Also known as: Carbanak, Carbon Spider, ELBRUS, Sangria Tempest, ITG14, Navigator Group, GrayAlpha, Savage Ladybug, Storm-0324, Storm-1674, Storm-1811, STAC5143, WaterSeed, UNC3319, Gold Niagara
Spearphishing Attachment
Send targeted emails with malicious file attachments to gain initial access.
Exploit Public-Facing Application
Exploit vulnerabilities in internet-facing applications to gain access.
Valid Accounts
Use legitimate credentials to authenticate and gain access.
Drive-by Compromise
Gain access through a user visiting a compromised website during normal browsing.
Spearphishing Link
Send targeted emails with malicious links to credential harvesting or exploit pages.
T1204.002
T1059.005
T1059.007
T1071.001
T1027.010
T1053.005
T1091
T1195.002
T1204.001
T1136.001
T1543.003
T1176
T1199
T1210
T1583.001
T1583.003
T1608.001
T1608.004
T1218.011
T1218.005
T1562.001
T1588.002
T1583.006
T1114.001
T1592.002
T1589.002
T1598.003
Signature backdoor used in billion-dollar bank heists. Provides full remote access to compromised banking systems including screen recording, keylogging, and ability to manipulate ATM/SWIFT transactions.
JavaScript-based backdoor delivered via spear-phishing. Lightweight initial access tool that profiles victims before deploying heavier Carbanak or Cobalt Strike payloads.
Multi-purpose backdoor with screenshot, keylogging, and file exfiltration capabilities. Used as primary implant in hospitality and restaurant sector attacks.
Point-of-sale (POS) RAM scraper that extracts credit card data from memory of payment processing applications. Deployed on POS terminals in restaurant chains.
Utility module that patches PowerShell processes in memory to bypass AMSI (Antimalware Scan Interface), allowing execution of malicious PowerShell scripts undetected.
PowerShell-based backdoor framework used for persistent access. Supports dynamic module loading and uses multiple layers of obfuscation to evade detection.
.NET-based downloader that retrieves and executes secondary payloads. Used as intermediary between initial spear-phishing access and deployment of main backdoors.
Primary post-exploitation framework. FIN7 uses heavily customized Cobalt Strike with unique malleable C2 profiles to evade network detection signatures.
Open-source penetration testing framework used alongside Cobalt Strike for exploitation, privilege escalation, and payload delivery.
Weaponized USB devices mailed to targets disguised as Best Buy gift cards or COVID-19 guidance. Emulate a keyboard to execute PowerShell commands on insertion.
Credential harvesting tool used to extract POS terminal credentials, domain admin hashes, and Kerberos tickets for lateral movement within retail networks.
Legitimate remote desktop software deployed for persistent access to compromised systems. Used as a fallback if primary C2 channels are disrupted.
Remote access tool deployed on compromised POS management servers. Provides hands-on-keyboard access for manual operations during heist execution.
Network discovery tool used to map internal networks after initial compromise, identifying POS terminals, domain controllers, and payment processing servers.
Central to FIN7 operations — used for fileless execution, AMSI bypass, payload staging, and lateral movement throughout compromised retail/restaurant networks.
Front companies established by FIN7 to recruit penetration testers who unknowingly developed offensive tools and conducted attacks on real targets.
