Financial Theft (T1657) is the one ATT&CK technique where the goal is simply money. MITRE files it under the Impact tactic and lists Linux, macOS, Windows, Office Suite and SaaS as the platforms involved.
The description is broad on purpose. It covers extortion by ransomware, business email compromise (BEC) and fraud, "pig butchering" scams, bank hacking, and exploiting cryptocurrency networks. The common thread is that the adversary takes monetary resources from the victim, whether by moving funds, demanding a ransom, or tricking someone into paying.
That makes this technique different from most of the catalog. There is often no single malicious binary to find. The theft happens through a payment workflow, a compromised account or a negotiation, and the technical intrusion that came before it is only the setup.
How attackers use it
MITRE describes several routes to the same outcome.
Unauthorized transfers from compromised accounts. Adversaries may use Compromise Accounts (T1586) to move money. In a BEC case they may impersonate a trusted entity (see Impersonation, T1684.001) and persuade a victim to send funds to an account the adversary controls. MITRE points out that this can create several victims at once: the owner of the compromised account and whoever ultimately loses the money.
Extortion by ransomware. An adversary may demand payment after Data Encrypted for Impact (T1486) and exfiltration of data, then threaten to leak that data unless the victim pays. Dedicated leak sites are one way adversaries publish stolen data.
Crypto and wallet theft. The technique page lists malware and groups that search devices for cryptocurrency wallet data or credentials, and others that targeted the cryptocurrency industry directly.
Distraction. MITRE also notes that adversaries may use the prospect of financial gain to divert attention from their real goals, such as Data Destruction (T1485) and business disruption. A ransom note can be cover for something else.
The page also records that financially motivated actors have used pressure tactics against victims, and the User Training mitigation mentions swatting and doxing as ways groups try to coerce victims into paying.
How to detect it
MITRE does not publish a detection strategy for T1657 itself, because the behavior spans many other techniques. The useful move is to watch the steps around the payment, not the payment alone.
Signals worth building alerts for:
- A change to payment details for an existing vendor, especially when the request arrives by email.
- Urgent payment requests that bypass the normal approval path.
- Sign-ins to finance mailboxes or banking portals from new devices or locations, followed by new forwarding or inbox rules.
- Mass file reads, archive creation or large outbound transfers that precede an extortion demand. These map to exfiltration and encryption techniques, so the detections for those techniques apply.
- New leak site or extortion messages reaching staff by email, text or phone.
For SaaS and Office Suite environments, audit logs for mailbox rule changes, delegated access, and OAuth consent are the best place to catch the account takeover that makes a fraudulent transfer possible.
The honest limit: much of the final act happens outside your telemetry, at a bank or on a blockchain. Detection has to land earlier in the chain.
How to reduce the risk
MITRE lists two mitigations. Both are about people and process.
- User Training. Train and encourage users to recognize the social engineering used to enable financial theft. MITRE also suggests training users on procedures to prevent and respond to swatting and doxing, which financially motivated groups use to push victims toward paying.
- User Account Management. Limit who has authority to execute sensitive transactions. Move payment and purchase approval to systems and procedures that authenticate requests outside insecure channels such as email.
In plain steps:
- Require a second person to approve any new payee or changed bank detail.
- Confirm those changes through a channel you already trust, such as a known phone number, never the contact details in the request itself.
- Keep payment authority narrow. Fewer people who can move money means fewer accounts worth stealing.
- Rehearse your response to an extortion demand before you receive one: who decides, who talks to law enforcement, who talks to staff.
- Apply the controls for the techniques that lead here, including account protection, backups, and data exfiltration monitoring.
Check your own environment
A short review you can run this week:
- List everyone who can approve or release a payment. Is each of them necessary?
- Pick the last three bank detail changes. Were they verified out of band?
- Check finance mailboxes for forwarding rules and delegates you do not recognize.
- Confirm that payment approval cannot happen through email alone.
- Ask whether staff know who to call if they receive a threat or a leak demand.
- Check that backups are separate from the systems they protect, so that a ransom demand is not your only way back.
Quick check
Why does MITRE suggest approving payments outside email?
Email is the channel adversaries impersonate and compromise in BEC and fraud. A request that arrives by email, even from a real account that has been taken over, cannot prove who sent it. An approval process on a separate, authenticated system removes that trust in the message.
Is a ransom demand always the main goal of an intrusion?
No. MITRE notes that adversaries may abuse the possibility of financial theft to divert attention from other goals, such as data destruction or business disruption.
Sources
- MITRE ATT&CK, Financial Theft (T1657): https://attack.mitre.org/techniques/T1657
