CVE Intelligence
Home / Threat actors / FIN7

FIN7 G0046

🔔 Create alert

Also known as: GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

2
associated CVEs
80
Techniques
19
Malware and tools

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.

Ransomware operations linked to this group ransomware.live

maze via Mazerevil via REvil

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2021-31207 Medium · 6.6 KEV Ransomware Microsoft Exchange Server Security Feature Bypass Vulnerability
“FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange.”
CVE-2020-1472 Medium · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability
“FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.”

Techniques by tactic

Reconnaissance
T1591 Gather Victim Org InformationT1591.004 Identify Roles
Resource Development
T1583.001 DomainsT1583.006 Web ServicesT1587.001 MalwareT1588.002 ToolT1608.001 Upload MalwareT1608.004 Drive-by TargetT1608.005 Link Target
Initial Access
T1078 Valid AccountsT1078.003 Local AccountsT1091 Replication Through Removable MediaT1190 Exploit Public-Facing ApplicationT1195.002 Compromise Software Supply ChainT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link
Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059 Command and Scripting InterpreterT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1059.007 JavaScriptT1204.001 Malicious LinkT1204.002 Malicious FileT1559.002 Dynamic Data ExchangeT1569.002 Service ExecutionT1674 Input Injection
Persistence
T1053.005 Scheduled TaskT1078 Valid AccountsT1078.003 Local AccountsT1543.003 Windows ServiceT1546.011 Application ShimmingT1547.001 Registry Run Keys / Startup Folder
Privilege Escalation
T1053.005 Scheduled TaskT1078 Valid AccountsT1078.003 Local AccountsT1543.003 Windows ServiceT1546.011 Application ShimmingT1547.001 Registry Run Keys / Startup Folder
Stealth
T1027.010 Command ObfuscationT1027.016 Junk Code InsertionT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1078 Valid AccountsT1078.003 Local AccountsT1140 Deobfuscate/Decode Files or InformationT1218.005 MshtaT1218.011 Rundll32T1497.002 User Activity Based ChecksT1564.001 Hidden Files and DirectoriesT1564.003 Hidden WindowT1620 Reflective Code Loading
Defense Impairment
T1553.002 Code SigningT1686 Disable or Modify System Firewall
Credential Access
T1558.003 Kerberoasting
Discovery
T1033 System Owner/User DiscoveryT1057 Process DiscoveryT1069.002 Domain GroupsT1082 System Information DiscoveryT1087.002 Domain AccountT1124 System Time DiscoveryT1497.002 User Activity Based Checks
Lateral Movement
T1021.001 Remote Desktop ProtocolT1021.004 SSHT1021.005 VNCT1091 Replication Through Removable MediaT1210 Exploitation of Remote Services
Collection
T1005 Data from Local SystemT1113 Screen CaptureT1125 Video Capture
Command and Control
T1008 Fallback ChannelsT1071.004 DNST1102.002 Bidirectional CommunicationT1105 Ingress Tool TransferT1219 Remote Access ToolsT1571 Non-Standard PortT1572 Protocol Tunneling
Exfiltration
T1567.002 Exfiltration to Cloud Storage
Impact
T1486 Data Encrypted for Impact

Malware and tools

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.