Loading threat actor…
FIN12 is a financially motivated ransomware deployment group active since at least October 2018. Also tracked as DEV-0237 and Pistachio Tempest, it specializes in rapid post-compromise deployment of ransomware, principally Ryuk and, in observed cases, Conti. The group has also been identified as an affiliate using Hive, BlackCat/ALPHV, and Qilin ransomware. FIN12 is assessed to consist of Russian-speaking actors likely operating in the Commonwealth of Independent States sphere. FIN12 commonly obtains footholds through partnerships with initial-access providers, historically including TrickBot-associated operators and later BazarLoader-associated activity, as well as compromised cloud accounts and Citrix environments. It has extensively used Cobalt Strike Beacon for post-exploitation, along with SystemBC, Sliver, and in-memory loaders including WEIRDLOOP. Operations employ remote administration and deployment mechanisms such as PsExec, WMI, PowerShell, RDP, Group Policy, scheduled tasks, WebDAV, and BITSAdmin to move laterally and distribute ransomware at scale. The group has used infrastructure concealment, in-memory execution, and proxying to evade detection. FIN12 predominantly targets high-revenue enterprises, with a significant and unusual concentration on healthcare organizations. Its victims have been concentrated in North America, particularly the United States and Canada, with later expansion into Europe, Asia-Pacific, the Middle East, and Latin America. FIN12 prioritizes speed to encryption: reported intrusions had a median dwell time of less than two days. Unlike many ransomware groups, it historically rarely conducted data theft, although at least one Conti-associated operation involved exfiltration and extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
48 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
24 malware families attributed to this actor across reporting.
19 additional families tracked in Mallory.
6 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
18 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Cybercrime group observed using Conti and Ryuk ransomware, with a noted focus on healthcare targets.
Mentioned only in connection with SliverC2 usage in separate operations.
Financially motivated threat actor tracked by Microsoft under the Tempest family.
Listed as one of multiple threat groups associated with using SystemBC.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.