Spot ransomware threats targeting financial institutions by watching for credential phishing, exposed Remote Desktop Protocol, and unpatched VPNs or firewalls. Treat sudden encryption paired with a leak threat, and suspicious access around market-moving events, as high-risk signals.
Ransomware is malicious software that locks systems until payment. Double extortion means attackers also steal data and threaten to publish it. Financial services face sustained pressure, with FinCEN analysis finding 432 incidents and about $365.6 million paid during 2022-2024, according to the FinCEN trend analysis.
Table of Contents
- What bank attacks look like now
- Which entry points to check first
- Why timing exposes the motive
- What to do when you spot the signs
What bank attacks look like now
Medusa operates as ransomware-as-a-service, where affiliates rent the malware and share payments. Joint CISA-FBI-HHS advisory AA25-071A says it breached more than 500 U.S. organizations since June 2021, including financial services. It uses encryption plus threatened leak-site publication, according to the CISA advisory on Medusa. Gunra emerged in April 2025 from leaked Conti code and runs the same rental model. CISA reports a Tor negotiation portal and leak site, with targets in financial services, health care and government worldwide.
Gunra actors gain entry by exploiting Fortinet firewall flaws CVE-2024-55591 and CVE-2025-24472, then combine data theft with encryption. The November 2023 LockBit attack on ICBC Financial Services shows market impact. Computer Weekly reported disrupted U.S. Treasury-market settlement and temporary manual settlement by messenger-carried USB drives. The broker temporarily owed BNY Mellon $9 billion.
Which entry points to check first
The FBI's IC3 found phishing email, RDP exploitation and software-vulnerability exploitation remained the top ransomware entry vectors, summarized in the FBI IC3 findings summary. RDP, or Remote Desktop Protocol, is a remote-access tool that attackers abuse when it is exposed to the internet.
Unpatched VPNs and firewalls give the same easy foothold. Check these warning signs during triage:.
- credential-phishing emails aimed at finance, IT and wire-operations staff
- RDP open to the internet or with weak logins
- unpatched VPNs, firewalls and public-facing devices
- Fortinet devices missing fixes for CVE-2024-55591 or CVE-2025-24472
Why timing exposes the motive
The FBI warned that groups target companies involved in time-sensitive financial events such as mergers, acquisitions or stock-moving announcements. Attackers steal nonpublic data during reconnaissance and use it to force faster payment. That pressure tactic matters more for banks, brokers and listed borrowers than for ordinary victims.
Raise scrutiny around deal calendars, earnings and settlement windows. Compare login alerts, data-transfer alerts and extortion messages against those dates. A quiet intrusion that turns loud just before an announcement points to deliberate financial coercion.
What to do when you spot the signs
Separate critical systems so one infection cannot reach backups and payments. Keep segmented offline backups, require phishing-resistant MFA and restrict RDP. Phishing-resistant MFA means login that a fake page cannot replay, such as a hardware key.
Patch CISA Known Exploited Vulnerabilities promptly. Isolate the affected system, preserve logs and start recovery from clean offline copies. U.S. banks must also notify their primary federal regulator within 36 hours of a significant computer-security incident, according to the Federal Reserve notification rule.
You Might Also Like
- Will Banks Compensate Customers After a Financial Data Breach?
- How Long Should a Financial Data Breach Investigation Take?
- ARTEX AI Pentesting Tool Linked to Financial Sector Data Breach