# The State of Ransomware in Financial Services 2026 (Sophos survey)

> Sophos' sixth annual financial-services ransomware survey (177 IT/security leaders in banking, financial services and insurance across 17 countries, fielded January-March 2026) finds 85% of attacks began with identity-based vectors, with malicious email and compromised credentials each the leading root cause at 26%. Median ransom demand was $1 million and median payment $1.07 million.

- **Published:** 2026-11-05T14:09:55Z
- **Last reviewed:** 2026-11-05T14:09:55Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5325
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5325.png
- **ID:** TL-2026-5325
- **Severity:** HIGH
- **Category:** RANSOMWARE
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 7

## Description

This is a sector-level trend report, not a single campaign or vulnerability. Sophos surveyed 177 IT and cybersecurity leaders from banking, financial services and insurance organizations across 17 countries, administered January to March 2026. It is the sixth annual edition of the financial-services report. Respondents were organizations that experienced ransomware in the prior 12 months. The report names no threat actors, malware families, CVEs or network indicators; the IOCs below are therefore behavioral/statistical trend indicators rather than atomic network or file artifacts.

Initial access and root cause: identity-based vectors (malicious email, phishing, compromised credentials, brute force) initiated 85% of attacks (cross-sector average 79%). Malicious email and compromised credentials were tied as the leading technical root causes at 26% each, followed by phishing at 23%, exploited vulnerabilities at 12% (down from 40% the prior year) and brute force at 10% (cross-sector 6%). Operationally, known security gaps were cited by 44% of respondents (cross-sector 36%), unknown security gaps by 41% and lack of protection by 40%.

Outcomes: 59% of attacks resulted in data encryption (cross-sector 56%) and 21% resulted in both encryption and data theft (up from 18% in 2025 and 16% in 2024). 75% of victims restored data from backups (cross-sector 66%; 44% used backups the prior year). Median ransom demand was $1 million (cross-sector $698,000; down from $3 million in 2025); 53% of demands were $1 million or more; median payment was $1.07 million (cross-sector $769,000; down from $2.2 million in 2024). Mean recovery cost excluding ransom was $1.50 million (down from $1.74 million; cross-sector $1.70 million) and median recovery cost was $750,000, double the $375,000 cross-sector median. Recovery took one week longer than the prior year. 52% of financial-services teams reported increased anxiety about future attacks versus 41% cross-sector.

Control effectiveness: 96% of victims of credential-based attacks had MFA enabled, yet 70% were still encrypted. Firewalls detected 48% of attacks before deployment of the ransomware payload, but victims were encrypted 53% of the time. Sophos concludes that controls collect the right signals but are not integrated deeply enough to respond together, and recommends a connected 'defense system' approach in which identity, email, endpoint and network controls respond as one, with closing known security gaps as the highest-leverage investment.

Corroborating context: Sophos' Active Adversary Report 2026 (published 2026-02-25; 661 IR/MDR cases, 70 countries, 34 industries, analysis window 2024-11-01 to 2025-10-31) found 67% of incidents rooted in identity attacks, 59% of cases lacking MFA, 15.6% of initial access via brute force, 16% via exploitation, a 3-day median dwell time, 3.4 hours on average to reach Active Directory, and 88% of ransomware payloads deployed outside business hours. Akira (22% of incidents; GOLD SAHARA) and Qilin (GOLD FEATHER) were prominent, and LockBit, MedusaLocker, Phobos and BitLocker abuse persisted since 2020. Sophos' cross-industry State of Ransomware 2026 report (2,158 respondents) was reported in July 2026 with 79% of attacks originating from compromised identities. These cross-sector findings are context and are not attributed to the financial-services survey respondents.

The publication date of the 2026 financial-services edition is not stated in the fetched content. Severity is an analyst judgment as the source gives no rating.

## MITRE ATT&CK

- T1566 Phishing
- T1078 Valid Accounts
- T1190 Exploit Public-Facing Application
- T1110 Brute Force
- T1078 Valid Accounts
- T1078 Valid Accounts
- T1078 Valid Accounts

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**TL-2026-5325 Malicious Email Phishing Attachment Spawning Script Interpreter (T1566.001)** (`TL-2026-5325-SPL-001`)

Detects Office and mail-client processes launching script interpreters or LOLBins, the behaviour behind the malicious email and phishing root causes (26% and 23% of financial-services ransomware attacks in the Sophos 2026 survey, T1566.001/T1204.002/T1059). Behaviour-first, no IOC dependency.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1566.001, T1204.002, T1059
- **Data sources:** sysmon, index=sysmon, DeviceProcessEvents
- **Severity:** high
- **Confidence:** high

