This page translates real, active cyber threat intelligence into plain English for UK business owners. No acronyms. No jargon. Just what you need to know and what you should do about it.
Last updated: 2 June 2026 · Week 23 / 2026 · Next update: 9 June 2026
Every week we assess the overall risk level for UK small businesses in financial services — insurance brokers, financial advisers, mortgage intermediaries, and professional services firms. This is based on real intelligence from the UK's National Cyber Security Centre (NCSC), US cyber agencies, and industry reporting.
Seven criminal and state-sponsored groups are currently running active operations targeting UK businesses in your sector. Attacks involving fake payment requests, account takeover, and ransomware are all running at higher-than-normal frequency. This does not mean an attack on your specific business is imminent — but it does mean your defences are more likely to be tested than they would be in a quieter period.
Each week we identify the single highest-risk attack technique that is seeing a spike in use against UK businesses. This week:
The UK's National Cyber Security Centre issued a specific warning this week about attackers harvesting business owners' and senior staff members' personal messaging app accounts — WhatsApp, Signal, and LinkedIn in particular.
Here is how it works. Attackers spend days or weeks collecting information about a business from public sources — LinkedIn profiles, company websites, Companies House, social media. They build a detailed picture of who works there, who the clients are, what the business does, and what the relationships look like. They may even get into a WhatsApp group or follow the business on LinkedIn.
They then use that information to send highly convincing impersonation messages — either pretending to be you to your staff, or pretending to be a trusted supplier or client to you. Because they know details only an insider would know, the messages look completely genuine. The request is usually urgent — a payment, a password reset, access to an account.
This is increasingly used as the first step before a ransomware or BEC attack, because it bypasses technical security entirely. There is no malicious link to click. There is no suspicious email to filter. It is just a convincing message from someone who appears to know you.
These are confirmed, active criminal and state-sponsored groups currently running operations against UK financial services businesses. They are not hypothetical — these groups have successfully attacked businesses similar to yours in recent months.
This group specialises in one thing: intercepting payments. They break into a business email account — usually by phishing someone's password — then quietly read emails for days or weeks, learning how the business operates. When they see a payment being arranged — a solicitor's invoice, a supplier payment, a client refund — they step in at the right moment and change the bank account details to their own. The money lands in their account, not the intended recipient's. By the time anyone notices, it's gone.
Insurance brokers and financial services firms are their primary target because they handle client money, arrange regular payments, and deal with solicitors and other third parties who are also being impersonated.
LockBit is not a single group — it's a criminal franchise. The developers build and maintain the ransomware software, then rent it out to dozens of "affiliate" attackers who do the actual breaking-in. The affiliates keep most of the ransom money; LockBit takes a cut.
Ransomware means your files get encrypted — locked with a code only the attacker knows — and you cannot access anything: client records, accounts, emails, documents. You're handed a ransom demand, typically between £20,000 and £150,000, with a countdown timer. Pay, and you might get your files back. Don't pay, and your data may be published publicly.
SMEs are actively preferred targets because they typically have weaker defences than large corporations, but still have money and data worth holding to ransom.
Scattered Spider are unusually effective because they don't rely heavily on technical hacking — they manipulate people. They are known to call IT helpdesks pretending to be a staff member who has been locked out, convincing support teams to reset passwords and bypass security checks. They also use SIM swapping — convincing a mobile network to transfer someone's phone number to a SIM card they control, giving them access to SMS-based login codes.
Once they have account access, they move quickly to steal data, set up persistent access, and often deploy ransomware from other groups as a final step.
Similar to LockBit but with an additional pressure tactic — before encrypting your files, they first steal a copy of your data. This means even if you have backups and refuse to pay the ransom, they threaten to publish your client data, financial records, or confidential communications publicly unless you pay.
They target professional services firms specifically because client confidentiality is a regulatory requirement — making the threat of publication particularly damaging.
This group works for Russian foreign intelligence (SVR). They are sophisticated, patient, and specifically interested in financial sector data — transaction information, client lists, business communications, and anything that gives Russia economic intelligence about UK businesses and their clients.
They typically enter through carefully crafted phishing emails that look completely legitimate, then sit quietly inside a network for weeks or months gathering information before they're detected — if they're ever detected at all. The goal is intelligence gathering, not financial theft.
Linked to Iran's Ministry of Intelligence, MuddyWater targets professional services and financial firms primarily through phishing emails and by exploiting known security weaknesses in popular business software. Their goals are a mix of intelligence gathering and causing disruption to UK and Western business operations.
