Loading story…
Morphisec reported that FIN7 launched two campaigns against restaurant and hospitality organizations using password-protected Microsoft Word documents with Russian-language lures and branding themed around Finjan’s InvinciBull VPN. Victims were prompted to enable macros, which extracted obfuscated JavaScript, copied and renamed wscript.exe to mses.exe to reduce some EDR visibility, and installed a JavaScript backdoor that contacted command-and-control domains including bing-cdn[.]com and googleapi-cdn[.]com. The malware transmitted limited host profiling data such as MAC address and computer domain, indicating the operators were likely filtering victims before delivering additional payloads.
The activity fits long-observed FIN7 tradecraft documented by Mandiant and Splunk, including lure documents tied to malware families such as CARBANAK, GRIFFON, BATELEUR, POWERSOURCE, and BEACON, as well as JavaScript-based loaders that use WMI, ActiveX, and HTTP or DNS for reconnaissance and command-and-control. The new campaign also underscores FIN7’s resilience after multiple U.S. prosecutions of senior members, including recruiter Andrii Kolpakov’s guilty plea and administrator Fedir Hladyr’s prison sentence, while prior reporting has linked the group to large-scale payment-card theft and later expansion into ransomware-related operations.
Get the infrastructure and lures behind it.
14 events from the most recent confirmed update back to the earliest known activity.
Morphisec reported two November FIN7 campaigns and said the group remained active despite prior indictments. The report described the lures, macro behavior, JavaScript backdoor, and selective host profiling sent to command-and-control infrastructure.
Mandiant published a dataset of malicious document filenames and MD5 hashes attributed to FIN7 and suspected FIN7 activity. The indicator list mapped lure files to malware families including BEACON, BELLHOP, HALFBAKED, CARBANAK, DRIFTPIN, POWERSOURCE, BATELEUR, and GRIFFON.
Splunk published analysis describing FIN7 tradecraft and the resurfacing of JSS Loader and Remcos in the field. The report detailed JavaScript execution chains, host reconnaissance, and data exfiltration methods associated with the group.
A U.S. federal judge sentenced Fedir Hladyr to 10 years in prison and ordered $2.5 million in restitution. Prosecutors described him as a key technical figure in FIN7's theft of payment card data and credentials from hundreds of U.S. firms.
Andrii Kolpakov pleaded guilty in the United States to conspiracy to commit wire and bank fraud and conspiracy to commit computer hacking. Prosecutors identified him as a FIN7 manager and recruiter involved in a scheme that caused more than $100 million in losses during his participation.
FIN7 conducted a campaign in early 2020 that used the U.S. Postal Service to send malicious USB devices to multiple organizations. The activity showed the group remained operational despite prior arrests.
Fedir Hladyr pleaded guilty to wire fraud and conspiracy to commit computer hacking for his role in FIN7. The plea was part of an agreement intended to reduce his sentence.
After his 2018 arrest in Spain, Andrii Kolpakov was extradited to the United States to face charges tied to FIN7's hacking and fraud scheme.
A FIN7 lure document named "Oprosnik_new.doc" was created, according to its metadata. Morphisec later tied it to a campaign targeting the restaurant and hospitality sector.
Spanish police arrested alleged FIN7 manager and recruiter Andrii Kolpakov. Authorities said devices seized from him contained thousands of payment card numbers and stolen credentials from American companies.
German authorities arrested alleged FIN7 administrator Fedir Hladyr. He was later extradited to the U.S. for prosecution.
In the second week of November, FIN7 used closely related lure documents, including "dinners.doc," with minor macro changes and a different known C2 domain, googleapi-cdn[.]com. Morphisec said the samples were submitted from Ukraine and appeared to have been created only days earlier.
In the first week of November, FIN7 ran a phishing campaign targeting the restaurant and hospitality sector using password-protected Word documents with Russian-language lures and spoofed Finjan InvinciBull branding. Enabling macros led to obfuscated JavaScript execution, renaming of wscript.exe to mses.exe, and deployment of a backdoor communicating with bing-cdn[.]com.
