FIN7 — ATT&CK profile, 67 techniques

Overview

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.

Naming & attribution

FIN7 is tracked under 6 names across the industry. It uses 67 documented ATT&CK techniques — more than 92% of the 174 groups tracked here. Activity attributed since 2013.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
GOLD NIAGARA	CTU
ITG14	Singleton, C. and Kiefer, C
Carbon Spider	Loui, E. and Reynolds, J
ELBRUS	Microsoft
Sangria Tempest	Microsoft
FIN7	Miller, S., et al

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1546.011 Application Shimming — used by 1 of 174 groups
T1674 Input Injection — used by 1 of 174 groups
T1497.002 User Activity Based Checks — used by 2 of 174 groups
T1558.003 Kerberoasting — used by 3 of 174 groups
T1608.005 Link Target — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

OilRig Iran — 33 shared techniques (30% overlap)
MuddyWater Iran — 31 shared techniques (30% overlap)
Gamaredon Group Russia — 31 shared techniques (29% overlap)
Lazarus Group North Korea — 35 shared techniques (28% overlap)
APT32 Vietnam — 32 shared techniques (28% overlap)
Mustang Panda China — 31 shared techniques (26% overlap)

Malware families with current indicators

5 families attributed to FIN7, carrying 331 indicators currently tracked from abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL. MITRE documents what a group does; this is what its tooling is doing now.

SystemBC 296 indicators
Maze 19 indicators
JSSLoader 7 indicators
Carbanak 5 indicators
REvil 4 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Capabilities

Supply-chain compromise — ATT&CK T1195.002
Exploitation of public-facing / client applications — ATT&CK T1190
Custom malware/implant development — ATT&CK: 15 attributed custom malware families

TTPs — 67 techniques across 15 tactics

Reconnaissance

T1591 Gather Victim Org Information
T1591.004 Identify Roles

Resource Development

T1583.001 Domains
T1583.006 Web Services
T1587.001 Malware
T1588.002 Tool
T1608.001 Upload Malware
T1608.004 Drive-by Target
T1608.005 Link Target

Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol
T1021.004 SSH
T1021.005 VNC
T1091 Replication Through Removable Media
T1210 Exploitation of Remote Services

Collection

Command and Control

Exfiltration

T1567.002 Exfiltration to Cloud Storage

Impact

T1486 Data Encrypted for Impact

Tools & malware (19)

GRIFFON · Mimikatz · AdFind · JSS Loader · HALFBAKED · REvil · PowerSploit · CrackMapExec · Carbanak · Pillowmint · Cobalt Strike · Maze · POWERSOURCE · RDFSNIFFER · SQLRat · Lizar · TEXTMATE · BOOSTWRITE · SystemBC

Reporting (3)

How Microsoft names threat actors — Microsoft
Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself — Microsoft
FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 — Abdo, B., et al