FIN7

FIN7 has used application shim databases for persistence.^[12]

FIN7 has created a scheduled task named "AdobeFlashSync" to establish persistence.^[13]

FIN7 has gained initial access by compromising a victim's software supply chain.^[6]

FIN7 created new Windows services and added them to the startup directories for persistence.^[4]

FIN7 malware has created Registry Run and RunOnce keys to establish persistence, and has also added items to the Startup folder.^[2][4]

FIN7 has performed C2 using DNS via A, OPT, and TXT records.^[4]

FIN7 has developed malware for use in operations, including the creation of infected removable media.^[15][18]

FIN7 has staged legitimate software, that was trojanized to contain an Atera agent installer, on Amazon S3.^[6]

FIN7 has used the command net group "domain admins" /domain to enumerate domain groups.^[6]

FIN7 has used random junk code to obfuscate malware code.^[6]

FIN7 has used malicious links to lure victims into downloading malware.^[5]

FIN7 has used Kerberoasting PowerShell commands such as, Invoke-Kerberoast for credential access and to enable lateral movement.^[5][6]

FIN7 has used mshta.exe to execute VBScript to execute malicious code on victim systems.^[2]

FIN7 used legitimate services like Google Docs, Google Scripts, and Pastebin for C2.^[4]

FIN7 has registered look-alike domains for use in phishing campaigns.^[11]

FIN7 has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.^[6]

FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.^[2]

FIN7 spear phishing campaigns have included malicious Word documents with DDE execution.^[20]

FIN7 has used RDP to move laterally in victim environments.^[5]

FIN7 has exfiltrated stolen data to the MEGA file sharing site.^[5]

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.^{[2][17][14][11][5]}

FIN7 malware has created scheduled tasks to establish persistence.^{[2][13][4][14]}

FIN7 has signed Carbanak payloads with legally purchased code signing certificates. FIN7 has also digitally signed their phishing documents, backdoors and other staging tools to bypass security controls.^[3][4]