Loading threat actor…
FIN7, also tracked as Coreid, Carbanak, and Carbon Spider, is a cybercrime threat actor associated with financially motivated intrusion activity and ransomware operations. Reporting links the actor to the DarkSide and BlackMatter ransomware operations and attributes BlackCat/ALPHV activity to the same broader adversary cluster. The group has operated through an affiliate-driven ransomware-as-a-service model in which partners conduct intrusions and share proceeds, with data theft and extortion central to its operations. Activity associated with this actor includes the use and continued refinement of custom tooling for pre-encryption data theft. One such tool, Exmatter, is a .NET-based exfiltration utility used to enumerate logical drives, identify files of interest based on extension and other filters, prioritize them for theft, and exfiltrate selected data before ransomware deployment. Later variants added fallback exfiltration mechanisms and expanded file targeting, indicating active tool development. Reporting also associates BlackCat-linked operations with Eamfo, malware designed to steal credentials from Veeam software, supporting follow-on privilege escalation and lateral movement. Tactics attributed to this actor include initial access via compromised internet-facing systems and malware delivery through established criminal access channels, followed by credential theft, privilege escalation, lateral movement, data exfiltration, defense evasion, and extortion. BlackCat-linked operations have also been reported exploiting unpatched Microsoft Exchange servers for ransomware deployment, rebooting Windows systems into Safe Mode to reduce the effectiveness of security controls, and enhancing leak-site functionality to support pressure on victims through searchable stolen-data disclosures. Overall, the actor is best characterized as a mature financially motivated cybercrime enterprise with strong post-compromise tradecraft, custom tooling, and sustained emphasis on theft-led ransomware extortion.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Who, where, and (when attributed) which flag flies behind the operation. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
8 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
3 malware families attributed to this actor across reporting.
10 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Actor attributed as being behind/associated with BlackCat operations per the content (tracking/attribution linkage).
Cybercrime group linked to BlackMatter and previously responsible for Darkside; operates a ransomware-as-a-service model with affiliates and uses data theft and extortion to pressure victims.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.