Nearly half of UK FinServ sensors hit by an exploit invisible everywhere else in the world, as ransomware collapses in favour of stealth credential theft
UK financial institutions are facing a unique region-specific cyber siege. Exclusive data from SonicWall reveals that instead of loud, disruptive ransomware campaigns, advanced adversaries are quietly mapping out the UK’s digital banking infrastructure using modern web exploits completely invisible in global sector data.
Sonicwall’s monitoring across specialised network-perimeter sensors in UK financial and insurance environments between January and May 2026 caught 475,075 Intrusion Prevention System (IPS) events and 28,192 distinct malware threats.
Featuring prominently in the data is a cutting-edge React Server Components Remote Code Execution (RCE) vulnerability targeting modern web frameworks like Next.js. This exploit penetrated nearly half (47%) of all monitored UK financial sensors. Because this signature does not appear in global financial data, SonicWall analysts conclude that UK firms adopting modern web stacks are being systematically and uniquely targeted.
Key Intelligence:
• Just five ransomware hits were detected by the sensors all year as attackers have mostly ditched loud extortion
• Credential-stealing Trojans dominate: 24,702 hits across 33 sensors. Quiet access over disruption
• Legacy Java middleware persists as a threat: 58,099 hits across 37% of sensors – still unpatched two years on
• SIPVicious: 48,000 hits across 15 sensors, targeting phones for toll fraud and recon
• Hikvision cameras remain an IoT vulnerability: 20,055 hits across 13 sensors at physical offices
Spencer Starkey, executive vice president, EMEA, SonicWall notes:
“Our data confirms that UK financial institutions are dealing with a precise, double-edged threat matrix. The fact that the React Server Components exploit is hitting nearly half of our UK sensors, while remaining completely invisible globally, proves that attackers are carefully mapping out the specific digital footprints of British firms. The cyber game has changed. Disruptive ransomware has dropped to near-zero because attackers aren’t trying to lock financial networks down anymore, they are quietly setting up camp. Between legacy Java infrastructure running unpatched and modern customer-facing portals being relentlessly scanned, threat actors are choosing silent persistence and credential theft over loud chaos.”
SonicWall emphasises that a lower baseline volume of recorded IPS events compared to 2025 benchmarks (14.4 million events down to 475,075) does not mean the sector has suddenly become safer. Instead, the drop reflects a contraction of the monitored sensor fleet and rapid customer migration to cloud-native security postures. The threat itself remains intensely precise and highly sophisticated.
Related Post: UK Ransomware volumes fall as ‘Big Game Hunters’ focus on High-Damage Targets