Linked to China's Ministry of State Security. APT40 focuses on stealing financial data and business intelligence. They primarily get in through unpatched software on internet-facing systems — VPNs, firewalls, and web applications that haven't been updated. Once in, they move systematically through the network looking for valuable data.
Most people imagine a cyber attack as a sudden dramatic event — a hacker hammering at a keyboard and then everything goes dark. The reality is more like a quiet burglary. Here is what actually happens, step by step, in most attacks on businesses like yours.
Attackers don't usually "break in" dramatically — they find something that's already open. The three most common entry points are: a phishing email that tricks someone into entering their password on a fake website; software on your systems that hasn't been updated and has a known security hole; or a password that was stolen in a previous data breach somewhere else and is still being used.
Once in, most attackers don't immediately do anything visible. They explore — looking at what files exist, what systems are connected, who has what level of access, and what data is valuable. They may try to gain higher levels of access — moving from a junior staff member's account towards an administrator account that can access everything. This phase can last days, weeks, or even months.
Many attackers create a secondary way back in — a hidden account, a remote access tool, or a piece of software that gives them a persistent foothold. This means that even if you change the password that was compromised, they may still have access. It's the equivalent of a burglar making a copy of your key before leaving.
The final stage depends on who the attacker is and what they want. Criminal groups typically either deploy ransomware (locking you out of everything and demanding payment), commit financial fraud (intercepting payments or making fraudulent transactions), or steal and sell your data. State-sponsored groups usually take data quietly without ever revealing they were there.
Understanding the attacker's goal helps you understand what you're protecting against. These are the three primary outcomes attackers are working towards when they target UK financial services SMEs.
All your files, emails, and systems are encrypted. You cannot access anything. A ransom demand arrives — typically between £20,000 and £150,000 — with a deadline. Even if you pay, recovery is not guaranteed. Even if you have backups, restoring everything takes weeks.
An attacker with access to your email intercepts a payment at the right moment, swapping legitimate bank details for their own. The money arrives in their account. Bank reversals succeed in fewer than 40% of cases. This is the number one financial loss vector for UK financial services SMEs.
Client records, financial data, confidential communications, and personal information are copied and taken. The attacker either sells this data, uses it for further fraud, or threatens to publish it unless you pay. Publishing client data may trigger ICO investigation and FCA scrutiny.
No security provider covers everything — and we think it's important to be honest about that. Here is a plain English summary of what the GET-IT stack addresses, where it partially helps, and where there are genuine gaps that we would want to discuss with you.
MITRE-Lite draws on three public intelligence sources, all updated regularly by government cybersecurity agencies. We filter and translate them so you don't have to read them yourself.
Based on the current threat picture, these are the three highest-value actions for a UK financial services business right now. You do not need a technical background to do any of them.
Search your own name, your business name, and the names of anyone in your team who handles money, client accounts, or IT access. Look at what comes up — LinkedIn, Companies House, your website, any press mentions. That is exactly what an attacker doing reconnaissance sees. If your mobile number is on your website, your home town is on LinkedIn, and your client list is on a case studies page, you have handed an attacker everything they need to impersonate you convincingly. Review what is publicly visible and remove anything that gives unnecessary detail about how your business operates internally.
Why now: NCSC issued a specific warning this week about messaging app and social media harvesting being used as preparation for BEC and ransomware attacks against UK professional services firms.
A critical security vulnerability has been confirmed in Palo Alto Networks firewall and VPN equipment that is being actively exploited by ransomware groups right now. If your IT provider manages Palo Alto kit, contact them today and ask specifically whether CVE-2026-0257 has been patched. You do not need to understand what that means — just ask the question and get a written confirmation. If they are not aware of it, that itself is important information about the quality of your IT support.
Why now: CISA added this to its critical exploited vulnerabilities list on 29 May 2026. Ransomware affiliate groups are actively using VPN bypass as their primary entry point into SME networks.
The most effective single defence against business email compromise is a procedure, not a technology. Any request to change a bank account — from a supplier, a client, a solicitor, or even internally — should require verbal confirmation via a phone number you already have on record. Not a reply email. Not a call to a number included in the same email. A call to the number you already have. Many UK businesses believe their staff know this already. Most don't have it written down as a formal procedure — which means it doesn't happen consistently under pressure.
Why now: FCA data confirms BEC attacks on insurance brokers are up 34% year-on-year. TA4903 are running active operations against UK financial services firms this week.
A GET-IT resilience scan maps your current defences against the active threat techniques on this page and tells you exactly where your gaps are — in plain English, with costs to fix them.
Book a Free Resilience Scan → View Technical Version