FIN7

FIN7 is a prolific financially motivated cybercrime group known for long-running intrusion activity against businesses worldwide. The group is widely tracked under aliases including Carbon Spider, ELBRUS, FIN_7, Gold Niagara, ITG14, and Sangria Tempest. FIN7 has historically specialized in phishing-led enterprise compromise and has expanded its tooling and operations over time to include broader malware delivery, post-compromise collection, and ransomware deployment. FIN7 commonly gains initial access through spearphishing emails carrying malicious Microsoft Office or RTF attachments and has also used look-alike domains in phishing campaigns. Its execution tradecraft includes extensive abuse of PowerShell, Visual Basic scripting, JavaScript/JScript, Windows command shell activity, and mshta for proxy execution of malicious code. The group has used hidden or obfuscated script delivery methods, including concealing PowerShell commands in text files and launching shellcode that retrieves follow-on payloads. The group is associated with modular, multi-stage intrusion chains in which compromised systems download additional malware for execution. FIN7 has used or been linked to a range of malware and loaders, including information stealers, backdoors, and downloaders, and has developed malware for operational use itself, including infected removable media. It has also been associated with screenshot capture and desktop video recording from victim systems, indicating hands-on collection and operator surveillance during intrusions. For persistence, FIN7 malware has created scheduled tasks, Registry Run and RunOnce entries, and Startup folder items. The group has also used reconnaissance tooling such as AdFind for directory and Active Directory enumeration. Reported behaviors further include command execution on victim hosts, collection of files and other sensitive information, and exfiltration of data from compromised networks. Some FIN7 malware families have supported fallback command-and-control mechanisms such as DNS when primary channels fail. FIN7 has broadened its criminal ecosystem relationships over time, including use of malware obtained from or associated with external developers and affiliates. More recent reporting indicates the group added ransomware to its arsenal, reflecting an evolution from intrusion-and-theft operations toward extortion-oriented activity. FIN7 is best understood as a mature, adaptable cybercrime actor with strong malware development capability, durable phishing tradecraft, and broad post-exploitation proficiency.