[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1657":3},{"item":4,"lessons":18,"controls":40,"related":68},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1657","T1657","Financial Theft",5,"MITRE","**What attackers do.** Attackers steal money from organisations or individuals through extortion, business email compromise, fraudulent payment requests, cryptocurrency theft or similar schemes. This serves the Impact tactic.\n\n**How to defend.** Use payment verification processes that require out-of-band confirmation for changes to bank details or urgent transfers, and separate duties for payment approval. Protect email and finance systems with MFA, and train finance staff on fraud patterns. Rehearse ransom and extortion decisions in advance with legal and leadership teams, so pressure does not drive choices. Report fraud quickly to banks, as prompt reporting improves the chance of recovering funds.\n\n**Signs to look for.** Look for requests to change supplier bank details, urgent payment requests from executives, new mailbox rules on finance accounts and emails from lookalike domains. A common gap is that the payment process trusts email as proof of identity.","Adversaries may steal monetary resources from targets through extortion, social engineering, technical theft, or other methods aimed at their own financial gain at the expense of the availability of these resources for victims. Financial theft is the ultimate objective of several popular campaign types including extortion by ransomware, business email compromise (BEC) and fraud, \"pig butchering,\" bank hacking, and exploiting cryptocurrency networks. \n\nAdversaries may Compromise Accounts to conduct unauthorized transfers of funds. In the case of business email compromise or email fraud, an adversary may utilize Impersonation of a trusted entity. Once the social engineering is successful, victims can be deceived into sending money to financial accounts controlled by an adversary. This creates the potential for multiple victims (i.e., compromised accounts as well as the ultimate monetary loss) in incidents involving financial theft.\n\nExtortion by ransomware may occur, for example, when an adversary demands payment from a victim after Data Encrypted for Impact  and Exfiltration of data, followed by threatening to leak sensitive data to the public unless payment is made to the adversary. Adversaries may use dedicated leak sites to distribute victim data.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1657\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36],{"slug":21,"title":22,"published_at":23},"shinyhunters-arrests-highlight-organized-cybercrime-data-breach-epidemic","ShinyHunters Arrests Highlight Organized Cybercrime & Data Breach Epidemic","2026-09-29T22:21:28.581+00:00",{"slug":25,"title":26,"published_at":27},"ai-powered-malware-uses-multi-model-voting-to-autonomously-execute-attacks","AI-Powered Malware Uses Multi-Model Voting to Autonomously Execute Attacks","2026-09-23T21:21:59.067+00:00",{"slug":29,"title":30,"published_at":31},"bluenoroff-uses-fake-zoom-invites-to-target-crypto-wallets","BlueNoroff Uses Fake Zoom Invites to Target Crypto Wallets","2026-07-24T18:20:38.709+00:00",{"slug":33,"title":34,"published_at":35},"ransomware-syndicates-exploit-corporate-tactics-and-cyber-insurance-data","Ransomware Syndicates Exploit Corporate Tactics and Cyber Insurance Data","2026-06-30T10:21:30.271+00:00",{"slug":37,"title":38,"published_at":39},"shinyhunters-claims-22m-kodak-records-stolen-in-ransomware-style-breach","ShinyHunters Claims 2.2M Kodak Records Stolen in Ransomware-Style Breach","2026-06-18T08:20:17.673+00:00",[41,46,51,56,60,64],{"slug":42,"name":43,"problem":44,"stories":45},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",3,{"slug":47,"name":48,"problem":49,"stories":50},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",2,{"slug":52,"name":53,"problem":54,"stories":55},"ai-security","AI application security","Prompt injection, data leaks through AI tools and unapproved AI use get caught.",1,{"slug":57,"name":58,"problem":59,"stories":55},"patch-management","Automated patch management","Known holes get closed in days, not months.",{"slug":61,"name":62,"problem":63,"stories":55},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":65,"name":66,"problem":67,"stories":55},"immutable-backup","Immutable backup and recovery","Ransomware cannot delete or encrypt your way back.",[69,74,80,85,89,93,97,101],{"family":70,"item":71,"code":72,"title":73,"together":9},"gdpr","32","Article 32","Security of processing",{"family":75,"item":76,"code":77,"title":78,"together":79},"cis","13","Control 13","Network Monitoring and Defense",4,{"family":81,"item":82,"code":83,"title":84,"together":79},"nist-800-53","ir-4","IR-4","Incident Handling",{"family":70,"item":86,"code":87,"title":88,"together":45},"33","Article 33","Notification of a personal data breach to the supervisory authority",{"family":81,"item":90,"code":91,"title":92,"together":50},"ac-6","AC-6","Least Privilege",{"family":75,"item":94,"code":95,"title":96,"together":50},"3","Control 3","Data Protection",{"family":75,"item":98,"code":99,"title":100,"together":50},"17","Control 17","Incident Response Management",{"family":75,"item":102,"code":103,"title":104,"together":50},"14","Control 14","Security Awareness and Skills Training"]