Procedure examples

FIN7 has conducted broad phishing campaigns using malicious links. Additionally, FIN7 has sent spearphishing emails containing a typosquatted link to “ip-sccanner[.]com.”

FIN7 has exfiltrated stolen data to the MEGA file sharing site.

FIN7 has started the SSH service by executing `sc start sshd`.

FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2. FIN7 has used TCP ports 59999 and 9898 for firewall rules.

FIN7 has tunneled C2 traffic via OpenSSH.

FIN7 has registered look-alike domains for use in phishing campaigns. Additionally, FIN7 has registered a malicious domain as `advanced-ip-sccanner[.]com` that redirected to an adversary-controlled Dropbox which contained the malicious executable.

FIN7 has set up Amazon S3 buckets to host trojanized digital products.

FIN7 has developed malware for use in operations, including the creation of infected removable media.

FIN7 has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.

FIN7 has compiled a list of victims by filtering companies by revenue using Zoominfo, which is a service that provides business information.

FIN7 has identified IT staff and employees who had higher levels of administrative rights.

FIN7 has staged legitimate software, that was trojanized to contain an Atera agent installer, on Amazon S3. FIN7 has also used an open directory web server as a staging server for payloads and other tools, such as OpenSSH and 7zip.

FIN7 has compromised a digital product website and modified multiple download links to point to trojanized versions of offered digital products.

FIN7 has created a fake link that redirected to an adversary-controlled Dropbox that downloaded the malicious executable.

FIN7 has loaded a .NET assembly into the currect execution context via `Reflection.Assembly::Load`.

FIN7 has used malicious USBs to emulate keystrokes to launch PowerShell to download and execute malware from the adversary's server.

FIN7 has added a firewall rule to allow TCP port 59999 inbound and a rule to allow sshd.exe on TCP port 9898.