This adversary targeted financial services by leveraging sophisticated social engineering techniques to capture user credentials. The adversary often targets accounts belonging to IT personnel to gain access to tools that assist with lateral movement and account compromise