Financial Crime Is Going Interactive: Why the New Hunt Targets Identity, Not Just Endpoints
CrowdStrike’s latest financial-services threat landscape shows a sector under pressure from hands-on intrusions, leak-site extortion, cloud trust abuse, and proxy infrastructure that makes defenders chase behavior instead of a single bad file.
Financial services did not just stay on the threat map in the latest landscape report - it remained one of the hottest targets in sight. The assessment puts the sector fourth globally, at 12% of observed activity, and describes a sharp rise in hands-on-keyboard intrusions. That matters because interactive attacks are harder to stop with simple malware rules: operators can adapt in real time, move through identity systems, and blend into normal administrative traffic.
Fast Facts
- Financial services ranked as the fourth most-targeted sector globally, with 12% of observed activity.
- Hands-on-keyboard intrusions against financial institutions rose 43% globally and 48% in North America over two years.
- Big game hunting crews named 423 financial-services entities on leak sites, up 27% year over year.
- The report highlights cloud-identity abuse, ORB proxy networks, and DLL search-order hijacking as recurring tradecraft.
- Several named clusters were tied to ransomware pressure, cryptocurrency theft, and social-engineering operations.
Why the pattern is changing
The technical story here is not just ransomware. It is the growing overlap between access brokerage, cloud trust relationships, and post-compromise operator tradecraft. In CrowdStrike’s assessment, some groups are using transaction-themed lures, recruiter impersonation, malicious coding challenges, and synthetic video environments to get a foothold. That is a reminder that credential theft is often the real prize, not the lure itself.
From a defensive perspective, the cloud piece is especially important. In Microsoft Entra, a service principal is the local representation of an application in a tenant. If attackers obtain related credentials or abuse app trust, they may appear to be legitimate software rather than a noisy intruder. That makes identity telemetry, app registration monitoring, and unusual Graph activity far more important than endpoint alerts alone.
The report also points to operational relay box, or ORB, infrastructure. These proxy layers are designed to distribute traffic across many hosts and countries, which makes static IP blocking less effective and forces defenders to look for patterns such as short-lived infrastructure, unusual hosting combinations, and repeated access through changing relays.
At the host level, old techniques still matter. DLL search-order hijacking remains attractive because a legitimate Windows process can be induced to load attacker-controlled code. It is a classic example of malicious execution hiding inside normal behavior, which is why application control and library-loading hardening still pay off.
One important caution: the figures and group attributions in the report are intelligence assessments, not courtroom proof. The available information supports a risk analysis, not a definitive claim that every named target suffered the same outcome or that every attributed cluster acted in exactly the same way.
Conclusion
The broader lesson is clear: financial-services defense is now an identity-and-trust problem as much as a malware problem. In CrowdStrike’s framing, the most dangerous path is the one that starts with a believable login, passes through a trusted relationship, hides behind disposable infrastructure, and ends with interactive control. The defenders who win this fight will be the ones watching for behavior, not just binaries.
TECHCROOK
Hardware security key: A physical MFA key is a practical way to add a second factor to important logins. For organizations and individuals watching for credential theft, it is a simple, widely available device that helps reduce reliance on passwords alone.
WIKICROOK
- Service Principal: In Microsoft Entra, the local representation of an application in a tenant, defining what the app can do there.
- Operational Relay Box (ORB): A proxy network pattern that routes traffic through distributed servers and compromised devices to obscure origin.
- Hands-on-keyboard intrusion: An attack where a human operator actively interacts with the victim environment after initial access.
- DLL search-order hijacking: A Windows technique where a malicious library is placed where a legitimate program will load it first.
- Supply-chain compromise: A compromise of trusted software or delivery paths so malicious code reaches victims through normal installation or update channels.
