fermer
fermer
La plateforme du futur est Netskope

Intelligent Security Service Edge (SSE), Cloud Access Security Broker (CASB), Cloud Firewall, Next Generation Secure Web Gateway (SWG), et Private Access for ZTNA intégrés nativement dans une solution unique pour aider chaque entreprise dans son cheminement vers l'architecture Secure Access Service Edge (SASE).

Présentation des produits
Vidéo Netskope
Next Gen SASE Branch est hybride - connectée, sécurisée et automatisée

Netskope Next Gen SASE Branch fait converger Context-Aware SASE Fabric, Zero-Trust Hybrid Security et SkopeAI-Powered Cloud Orchestrator dans une offre cloud unifiée, ouvrant la voie à une expérience de succursale entièrement modernisée pour l'entreprise sans frontières.

En savoir plus Next Gen SASE Branch
Personnes au bureau de l'espace ouvert
La conception d'une architecture SASE pour les nuls

Obtenez votre exemplaire gratuit du seul guide consacré à la conception d'une architecture SASE dont vous aurez jamais besoin.

Obtenir l'EBook
Adopter une architecture SASE (Secure Access Service Edge)

Netskope NewEdge est le nuage privé de sécurité le plus grand et le plus performant au monde. Il offre aux clients une couverture de service, des performances et une résilience inégalées.

Découvrez NewEdge
NewEdge
Votre réseau de demain

Planifiez votre chemin vers un réseau plus rapide, plus sûr et plus résilient, conçu pour les applications et les utilisateurs que vous prenez en charge.

Obtenir le livre blanc
Votre réseau de demain
Netskope Cloud Exchange

Le Netskope Cloud Exchange (CE) fournit aux clients des outils d'intégration puissants pour optimiser les investissements dans l'ensemble de leur infrastructure de sécurité.

En savoir plus sur Cloud Exchange
Vidéo Netskope
Optez pour les meilleurs services de sécurité cloud du marché, avec un temps de latence minimum et une fiabilité élevée.

Découvrez NewEdge
Lighted highway through mountainside switchbacks
Permettez en toute sécurité l'utilisation d'applications d'IA générative grâce au contrôle d'accès aux applications, à l'accompagnement des utilisateurs en temps réel et à une protection des données de premier ordre.

Découvrez comment nous sécurisons l'utilisation de l'IA générative
Autorisez ChatGPT et l’IA générative en toute sécurité
Solutions Zero Trust pour les déploiements du SSE et du SASE

En savoir plus sur la confiance zéro
Boat driving through open sea
Netskope obtient l'autorisation FedRAMP High Authorization

Choisissez Netskope GovCloud pour accélérer la transformation de votre agence.

En savoir plus sur Netskope GovCloud
Netskope GovCloud
  • Ressources signe chevron

    Découvrez comment Netskope peut vous aider à sécuriser votre migration vers le Cloud.

  • Blog signe chevron

    Découvrez comment Netskope permet de transformer la sécurité et les réseaux à l'aide du Security Service Edge (SSE).

  • Événements et ateliers signe chevron

    Restez à l'affût des dernières tendances en matière de sécurité et créez des liens avec vos pairs.

  • Définition de la sécurité signe chevron

    Tout ce que vous devez savoir dans notre encyclopédie de la cybersécurité.

Podcast Security Visionaries

Des cookies, pas des biscuits
L'animatrice Emily Wearmouth rencontre les experts David Fairman et Zohar Hod pour discuter du passé, du présent et de l'avenir des cookies sur Internet.

Écouter le podcast
Podcast : Des cookies, pas des biscuits
Derniers blogs

Comment Netskope peut faciliter le parcours Zero Trust et SASE grâce aux capacités des services de sécurité en périphérie (SSE).

Lire le blog
Sunrise and cloudy sky
SASE Week 2023 : Votre voyage SASE commence maintenant !

Retrouvez les sessions de la quatrième édition annuelle de SASE Week.

Explorer les sessions
SASE Week 2023
Qu'est-ce que le Security Service Edge ?

