FIN7
FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be…
- ATT&CK ID
- G0046
- Weather family
- Tempest
- Techniques
- 50
- Tools
- 19
Also tracked as GOLD NIAGARA · ITG14 · Carbon Spider · ELBRUS · Sangria Tempest
Vulnerabilities it has exploited
- CVE-2020-1472 Microsoft NetlogonUnscored · exploited in the wild
- CVE-2021-31207 Microsoft Exchange ServerUnscored · exploited in the wild
Techniques
Reconnaissance
Resource Development
Acquire InfrastructureDevelop CapabilitiesObtain CapabilitiesStage Capabilities
Initial Access
Valid AccountsReplication Through Removable MediaExploit Public-Facing ApplicationSupply Chain CompromisePhishing
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterUser ExecutionInter-Process CommunicationSystem ServicesInput Injection
Persistence
Scheduled Task/JobValid AccountsCreate or Modify System ProcessEvent Triggered ExecutionBoot or Logon Autostart Execution
Privilege Escalation
Scheduled Task/JobValid AccountsCreate or Modify System ProcessEvent Triggered ExecutionBoot or Logon Autostart Execution
Stealth
Obfuscated Files or InformationMasqueradingValid AccountsDeobfuscate/Decode Files or InformationSystem Binary Proxy ExecutionVirtualization/Sandbox EvasionHide ArtifactsReflective Code Loading
Defense Impairment
Subvert Trust ControlsDisable or Modify System Firewall
Credential Access
Steal or Forge Kerberos Tickets
Discovery
System Owner/User DiscoveryProcess DiscoveryPermission Groups DiscoverySystem Information DiscoveryAccount DiscoverySystem Time DiscoveryVirtualization/Sandbox Evasion
Lateral Movement
Remote ServicesReplication Through Removable MediaExploitation of Remote Services
Collection
Data from Local SystemScreen CaptureVideo Capture
Command and Control
Fallback ChannelsApplication Layer ProtocolWeb ServiceIngress Tool TransferRemote Access ToolsNon-Standard PortProtocol Tunneling
Exfiltration
Impact
Software
AdFind · BOOSTWRITE · Carbanak · Cobalt Strike · CrackMapExec · GRIFFON · HALFBAKED · JSS Loader · Lizar · Maze · Mimikatz · POWERSOURCE · Pillowmint · PowerSploit · RDFSNIFFER · REvil · SQLRat · SystemBC · TEXTMATE