Custom PowerShell-based loader deployed by GrayAlpha sub-cluster via fake software downloads
Batch file-based loader used by GrayAlpha for initial compromise via trojanized downloads
Automated platform for SQL injection attacks against public-facing web servers
EDR bypass tool designed to disable and evade endpoint detection and response solutions
Tunneling tool used for establishing persistent network access and lateral movement
Malware loader used to deploy additional payloads and maintain persistence
JavaScript-based backdoor providing remote access capabilities
Backdoor that uses SQL Server for command and control communications
Information stealer targeting credentials and sensitive data
Modular backdoor also known as Tirion, used for reconnaissance and data theft
JScript-based backdoor deployed via malicious LNK files in phishing campaigns
Legitimate Metasploit payload used by FIN7 for post-exploitation
Fileless backdoor that uses DNS queries for command and control communications
Custom loader used to execute shellcode and deploy additional malware
PowerShell-based backdoor for persistent access and command execution
Lightweight reconnaissance and execution backdoor deployed in initial compromise stages
PowerShell backdoor used for establishing persistence and executing commands
DNS tunneling backdoor used by FIN7 for covert command and control communications
Ransomware deployed by FIN7 in campaigns starting 2022
Legitimate remote administration tool abused for unauthorized access
Information stealer targeting credentials and sensitive data
Multi-stage loader used to deploy final payloads while evading detection
| Type | Value |
|---|---|
| domain | comfrede[.]com |
| domain | julopos[.]com |
| ip | 185[.]180[.]197[.]36 |
| ip | 91[.]219[.]236[.]166 |
| hash | fcc2e3e2a9a2a2bdd5a5e5c6c0e34f13 |
| domain | advanced-ip-sccanner[.]com |
| domain | myipscanner[.]com |
| hash | 2fc8b38d3f40d8151ec717c8a8813cf06df90c10 |
| ip | 38[.]180[.]138[.]251 |
| Domain / Host | Status |
|---|---|
comfrede[.]comC2 domain used in hospitality sector targeting | offline |
julopos[.]comC2 infrastructure for GRIFFON malware | offline |
185[.]180[.]197[.]36Carbanak C2 server infrastructure | offline |
91[.]219[.]236[.]166C2 node linked to POS malware operations | offline |
advanced-ip-sccanner[.]com | offline |
myipscanner[.]com | active |
Infrastructure data reflects monitoring status only — no raw fingerprint data is exposed.
MITRE ATT&CK - FIN7
https://attack.mitre.org/groups/G0046/
U.S. DOJ - Three Members of Notorious Cybercrime Group FIN7 Charged
https://www.justice.gov/opa/pr/three-members-notorious-international-cybercrime-group-fin7-custody-role-attacking-over-100
Mandiant - FIN7 Evolution and Ransomware
https://www.mandiant.com/resources/evolution-of-fin7
FIN7 Reboot - Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks
https://www.sentinelone.com/labs/fin7-reboot-cybercrime-gang-enhances-ops-with-new-edr-bypasses-and-automated-attacks/
GrayAlpha Unmasked: New FIN7-Linked Infrastructure, PowerNet Loader, and Fake Update Attacks
https://www.recordedfuture.com/research/grayalpha-uses-diverse-infection-vectors-deploy-powernet-loader-netsupport-rat
Threat Group FIN7 Targets the U.S. Automotive Industry
https://blogs.blackberry.com/en/2024/04/fin7-targets-the-united-states-automotive-industry
Microsoft: Notorious FIN7 hackers return in Clop ransomware attacks
https://www.bleepingcomputer.com/news/security/microsoft-notorious-fin7-hackers-return-in-clop-ransomware-attacks/
FIN7: Silent Push unearths 4000+ phishing and shell domains
https://www.silentpush.com/blog/fin7/
Threat hunting case study: Uncovering FIN7
https://www.intel471.com/blog/threat-hunting-case-study-uncovering-fin7
Financially motivated threat actors misusing App Installer
https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/
