FIN7 Threat Group

Executive Summary

First Identified: 2012
Threat Type:
- Advanced Persistent Threat (APT)
Extortion Method:
- Drive-by compromise, vulnerability exploitation, supply chain compromise, trusted relationship, social engineering (MITRE ATT&CK: T1189, T1190, T1195, T1199, T1566)
Most Frequently Targeted Industries:
- Consumer Cyclicals
- Transportation
- Utilities
Most Frequently Targeted Victim HQ Locations:
- North America
- Europe
Select Known Associations:
- Combi Security
- Bastion Secure
- ITG23
- Stark Industries Solutions
- UNC3381
Select MITRE ATT&CK Mappings:
- Initial Access
  - Drive-by compromise, vulnerability exploitation, supply chain compromise, trusted relationship, social engineering (MITRE ATT&CK: T1189, T1190, T1195, T1199, T1566)
- Persistence
  - Scheduled tasks, browser extensions, create/modify system process, event triggered execution, boot or logon autostart execution (MITRE ATT&CK: T1053, T1176, T1543, T1546, T1547)
- Lateral Movement
  - Abuse of remote services, replication through removable media, vulnerability exploitation, lateral tool transfer (MITRE ATT&CK: T1021, T1091, T1210, T1570)

September 06, 2024: APG Urgent Threat Alert
- “Alert: New Critical Veeam CVEs Expose Backups to Ransomware Gangs”