aol.pm

FIN7

IntrusionSet · ATTACK:enterprise:G0046

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0046",
  "title": "FIN7",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0046",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--3753cc21-2dae-4dfb-8481-d004e74502cc",
  "external_id": "G0046",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:09.460Z",
  "modified": "2026-07-31T20:48:31.412Z",
  "version": "4.1",
  "aliases": [
    "FIN7",
    "GOLD NIAGARA",
    "ITG14",
    "Carbon Spider",
    "ELBRUS",
    "Sangria Tempest"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Carbon Spider"
    },
    {
      "source_name": "FIN7"
    },
    {
      "source_name": "ELBRUS"
    },
    {
      "source_name": "Sangria Tempest"
    },
    {
      "source_name": "GOLD NIAGARA"
    },
    {
      "source_name": "Mandiant FIN7 Apr 2022",
      "url": "https://www.mandiant.com/resources/evolution-of-fin7"
    },
    {
      "source_name": "FireEye CARBANAK June 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"
    },
    {
      "source_name": "BiZone Lizar May 2021",
      "url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
    },
    {
      "source_name": "FireEye FIN7 April 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
    },
    {
      "source_name": "FireEye FIN7 Aug 2018",
      "url": "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
    },
    {
      "source_name": "Secureworks GOLD NIAGARA Threat Profile",
      "url": "https://www.secureworks.com/research/threat-profiles/gold-niagara"
    },
    {
      "source_name": "FireEye FIN7 Shim Databases",
      "url": "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html"
    },
    {
      "source_name": "Morphisec FIN7 June 2017",
      "url": "http://blog.morphisec.com/fin7-attacks-restaurant-industry"
    },
    {
      "source_name": "ITG14"
    },
    {
      "source_name": "CrowdStrike Carbon Spider August 2021",
      "url": "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Microsoft Ransomware as a Service",
      "url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
    },
    {
      "source_name": "FireEye FIN7 March 2017",
      "url": "https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html"
    },
    {
      "source_name": "IBM Ransomware Trends September 2020",
      "url": "https://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/"
    }
  ]
}

Explicit source assertions (86)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1204.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--00561c3c-345e-4578-95c3-b7e0a95db7b1

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1553.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--081c68ae-de26-4ab4-9108-5c7493f34f43

FireEye CARBANAK June 2017 · FireEye FIN7 Aug 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0417

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08678e7f-c675-4f85-9593-f06cb90f6e44

CrowdStrike Carbon Spider August 2021 · Microsoft Ransomware as a Service · SecureList Griffon May 2019 · FBI Flash FIN7 USB

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08e70a50-f4fe-4856-9bd1-a7098f802fca

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0ea53e8d-743e-4828-8c65-9b610593270a

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1059

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1332e859-38be-45ed-9ebc-09efd7117c17

FireEye FIN7 Aug 2018 · Flashpoint FIN 7 March 2019 · FireEye FIN7 Aug 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--15d87b47-837d-4f62-9d78-4ec092c111d2

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--198a9aa2-5d98-46c2-b43b-0191786049e7

Microsoft Ransomware as a Service

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1027.016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--19ab4bf2-7498-4f53-afd7-fc1a99a96187

Mandiant FIN7 Apr 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1608.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f3d48af-f6e6-423b-8290-2386f13b766f

BlackBerry_FIN7_April2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1033

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f548074-df9e-4029-842b-7d774e2f1093

Mandiant FIN7 Apr 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1f7b17e9-9ad3-42dd-ab92-e3afe752247b

BlackBerry_FIN7_April2024 · FireEye FIN7 April 2017 · FireEye FIN7 Aug 2018 · Morphisec FIN7 June 2017 · Flashpoint FIN 7 March 2019

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0552

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--210b5693-f039-4853-a0ea-70b4fa3abed9

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1021.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f1588c1-16b9-4cb2-b94c-1756829183ae

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--306ab1b7-4926-43ae-8989-b0dde2a43111

BlackBerry_FIN7_April2024 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--331313a6-8f2d-46ef-939f-2688d06af86e

Gemini_FIN7_Jan2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1566.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--34319090-f87a-431b-a6c1-38d8494495b6

BlackBerry_FIN7_April2024 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37ba7858-8765-4445-a65e-d2765b673b34

Morphisec FIN7 June 2017

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1218.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3832d04e-41aa-456d-8104-b0a1fa2c12bb

