Threat feed IOCs (126)

Indicators from free threat feeds (abuse.ch ThreatFox, AlienVault OTX) attributed to FIN7. Each row shows why it was linked and where it came from.

Public research & publications (45)

Open-source reports about this actor collected from MISP Galaxy and MITRE ATT&CK.

• blog.morphisec.comhttp://blog.morphisec.com/fin7-attacks-restaurant-industry
• attack.mitre.orghttps://attack.mitre.org/groups/G0046
• bi-zone.medium.comhttps://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319
• learn.microsoft.comhttps://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide
• securityintelligence.comhttps://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/
• web.archive.orghttps://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
• crowdstrike.comhttps://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/
• fireeye.comhttps://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
• fireeye.comhttps://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
• fireeye.comhttps://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html
• fireeye.comhttps://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
• mandiant.comhttps://www.mandiant.com/resources/evolution-of-fin7
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
• secureworks.comhttps://www.secureworks.com/research/threat-profiles/gold-niagara
• attack.mitre.orghttps://attack.mitre.org/groups/G0008
• media.kasperskycontenthub.comhttps://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
• europol.europa.euhttps://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain
• fox-it.comhttps://www.fox-it.com/en/news/blog/anunak-aka-carbanak-update/
• secureworks.comhttps://www.secureworks.com/research/threat-profiles/gold-kingswood?filter=item-financial-gain
• en.wikipedia.orghttps://en.wikipedia.org/wiki/Carbanak
• app.box.comhttps://app.box.com/s/p7qzcury97tuwk26694uutujwqmwqyhe
• 2014.zeronights.ruhttp://2014.zeronights.ru/assets/files/slides/ivanovb-zeronights.pdf
• web.archive.orghttps://web.archive.org/web/20161223002016/https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks
• proofpoint.comhttps://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor
• icebrg.iohttps://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
• crowdstrike.comhttps://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/
• computerweekly.comhttps://www.computerweekly.com/news/252446153/Three-Carbanak-cyber-heist-gang-members-arrested
• group-ib.comhttps://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf
• attack.mitre.orghttps://attack.mitre.org/groups/G0008/
• fireeye.comhttps://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
• threatpost.comhttps://threatpost.com/fileless-malware-campaigns-tied-to-same-attacker/124369/
• blog.morphisec.comhttps://blog.morphisec.com/fin7-attacks-restaurant-industry
• flashpoint-intel.comhttps://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/
• blog.morphisec.comhttps://blog.morphisec.com/fin7-attack-modifications-revealed
• blog.morphisec.comhttps://blog.morphisec.com/fin7-not-finished-morphisec-spots-new-campaign
• securelist.comhttps://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/
• attack.mitre.orghttps://attack.mitre.org/groups/G0046/
• go.crowdstrike.comhttps://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
• threatintel.bloghttps://threatintel.blog/OPBlueRaven-Part1/
• threatintel.bloghttps://threatintel.blog/OPBlueRaven-Part2/
• computerweekly.comhttps://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous
• deepinstinct.comhttps://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape
• microsoft.comhttps://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/
• wired.comhttps://www.wired.com/story/fin7-carbanak-hacking-group-behind-a-string-of-big-breaches/
• cloud.google.comhttps://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/