FIN7
FIN7 is a financially motivated threat actor. Known aliases in the provided content include Carbon Spider, ELBRUS, G0046, GOLD NIAGARA, ITG14, and Sangria Tempest; the content also notes FIN7 is also known as Carbanak. The group has been linked to attacks targeting Veeam Backup & Replication security flaws and has often collaborated with the Maze, Egregor, Conti, REvil, and BlackBasta ransomware groups. Microsoft reporting in the provided content states that Sangria Tempest/ELBRUS/Carbon Spider/FIN7 received access from Storm-0324 and that such handoffs frequently resulted in ransomware deployment. JSSLoader is attributed in the content to the Russian FIN7 hacking group. The provided content describes FIN7 tradecraft including spear-phishing campaigns, including one targeting personnel involved in SEC filings; use of malicious Microsoft Excel add-in (.xll) files delivered by email to drop JSSLoader; and abuse of mshta.exe/HTA and VBScript in tradecraft associated with FIN7. FIN7 used legitimate services such as Google Docs, Google Scripts, and Pastebin for command and control. The group used cmd.exe extensively, including a novel environment-variable string substitution obfuscation technique observed in June 2017, and also used the command prompt to launch commands and to open the Run dialog via malicious USB devices acting as virtual keyboards. FIN7 has established persistence by creating Registry Run and RunOnce keys, adding items to the Startup folder, and creating scheduled tasks. The group has used PowerShell, including a script named 3CF9.ps1 to perform process discovery via tasklist /v, and used PowerShell to launch shellcode that retrieved additional payloads. FIN7 used WMI to install malware on targeted systems. The content also states FIN7 used JavaScript scripts and SQL scripts to perform tasks on victim machines. Tooling and utilities directly mentioned in the content include Cobalt Strike, PowerSploit, Atera, Impacket, Mimikatz, and PsExec. FIN7 malware has used csvde.exe to export system information, and malware associated with FIN7/WsTaskLoad gathered host details such as operating system and hostname. The group has collected files and other sensitive information from compromised networks. The content also notes FIN7 attempted to run Darkside ransomware with the filename sleep.exe and used a malicious executable named WsTaskLoad.exe to mimic the legitimate Wondershare-associated filename. The content further states FIN7 signed Carbanak payloads with legally purchased code-signing certificates and also signed phishing documents, backdoors, and staging tools.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
49 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
42 malware families attributed to this actor across reporting.
37 additional families tracked in Mallory.
Associated vulnerabilities
11 CVEs this actor has used in observed campaigns. 11 of them exploited in the wild.
ELBRUS has also been abusing CVE-2021-31207 in Exchange to compromise organizations in April of 2022, an interesting pivot to using a less popular authenticated vulnerability in the ProxyShell cluster of vulnerabilities.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
CVE-2019-0604, a critical vulnerability opening unpatched Microsoft SharePoint servers to attack, is being exploited by attackers to install a web shell... A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application package...
Dragonfly has exploited a Windows Netlogon vulnerability (CVE-2020-1472) to obtain access to Windows Active Directory servers.
This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.
6 more CVEs tied to this actor tracked in Mallory.
Observables
100 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Financially motivated threat group linked to attacks targeting Veeam Backup & Replication security flaws and noted as often collaborating with multiple ransomware groups.
Named threat actor referenced in global threat reporting.
Show notes ... On the Hunt for FIN7
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.