Mandiant FIN7 Apr 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a30af61-b9b4-488e-aebc-dee4dfce52b6

eSentire FIN7 July 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1620

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3c01b9a0-b53f-45f1-a277-f1c0e5d088ed

Gemini_FIN7_Jan2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f0e6cfa-7edc-4eaa-bc03-754d0f46d605

FireEye FIN7 Aug 2018 · Flashpoint FIN 7 March 2019 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0648

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3f4ff91e-a279-4777-b362-a57b0c4c098b

CrowdStrike Carbon Spider August 2021 · Microsoft Ransomware as a Service

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1219

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42684416-c3f0-4668-9c86-77482740179e

Mandiant FIN7 Apr 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--42cedca0-2faf-47db-a2da-c81b430ace60

BlackBerry_FIN7_April2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4856de0a-2635-4081-97a8-3f15593c2aa5

BlackBerry_FIN7_April2024 · Mandiant FIN7 Apr 2022 · FireEye FIN7 April 2017 · Gemini_FIN7_Jan2022 · Morphisec FIN7 June 2017 · FBI Flash FIN7 USB

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0151

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--49d09bc3-cdc0-479b-8516-f64bff9b6757

FireEye FIN7 April 2017 · FireEye FIN7 Aug 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1572

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4c0cf71d-c000-46c5-a232-ea0e41a4b48a

BlackBerry_FIN7_April2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1546.011

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--506acc8a-e691-4f4e-b69f-bfab84cf2c73

FireEye FIN7 Shim Databases

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1559.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51afbe4e-c5cd-4acd-b4e1-ff7877b78b9e

CyberScoop FIN7 Oct 2017

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1069.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--51db2539-ad77-4fa1-8f54-2bb6ccf603df

BlackBerry_FIN7_April2024 · Mandiant FIN7 Apr 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--58dd2402-7b8a-4ed0-8fd3-7b9656b543b8

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1674

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c95135f-dbdf-4a9d-8fe0-3a489a171c58

Gemini_FIN7_Jan2022 · FBI Flash FIN7 USB

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1486

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5ed383c7-a4b7-441b-8f99-a9927689aea0

BlackBerry_FIN7_April2024 · Mandiant FIN7 Apr 2022 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5f0b2cd5-125e-4473-8623-5f5a7dc09caf

Mandiant FIN7 Apr 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1591

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--600d5767-1a78-4853-a152-a376b6a59239

BiZone Lizar May 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--619998d9-cbe8-40b1-ad0e-bc47f9c8037a

BlackBerry_FIN7_April2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1583.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64f76b74-cafc-4cf5-9c86-f7305fbaf61c

Mandiant FIN7 Apr 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0496

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--65adbdda-7069-40ed-9825-b79ec87e4916

CrowdStrike Carbon Spider August 2021 · Microsoft Ransomware as a Service · IBM Ransomware Trends September 2020 · FBI Flash FIN7 USB

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1497.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6aaf2c92-43a3-42f5-81ab-220c854607b0

FireEye FIN7 April 2017

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0194

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6afed42c-6a42-402a-8964-7fcde5435336

Mandiant FIN7 Apr 2022 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0488

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--707474c8-890d-4be2-81d5-f6a4902b1309

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1059.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72b1c4ab-81ca-47a4-a541-ceb44580c87b

FireEye FIN7 Aug 2018 · Flashpoint FIN 7 March 2019

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74859e2a-7a8f-4b87-b75c-7286b3de685c

FireEye FIN7 April 2017 · FireEye FIN7 Aug 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1608.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--75270994-ea95-4744-a383-056eb96ab50d

Mandiant FIN7 Apr 2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0030

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7577e14c-ceba-4646-98ce-41e7fa9ae851

BlackBerry_FIN7_April2024 · Mandiant FIN7 Apr 2022 · FireEye FIN7 Aug 2018 · DOJ FIN7 Aug 2018 · CrowdStrike Carbon Spider August 2021 · FireEye FIN7 March 2017 · IBM Ransomware Trends September 2020 · FBI Flash FIN7 USB

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--83ce1f0c-8afc-472d-af07-71b359d7781b

BlackBerry_FIN7_April2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8fa843c8-bd61-48a2-8c65-587f6d96e238

BlackBerry_FIN7_April2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1125

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--91926031-c1b4-462b-8597-20b10e7211ef

FireEye FIN7 Aug 2018 · DOJ FIN7 Aug 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1571

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--921b9a4d-091a-442b-981a-0b34daa2ed6a