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1 (ParentImage=*OUTLOOK.EXE OR ParentImage=*WINWORD.EXE OR ParentImage=*EXCEL.EXE OR ParentImage=*ONENOTE.EXE) (Image=*powershell.exe OR Image=*cmd.exe OR Image=*wscript.exe OR Image=*cscript.exe OR Image=*mshta.exe OR Image=*rundll32.exe) | stats count min(_time) as first_seen max(_time) as last_seen by host, User, ParentImage, Image, CommandLine | convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceProcessEvents | where Timestamp > ago(24h) | where InitiatingProcessFileName in~ ('outlook.exe','winword.exe','excel.exe','onenote.exe') | where FileName in~ ('powershell.exe','cmd.exe','wscript.exe','cscript.exe','mshta.exe','rundll32.exe') | project Timestamp, DeviceName, AccountName, InitiatingProcessFileName, FileName, ProcessCommandLine
```

### Sigma

```yaml
title: Office or Mail Client Spawning Script Interpreter After Phishing Email
id: 5a1c3e70-8b2d-4f6a-9c11-0d7e2a4b6c01
status: experimental
description: Detects Outlook, Word, Excel or OneNote spawning script interpreters or LOLBins, consistent with phishing attachment execution (TL-2026-5325).
references:
  - https://www.sophos.com/en-us/blog/the-state-of-ransomware-in-financial-services-2026
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
  - attack.initial_access
  - attack.t1566.001
  - attack.execution
  - attack.t1204.002
  - attack.t1059
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith:
      - '\OUTLOOK.EXE'
      - '\WINWORD.EXE'
      - '\EXCEL.EXE'
      - '\ONENOTE.EXE'
  selection_child:
    Image|endswith:
      - '\powershell.exe'
      - '\cmd.exe'
      - '\wscript.exe'
      - '\cscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Office macros or add-ins used by finance teams for legitimate automation
  - Software deployment tooling launched from Outlook add-ins
level: high

```

**Known false positives:**

- Legitimate Office macros or add-ins used for finance reporting automation
- Software deployment or ticketing add-ins launching cmd.exe from Outlook

**Tuning notes:** Allowlist known signed macro-enabled workbooks and add-in command lines by hash or path. Raise severity when the child process makes an outbound connection or CommandLine contains encoded or download-cradle strings.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- TL-2026-5325 MFA Fatigue or Bypass Followed by Successful Cloud Sign-in (T1078.004/T1621) (locked: unlock with TL Creds)
- TL-2026-5325 Web Server Process Spawning Shell or Download Utility (T1190) (locked: unlock with TL Creds)
- TL-2026-5325 Data Exfiltration Tooling for Double Extortion (T1567.002/T1048) (locked: unlock with TL Creds)
- TL-2026-5325 Script Interpreter Run From Email Attachment Cache or Archive Path (T1566.001) (locked: unlock with TL Creds)
- TL-2026-5325 Lateral Movement via RDP From Non-Standard Process Fanning Out (T1021.001/T1078) (locked: unlock with TL Creds)
- TL-2026-5325 Connections to Community-Reported Ransomware-Related Infrastructure (T1071) (locked: unlock with TL Creds)
- TL-2026-5325 Password Spray or Brute Force Followed by Successful Logon (T1110/T1078) (locked: unlock with TL Creds)
- TL-2026-5325 Ransomware Recovery Inhibition Before Encryption (T1490/T1486) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [The State of Ransomware in Financial Services 2026 (Sophos blog)](https://www.sophos.com/en-us/blog/the-state-of-ransomware-in-financial-services-2026)
- [State of Ransomware in Financial Services (Sophos whitepaper page)](https://www.sophos.com/en-us/whitepaper/state-of-ransomware-in-financial-services)
- [State of Ransomware in Financial Services (Sophos events/webinar page)](https://events.sophos.com/state-of-ransomware-financial-services/)
- [State of Ransomware in Financial Services 2025 (Sophos PDF)](https://assets.sophos.com/X24WTUEQ/at/749t28qhvtxq93p8gb7wtgz/sophos-state-of-ransomware-in-financial-services-2025.pdf)
- [Sophos State of Ransomware 2026 (cross-industry)](https://www.sophos.com/zh-cn/blog/sophos-state-of-ransomware-2026)
- [79% of Ransomware Attacks Now Originate from Compromised Identities, Sophos Report Finds](https://www.albawaba.com/business/pr/79-ransomware-attacks-now-originate-1633481)
- [Sophos Active Adversary Report 2026: Identity attacks dominate as threat groups proliferate](https://www.albawaba.net/business/pr/sophos-active-adversary-report-2026-1622812)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5325