Loading story…
Google-owned Mandiant reported that FIN11 is using widespread email campaigns as an initial access method ahead of ransomware deployment and data theft operations. The activity links high-volume phishing and malicious email delivery to later-stage intrusions, showing how the financially motivated group continues to blend spam-driven access with hands-on post-compromise actions to monetize victims through both encryption and extortion.
The reporting indicates that FIN11’s email operations are not isolated nuisance activity but part of a broader intrusion chain that can culminate in ransomware and data exfiltration. For defenders, the campaign underscores the need to treat large-scale malicious email waves as potential precursors to major incidents, with priority placed on email security controls, rapid investigation of phishing-driven access, and monitoring for follow-on lateral movement, staging, and theft activity after initial compromise.
Get the infrastructure and lures behind it.
2 events from the most recent confirmed update back to the earliest known activity.
FIN11 was reported to have evolved from financially motivated email campaigns into deploying Clop ransomware and pursuing larger, enterprise-scale victims. This marked a notable change in the group's tactics and monetization strategy.
Google Cloud's Mandiant Threat Intelligence team published a report describing FIN11's widespread email campaigns as a precursor to ransomware deployment and data theft activity. The reference indicates public disclosure of the analysis but provides no additional dated incident details in the supplied content.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
2 references tracked. Mallory keeps watching after this page renders.
cloud.google.com
Open sourcescmagazine.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
The **Silent Ransom Group** — also tracked as **UNC3753**, **Luna Moth**, and **Chatty Spider** — has been targeting U.S. law firms and other professional, financial, insurance, and healthcare organizations with data-theft extortion campaigns that rely on social engineering instead of file encryption. FBI alerts and Google Mandiant reporting say the actors send invoice-themed phishing emails and follow up with voice calls impersonating internal IT or help desk staff, persuading employees to join screen-sharing sessions or install legitimate remote management tools such as AnyDesk, Zoho Assist, Bomgar, Splashtop, Syncro, Atera, and SuperOps. Once inside, the group rapidly searches document repositories and cloud stores for legal files, tax records, financial data, PII, and other sensitive material, then exfiltrates it with tools including WinSCP, hidden or renamed Rclone, Google Drive, Microsoft OneDrive, or victim-controlled file-sharing channels. Authorities said the campaign has escalated beyond remote access attempts to **in-person intrusions**, with imposters arriving at offices posing as technicians and connecting USB drives or external disks to steal data when remote social engineering fails. Mandiant said dozens of U.S. organizations were targeted between January and May, and in some cases the intrusion, theft, and extortion cycle was completed within a single business day, with ransom demands sent shortly after access ended. Researchers and the FBI linked the operation to the post-Conti cybercrime ecosystem and noted that its abuse of legitimate tools leaves few forensic artifacts, while Resecurity reported fast-flux infrastructure supporting leak sites including `business-data-leaks[.]com` and `ep6pheij[.]com`. The FBI and Google urged organizations to verify anyone claiming to be IT staff, restrict unauthorized remote management and VDI access, harden USB and removable-media controls, deploy phishing-resistant MFA, and closely monitor sensitive document systems.
Jun 29, 2026
Mandiant reported a red team exercise at a European engineering organization that demonstrated how a financially motivated actor using **FIN11**-style tactics could move from a standard corporate endpoint into operational technology environments. Starting with regular employee credentials, the team was able to escalate access to **domain administrator**, steal critical data, and reach **OT servers**, illustrating how weaknesses between enterprise and OT networks can enable ransomware operators to extend an intrusion beyond traditional IT systems. The report warns that OT environments remain exposed even though many ransomware incidents have primarily affected enterprise networks. Mandiant said financially motivated groups are increasingly using tradecraft associated with more advanced intrusions, and cited prior **CLOP** activity linked to FIN11 that used a process kill list containing OT-related processes. That overlap suggests ransomware operators may be capable of disrupting or encrypting critical OT functions without needing deep, specialized OT expertise.
Jun 29, 2026
Suspected former **Black Basta** affiliates have launched a fast-scaling social-engineering campaign against dozens of organizations, targeting more than 100 employees to gain network access for **data theft, ransomware deployment, and extortion**. According to ReliaQuest, the operators use mass email bombing to overwhelm victims and then follow up through **Microsoft Teams** messages or phone calls while impersonating IT help desk staff. The activity has been linked to former Black Basta members or closely aligned actors because the tooling, targeting, and execution closely mirror the group’s historical playbook, even after Black Basta fragmented following the leak of its internal chats. The campaign has increasingly focused on senior leaders and other highly privileged personnel, with executive targeting rising from **59%** in January and February to **77%** in March. Attackers have persuaded victims to install remote monitoring and management tools such as **Supremo Remote Desktop** or to launch **Windows Quick Assist**, sometimes obtaining remote access within minutes before running malicious scripts. Manufacturing and professional services have been hit hardest, with finance, insurance, construction, and technology also affected, underscoring how the operators are moving faster and using more automation to scale intrusions and make early detection more difficult.
Jun 29, 2026