Découvrez le côté sécurité de SASE, l'avenir du réseau et de la protection dans le cloud.

En savoir plus sur Security Service Edge
Four-way roundabout
  • Nos clients signe chevron

    Netskope sert plus de 2 000 clients dans le monde, dont plus de 25 des entreprises du classement Fortune 100

  • Solutions pour les clients signe chevron

    Nous sommes là pour vous et avec vous à chaque étape, pour assurer votre succès avec Netskope.

  • Communauté Netskope signe chevron

    Apprenez d'autres professionnels des réseaux, des données et de la sécurité.

  • Formation et certification signe chevron

    Avec Netskope, devenez un expert de la sécurité du cloud.

Nous parons nos clients à l'avenir, quel qu'il soit

Voir nos clients
Woman smiling with glasses looking out window
L’équipe de services professionnels talentueuse et expérimentée de Netskope propose une approche prescriptive pour une mise en œuvre réussie.

En savoir plus sur les services professionnels
Services professionnels Netskope
La communauté Netskope peut vous aider, vous et votre équipe, à tirer le meilleur parti des produits et des pratiques.

Accéder à la communauté Netskope
La communauté Netskope
Sécurisez votre parcours de transformation numérique et tirez le meilleur parti de vos applications cloud, Web et privées grâce à la formation Netskope.

En savoir plus sur les formations et les certifications
Group of young professionals working
  • Entreprise signe chevron

    Nous vous aidons à conserver une longueur d'avance sur les défis posés par le cloud, les données et les réseaux en matière de sécurité.

  • Pourquoi Netskope signe chevron

    La transformation du cloud et le travail à distance ont révolutionné le fonctionnement de la sécurité.

  • Équipe de direction signe chevron

    Nos dirigeants sont déterminés à faciliter la réussite de nos clients.

  • Partenaires signe chevron

    Nous collaborons avec des leaders de la sécurité pour vous aider à sécuriser votre transition vers le cloud.

Soutenir le développement durable par la sécurité des données

Netskope est fière de participer à Vision 2045 : une initiative visant à sensibiliser au rôle de l'industrie privée dans le développement durable.

En savoir plus
Soutenir le développement durable grâce à la sécurité des données
Meilleure capacité d'exécution. Le plus loin dans sa vision.

Netskope nommé leader dans le rapport Magic QuadrantTM 2023 pour SSE de Gartner®.

Recevoir le rapport
Netskope nommé leader dans le rapport Magic QuadrantTM 2023 pour SSE de Gartner®.
Penseurs, concepteurs, rêveurs, innovateurs. Ensemble, nous fournissons le nec plus ultra des solutions de sécurité cloud afin d'aider nos clients à protéger leurs données et leurs collaborateurs.

Rencontrez notre équipe
Group of hikers scaling a snowy mountain
La stratégie de commercialisation de Netskope privilégie ses partenaires, ce qui leur permet de maximiser leur croissance et leur rentabilité, tout en transformant la sécurité des entreprises.

En savoir plus sur les partenaires de Netskope
Group of diverse young professionals smiling

Netskope
Threat Labs Report:
FINANCIAL SERVICES

light blue plus
This report examines the cloud adoption and threat trends affecting organizations in the financial services sector over the past twelve months, highlighting attackers consistently using social engineering to target users with Trojans via popular cloud apps.
Netskope Threat Labs Report
8 min read

In This Report link link

test answer

Cloud App Adoption: While the average user in the financial services sector interacts with 25 different apps per month, Microsoft OneDrive is the most popular app by a large margin, with 54% using it on any given day, with 22% uploading data to and 23% downloading data from OneDrive daily.

Cloud App Abuse: 63% of malware downloads come from cloud apps in the financial services sector, with OneDrive leading the pack due to its overall popularity in financial services. Only the telecommunications sector has a higher percentage of cloud malware downloads.

Malware & Ransomware: Attacks primarily targeted users in the financial services sectors with Trojans to trick them into downloading other malware payloads. FormBook, Valyria, and Razy were among the top Trojans, while other common malware families included the infostealers AgentTesla and Redline, and the Hive ransomware.