Three high-ranking alleged FIN7 members were indicted, according to Morphisec's account of later campaign activity. The indictment did not stop subsequent FIN7 operations.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
6 references tracked. Mallory keeps watching after this page renders.
blog.morphisec.com
Open sourcecloud.google.com
Open sourcesplunk.com
Open sourcecyberscoop.com
Open sourcecyberscoop.com
Open sourceprodaft.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
FIN7 has been profiled by multiple security and law-enforcement sources as a Russian-speaking cybercrime group that evolved from large-scale payment-card theft into ransomware operations. The group is described as operating with a corporate-like structure, using front companies including **Combi Security**, **IPC**, and **Bastion Secure** to recruit technical staff, and relying on phishing, software supply-chain compromise, and mailed **BadUSB** devices for initial access. Researchers and government reporting tie FIN7 to a broad toolkit including **Carbanak**, **Bateleur**, **Griffon/Harpy**, **Lizar**, **Cobalt Strike**, and PowerShell-based tooling, while intelligence reporting says investigators obtained insight into the gang’s internal organization, infrastructure, victim targeting, and member communications. U.S. prosecutors said FIN7 compromised hundreds of companies, breached more than 6,500 point-of-sale terminals across over 3,600 business locations, and stole more than 20 million payment-card records, causing losses estimated above **$1 billion**; in one case, high-level member **Andrii Kolpakov** was sentenced to seven years in prison. Separate reporting and government assessments say FIN7 later moved into big-game-hunting ransomware and was linked to **Sodinokibi**, **DarkSide**, and later **BlackMatter**, though attribution to **ALPHV** remained unconfirmed by ANSSI. Reporting on DarkSide’s collapse after the Colonial Pipeline incident also showed affiliates publicly disputing unpaid ransom shares on the **XSS** forum, underscoring the instability inside the ransomware ecosystem tied to groups that security researchers have associated with FIN7.
Aug 15, 2026
FIN7 has continued to evolve its malware delivery and post-compromise tooling, with multiple reports tying the group to campaigns that use malicious Excel add-ins (`.xll`) to deliver a rewritten **JSSLoader**. Malwarebytes reported a late-June malspam operation in which an XLL component launched JSSLoader and dropped a secondary .NET payload, while later reporting from Morphisec and Secureworks also linked new JSSLoader activity to Excel add-ins. Researchers said the newer JSSLoader variants expand on earlier versions with added functionality, including enhanced data-exfiltration capabilities. The activity fits a broader pattern in FIN7 intrusions documented by Mandiant, which showed the group shifting from older loaders such as **LOADOUT** and **GRIFFON** toward more flexible access tools including **POWERPLANT** and **Cobalt Strike BEACON**, while continually rewriting malware to evade detection. Mandiant also described FIN7 using compromised RDP credentials, shellcode loaders, reconnaissance, Kerberoasting, and customized backdoors, underscoring that the latest JSSLoader delivery chain is part of a longer-running effort by the financially motivated group to refine initial access, persistence, and follow-on intrusion capability.
Aug 15, 2026
Mandiant published new reporting on **FIN7**, detailing how the financially motivated threat group has continued to operate as an elusive and adaptive global criminal enterprise. The report describes FIN7 as a long-running actor known for intrusion activity tied to cybercrime, with investigators emphasizing the group’s persistence, operational flexibility, and ability to evade disruption while maintaining a broad international footprint. The findings highlight renewed efforts to identify and track the people, infrastructure, and tradecraft behind FIN7 as defenders and law enforcement continue pursuing the group. Mandiant’s account frames FIN7 as an enduring threat to organizations worldwide, underscoring the value of sustained threat intelligence collection and coordinated action against one of the most established names in financially driven intrusion activity.
Jul 12, 2026