Adversaries targeting the financial sector include a total of 138 actors.

Key findings among these actors reveal that the majority originate from Europe, Eastern Europe, and the Russian Federation. Their primary motivations are criminal activities, followed by state-sponsored actions and hacktivism. The most common capabilities employed by these actors include ransomware, remote access tools (RATs), and downloaders. The actors are predominantly involved in eCrime and targeted attacks. The United States, United Kingdom, and Germany are the top countries targeted by these adversaries.

SILENT CHOLLIMA is a state-sponsored adversary attributed to North Korea, active against 19 industries and 22 countries. Falcon has 16 techniques mapped to this actor across 7 ATT&CK tactics.

6 of those techniques have been observed in your environment, all between May 4 and May 7, and all tracing back to a single spearphishing attachment opened by a contractor. The activity progressed as far as a blocked credential dumping attempt on SE-JAR-WIN10-BL before it stopped.

You have detection coverage for 12 of the 16 techniques. The 4 gaps are concentrated in how this adversary gets in and how it takes data out. Closing the two Initial Access gaps would give you coverage of the specific route used against you in May.