The State of Ransomware in Financial Services 2026 (Sophos survey)

Key facts for Sophos financial ransomware survey

Detection coverage for Sophos financial ransomware survey

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5325 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: TL-2026-5325 Malicious Email Phishing Attachment Spawning Script Interpreter (T1566.001)

Detects Office and mail-client processes launching script interpreters or LOLBins, the behaviour behind the malicious email and phishing root causes (26% and 23% of financial-services ransomware attacks in the Sophos 2026 survey, T1566.001/T1204.002/T1059). Behaviour-first, no IOC dependency.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1566.001, T1204.002, T1059
• Data sources: sysmon, index=sysmon, DeviceProcessEvents
• Severity: high
• Confidence: high

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage=*OUTLOOK.EXE OR ParentImage=*WINWORD.EXE OR ParentImage=*EXCEL.EXE OR ParentImage=*ONENOTE.EXE) (Image=*powershell.exe OR Image=*cmd.exe OR Image=*wscript.exe OR Image=*cscript.exe OR Image=*mshta.exe OR Image=*rundll32.exe) | stats count min(_time) as first_seen max(_time) as last_seen by host, User, ParentImage, Image, CommandLine | convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceProcessEvents | where Timestamp > ago(24h) | where InitiatingProcessFileName in~ ('outlook.exe','winword.exe','excel.exe','onenote.exe') | where FileName in~ ('powershell.exe','cmd.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe') | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine

Sigma

title: Office or Mail Client Spawning Script Interpreter After Phishing Email
id: 5a1c3e70-8b2d-4f6a-9c11-0d7e2a4b6c01
status: experimental
description: Detects Outlook, Word, Excel or OneNote spawning script interpreters or LOLBins, consistent with phishing attachment execution (TL-2026-5325).
references:
  - https://www.sophos.com/en-us/blog/the-state-of-ransomware-in-financial-services-2026
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\ONENOTE.EXE'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Office macros or add-ins used by finance teams for legitimate automation
  - Software deployment tooling launched from Outlook add-ins
level: high

Known false positives:

• Legitimate Office macros or add-ins used for finance reporting automation
• Software deployment or ticketing add-ins launching cmd.exe from Outlook

Tuning notes: Allowlist known signed macro-enabled workbooks and add-in command lines by hash or path. Raise severity when the child process makes an outbound connection or CommandLine contains encoded or download-cradle strings.

• 🔒 TL-2026-5325 MFA Fatigue or Bypass Followed by Successful Cloud Sign-in (T1078.004/T1621) · unlock with TL Creds
• 🔒 TL-2026-5325 Web Server Process Spawning Shell or Download Utility (T1190) · unlock with TL Creds
• 🔒 TL-2026-5325 Data Exfiltration Tooling for Double Extortion (T1567.002/T1048) · unlock with TL Creds
• 🔒 TL-2026-5325 Script Interpreter Run From Email Attachment Cache or Archive Path (T1566.001) · unlock with TL Creds
• 🔒 TL-2026-5325 Lateral Movement via RDP From Non-Standard Process Fanning Out (T1021.001/T1078) · unlock with TL Creds
• 🔒 TL-2026-5325 Connections to Community-Reported Ransomware-Related Infrastructure (T1071) · unlock with TL Creds
• 🔒 TL-2026-5325 Password Spray or Brute Force Followed by Successful Logon (T1110/T1078) · unlock with TL Creds
• 🔒 TL-2026-5325 Ransomware Recovery Inhibition Before Encryption (T1490/T1486) · unlock with TL Creds

Indicators of compromise for Sophos financial ransomware survey

As of 2026-11-05, Threadlinqs Intelligence tracks 7 indicators of compromise for TL-2026-5325.

How Sophos financial ransomware survey works

Median ransom demand was $1 million and median payment $1.07 million.

This is a sector-level trend report, not a single campaign or vulnerability. Sophos surveyed 177 IT and cybersecurity leaders from banking, financial services and insurance organizations across 17 countries, administered January to March 2026. It is the sixth annual edition of the financial-services report. Respondents were organizations that experienced ransomware in the prior 12 months. The report names no threat actors, malware families, CVEs or network indicators; the IOCs below are therefore behavioral/statistical trend indicators rather than atomic network or file artifacts.

Initial access and root cause: identity-based vectors (malicious email, phishing, compromised credentials, brute force) initiated 85% of attacks (cross-sector average 79%). Malicious email and compromised credentials were tied as the leading technical root causes at 26% each, followed by phishing at 23%, exploited vulnerabilities at 12% (down from 40% the prior year) and brute force at 10% (cross-sector 6%). Operationally, known security gaps were cited by 44% of respondents (cross-sector 36%), unknown security gaps by 41% and lack of protection by 40%.

Outcomes: 59% of attacks resulted in data encryption (cross-sector 56%) and 21% resulted in both encryption and data theft (up from 18% in 2025 and 16% in 2024). 75% of victims restored data from backups (cross-sector 66%; 44% used backups the prior year). Median ransom demand was $1 million (cross-sector $698,000; down from $3 million in 2025); 53% of demands were $1 million or more; median payment was $1.07 million (cross-sector $769,000; down from $2.2 million in 2024). Mean recovery cost excluding ransom was $1.50 million (down from $1.74 million; cross-sector $1.70 million) and median recovery cost was $750,000, double the $375,000 cross-sector median. Recovery took one week longer than the prior year. 52% of financial-services teams reported increased anxiety about future attacks versus 41% cross-sector.

