FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

FIN7 has conducted broad phishing campaigns using malicious links.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

FIN7 has used malicious links to lure victims into downloading malware.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1047|Windows Management Instrumentation|

FIN7 has used WMI to install malware on targeted systems.(Citation: eSentire FIN7 July 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.001|Domains|

FIN7 has registered look-alike domains for use in phishing campaigns.(Citation: eSentire FIN7 July 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1008|Fallback Channels|

FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1587.001|Malware|

FIN7 has developed malware for use in operations, including the creation of infected removable media.(Citation: FBI Flash FIN7 USB)(Citation: FireEye FIN7 Oct 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.007|JavaScript|