Cloud App Adoption link link

Cloud app adoption continues to increase in the financial services industry, with enterprises using cloud apps to improve productivity and enable hybrid workforces. The number of apps a user in financial services interacts with per month has increased from 22 to 25 apps over the past 12 months, slightly ahead of other industries, which increased from 22 to 24. The top 1% of users interacted with 94 apps per month on average, the same as other industries.

Average apps per user. Financial Services vs Other Industries - Last 12 Months

Downloads from cloud apps are as common in financial services as they are in other industries, with 93% of users downloading data from cloud apps every month. However, uploads are slightly more common in financial services, where 69% of users upload data compared to 64% in other industries.

Percentage of users uploading data. Financial Services vs Other Industries - Last 12 Months

Most Popular Cloud Apps

As it is in most industries, OneDrive is the most popular app in financial services. It is even more popular than in other industries with 54% of users accessing OneDrive daily compared to 49% in other industries. For videoconferencing and chat, Microsoft Teams is also more popular in financial services, with 38% of users using Teams per day. After Teams, the other top apps are similarly as popular in other industries.

Overall App Popularity. Financial Services vs Other Industries

Top Apps Used for Uploads

As expected, with Microsoft OneDrive being the most popular app by a large margin, it is also the app most used for uploading data, with 22% of users uploading data to OneDrive daily, compared to 20% in other industries.

Apps Used for Uploads. Financial Services vs Other Industries

Top Apps Used for Downloads

Similarly, OneDrive is also the most popular app for downloads in financial services, with 23% of users downloading files from OneDrive on any given day. The only other app that really stands out in the top ten is WhatsApp, which is less than half as popular in financial services as in other industries.

Apps Used for Downloads. Financial Services vs Other Industries

Cloud App Abuse link link

Cloud Malware Delivery

The popularity of cloud malware delivery in telecom has remained consistently high for the past 12 months, spending most of that period between 60% and 70%. On average, 62% of malware downloads in telecom came from cloud apps, compared to 53% in other industries. Abusing cloud apps for malware delivery enables attackers to evade security controls that rely primarily on domain block lists and URL filtering, or that do not inspect cloud traffic.

Malware Delivery, Cloud vs. Web. Financial Services vs Other Industries - Last 12 Months

Compared to other industries, financial services has the second highest percentage of cloud malware downloads, behind only the telecommunications sector.

Malware Sourced from the Cloud Last 12 Months Average. Financial Services vs Other Industries

Cloud Apps Abused for Malware Delivery

The popularity of Microsoft OneDrive in financial services propels the app to the top of another list, this time for the number of cloud malware downloads originating from that app. Such malware downloads typically take the form of an attacker using OneDrive to host malware and sharing the malware with their victims. Occasionally, a user may inadvertently upload an infected file to a shared location that results in malware spreading within an organization. As highlighted earlier in this report, Microsoft OneDrive is also the most popular app among users in financial services, which makes it both an useful app for attackers seeking to target a wide variety of organizations using the same app, and also makes it more likely that the malicious payloads would reach their targets. Other top apps for malware downloads include free software hosting sites (GitHub), collaboration apps (SharePoint), cloud storage apps (Amazon S3, Google Drive, Azure Blob Storage), free web hosting services (Weebly, Squarespace), and webmail apps (Outlook.com, Google Gmail).

Top Cloud Apps Abused for Malware Download Last 12 Months. Financial Services vs Other Industries

Malware & Ransomware link link

Top Malware Types

The most common types of malware that Netskope users attempted to download from the web or cloud were Trojans, which are commonly used by attackers to gain an initial foothold and deliver other types of malware, such as infostealers, remote access Trojans, backdoors, and ransomware. Detecting and blocking Trojans can prevent malware infections that would result in other malicious payloads being installed. All other types of malware make up a comparatively small percentage of the total, which is the same as in other industries.

Most Common Types of Malware Last 12 Months. Financial Services vs Other Industries

Top Malware & Ransomware Families

This list contains the top 10 malware and ransomware families detected by Netskope targeting users in the financial services industry in the last 12 months:

Backdoor.Zusy (a.k.a. TinyBanker) is a banking Trojan based on the source code of Zeus, aiming to steal personal information via code injection into websites.

