Financial Services Must Prepare for Attacks Originating Inside the Cloud

With the increase in adoption of cloud-based infrastructure, digital banking ecosystems, and interconnected transaction platforms, cybersecurity has evolved from a regulatory requirement to a critical element of operational resilience. 

Payment service providers, banks, insurance companies, and investment firms now process massive amounts of sensitive financial data and transactions across increasingly complex environments, which makes them persistent targets for sophisticated cyber-adversaries.
It encompasses the protection of internal networks, cloud workloads, customer records, mobile banking systems, and critical transaction pipelines against unauthorised access, fraud, and compromise of data. 

A comprehensive financial cybersecurity strategy today goes far beyond perimeter defence, in addition to protecting internal networks, cloud workloads, customer records, and mobile banking systems.
As threats evolve, preserving the confidentiality, integrity, and accessibility of financial systems becomes increasingly important not only to prevent cyberattacks and financial losses, but also to maintain institutional trust, regulatory compliance, and overall financial system stability. 

Cloud-based applications and distributed financial platforms are simultaneously expanding the attack surface for threat actors targeting the financial sector due to the increasing reliance on cloud-native applications. As explained by Cristian Rodriguez, CrowdStrike Field CTO for the Americas, an increasing frequency of cloud-based intrusions has been directly linked to the rapid migration of financial workloads and services to cloud-based environments. 

By leveraging stolen credentials and compromised digital identities, attackers have bypassed traditional exploitation techniques altogether in many observed incidents. The ability to move discreetly across environments allows adversaries to exfiltrate data, deploy malware, and run ransomware operations at a large scale, as well as abuse cloud infrastructure to perform command and control functions. 

Based on CrowdStrike’s 2025 Threat Hunting Report, intrusions targeting the financial sector increased by 26 percent during 2024, with a significant portion associated with credentials acquired through cybercriminal marketplaces operated by access brokers. A significant increase of almost 80 percent in nation-state activity targeting financial institutions was also observed, reflecting growing geopolitical and economic reasons for these attacks. 

There is an increasing focus on obtaining intelligence regarding mergers, acquisitions, investment movements, and broader market trends from threat groups, who use stolen financial data to support strategic influence operations and economic espionage. 

Genesis Panda was observed as an actor in these operations, demonstrating the continued involvement of advanced state-aligned cyber groups in financial-driven cyber attacks.

Due to the rapidly expanding digital footprint within the financial sector, cybersecurity has evolved from a technical safeguard to a critical business necessity. The financial sector is increasingly targeted by cybercriminals due to the vast amounts of sensitive customer information, financial credentials, and transaction records it manages. 

By encrypting, segmenting networks, implementing multi-factor authentication, protecting endpoints, and continuously monitori

[…]
Content was cut in order to protect the source.Please visit the source for the rest of the article.