Organised criminal alliance / RaaS
• Primary Motivation: Financial (ransomware + data extortion)
• Sector Targeting: Retail, hospitality, telecoms, technology, real estate, manufacturing, construction, financial services (payments)
• Geographic Focus: Anglophone western targets
• Signature TTPs: Voice-phishing IT service desk to reset MFA, help-desk social engineering, EDR bypass via legitimate RMM tooling, DragonForce Linux/ESXi ransomware, aggressive cloud-tenant pivot
• Tooling / Malware Families: DragonForce ransomware, Ngrok, AnyDesk, SplashTop, Impacket, Chisel
• Recent Activity: Continued leak-site postings (Real Estate, Manufacturing, Construction focus); further NCA arrests 10 Jul 2026 connected to M&S/Co-op/Harrods case; alliance-affiliate operations continue
• Assessed Threat to Vertical: HIGH - social-engineering methodology transfers directly across verticals
• Analytic Confidence: HIGH

FSB Centre 16 (Static Tundra / Berserk Bear)

• Aliases: Berserk Bear, Energetic Bear, Crouching Yeti, Dragonfly, Ghost Blizzard, Static Tundra
• Suspected Origin: Russian Federation (FSB Centre 16)
• Suspected Sponsor: Nation state (Russian FSB)
• Primary Motivation: Espionage; strategic access; disruption-adjacent given target choice
• Sector Targeting: Energy, communications, defence industrial base, healthcare, financial services, government, critical national infrastructure globally
• Geographic Focus: Global; UK, US, EU and allied CNI
• Signature TTPs: Systematic router-perimeter compromise (Cisco IOS legacy CSRF resurfaced 13 Jul 2026), SNMP abuse, credential harvesting via man-in-the-middle, edge-appliance persistence
• Tooling / Malware Families: Custom implants on Cisco IOS, MikroTik, TP-Link; SNMP misuse; DNS hijacking
• Recent Activity: 19-agency joint advisory of 13 Jul 2026 attributing systematic router-perimeter compromise across CNI and defence-sector networks; paired APT28 "FrostArmada" DNS-hijack campaign against ~18,000 SOHO routers stealing M365 credentials and OAuth tokens
• Assessed Threat to Vertical: HIGH for CNI, defence, government; MEDIUM-HIGH elsewhere
• Analytic Confidence: HIGH

4. Tactics, techniques and procedures

The TTPs listed below are aligned to the MITRE ATT&CK Enterprise framework and represent techniques observed in incidents affecting the vertical during the reporting period. The corresponding behaviours should be cross-referenced to the incidents listed in Section 5 and to detection logic deployed within client environments.

5. Notable incidents and campaigns

Where peer organisations are named, the source of attribution is recorded. Where peer organisations are anonymised, the description is sufficient to convey the operational lessons without identifying the affected party.

6. Vulnerabilities of concern

The vulnerabilities below are those assessed to carry the greatest material risk to the vertical at the time of issue, taking into account exploit availability, observed exploitation, the prevalence of affected products in the sector, and listing on the CISA Known Exploited Vulnerabilities catalogue. The remediation guidance should be read alongside the recommended actions in Section 9.

7. Indicators of compromise

The following indicators are provided to support detection engineering and threat hunting within client environments. Indicators are defanged in line with industry convention, and confidence ratings reflect the analyst’s assessment of the strength of the association between the indicator and the named actor or campaign. Indicators should be ingested with appropriate decay periods; high-confidence atomic indicators (hashes) generally warrant longer retention than network indicators (IPs, domains).

A machine-readable companion file in STIX 2.1 format is available on request from the lead analyst.

8. Sector risk assessment

The risk assessment below combines the threat picture established in earlier sections with an estimate of the impact each scenario would carry for a representative organisation operating in the vertical. The composite rating is intended to inform prioritisation of defensive investment and is not a substitute for an organisation-specific risk assessment.

