FIN7 - G0046

Created: 2017-05-31T21:32:09.460Z

Modified: 2023-03-22T03:51:04.185Z

Contributors: Edward Millington

Aliases

FIN7,GOLD NIAGARA,ITG14,Carbon Spider

Description

FIN7 is a financially-motivated threat group that has been active since 2013 primarily targeting the U.S. retail, restaurant, and hospitality sectors, often using point-of-sale malware. A portion of

FIN7 was run out of a front company called Combi Security. Since 2020

FIN7 shifted operations to a big game hunting (BGH) approach including use of

REvil ransomware and their own Ransomware as a Service (RaaS), Darkside.

FIN7 may be linked to the

Carbanak Group, but there appears to be several groups using

Carbanak malware and are therefore tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)

Techniques Used

FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.(Citation: FBI Flash FIN7 USB)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

FIN7 has collected files and other sensitive information from a compromised network.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

FIN7 has exfiltrated stolen data to the MEGA file sharing site.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1021.005|VNC|