Loading story…
FIN7 has continued to evolve its malware delivery and post-compromise tooling, with multiple reports tying the group to campaigns that use malicious Excel add-ins (.xll) to deliver a rewritten JSSLoader. Malwarebytes reported a late-June malspam operation in which an XLL component launched JSSLoader and dropped a secondary .NET payload, while later reporting from Morphisec and Secureworks also linked new JSSLoader activity to Excel add-ins. Researchers said the newer JSSLoader variants expand on earlier versions with added functionality, including enhanced data-exfiltration capabilities.
The activity fits a broader pattern in FIN7 intrusions documented by Mandiant, which showed the group shifting from older loaders such as LOADOUT and GRIFFON toward more flexible access tools including POWERPLANT and Cobalt Strike BEACON, while continually rewriting malware to evade detection. Mandiant also described FIN7 using compromised RDP credentials, shellcode loaders, reconnaissance, Kerberoasting, and customized backdoors, underscoring that the latest JSSLoader delivery chain is part of a longer-running effort by the financially motivated group to refine initial access, persistence, and follow-on intrusion capability.
Pull IOCs and campaign context straight into your stack.
6 events from the most recent confirmed update back to the earliest known activity.
In its analysis of the late-June campaign, Malwarebytes determined that FIN7 was using another rewrite of JSSLoader with expanded capabilities. The newly observed version included data exfiltration functions, and one analyzed sample dropped a secondary .NET payload during execution.
Malwarebytes observed a malspam campaign in late June and attributed it to FIN7. The attack chain used an XLL component as an initial step leading to JSSLoader.
Mandiant published research describing FIN7’s evolution from 2020 through 2021, including its move away from LOADOUT and GRIFFON toward POWERPLANT and BEACON. The report also highlighted distinctive PowerShell execution patterns and a 2021 intrusion case involving TERMITE and victim-customized POWERPLANT.
Morphisec Labs reported a new JSSLoader campaign linked to FIN7 that used phishing emails with malicious Excel XLL or XLM add-ins to download and execute the payload. The updated malware added stronger obfuscation, including renamed functions and runtime string concatenation, to hinder static and endpoint detection.
Mandiant identified an uptick in FIN7-suspected activity during 2021 across five intrusions beginning in April 2021. In these intrusions, FIN7 shifted away from earlier loaders toward direct deployment of POWERPLANT and Cobalt Strike BEACON.
Mandiant reported that FIN7 was first observed using the POWERPLANT PowerShell backdoor in late summer 2020. It was initially delivered after successful GRIFFON infections, with August 2020 specifically noted for this delivery pattern.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
6 references tracked. Mallory keeps watching after this page renders.
secureworks.com
Open sourceblog.morphisec.com
Open sourcemalwarebytes.com
Open sourcemandiant.com
Open sourcebleepingcomputer.com
Open sourcemorphisec.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat researchers reported that attackers increasingly used malicious Microsoft Excel add-in files with the `.xll` extension as an initial access vector, exploiting Excel's `xlAutoOpen` behavior to run code with a single user action. HP Wolf Security said the technique was being used to deliver malware including **Dridex**, **Agent Tesla**, **Raccoon Stealer**, and **Formbook**, and noted that some samples were built with the legitimate **Excel-DNA** framework while others were custom downloaders that decrypted embedded configuration data, resolved APIs dynamically, fetched payloads, and executed them. Researchers also observed underground promotion of XLL dropper builders, indicating the method was becoming commoditized. Fortinet and SANS documented active spam operations using the format in the wild. One campaign used DHL and Amazon-themed lures to distribute a signed malicious XLL that downloaded `csrsc.exe` from `dmequest[.]com`, saved it as `%PUBLIC%\srtherhaeth[.]eXe`, and installed a Rust-based **Buer Loader** variant that communicated with `shipmentofficedepot[.]com`; the file was signed with a certificate assigned to **HORUM**, likely to reduce detection. Separately, SANS observed a **Hancitor** malspam wave using DocuSign-themed emails and Google `feedproxy` links that redirected victims through compromised sites to an XLL payload, which then retrieved an HTA file and a Hancitor executable from `srand04rf[.]ru`, followed by activity linked to **Cobalt Strike** and **Ficker Stealer**. Defenders were advised to block inbound XLL attachments, restrict add-ins to trusted signed files, or disable proprietary Excel add-ins where possible.
Aug 15, 2026
Researchers documented multiple **XLoader/Formbook** delivery chains that used different initial access methods but converged on the same information-stealing malware. One campaign used spam emails with PDF attachments that led victims through embedded `XLSX` and downloaded `RTF` files, while another impersonated **SharePoint** to push users to a malicious ZIP archive. A separate Excel-based campaign exploited **`CVE-2017-11882`** in Microsoft Equation Editor (`EQNEDT32.exe`) through a malicious OLE object, triggering shellcode that downloaded and launched additional malware from attacker-controlled infrastructure. Across the campaigns, the loaders relied on layered obfuscation, in-memory execution, and repeated process injection before deploying the final **XLoader** payload. Analysts observed AutoIT-based loaders, anti-analysis delays, CRC32 API hashing, shellcode injection into processes including `svchost.exe`, `netsh.exe`, and `explorer.exe`, and payload components hidden in bitmap resources and unpacked with steganography or decompression routines. The final malware established persistence through **HKCU Run** keys and shortcut artifacts, used process hollowing, and stole credentials, cookies, keystrokes, clipboard contents, and screenshots while maintaining command-and-control channels that could fetch additional payloads or remove the malware.
Aug 15, 2026
Morphisec reported that **FIN7** launched two campaigns against restaurant and hospitality organizations using password-protected Microsoft Word documents with Russian-language lures and branding themed around Finjan’s InvinciBull VPN. Victims were prompted to enable macros, which extracted obfuscated JavaScript, copied and renamed `wscript.exe` to `mses.exe` to reduce some EDR visibility, and installed a JavaScript backdoor that contacted command-and-control domains including `bing-cdn[.]com` and `googleapi-cdn[.]com`. The malware transmitted limited host profiling data such as MAC address and computer domain, indicating the operators were likely filtering victims before delivering additional payloads. The activity fits long-observed **FIN7** tradecraft documented by Mandiant and Splunk, including lure documents tied to malware families such as **CARBANAK**, **GRIFFON**, **BATELEUR**, **POWERSOURCE**, and **BEACON**, as well as JavaScript-based loaders that use WMI, ActiveX, and HTTP or DNS for reconnaissance and command-and-control. The new campaign also underscores FIN7’s resilience after multiple U.S. prosecutions of senior members, including recruiter Andrii Kolpakov’s guilty plea and administrator Fedir Hladyr’s prison sentence, while prior reporting has linked the group to large-scale payment-card theft and later expansion into ransomware-related operations.
Aug 15, 2026