FS-ISAC, a member-driven, not-for-profit organization that seeks to advance cybersecurity and resilience in the global financial system, announced the findings of its annual global intelligence office report, Navigating Cyber 2024.

The organization highlighted its report details the increasing sophistication of adversarial tactics, techniques, and procedures leveraged by threat actors, such as social engineering, SEO poisoning, malvertising, and QR code phishing.

The report also focuses on the use of evolving technology by threat actors, as they look to leverage generative AI for increased scale and automation of attacks and effectiveness of lures, as well as to poison, manipulate, and exploit generative AI tools themselves.

“Each year, a new set of threats comes to light, requiring the financial services sector’s mitigation strategies to advance at an equal if not faster pace than threat actors’ tactics,” FS-ISAC CEO Steven Silberstein said in a news release.

“As we look ahead to a critical year marked by emerging technology and heightened geopolitical tensions, the best way to maintain the integrity, security and trust of the sector is through global information sharing,” Silberstein continued.

In addition to long-standing threat vectors, FS-ISAC said new threats are continuing to emerge that will have disruptive implications for the sector. These include:

Increased geopolitical hacktivism

Experts said threat actors are expected to launch misinformation campaigns and DDoS attacks against critical infrastructure, capitalizing on ongoing geopolitical conflicts and a “super election” year, as five national elections take place across the globe.

FS-ISAC indicated DDoS attacks are continuing to increase in size, scope, and sophistication, with 35% of all DDoS attacks targeting the financial services sector in 2023.

New extortion tactics in response to global regulations

FS-ISAC pointed out that Threat actors have noted the implementation of key legislation in 2023 and are monitoring pending global regulations in 2024 and 2025, adjusting their tactics accordingly.

Experts acknowledged cybercriminals may weaponize new disclosure requirements, pushing companies to fulfill extortion demands ahead of the required reporting deadline.

Intensified focus on establishing cryptographic agility

FS-ISAC explained recent quantum computing and AI advancements are expected to challenge established cryptographic algorithms.

In response, experts suggested that the financial services sector must have an increased focus on developing new encryption methods that can be rapidly adopted without altering the bottom-line system infrastructure.

Improvement of supply chain’s cybersecurity posture

Experts insisted zero-day vulnerabilities in the supply chain continue to leave the sector unprotected, as attacks on providers disrupt various systems across the sector, such as those of clearing, trading, payments, and back-office service operations.

In response, FS-ISAC said the sector should work closely with suppliers to establish communication channels for incident response and bolster suppliers’ greater cybersecurity posture.

“Threat actors will exploit vulnerabilities in critical infrastructure and will leverage any tool available to destroy trust in the security of our systems,” FS-ISAC chief intelligence officer and managing director Teresa Walsh said in the news release.

“The financial services sector operates in a cyber landscape that is endlessly dynamic, as cybercrime and fraud converge, and emerging technologies create additional opportunities for exposure,” Walsh continued. “In order to maintain trust in the sector, companies must prioritize proactive cyber hygiene to ensure operational resilience in the face of an attack.”

The organization noted its Navigating Cyber 2024 report is sourced from FS-ISAC’s thousands of member financial firms in 75 countries and further augmented by analysis by the Global Intelligence Office.

Multiple streams of intelligence were leveraged for the curation of the round-up, which examined data from January 2023 to January 2024.

The publicly accessible version of the report can be found via this website. The full report is only available to member financial institutions.