FIN7
Actor Profile
Key Findings
- OriginCybercrime enterprise active since at least 2013, centered in Eastern Europe and Russia, organized into compartmentalized teams rather than a single crew.
- Primary TargetRetail, financial services, healthcare, software, and manufacturing organizations, including a documented campaign against a major US automotive manufacturer.
- Initial AccessMalvertising and fake software download pages, malicious USB drives mailed to targets, and trojanized legitimate tooling.
- Primary ObjectiveOriginally bulk payment card theft from point-of-sale systems; since around 2020, high-value ransomware deployment and EDR evasion tool sales.
- Operating MethodCustom loaders and backdoors establish access, followed by dedicated EDR-disabling tooling and low-visibility persistence before escalation.
- Defense PrioritiesRestrict software installation sources, alert on EDR/AV tampering, control removable media, and maintain offline tested backups.
Kill Chain & MITRE ATT&CK Mapping
FIN7's tradecraft spans over a decade of adaptation, from fraudulent tech-support calls to fake software download pages, but the throughline is disciplined initial access followed by rapid, well-tooled escalation.
Initial Access
Malicious Google ads spoofing legitimate brands and fake software download pages, including impersonated 7-Zip and browser update sites, lure victims into running an MSIX installer or dropper.
Malicious USB drives mailed directly to target organizations, styled as gifts or promotional items, execute malware when plugged into a workstation.
Fake IP scanning tools and other seemingly legitimate utilities have been used as an initial malware lure against high-value targets.
They get in through fake ads, fake software downloads, or occasionally mailed USB drives loaded with malware.
Execution & Delivery
Purpose-built loaders including PowerNet and MaskBat decompress and execute the group's payloads, with some variants checking whether the host is enterprise-domain joined before continuing.
A Python-based backdoor giving full system control via in-memory execution, communicating with command-and-control infrastructure using Base64-encoded data.
Custom-built tools unpack and run the malware, giving them full remote control over the infected machine.
Defense Evasion
A dedicated EDR impairment tool built and sold by the group, used to disable endpoint security products and shared across multiple ransomware operators.
Application compatibility shim databases have been abused as a low-visibility persistence mechanism on compromised hosts.
They use their own tool to disable your security software and hide their foothold using low-visibility Windows tricks.
Command & Control
A commercially available remote administration tool repurposed as the group's primary remote access payload across its recent malvertising and fake-download campaigns.
They rely on a legitimate remote-access tool to control infected machines, which can blend in with normal IT activity.
Impact
Depending on the campaign, impact ranges from bulk payment card data harvesting from POS environments to full ransomware deployment, with some affiliated strains including a destructive wipe mode that erases files even after ransom payment.
Depending on the target, they either steal payment card data in bulk or deploy ransomware — sometimes with a destructive twist that erases files even if you pay.
Indicators of Compromise
FIN7's infrastructure and tooling shift frequently, but the following patterns have recurred across recent, publicly reported campaigns.
Reported patterns & behavior
| Indicator / Behavior | Type | Notes |
|---|---|---|
| Fake 7-Zip or browser update download site | Domain pattern | Delivers PowerNet or MaskBat loader leading to NetSupport RAT |
| NetSupport RAT process on an unmanaged endpoint | Behavior | Commercial RAT repurposed as primary payload |
| Unsolicited USB drive received by mail | Physical / behavior | Historical BadUSB delivery method, still worth staff awareness |
| EDR service unexpectedly disabled or crashing | Behavior | Consistent with AvNeutralizer / AuKill tampering |
| Malicious ad impersonating a well-known software brand | Delivery vector | Recent vector for MSIX installer delivery |
| Traffic to TAG-124 style traffic distribution infrastructure | Infrastructure | Redirects victims toward fake update or download pages |
No single indicator confirms FIN7, but a fake software download followed by NetSupport RAT and EDR tampering is a strong combined signal.
Detection & Mitigation Priorities
Ordered by impact-to-effort ratio for a mid-sized enterprise, with attention to the group's diversified initial access playbook.
- P1Restrict software installation to approved sources and block execution of MSIX installers from outside managed channels.
- P1Alert on EDR/AV service tampering or unexpected crashes, a leading indicator of active defense evasion tooling.
- P1Block or closely control removable media on workstations, particularly unsolicited or unrecognized devices.
- P2Filter malicious advertising and enforce DNS/web filtering against known fake-download and traffic distribution domains.
- P2Monitor for unauthorized remote access tools such as NetSupport RAT running outside approved IT use.
- P3Maintain offline, tested backups given the group's ties to destructive ransomware variants that can erase files even after payment.
Locking down where software can install from and watching for EDR tampering blocks most of FIN7's current playbook.
References
- 01FIN7, GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest (Group G0046)MITRE ATT&CK
- 02GrayAlpha Uses Diverse Infection Vectors to Deploy PowerNet Loader, NetSupport RATRecorded Future / Insikt Group
- 03FIN7 Reboot: Cybercrime Gang Enhances Ops with New EDR BypassesSentinelOne
- 04Anubis Ransomware Encrypts and Wipes Files, Making Recovery ImpossibleThe Hacker News
- 05Threat Group FIN7 Targets the U.S. Automotive IndustryArctic Wolf (formerly BlackBerry)
- 06Threat Hunting Case Study: Uncovering FIN7Intel 471
- 07FIN7 Cybercrime Group: Tactics, Tools, and Threat InsightsHuntress