APT Groups Targeting Financial Services: Tactics, Techniques, and Procedures

Advanced Persistent Threat (APT) groups represent the most sophisticated and dangerous adversaries targeting financial institutions worldwide. Unlike opportunistic cybercriminals, APT actors — typically nation-state sponsored or tolerated — conduct long-horizon operations designed to steal funds, exfiltrate intelligence, or pre-position for strategic disruption. For financial services firms operating in New York City and globally, understanding who these actors are, how they operate, and how to detect their tradecraft is not optional. It is a core security competency.

The APT Landscape Targeting Finance

Four actor clusters dominate the threat landscape for financial institutions in 2025-2026. Each has distinct motivations, capabilities, and preferred techniques that shape how defenders must orient their detection engineering.

Lazarus Group / APT38 — North Korea

Lazarus Group, operating under the umbrella of North Korea's Reconnaissance General Bureau, is arguably the most prolific financially motivated nation-state threat actor in history. APT38, a subgroup focused specifically on financial theft, has stolen an estimated $3 billion or more from financial institutions since 2016. Their operations are characterized by extreme patience — dwell times of 6 to 18 months before executing the final theft are documented.

Their signature capability is SWIFT system targeting. By gaining persistent access to a bank's internal network, moving laterally to the SWIFT operator workstations, and studying the messaging procedures for weeks, they execute fraudulent SWIFT transfers timed for weekends or holidays when response times are slowest. The 2016 Bangladesh Bank heist ($81 million transferred before partial recall) remains the canonical example. More recently, Lazarus has pivoted to cryptocurrency exchange targeting using the same patient access methodology.

Their initial access vector of choice is fake job lure spearphishing — a campaign format dubbed "Operation Dream Job" that sends highly personalized LinkedIn recruitment messages or email offers purporting to be from major financial firms, embedding malicious documents or links. The targeting research behind these lures is sophisticated enough to fool experienced professionals.

Key tools include: BLINDINGCAN (backdoor), HOPLIGHT (proxy tool), FALLCHILL (RAT), and custom cryptocurrency theft tooling. MITRE ATT&CK techniques map to T1566.001 (Spearphishing Attachment), T1055 (Process Injection), T1005 (Data from Local System), and T1070 (Indicator Removal).

Carbanak / FIN7 — Criminal Organization

FIN7 (overlapping with the Carbanak group) operates as a sophisticated criminal enterprise rather than a nation-state actor, but their capabilities rival those of government-sponsored groups. They have compromised hundreds of financial institutions, restaurant chains, hotel brands, and retailers, stealing over $1 billion cumulatively.

FIN7's hallmark is POS (point-of-sale) malware deployment and, increasingly, supply chain compromise. They infiltrate managed service providers and payment processing vendors to gain simultaneous access to dozens of downstream victims. Their social engineering is highly refined — they have posed as legitimate businesses to mail physical devices containing malware to targeted organizations, a technique that bypasses email security controls entirely.

Their CARBANAK malware suite provides full remote access, video recording of the operator's screen, and the ability to control ATM dispensing mechanisms. More recently they have deployed POWERTRASH, BIRDDOG, and various Cobalt Strike derivatives. MITRE ATT&CK coverage includes T1059.001 (PowerShell), T1027 (Obfuscated Files), T1078 (Valid Accounts), and T1546 (Event Triggered Execution).

APT29 / Cozy Bear — Russia (SVR)

APT29, attributed to Russia's Foreign Intelligence Service (SVR), targets financial institutions primarily for intelligence collection rather than direct theft. Their objective is economic intelligence — merger activity, regulatory decisions, sovereign debt positions — that provides strategic advantage to the Russian state and affiliated oligarchs. The financial sector's concentration of sensitive economic data makes it a high-value SVR target.

APT29's defining characteristic is living-off-the-land (LotL) tradecraft — they prefer native Windows tools (WMI, PowerShell, scheduled tasks, certutil) over custom malware wherever possible, making them extremely difficult to detect with signature-based controls. When they do deploy implants, they use sophisticated loaders designed to evade EDR behavioral detection. Their SolarWinds SUNBURST campaign (discussed in our supply chain article) demonstrated their ability to operate inside enterprise environments for months without detection.

Key techniques: T1195 (Supply Chain Compromise), T1078 (Valid Accounts), T1550.004 (Web Session Cookie), T1021.002 (SMB/Windows Admin Shares), and heavy use of T1027.010 (Command Obfuscation).

