Financial Theft

{
  "id": "ATTACK:enterprise:T1657",
  "title": "Financial Theft",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1657",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--851e071f-208d-4c79-adc6-5974c85c78f3",
  "external_id": "T1657",
  "domain": "enterprise",
  "created": "2023-08-18T20:50:04.222Z",
  "modified": "2026-05-12T15:12:00.685Z",
  "version": "1.2",
  "aliases": [

  ],
  "tactics": [
    "impact"
  ],
  "source_references": [
    {
      "source_name": "VEC",
      "url": "https://www.cloudflare.com/learning/email-security/what-is-vendor-email-compromise/#:~:text=Vendor%20email%20compromise%2C%20also%20referred,steal%20from%20that%20vendor%27s%20customers."
    },
    {
      "source_name": "Crowdstrike-leaks",
      "url": "https://www.crowdstrike.com/blog/double-trouble-ransomware-data-leak-extortion-part-1/"
    },
    {
      "source_name": "Mandiant-leaks",
      "url": "https://www.mandiant.com/resources/blog/ransomware-extortion-ot-docs"
    },
    {
      "source_name": "DOJ-DPRK Heist",
      "url": "https://www.justice.gov/usao-cdca/pr/3-north-korean-military-hackers-indicted-wide-ranging-scheme-commit-cyber-attacks-and"
    },
    {
      "source_name": "FBI-BEC",
      "url": "https://www.fbi.gov/file-repository/fy-2022-fbi-congressional-report-business-email-compromise-and-real-estate-wire-fraud-111422.pdf/view"
    },
    {
      "source_name": "FBI-ransomware",
      "url": "https://www.cisa.gov/sites/default/files/Ransomware_Trifold_e-version.pdf"
    },
    {
      "source_name": "AP-NotPetya",
      "url": "https://apnews.com/article/russia-ukraine-technology-business-europe-hacking-ce7a8aca506742ab8e8873e7f9f229c2"
    },
    {
      "source_name": "Internet crime report 2022",
      "url": "https://www.ic3.gov/Media/PDF/AnnualReport/2022_IC3Report.pdf"
    },
    {
      "source_name": "BBC-Ronin",
      "url": "https://www.bbc.com/news/technology-60933174"
    },
    {
      "source_name": "wired-pig butchering",
      "url": "https://www.wired.com/story/pig-butchering-fbi-ic3-2022-report/"
    },
    {
      "source_name": "NYT-Colonial",
      "url": "https://www.nytimes.com/2021/05/13/technology/colonial-pipeline-ransom.html"
    }
  ]
}