FIN7

FIN7 is a financially motivated cybercriminal group associated with Russia and Ukraine, also tracked as Carbon Spider, ELBRUS, GOLD NIAGARA, ITG14, and Sangria Tempest. Its operations include credential theft, network compromise, and ransomware deployment. Its documented targeting spans numerous countries, with the United States particularly prominent, alongside the United Kingdom, Australia, and France. The group has used fictitious cybersecurity companies as operational fronts and bulletproof hosting services to conceal its activities. FIN7 gains initial access through spearphishing emails containing malicious links and Microsoft Office or RTF attachments, and has received access to compromised environments from Storm-0324. It harvests administrative credentials and uses Kerberoasting to obtain credentials supporting lateral movement. Its techniques include exploiting Zerologon (CVE-2020-1472) against vulnerable domain controllers and using Remote Desktop Protocol to move between systems. FIN7 executes commands through command shells and obscures them using fragmented strings, environment variables, standard input, and native character-replacement functionality. Persistence mechanisms include Registry autostart entries, Startup-folder items, scheduled tasks, and Windows services. FIN7 has deployed ransomware, including a version of DarkSide used to encrypt virtual disk volumes on VMware ESXi servers. It has also been observed deploying Clop ransomware.