APT41 — China (MSS-Affiliated)

APT41 is uniquely positioned as a group that conducts both state-sponsored espionage and financially motivated cybercrime — sometimes simultaneously. Attributed to contractors working for China's Ministry of State Security, APT41 targets financial services for both intelligence collection and direct financial theft, depending on the operation. In the financial sector, their primary interest is in institutions that hold data about Chinese nationals, technology transfer intelligence, and pre-IPO financial data.

APT41 has exploited zero-day vulnerabilities more aggressively than almost any other APT group — documented exploitation of Citrix, Cisco, ManageEngine, and Microsoft Exchange vulnerabilities within days of public disclosure. Their malware ecosystem is expansive: WINNTI, XDOOR, DUSTPAN, DUSTTRAP, and numerous others. MITRE coverage includes T1190 (Exploit Public-Facing Application), T1505.003 (Web Shell), T1036 (Masquerading), and T1071 (Application Layer Protocol).

FS-ISAC and Intelligence Sharing

The Financial Services Information Sharing and Analysis Center (FS-ISAC) provides sector-specific threat intelligence that is significantly more operationally relevant than generic feeds. FS-ISAC members receive indicator packages, TTP reports, and sector-specific warnings faster than public disclosure. For financial institutions subject to NY DFS 23 NYCRR 500, participation in FS-ISAC or equivalent intelligence-sharing communities supports the third-party intelligence requirement under Section 500.09.

Actionable intelligence from FS-ISAC includes: SWIFT fraud patterns, ATM jackpotting campaigns, BEC actor infrastructure, and sector-targeted phishing campaigns with fresh IOCs. The organization also coordinates with FS-CERT (Europe) and the Cyber Defence Alliance for global financial sector coverage.

Detection Strategies for APT Tradecraft

Detecting APT activity in financial networks requires moving beyond signature detection toward behavioral and anomaly-based approaches:

• SWIFT transaction anomaly monitoring: Establish behavioral baselines for SWIFT operator accounts — typical transaction volumes, timing patterns, destination countries. Deviations from baseline, especially outside business hours or involving new correspondent banks, warrant immediate investigation.
• Living-off-the-land detection: Alert on LOLBin usage (certutil downloading external files, regsvr32 executing remote scripts, wmic spawning cmd.exe) in contexts where these tools are not expected. Most financial workstations have no legitimate need for certutil to reach the internet.
• Lateral movement detection: Monitor for Pass-the-Hash, Pass-the-Ticket, and Kerberoasting indicators. Alert on service account authentications from workstations, unusual SMB connections to domain controllers, and new service principal name (SPN) registrations.
• Spearphishing resilience: Implement DMARC/DKIM/SPF enforcement, analyze email headers for lookalike domains, enable macro execution blocking via Group Policy, and deploy anti-phishing awareness training with simulated APT-style lures (not just generic phishing).
• UEBA for account compromise: Deploy User and Entity Behavior Analytics to detect account credential theft — impossible travel, off-hours access, new device enrollment, bulk data access inconsistent with role.

Our network penetration testing service includes adversary simulation modeled on APT tradecraft, giving your detection team the opportunity to validate controls against real attack patterns before actual threat actors do. If your organization handles SWIFT transactions or holds economic intelligence attractive to nation-state actors, contact us to discuss a threat-informed security assessment.

NYC Financial Sector Targeting Patterns

New York City's concentration of financial institutions — major banks, asset managers, payment processors, insurance carriers, and FinTech firms — makes it a uniquely high-density target environment. Several patterns are specific to this geography:

• Wire transfer fraud targeting firms with correspondent relationships to Eastern European and Asian financial institutions — attackers exploit these legitimate corridors for fund movement.
• Targeting of mid-market investment firms and family offices, which often lack the security maturity of bulge-bracket banks but hold significant assets and market-sensitive data.
• Social engineering of law firms and accounting firms that serve financial sector clients — these professional service firms are often softer targets that provide a pathway into their financial sector clients' data.
• Physical proximity attacks: NYC's dense office environment creates social engineering opportunities — tailgating, shoulder surfing of trading floor screens, and impersonation of IT staff — that are less prevalent in distributed environments.

Financial firms operating in New York should review their threat models annually to account for these geography-specific patterns, and ensure their network infrastructure is segmented to limit lateral movement in the event of a successful initial access by an APT actor.