MITRE ATT&CKgroup
G0046 FIN7
- Domain
- enterprise, ics
- Aliases
- GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest
- Version
- 4.1
- Created
- 2017-05-31
Description
FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.
Related
Uses · MITRE ATT&CK (86)
- T1686 Disable or Modify System Firewall technique
- S9001 SystemBC software (malware)
- T1674 Input Injection technique
- T1027.016 Junk Code Insertion sub-technique
- T1027.010 Command Obfuscation sub-technique
- S0681 Lizar software (malware)
- T1620 Reflective Code Loading technique
- S0648 JSS Loader software (malware)
- T1608.001 Upload Malware sub-technique
- T1608.004 Drive-by Target sub-technique
- T1608.005 Link Target sub-technique
- S0552 AdFind software (tool)
- T1591 Gather Victim Org Information technique
- T1591.004 Identify Roles sub-technique
- T1583.006 Web Services sub-technique
- T1587.001 Malware sub-technique
- T1588.002 Tool sub-technique
- T1583.001 Domains sub-technique
- S0496 REvil software (malware)
- S0517 Pillowmint software (malware)
- S0488 CrackMapExec software (tool)
- T1059.007 JavaScript sub-technique
- S0449 Maze software (malware)
- T1071.004 DNS sub-technique
- T1572 Protocol Tunneling technique
- T1102.002 Bidirectional Communication sub-technique
- T1571 Non-Standard Port technique
- T1078.003 Local Accounts sub-technique
- T1564.003 Hidden Window sub-technique
- T1195.002 Compromise Software Supply Chain sub-technique
References
- https://www.mandiant.com/resources/evolution-of-fin7 Mandiant FIN7 Apr 2022
- https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html FireEye CARBANAK June 2017
- https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319 BiZone Lizar May 2021
- https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html FireEye FIN7 April 2017
- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html FireEye FIN7 Aug 2018
- https://www.secureworks.com/research/threat-profiles/gold-niagara Secureworks GOLD NIAGARA Threat Profile
- https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html FireEye FIN7 Shim Databases
- http://blog.morphisec.com/fin7-attacks-restaurant-industry Morphisec FIN7 June 2017
- https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/ CrowdStrike Carbon Spider August 2021
- https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide Microsoft Threat Actor Naming July 2023
- https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/ Microsoft Ransomware as a Service
- https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html FireEye FIN7 March 2017
- https://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/ IBM Ransomware Trends September 2020