NEW YORK (BLOOMBERG) - After an unrelenting year of fighting off cyber threats, the financial service sector should expect more of the same or even worse, as nation-state hacking campaigns are expected to mirror geopolitical tensions and ransomware gangs retool to dodge increased scrutiny, according to an industry group report.

The Financial Services Information Sharing and Analysis Centre, known as FS-ISAC, said in its annual report on cyber threats that global tensions could fuel further attacks by state-backed hackers and patriotic hacktivists.

In addition, after a series of devastating breaches on the software supply chain, the group warned that its members need to be wary of potential nation-state meddling in products and services being used.

"We expect current trends to continue and possibly worsen over the next year," according to the report, which was released on Thursday (March 10).

Saying that cyber security is "no longer just a back-office cost", the group warned that cyber threats pose critical business risks, including operational disruption, lawsuits and credit downgrades.

FS-ISAC, which shares cyber intelligence among financial institutions around the world, published the report at a time when Russia's invasion of Ukraine has kept organisations in the United States and elsewhere on alert for possible retaliatory attacks. So far, those fears appear largely unrealised, and cyber attacks have played a smaller role in the conflict than many predicted.

The report represents a relatively rare example of an industry publicly acknowledging cyber risks and encouraging its members to prepare for them.

In an interview about the report's findings, Ms Teresa Walsh, who leads FS-ISAC's global intelligence office, said the biggest worry remains a cyber attack that disrupts members' ability to conduct business. Industry leaders, meanwhile, have previously sounded the alarm about the possibility for global conflicts to erupt into digital attacks capable of destabilising the financial system.

At a January event, Goldman Sachs Group president John Waldron said the potential for a cyber attack that "hits at the core of the financial markets" poses a significant danger.

"It doesn't get enough attention," Mr Waldron said. "When you sort of marry what's going on with Russia and Ukraine and China and other actors around the world geopolitically, you have to come back and think that one of their major weapons is cyber."

The FS-ISAC report details a year of relentless cyber attacks globally in which the group raised its threat level from guarded to elevated three times. It typically does so once a year.

The threat level system follows a colour scheme, with green denoting a guarded status and yellow meaning elevated. However, the threat level was not raised to high (orange) or severe (red) last year, according to the group.

The organisation also hosted five member-wide webinars last year to address a security incident with the potential to impact the financial services sector, Ms Walsh said. Typically, FS-ISAC hosts one such "spotlight" session annually.

The increases were due to several factors, including the "rapid digitisation of financial services, which accelerated during the pandemic" and increased entry points for hackers to possibly exploit, as well as a sharp rise in "zero-day" vulnerabilities being identified.

Zero days are flaws in software and hardware that developers and cyber-security professionals do not know about, meaning that once a hacker exploits one of them, they have zero days to fix it.

"There was a dizzying number of vulnerabilities," Ms Walsh said.

Third-party hacks remain a threat for the financial sector, due to its reliance on "a myriad of providers and suppliers", and a potential way to infiltrate organisations that "are considered adequately hardened to traditional attack methods, such as financial institutions", according to the report. There is also a concentration risk among financial institutions because many use the same suppliers, according to a FS-ISAC spokesman.

Several recent attacks on the software supply chain, such as breaches at SolarWinds and Accellion, have demonstrated that "a one-to-many compromise chain is possible", the report said.

FS-ISAC also warned that ransomware remains a persistent concern, "a game of whack-a-mole, where operators shut down when they feel the heat of law enforcement, only to reopen under new names months later", the group wrote.

Despite a concerted effort by law enforcement to crack down on ransomware in the last year, particularly after a devastating attack on Colonial Pipeline that snarled fuel supplies last May, FS-ISAC's report found that members reported an increase in ransomware-related events in the second half of 2021.

Ms Walsh said she had expected to see a measurable change in ransomware attacks because of the increased scrutiny. But aside from a "few hiccups", she said, "it didn't drop at all".

The FS-ISAC report was written in early January, and Ms Walsh said the group recognised then that its predictions could be upended by world events. However, she said FS-ISAC members have been preparing for the possibility of increased cyber attacks for months, reviewing tactics and techniques commonly used by hackers and finding ways to defend against them.

Still, common hacking methods remain an issue. Of the incidents reported by members, 24 per cent started with an employee being targeted by a phishing attack, according to FS-ISAC.