Início / Grupos de ameaça / FIN7

FIN7 G0046

🔔 Criar alerta

Também conhecido como: GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

2

CVEs associadas

80

Técnicas

19

Malwares e ferramentas

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.

Operações de ransomware ligadas a este grupo ransomware.live

maze via Maze revil via REvil

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2021-31207 Média · 6.6 KEV Ransomware Microsoft Exchange Server Security Feature Bypass Vulnerability

“FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange.”

CVE-2020-1472 Média · 5.5 KEV Ransomware Microsoft Netlogon Privilege Escalation Vulnerability

“FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.”

Técnicas por tática

Reconhecimento

T1591 Gather Victim Org Information T1591.004 Identify Roles

Desenvolvimento de recursos

T1583.001 Domains T1583.006 Web Services T1587.001 Malware T1588.002 Tool T1608.001 Upload Malware T1608.004 Drive-by Target T1608.005 Link Target

Acesso inicial

T1078 Valid Accounts T1078.003 Local Accounts T1091 Replication Through Removable Media T1190 Exploit Public-Facing Application T1195.002 Compromise Software Supply Chain T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059 Command and Scripting Interpreter T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1059.007 JavaScript T1204.001 Malicious Link T1204.002 Malicious File T1559.002 Dynamic Data Exchange T1569.002 Service Execution T1674 Input Injection

Persistência

T1053.005 Scheduled Task T1078 Valid Accounts T1078.003 Local Accounts T1543.003 Windows Service T1546.011 Application Shimming T1547.001 Registry Run Keys / Startup Folder

Escalada de privilégios

T1053.005 Scheduled Task T1078 Valid Accounts T1078.003 Local Accounts T1543.003 Windows Service T1546.011 Application Shimming T1547.001 Registry Run Keys / Startup Folder

Furtividade

T1027.010 Command Obfuscation T1027.016 Junk Code Insertion T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1078 Valid Accounts T1078.003 Local Accounts T1140 Deobfuscate/Decode Files or Information T1218.005 Mshta T1218.011 Rundll32 T1497.002 User Activity Based Checks T1564.001 Hidden Files and Directories T1564.003 Hidden Window T1620 Reflective Code Loading

Comprometimento de defesas

T1553.002 Code Signing T1686 Disable or Modify System Firewall

Acesso a credenciais

T1558.003 Kerberoasting

Descoberta

T1033 System Owner/User Discovery T1057 Process Discovery T1069.002 Domain Groups T1082 System Information Discovery T1087.002 Domain Account T1124 System Time Discovery T1497.002 User Activity Based Checks

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.004 SSH T1021.005 VNC T1091 Replication Through Removable Media T1210 Exploitation of Remote Services

Coleta

T1005 Data from Local System T1113 Screen Capture T1125 Video Capture

Comando e controle

T1008 Fallback Channels T1071.004 DNS T1102.002 Bidirectional Communication T1105 Ingress Tool Transfer T1219 Remote Access Tools T1571 Non-Standard Port T1572 Protocol Tunneling

Exfiltração

T1567.002 Exfiltration to Cloud Storage

Impacto

T1486 Data Encrypted for Impact

Malwares e ferramentas

BOOSTWRITEMalwareS0415
CarbanakMalwareS0030
Cobalt StrikeMalwareS0154
GRIFFONMalwareS0417
HALFBAKEDMalwareS0151
JSS LoaderMalwareS0648
LizarMalwareS0681
MazeMalwareS0449
PillowmintMalwareS0517
POWERSOURCEMalwareS0145
RDFSNIFFERMalwareS0416
REvilMalwareS0496
SQLRatMalwareS0390
SystemBCMalwareS9001
TEXTMATEMalwareS0146
AdFindFerramentaS0552
CrackMapExecFerramentaS0488
MimikatzFerramentaS0002
PowerSploitFerramentaS0194

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.