THREATNOIR
Subscribe
MITRE ATT&CK · T1657

Financial Theft

MITRE · cited in 5 of our lessons

Explanation

What attackers do. Attackers steal money from organisations or individuals through extortion, business email compromise, fraudulent payment requests, cryptocurrency theft or similar schemes. This serves the Impact tactic.

How to defend. Use payment verification processes that require out-of-band confirmation for changes to bank details or urgent transfers, and separate duties for payment approval. Protect email and finance systems with MFA, and train finance staff on fraud patterns. Rehearse ransom and extortion decisions in advance with legal and leadership teams, so pressure does not drive choices. Report fraud quickly to banks, as prompt reporting improves the chance of recovering funds.

Signs to look for. Look for requests to change supplier bank details, urgent payment requests from executives, new mailbox rules on finance accounts and emails from lookalike domains. A common gap is that the payment process trusts email as proof of identity.

Open the technique on MITRE ATT&CK
The official text
Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering," bank hacking, and exploiting cryptocurrency networks. Adversaries may Compromise Accounts to conduct unauthorized transfers of funds. In the case of business email compromise or email fraud, an adversary may utilize Impersonation of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary. This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft. Extortion by ransomware may occur, for example, when an adversary demands payment from a victim after Data Encrypted for Impact and Exfiltration of data, followed by threatening to leak sensitive data to the public unless payment is made to the adversary. Adversaries may use dedicated leak sites to distribute victim data.

© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).

Lessons that cite it

Real incidents where this item mattered.