FIN7
Also known as: Carbon Spider, Sangria Tempest, ELBRUS, GOLD NIAGARA, ITG14
FIN7 became infamous for stealing payment card data from restaurant and retail point-of-sale systems using carefully crafted phishing. It later moved into big-game ransomware, and research has linked it to ransomware operations including DarkSide and REvil. It has also been linked to mailing malicious USB devices to companies.
- Public attribution
- A financially motivated criminal group (MITRE ATT&CK); MITRE notes part of it operated through a front company called Combi Security.
- Active since
- Around 2013
- Targets
- US retail, restaurant and hospitality businesses
- Financial services, software and many other industries
Notable campaigns
2015-2018Point-of-sale card theft
Phishing-led intrusions into restaurant and retail networks to steal payment card data (MITRE ATT&CK).
2020 onwardShift to ransomware
MITRE reports a shift to big-game hunting, including use of REvil and the group's own DarkSide RaaS.
2022BadUSB and new tooling
Mandiant described a BadUSB campaign and the POWERPLANT backdoor among activity it tracks as or suspects is FIN7.
Signature ATT&CK techniques
- T1566.001Phishing: Spearphishing Attachment
- T1204.002User Execution: Malicious File
- T1059.005Command and Scripting Interpreter: Visual Basic
- T1059.001Command and Scripting Interpreter: PowerShell
- T1091Replication Through Removable Media
- T1558.003Steal or Forge Kerberos Tickets: Kerberoasting
- T1486Data Encrypted for Impact
Selected from the group's MITRE ATT&CK entry, plus initial-access techniques named in the cited advisories.
Defences that work against this actor
- Block macros and script files from the internet, and sandbox attachments.
- Segment point-of-sale systems and payment networks from the corporate network.
- Use long, random passwords (or managed service accounts) for service accounts to defeat Kerberoasting.
- Block unknown USB devices and warn staff about unsolicited USB gifts or parcels.