FIN7

Names and who uses them

• FIN7Our name
• Carbon SpiderCrowdStrike
• ELBRUSMicrosoft
• Sangria TempestMicrosoft
• ITG14MITRE ATT&CK
• GOLD NIAGARASecureworks

Targets

Sectors: Energy, Healthcare, Finance, Media, Retail, Transport, Hospitality, Pharmaceuticals

Regions: United States

Known techniques

• T1005Data from Local System
• T1008Fallback Channels
• T1021.001Remote Desktop Protocol
• T1021.004SSH
• T1021.005VNC
• T1027.010Command Obfuscation
• T1027.016Junk Code Insertion
• T1033System Owner/User Discovery
• T1036.004Masquerade Task or Service
• T1036.005Match Legitimate Resource Name or Location
• T1047Windows Management Instrumentation
• T1053.005Scheduled Task
• T1057Process Discovery
• T1059Command and Scripting Interpreter
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1059.007JavaScript
• T1069.002Domain Groups
• T1071.004DNS
• T1078Valid Accounts
• T1078.003Local Accounts
• T1082System Information Discovery
• T1087.002Domain Account
• T1091Replication Through Removable Media
• T1102.002Bidirectional Communication
• T1105Ingress Tool Transfer
• T1113Screen Capture
• T1124System Time Discovery
• T1125Video Capture
• T1140Deobfuscate/Decode Files or Information
• T1190Exploit Public-Facing Application
• T1195.002Compromise Software Supply Chain
• T1204.001Malicious Link
• T1204.002Malicious File
• T1210Exploitation of Remote Services
• T1218.005Mshta
• T1218.011Rundll32
• T1219Remote Access Tools
• T1486Data Encrypted for Impact

Malware and tools used