Loading story…
Mandiant published new research detailing the evolution of FIN7, the financially motivated threat group long associated with large-scale payment card theft and enterprise intrusions. The report describes how the group has adapted its operations over time, refining its tooling, delivery methods, and intrusion tradecraft while remaining a persistent threat to organizations across multiple sectors.
The research frames FIN7 as a mature adversary that has repeatedly shifted tactics to maintain access and monetize compromises, illustrating how older criminal groups continue to evolve rather than disappear. Mandiant’s findings add historical context to FIN7’s activity and highlight the group’s sustained role in the cybercrime ecosystem, where established actors continue to update techniques and infrastructure to support ongoing financially driven attacks.
TTPs, infrastructure, and targeting history in one profile.
1 event from the most recent confirmed update back to the earliest known activity.
Mandiant published a blog post titled "FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7," providing analysis of the threat group's development and activity. No additional dated incident details are available in the provided reference content.
See this adversary's TTPs, infrastructure, and targeting history, correlated against your exposure.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Mandiant published new reporting on **FIN7**, detailing how the financially motivated threat group has continued to operate as an elusive and adaptive global criminal enterprise. The report describes FIN7 as a long-running actor known for intrusion activity tied to cybercrime, with investigators emphasizing the group’s persistence, operational flexibility, and ability to evade disruption while maintaining a broad international footprint. The findings highlight renewed efforts to identify and track the people, infrastructure, and tradecraft behind FIN7 as defenders and law enforcement continue pursuing the group. Mandiant’s account frames FIN7 as an enduring threat to organizations worldwide, underscoring the value of sustained threat intelligence collection and coordinated action against one of the most established names in financially driven intrusion activity.
Jul 12, 2026
FIN7 has been profiled by multiple security and law-enforcement sources as a Russian-speaking cybercrime group that evolved from large-scale payment-card theft into ransomware operations. The group is described as operating with a corporate-like structure, using front companies including **Combi Security**, **IPC**, and **Bastion Secure** to recruit technical staff, and relying on phishing, software supply-chain compromise, and mailed **BadUSB** devices for initial access. Researchers and government reporting tie FIN7 to a broad toolkit including **Carbanak**, **Bateleur**, **Griffon/Harpy**, **Lizar**, **Cobalt Strike**, and PowerShell-based tooling, while intelligence reporting says investigators obtained insight into the gang’s internal organization, infrastructure, victim targeting, and member communications. U.S. prosecutors said FIN7 compromised hundreds of companies, breached more than 6,500 point-of-sale terminals across over 3,600 business locations, and stole more than 20 million payment-card records, causing losses estimated above **$1 billion**; in one case, high-level member **Andrii Kolpakov** was sentenced to seven years in prison. Separate reporting and government assessments say FIN7 later moved into big-game-hunting ransomware and was linked to **Sodinokibi**, **DarkSide**, and later **BlackMatter**, though attribution to **ALPHV** remained unconfirmed by ANSSI. Reporting on DarkSide’s collapse after the Colonial Pipeline incident also showed affiliates publicly disputing unpaid ransom shares on the **XSS** forum, underscoring the instability inside the ransomware ecosystem tied to groups that security researchers have associated with FIN7.
Aug 15, 2026
Morphisec reported that **FIN7** launched two campaigns against restaurant and hospitality organizations using password-protected Microsoft Word documents with Russian-language lures and branding themed around Finjan’s InvinciBull VPN. Victims were prompted to enable macros, which extracted obfuscated JavaScript, copied and renamed `wscript.exe` to `mses.exe` to reduce some EDR visibility, and installed a JavaScript backdoor that contacted command-and-control domains including `bing-cdn[.]com` and `googleapi-cdn[.]com`. The malware transmitted limited host profiling data such as MAC address and computer domain, indicating the operators were likely filtering victims before delivering additional payloads. The activity fits long-observed **FIN7** tradecraft documented by Mandiant and Splunk, including lure documents tied to malware families such as **CARBANAK**, **GRIFFON**, **BATELEUR**, **POWERSOURCE**, and **BEACON**, as well as JavaScript-based loaders that use WMI, ActiveX, and HTTP or DNS for reconnaissance and command-and-control. The new campaign also underscores FIN7’s resilience after multiple U.S. prosecutions of senior members, including recruiter Andrii Kolpakov’s guilty plea and administrator Fedir Hladyr’s prison sentence, while prior reporting has linked the group to large-scale payment-card theft and later expansion into ransomware-related operations.
Aug 15, 2026