Botnet.Emotet is one of the most relevant botnets in the cyber threat landscape, often used to deliver other malware such as TrickBot.

Downloader.SLoad (a.k.a Starslord) is a download that is often used to deliver Ramnit.

Infostealer.AgentTesla is a .NET-based Remote Access Trojan with many capabilities, such as stealing browsers’ passwords, capturing keystrokes, clipboard, etc.

Infostealer.RedLine is a malware designed to steal data such as credit card numbers, passwords, VPN and FTP credentials, gaming accounts, and even data from crypto wallets.

Phishing.PhishingX is a malicious PDF file used as part of a phishing campaign to redirect victims to a phishing page.

Ransomware.Hive is a RaaS (ransomware-as-a-service) group active since 2021, known for targeting critical infrastructure such as healthcare and energy providers.

Trojan.FormBook (a.k.a. XLoader) is a malware that provides full control over infected machines, offering many functionalities such as stealing passwords and executing additional malware.

Trojan.Razy is a Trojan typically distributed via malicious ads disguised as legitimate software, often used to steal cryptocurrency data.

Trojan.Valyria (a.k.a. POWERSTATS) is a family of malicious Microsoft Office Documents that contain embedded malicious VBScripts usually to deliver other malicious payloads.

Recommendations link link

This report highlighted increasing cloud adoption, including increases of data being uploaded to and downloaded from a wide variety of cloud apps. It also highlighted an increasing trend of attackers abusing a wide variety of cloud apps, especially popular enterprise apps, to deliver malware (mostly Trojans) to their victims. Netskope Threat Labs recommends organizations in the financial services industry review their security posture to ensure that they are adequately protected against these trends:

  • Inspect all HTTP and HTTPS downloads, including all web and cloud traffic, to prevent malware from infiltrating your network. Netskope customers can configure their Netskope NG-SWG with a Threat Protection policy that applies to downloads from all categories and applies to all file types.
  • Ensure that high-risk file types like executables and archives are thoroughly inspected using a combination of static and dynamic analysis before being downloaded. Netskope Advanced Threat Protection customers can use a Patient Zero Prevention Policy to hold downloads until they have been fully inspected.
  • Configure policies to block downloads from apps and instances that are not used in your organization to reduce your risk surface to only those apps and instances that are necessary for the business.
  • Configure policies to block uploads to apps and instances that are not used in your organization to reduce the risk of accidental or deliberate data exposure from insiders or abuse by attackers.
  • Use an Intrusion Prevention System (IPS) that can identify and block malicious traffic patterns, such as command and control traffic associated with popular malware. Blocking this type of communication can prevent further damage by limiting the attacker’s ability to perform additional actions.
  • Use Remote Browser Isolation (RBI) technology to provide additional protection when there is a need to visit websites that fall into categories that can present higher risk, like Newly Observed and Newly Registered Domains.

Netskope Threat Labs link link

Staffed by the industry’s foremost cloud threat and malware researchers, Netskope Threat Labs discovers, analyzes, and designs defenses against the latest cloud threats affecting enterprises. Our researchers are regular presenters and volunteers at top security conferences, including DefCon, BlackHat, and RSA.

About This Report link link

Netskope provides threat protection to millions of users worldwide. Information presented in this report is based on anonymized usage data collected by the Netskope Security Cloud platform relating to a subset of Netskope customers with prior authorization.

This report contains information about detections raised by Netskope’s Next Generation Secure Web Gateway (SWG), not considering the significance of the impact of each individual threat. Stats in this report are based on the period starting September 1, 2022 through August 31, 2023. Stats are a reflection of attacker tactics, user behavior, and organization policy.

light blue plus

Threat Labs Reports

In the monthly Netskope Threat Labs Report, you will find the top 5 malicious domains, malware, and apps that the Netskope Security Cloud platform blocked plus recent publications and a threat roundup.

Threat labs

Accelerate your security program with the SASE Leader