Report Finds 50% of Scattered Spider Phishing Domains Targeted Finance & Insurance

This threat landscape briefing for the finance and insurance sector highlights that phishing (including Microsoft Teams abuse) drove the majority of incidents in H2 2024, impersonating domains and subdomains remain a persistent risk, and ransomware group “RansomHub” became the most active ransomware actor targeting the sector—using remote-access tools and data exfiltration for double-extortion with average demands of $6–9M; the report details observed TTPs, tooling, victim impact, and recommends defensive measures such as monitoring, MFA, DLP, segmentation, and domain/DMARC protections while forecasting increased social engineering, state-sponsored activity, and AI model-poisoning risks in 2025.