9. Recommended defensive actions

The recommendations below are organised against the three operational pillars of Detect, Defend, and Disrupt. They are intended to be actionable within a typical client environment and should be prioritised according to the risk ratings assigned in Section 8 and the operational maturity of the receiving organisation.

Detect

Retain SharePoint w3wp.exe / cmd.exe / powershell.exe / rundll32.exe child-process hunts under the SharePoint application pool. Deprioritise the seven documented FP families (Intune Run-key, NinjaRMM explorer, Sophos File Scanner lsass, Defender-being-enabled, 117xxx DLP, loopback RDP, browser localhost 3389 probes) in triage weighting.

Defend

Preventive priorities follow Section 6 directly. Apply the SonicWall SMA1000 12.4.3-02962 patch immediately and restrict the Management Console to a dedicated management VLAN with MFA on admin logins.

Continue enforcement of SharePoint CVE-2026-45659 patching and Site Member permission audits. Apply Check Point R81.20 / R81.10 / R80.40 hotfixes for CVE-2026-50751 (Qilin initial-access exploitation). Given the FSB / APT28 router-perimeter advisory, verify router firmware currency on every internet-facing edge device, disable SNMP/RMI/UPnP on WAN interfaces, rotate management credentials, and lift Microsoft 365 conditional access to enforce MFA on all administrative sign-ins.

On Entra ID, extend smart-lockout scope to cover Azure CLI, Azure Active Directory PowerShell, One Outlook Web, Microsoft Teams and OfficeHome — the five app vectors documented in the Entra ID password-spray campaign.

Disrupt

Disruption activity within client lawful authority should focus on: (i) sustained participation in the FS-ISAC daily indicator exchange, with this week's AS200373 DREI-K-TECH-GMBH pivot and the associated IPv4/IPv6 family list submitted as the highest-value contributable; (ii) honeypot deployment fronting NetScaler Gateway, Check Point management paths and SonicWall SMA1000 workplace paths, with capture routed to the disruption workflow and shared with FS-ISAC and NCSC / CISA channels; (iii) tabletop exercise of the AD FS-compromise-into-M365-tenant scenario against the identity architecture the firm actually operates, not a generic reference architecture; (iv) coordinated takedown submissions against any DREI-K-TECH-GMBH-hosted IP identified as attacker infrastructure via the AS abuse-contact and CERT-DE.

10. Forward outlook

Looking forward to the next reporting period (18 Jul - 24 Jul 2026), it is highly likely that at least one UK or EU FS firm will publicly disclose a SonicWall SMA1000 CVE-2026-15409/-15410 intrusion, given Rapid7's confirmation of active zero-day exploitation and the ransomware objective. It is likely that AD FS CVE-2026-56155 exploitation will be publicly attributed to a named ransomware or espionage actor within the same window. It is likely that The Gentlemen and Qilin will maintain their leak-site cadence, with FS-adjacent mid-market victims continuing to feature.

11. Analytic confidence and source reliability

Analytic confidence ratings used throughout this report express the analyst’s assessment of the strength of the evidence and reasoning underlying each judgement. HIGH indicates well-corroborated evidence drawn from multiple credible sources and a strong analytic line of reasoning; MEDIUM indicates plausibility supported by partial corroboration or sound analytic inference; LOW indicates limited evidence, single-sourcing, or significant uncertainty in the underlying data. Where confidence is LOW, the rationale is recorded in the body of the report rather than allowed to stand unexamined.

Sources cited in Section 12 are graded against the Admiralty System, which assesses source reliability on a scale of A to F and information credibility on a scale of 1 to 6. The full key is reproduced below for reference.

12. References

The numbered references below correspond to citations within the body of the report. Each entry is graded against the Admiralty System.

---

About this report

UK Cyber Defence's SOC publishes sector threat intelligence for the organisations it defends, graded against the Admiralty system and mapped to MITRE ATT&CK. This public edition is provided in good faith on the basis of sources held to be reliable at the time of issue; recipients remain responsible for how they apply it. If you would like sector briefings, indicators and detection content for your own organisation, talk to an analyst or read about SOC365, our managed SOC.