Control effectiveness: 96% of victims of credential-based attacks had MFA enabled, yet 70% were still encrypted. Firewalls detected 48% of attacks before deployment of the ransomware payload, but victims were encrypted 53% of the time. Sophos concludes that controls collect the right signals but are not integrated deeply enough to respond together, and recommends a connected 'defense system' approach in which identity, email, endpoint and network controls respond as one, with closing known security gaps as the highest-leverage investment.

Corroborating context: Sophos' Active Adversary Report 2026 (published 2026-02-25; 661 IR/MDR cases, 70 countries, 34 industries, analysis window 2024-11-01 to 2025-10-31) found 67% of incidents rooted in identity attacks, 59% of cases lacking MFA, 15.6% of initial access via brute force, 16% via exploitation, a 3-day median dwell time, 3.4 hours on average to reach Active Directory, and 88% of ransomware payloads deployed outside business hours. Akira (22% of incidents; GOLD SAHARA) and Qilin (GOLD FEATHER) were prominent, and LockBit, MedusaLocker, Phobos and BitLocker abuse persisted since 2020. Sophos' cross-industry State of Ransomware 2026 report (2,158 respondents) was reported in July 2026 with 79% of attacks originating from compromised identities. These cross-sector findings are context and are not attributed to the financial-services survey respondents.

The publication date of the 2026 financial-services edition is not stated in the fetched content. Severity is an analyst judgment as the source gives no rating.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application; T1566 Phishing

Defense Evasion

T1078 Valid Accounts

Persistence

T1078 Valid Accounts

Privilege Escalation

T1078 Valid Accounts

Credential Access

T1110 Brute Force

Remediation for Sophos financial ransomware survey

Patches

• Prioritize patching of internet-facing systems; exploited vulnerabilities were the root cause in 12% of attacks

Immediate actions

• Review identity-based attack paths: compromised credentials, phishing and malicious email were the leading root causes
• Close known security gaps, cited by 44% of financial-services victims and named by Sophos as the highest-leverage investment
• Verify MFA coverage and monitor for session or MFA bypass, since 96% of credential-attack victims had MFA yet 70% were encrypted
• Alert on firewall detections that precede payload deployment; 48% of attacks were flagged by firewalls but 53% still ended in encryption

Longer-term hardening

• Integrate identity, email, endpoint and network controls so signals trigger a coordinated response
• Maintain tested, isolated backups (75% of victims restored from backups)
• Reduce brute-force exposure on internet-facing authentication services
• Provide off-hours monitoring and response coverage; related Sophos research found 88% of ransomware payloads deployed outside business hours

Timeline of Sophos financial ransomware survey

• 2024-11-01 Start of the analysis window (2024-11-01 to 2025-10-31) of the locked-ioc-5 Active Adversary Report 2026, which covers 661 IR/MDR cases and found 67% of incidents rooted in identity attacks.
• 2025-10-31 End of the Active Adversary Report 2026 analysis window.
• 2025-11-01 locked-ioc-5 published the 2025 State of Ransomware in Financial Services report (November 2025; day not stated; 369 respondents), the prior edition used for year-over-year comparison.
• 2026-01-01 locked-ioc-5 survey fieldwork for the 2026 financial-services edition began (January 2026; exact day not stated).
• 2026-02-25 locked-ioc-5 published the Active Adversary Report 2026: 59% of cases lacked MFA, 3-day median dwell time, 88% of ransomware payloads deployed outside business hours, locked-ioc-6 in 22% of incidents.
• 2026-02-27 Press coverage of the Active Adversary Report 2026 reported identity attacks dominating incidents, consistent with the identity-centric findings of this survey.
• 2026-03-31 Survey fieldwork ended (March 2026; exact day not stated); 177 IT and cybersecurity leaders across 17 countries responded.
• 2026-07-01 locked-ioc-5' cross-industry State of Ransomware 2026 report (2,158 respondents) was publicized in July 2026 with 79% of ransomware attacks originating from compromised identities (day not stated).

Sources cited for Sophos financial ransomware survey

• The State of Ransomware in Financial Services 2026 (Sophos blog) Sophos · Research
• State of Ransomware in Financial Services (Sophos whitepaper page) Sophos · Research
• State of Ransomware in Financial Services (Sophos events/webinar page) Sophos · Vendor report
• State of Ransomware in Financial Services 2025 (Sophos PDF) Sophos · Research · 2025-11-01
• Sophos State of Ransomware 2026 (cross-industry) Sophos · Vendor report
• 79% of Ransomware Attacks Now Originate from Compromised Identities, Sophos Report Finds albawaba.com · News
• Sophos Active Adversary Report 2026: Identity attacks dominate as threat groups proliferate albawaba.net · News · 2026-02-27

More in ransomware

• Higher Education Sector Under Ransomware and Extortion Pressure: Interlock (CCBC, Springfield Public Schools) and ShinyHunters (Instructure Canvas) with AI Data-Exposure Risk
• Nova (formerly RALord) Ransomware-as-a-Service Group
• Hawkmoth Anubis Ransomware Attack Uses New Backdoor.Lindnor and BYOVD Security Killers Against U.S. Organization
• NCSC Annual Review 2026 Warns AI Could Accelerate Ransomware Attacks on Critical Infrastructure
• BlackMatter Ransomware v2.0 — Reverse Engineering Analysis (RSA-1024 / Modified ChaCha20, ICMLuaUtil UAC Bypass)