BlackBerry_FIN7_April2024 · FireEye FIN7 Aug 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--94f5837a-6e62-4402-ad2e-b7ef7f3c60d9

Gemini_FIN7_Jan2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0517

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95d8ef7d-47b2-438d-921c-902dbb3467bb

Trustwave Pillowmint June 2020 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1027.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95fc970d-98cd-4bc9-895a-9534ba89c795

FireEye Obfuscation June 2017 · FireEye FIN7 Aug 2018 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9879a7e4-04b0-4cf2-a429-bad37bfd0741

BlackBerry_FIN7_April2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1204.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b9dad4a-c597-4979-9129-7753a7c3b3db

FireEye FIN7 April 2017 · eSentire FIN7 July 2021 · CrowdStrike Carbon Spider August 2021 · Crowdstrike_CarbonSpider_Part2_Nov2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ba9eff2-1471-4395-a2ed-2187aabd893b

BlackBerry_FIN7_April2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0154

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c61749d-ad78-476d-8cd6-ba4eafc8f74e

Mandiant FIN7 Apr 2022 · CrowdStrike Carbon Spider August 2021 · FBI Flash FIN7 USB

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1218.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9e77b81d-6298-4233-8baa-f419031a9d64

FireEye FIN7 April 2017

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1102.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ada291f4-524c-4400-9425-0936a03d4a41

FireEye FIN7 Aug 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0449

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--adfee22f-8471-4e82-b85c-21dcbb93ddde

Microsoft Ransomware as a Service

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b077d81d-0449-493f-9b93-23dc0fb0b62d

Mandiant FIN7 Apr 2022 · FireEye FIN7 April 2017 · DOJ FIN7 Aug 2018 · Gemini_FIN7_Jan2022

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1323523-7596-4cc2-bd31-34363e4e9b60

Microsoft Ransomware as a Service

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1591.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b304d2dd-a04a-4457-bc60-fadb58401e62

BlackBerry_FIN7_April2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0145

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b6eb09bc-fef4-4cf3-b337-dfe6bd87ca35

FireEye FIN7 March 2017

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1124

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b846a531-6945-45d6-86f1-7964645d2ef7

BlackBerry_FIN7_April2024

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1583.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba18e103-7479-4041-be39-4a78e0961d92

BlackBerry_FIN7_April2024 · eSentire FIN7 July 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc0ed7ce-f99f-4d88-a3cc-81af825f311a

CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bde512f7-afbb-4fe5-8df7-53a00bdadc79

FireEye FIN7 Aug 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1091

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c7697490-b9ad-45b9-9e69-ddc4a7a6d94c

Gemini_FIN7_Jan2022 · FBI Flash FIN7 USB

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1071.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca2a22df-7f99-497a-8f51-cf0180308305

FireEye FIN7 Aug 2018

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cbf95438-c89f-451f-9895-eaeb3fb65104

Mandiant FIN7 Apr 2022 · FireEye FIN7 Aug 2018 · Gemini_FIN7_Jan2022 · Flashpoint FIN 7 March 2019

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0416

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cc99be16-89cc-427a-b348-2236add3d816

FireEye FIN7 Oct 2019

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0390

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ceac12d5-3c40-42f6-a7df-0fa2e67bf1e8

Flashpoint FIN 7 March 2019

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1566.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf9e7512-c510-4605-9035-f60335c351f4

FireEye FIN7 April 2017 · DOJ FIN7 Aug 2018 · eSentire FIN7 July 2021 · CrowdStrike Carbon Spider August 2021 · Flashpoint FIN 7 March 2019

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0681

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d736ba76-c58b-4010-865e-68cd67fae4bf

Gemini FIN7 Oct 2021 · Threatpost Lizar May 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1608.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9a18216-bb4f-445a-92a9-abd99ba0609a

Mandiant FIN7 Apr 2022 · Cocomazzi FIN7 Reboot

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd9f1283-ff4b-4314-b7ce-f326d6932bab

Crowdstrike GTR2020 Mar 2020

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1558.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df3c2022-f649-45f5-a987-5ba7a766a058

Mandiant FIN7 Apr 2022 · CrowdStrike Carbon Spider August 2021

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:S0146

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e232f720-ab39-43f4-b419-ae8de115c5e6

FireEye FIN7 March 2017

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1195.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e814521c-211d-4db9-b637-dd13ccdfed92

Mandiant FIN7 Apr 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.