FIN11

FIN11 is a financially motivated cybercrime threat actor associated with large-scale extortion, ransomware deployment, and opportunistic mass exploitation of internet-facing enterprise software. The group is widely linked to the Cl0p extortion and ransomware ecosystem and is frequently described as overlapping with or operating within the broader TA505 criminal umbrella. Microsoft has also tracked related activity under the financially motivated Tempest naming scheme, including Lace Tempest / DEV-0950. Reporting indicates connections to Russian- and Ukrainian-linked cybercriminal milieus, but FIN11 is best characterized as a profit-driven criminal actor rather than a nation-state operator. FIN11 has targeted organizations across multiple industries worldwide, including finance, manufacturing, retail, transportation, education, healthcare, engineering, and other enterprise sectors. Its operations have included both traditional ransomware intrusion chains and exfiltration-led extortion campaigns in which encryption is optional or absent. The actor has been associated with point-of-sale malware activity, Cl0p ransomware deployment, and direct extortion using stolen data. A defining characteristic of FIN11 is repeated use of zero-day and n-day exploitation against managed file transfer and enterprise application platforms to enable broad victimization at scale. High-confidence public reporting links FIN11 or suspected FIN11 clusters to exploitation campaigns involving Accellion FTA, GoAnywhere MFT, MOVEit Transfer, Cleo managed file transfer products, and Oracle E-Business Suite. In several of these campaigns, the actor shifted from hands-on ransomware deployment toward rapid data theft followed by public leak-site pressure and executive-targeted extortion. FIN11 has been tied to the Cl0p leak site in multiple incidents, including MOVEit-related mass theft and later Oracle E-Business Suite extortion activity. The group’s tradecraft spans phishing, malware delivery, exploitation of public-facing applications, use of compromised accounts, and post-compromise extortion. FIN11 has historically been associated with malware families and tooling used in broader eCrime ecosystems, including AZORult and Cl0p-related tooling, and has been linked to Java-based downloader activity in Oracle E-Business Suite intrusions. Public reporting also notes use of large volumes of compromised email accounts to send extortion messages, a tactic consistent with high-scale pressure operations. FIN11 demonstrates operational flexibility in monetization. It has conducted ransomware distribution campaigns across many sectors, but more recent activity shows a strong emphasis on theft-first extortion, especially after exploiting file transfer and enterprise software vulnerabilities. This aligns with broader criminal trends in which data exfiltration and reputational pressure can replace encryption as the primary coercive mechanism. The actor has also drawn attention for tradecraft relevant to operational technology risk. Mandiant emulation of FIN11 techniques showed that a ransomware-oriented intrusion path could reach OT servers from standard enterprise access. FIN11-linked Cl0p activity has been associated with process kill lists that included some OT-related processes, indicating potential to disrupt industrial environments indirectly even without specialized OT expertise. Known aliases and related designations include Cl0p-associated FIN11 clusters, UNC5936 in suspected Oracle E-Business Suite activity, historical Mandiant cluster UNC4857 later merged into FIN11, and Microsoft’s Lace Tempest / DEV-0950. FIN11 is commonly discussed alongside Cl0p and TA505 due to overlapping infrastructure, tooling, victimology, and monetization patterns.