FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.1234567
- FireEye FIN7 March 2017
- FireEye FIN7 April 2017
- FireEye CARBANAK June 2017
- FireEye FIN7 Aug 2018
- CrowdStrike Carbon Spider August 2021
- Mandiant FIN7 Apr 2022
- BiZone Lizar May 2021
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1204.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1553.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.016 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1620 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1219 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.011 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1559.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1674 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1569.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.006 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1497.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.007 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1686 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1125 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1571 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1057 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1218.005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1591.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1124 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1583.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1543.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1091 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.004 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1608.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1008 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1558.003 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1195.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1113 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1567.002 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1210 | 2017 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2017 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1005 | Data from Local System | — |
| T1008 | Fallback Channels | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.004 | SSH | — |
| T1021.005 | VNC | — |
| T1027.010 | Command Obfuscation | — |
| T1027.016 | Junk Code Insertion | — |
| T1033 | System Owner/User Discovery | — |
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1047 | Windows Management Instrumentation | — |
| T1053.005 | Scheduled Task | — |
| T1057 | Process Discovery | — |
| T1059 | Command and Scripting Interpreter | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1059.007 | JavaScript | — |
| T1069.002 | Domain Groups | — |
| T1071.004 | DNS | — |
| T1078 | Valid Accounts | — |
| T1078.003 | Local Accounts | — |
| T1082 | System Information Discovery | — |
| T1087.002 | Domain Account | — |
| T1091 | Replication Through Removable Media | — |
| T1102.002 | Bidirectional Communication | — |
| T1105 | Ingress Tool Transfer | — |
| T1113 | Screen Capture | — |
| T1124 | System Time Discovery | — |
| T1125 | Video Capture | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1195.002 | Compromise Software Supply Chain | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1210 | Exploitation of Remote Services | — |
| T1218.005 | Mshta | — |
| T1218.011 | Rundll32 | — |
| T1219 | Remote Access Tools | — |
| T1486 | Data Encrypted for Impact | — |
| T1497.002 | User Activity Based Checks | — |
| T1543.003 | Windows Service | — |
| T1546.011 | Application Shimming | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1553.002 | Code Signing | — |
| T1558.003 | Kerberoasting | — |
| T1559.002 | Dynamic Data Exchange | — |
| T1564.001 | Hidden Files and Directories | — |
| T1564.003 | Hidden Window | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1567.002 | Exfiltration to Cloud Storage | — |
| T1569.002 | Service Execution | — |
| T1571 | Non-Standard Port | — |
| T1572 | Protocol Tunneling | — |
| T1583.001 | Domains | — |
| T1583.006 | Web Services | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1591 | Gather Victim Org Information | — |
| T1591.004 | Identify Roles | — |
| T1608.001 | Upload Malware | — |
| T1608.004 | Drive-by Target | — |
| T1608.005 | Link Target | — |
| T1620 | Reflective Code Loading | — |
| T1674 | Input Injection | — |
| T1686 | Disable or Modify System Firewall | — |
别名
Carbon Spider · ELBRUS · FIN7 · GOLD NIAGARA · ITG14 · Sangria Tempest
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。