FIN7 Group Attributed to TAG-124 TDS and GrayAlpha Cluster Operations
https://www.sentinelone.com/labs/grayalpha-fin7-deploys-powernet-maskbat/
Microsoft Threat Intelligence: Sangria Tempest Shifts to Automated Attacks
https://www.microsoft.com/en-us/security/blog/2023/08/24/flax-typhoon-using-legitimate-software-to-quietly-access-taiwanese-organizations/
FIN7 Deploys Clop Ransomware in 2023 Campaign
https://www.bleepingcomputer.com/news/security/fin7-hackers-launch-darkside-ransomware-attacks/
FIN7 Evolution and Phishing Campaigns
https://www.mandiant.com/resources/blog/fin7-spear-phishing-campaign-targets-personnel
CISA Alert on FIN7 Tactics
https://www.cisa.gov/news-events/cybersecurity-advisories/aa20-266a
FIN7 Evolution and Phishing Campaigns - Mandiant
https://www.mandiant.com/resources/blog/fin7-power-automate-api
FIN7 Backdoor Malware Analysis - Morphisec
https://blog.morphisec.com/fin7-attacks-restaurant-industry
Carbanak Group Uses Signed Binaries - ESET Research
https://www.welivesecurity.com/2019/05/29/carbanak-group-false-flag-attack/
FIN7 Evolution and Phishing Campaigns (Recorded Future)
https://www.recordedfuture.com/fin7-revisited-detecting-new-tactics-and-tools
Sangria Tempest Targets Automotive Industry (Microsoft)
https://www.microsoft.com/en-us/security/blog/2024/01/17/new-ttps-observed-in-mint-sandstorm-campaign-targeting-high-profile-individuals-at-universities-and-research-orgs/
FIN7 Evolution and Phishing Campaigns - Recorded Future
https://www.recordedfuture.com/fin7-threat-analysis
FIN7 Group Uses Updated Techniques - CISA Alert
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-320a
FIN7 Deploys Anubis Backdoor to Hijack Windows Systems via Compromised SharePoint Sites
https://thehackernews.com/2025/04/fin7-deploys-anubis-backdoor-to-hijack.html
PRODAFT - Anubis Backdoor IOCs
https://github.com/prodaft/malware-ioc/blob/master/SavageLadybug/AnubisBackdoor.md
FIN7 Cybercrime Group Targeting U.S. Auto Industry with Carbanak Backdoor
https://thehackernews.com/2024/04/fin7-cybercrime-group-targeting-us-auto.html
Emulating the Criminal Adversary FIN7 - Part 2
https://www.attackiq.com/2025/02/14/emulating-fin7-part-2/
FIN7, FIN8, and Others Use Ragnar Loader for Persistent Access and Ransomware Operations
https://thehackernews.com/2025/03/fin7-fin8-and-others-use-ragnar-loader.html
Sophos MDR tracks two ransomware campaigns using email bombing, Microsoft Teams vishing
https://news.sophos.com/en-us/2025/01/21/sophos-mdr-tracks-two-ransomware-campaigns-using-email-bombing-microsoft-teams-vishing/
Malware distributor Storm-0324 facilitates ransomware access
https://www.microsoft.com/en-us/security/blog/2023/09/12/malware-distributor-storm-0324-facilitates-ransomware-access/
FIN7 Evolution and Phishing Campaigns 2021-2024
https://www.mandiant.com/resources/blog/fin7-pursuing-software-supply-chain
Microsoft Threat Intelligence on Sangria Tempest (FIN7)
https://www.microsoft.com/en-us/security/blog/2023/09/14/financially-motivated-threat-actors-misusing-app-installer
FIN7 Group Unveiled: A Deep Dive into a Notorious Cybercrime Syndicate
https://www.sentinelone.com/labs/fin7-returns-with-new-tricks/
Microsoft Threat Intelligence - Sangria Tempest
https://learn.microsoft.com/en-us/security/operations/threat-actors/fin7
CISA Alert: FIN7 Continues Targeting Multiple Sectors
https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-278a
FIN7 Evolution and the Phishing LNK
https://www.mandiant.com/resources/blog/fin7-evolution-and-phishing-lnk
FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7
https://www.mandiant.com/resources/blog/fin7-power-hour-adversary-archaeology
FIN7 Malware Delivery and the BlackBasta Ransomware Emerged
https://www.sentinelone.com/labs/from-fin7-to-clop-understanding-the-evolution-of-carbanak/
Microsoft Threat Intelligence: Sangria Tempest
https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming