FIN7

FIN7 is a prolific financially motivated cybercrime group widely associated with the broader Carbanak cluster and also tracked under aliases including Carbon Spider, ELBRUS, FIN_7, G0046, Gold Niagara, ITG14, and Sangria Tempest. The group has been active since at least 2013 and is commonly assessed as Russia-based. FIN7 is known for intrusions against financial institutions as well as retail, hospitality, energy, high-technology, and other enterprise sectors, with a long record of targeting organizations in the United States and internationally. FIN7 has conducted phishing-led intrusions, including lures that rely on user execution of disguised attachments and hidden shortcut files. The group has also staged trojanized legitimate software on cloud infrastructure to deliver remote management tooling. Across campaigns, FIN7 has used remote access malware and backdoors including tooling associated with the Carbanak lineage, NetSupport RAT, Domino, and commercially available malware such as AveMariaRAT. Reporting also links FIN7 to development of the Domino backdoor under the ITG14 designation and to cooperation with ITG23 in intrusion chains where Domino was delivered by Dave Loader and used to profile victims, communicate with command infrastructure, and deploy follow-on payloads. Operationally, FIN7 is associated with credential theft, use of scripting and command interpreters, PowerShell-based payload retrieval, persistence through Registry Run keys, Startup folders, and Windows services, and lateral movement through remote services such as PsExec. The group has also been observed using process injection and reflective loading techniques, and historical Carbanak-linked activity overlapping with the FIN7 cluster included keylogging, screen and video capture, remote control, and movement into payment, card-processing, and ATM-management systems. FIN7 tradecraft frequently emphasizes defense evasion and post-compromise operational depth. FIN7 is also notable for commercialization of offensive tooling. The group has advertised and sold AvNeutralizer, a custom security-evasion tool designed to disable or bypass endpoint protections, to other criminal actors, including ransomware operators. This activity indicates that FIN7 functions not only as an intrusion actor but also as a supplier of capabilities within the cybercriminal ecosystem. Although FIN7 is strongly linked to financially driven operations and has overlap with ransomware ecosystems, the available facts here support the group primarily as an eCrime actor focused on theft, intrusion enablement, and security-evasion tooling rather than as a distinct ransomware brand operator.