FIN7

Actor Type Criminal Group
Affiliated Intrusion Sets ALPHV Blackcat Ransomware Group

FIN7 is a criminal, financially motivated group which Mandiant has tracked since 2015 and which shows overlaps with the Carbanak Group.

The group has targeted over 100 organizations, initially focusing on stealing payment card data. Their operations subsequently extended beyond card data theft, including attacks on finance departments within victim organizations. In April 2017, they sent spear-phishing emails to personnel involved in United States Securities and Exchange Commission (SEC) filings, indicating an interest in material non-public information for potential stock trading advantage.

Their innovation and social engineering prowess have allowed them to impact diverse industries, including restaurants, travel, hospitality, education, casinos, gaming, construction, energy, retail, finance, telecommunications, high-tech, government, software, and business services.

Over time, their TTPs have evolved and more recent reporting has linked the group to ransomware intrusions.

Cyber Threat Graph Context

Explore how this Intrusion Set relates to the wider threat graph

FIN7 Threat Reports

Report

Threat Group FIN7 Targets the U.S. Automotive Industry

In late 2023, BlackBerry analysts discovered a targeted attack by FIN7 on a U.S. automotive manufacturer, exploiting IT employees with higher ...

View Source

References

MITRE ATT&CK Techniques

MITRE ATT&CK techniques observed in use by this intrusion set.