# FIN7: threat group profile

> FIN7 is a threat group thought to operate from Russia. Public reporting links it to 38 attack techniques. This free profile shows how it works, stage by stage, so you can judge the risk to you. It lists the other names the group goes by and links to every public report behind it.

Canonical page: https://www.edgeprotect.io/threat-actors/fin7
Breadcrumb: [Home](https://www.edgeprotect.io/) > [Threat groups](https://www.edgeprotect.io/threat-actors) > FIN7

## At a glance

| Fact | Value |
|---|---|
| Attack techniques | 38 (plus 37 sub-techniques) |
| Thought to operate from | Russia |
| Other names | 12 |
| Public reports | 31 |

## Who is FIN7?

FIN7 is a threat group thought to operate from Russia. Public reporting links it to 38 attack techniques.

### Also known as

CARBON SPIDER, GOLD NIAGARA, Calcium, ATK32, G0046, G0008, Coreid, Carbanak, Sangria Tempest, ELBRUS, Carbon Spider, JokerStash

Security companies each give the same group their own name, so one group can have many.

### What public reporting says

> Groups targeting financial organizations or people with significant financial assets.

## How does FIN7 attack? Stage by stage

Each technique is a known way attackers research, get in, stay hidden or do damage. Here are the 38 linked to FIN7. Some techniques belong to more than one stage. Public reporting also lists 37 more specific variations of them, called sub-techniques.

### 1. Research (0)

- None linked in public reporting.

### 2. Preparation (4)

- T1583: Acquire Infrastructure
- T1587: Develop Capabilities
- T1588: Obtain Capabilities
- T1608: Stage Capabilities

### 3. Getting in (5)

- T1078: Valid Accounts
- T1091: Replication Through Removable Media
- T1190: Exploit Public-Facing Application
- T1195: Supply Chain Compromise
- T1566: Phishing

### 4. Running code (5)

- T1047: Windows Management Instrumentation
- T1053: Scheduled Task/Job
- T1059: Command and Scripting Interpreter
- T1204: User Execution
- T1559: Inter-Process Communication

### 5. Staying in (5)

- T1053: Scheduled Task/Job
- T1078: Valid Accounts
- T1543: Create or Modify System Process
- T1546: Event Triggered Execution
- T1547: Boot or Logon Autostart Execution

### 6. Taking control (5)

- T1053: Scheduled Task/Job
- T1078: Valid Accounts
- T1543: Create or Modify System Process
- T1546: Event Triggered Execution
- T1547: Boot or Logon Autostart Execution

### 7. Hiding (5)

- T1027: Obfuscated Files or Information
- T1036: Masquerading
- T1078: Valid Accounts
- T1218: System Binary Proxy Execution
- T1497: Virtualization/Sandbox Evasion

### 8. Disabling defences (1)

- T1553: Subvert Trust Controls

### 9. Stealing passwords (1)

- T1558: Steal or Forge Kerberos Tickets

### 10. Looking around (3)

- T1033: System Owner/User Discovery
- T1069: Permission Groups Discovery
- T1497: Virtualization/Sandbox Evasion

### 11. Spreading (3)

- T1021: Remote Services
- T1091: Replication Through Removable Media
- T1210: Exploitation of Remote Services

### 12. Gathering data (3)

- T1005: Data from Local System
- T1113: Screen Capture
- T1125: Video Capture

### 13. Keeping contact (6)

- T1008: Fallback Channels
- T1071: Application Layer Protocol
- T1102: Web Service
- T1105: Ingress Tool Transfer
- T1219: Remote Access Tools
- T1571: Non-Standard Port

### 14. Taking data out (1)

- T1567: Exfiltration Over Web Service

### 15. Causing damage (1)

- T1486: Data Encrypted for Impact

## Public reports about FIN7

- https://en.wikipedia.org/wiki/Carbanak
- https://app.box.com/s/p7qzcury97tuwk26694uutujwqmwqyhe
- http://2014.zeronights.ru/assets/files/slides/ivanovb-zeronights.pdf
- https://web.archive.org/web/20161223002016/https://www.symantec.com/connect/blogs/odinaff-new-trojan-used-high-level-financial-attacks
- https://www.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unleashes-bateleur-jscript-backdoor
- https://www.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
- https://www.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-group/
- https://www.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-bank-robbery-arrested-in-spain
- https://www.computerweekly.com/news/252446153/Three-Carbanak-cyber-heist-gang-members-arrested
- https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_APT_eng.pdf
- https://www.group-ib.com/resources/threat-research/Anunak_APT_against_financial_institutions.pdf
- https://attack.mitre.org/groups/G0008/
- https://www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html
- https://threatpost.com/fileless-malware-campaigns-tied-to-same-attacker/124369/
- https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html
- https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html
- https://blog.morphisec.com/fin7-attacks-restaurant-industry
- https://www.flashpoint-intel.com/blog/fin7-revisited-inside-astra-panel-and-sqlrat-malware/
- https://blog.morphisec.com/fin7-attack-modifications-revealed
- https://blog.morphisec.com/fin7-not-finished-morphisec-spots-new-campaign
- https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/
- https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html
- https://attack.mitre.org/groups/G0046/
- https://go.crowdstrike.com/rs/281-OBQ-266/images/Report2020CrowdStrikeGlobalThreatReport.pdf
- https://threatintel.blog/OPBlueRaven-Part1/
- https://threatintel.blog/OPBlueRaven-Part2/
- https://www.secureworks.com/research/threat-profiles/gold-niagara
- https://www.computerweekly.com/news/252525240/ALPHV-BlackCat-ransomware-family-becoming-more-dangerous
- https://www.deepinstinct.com/blog/understanding-the-windows-javascript-threat-landscape
- https://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/
- https://www.wired.com/story/fin7-carbanak-hacking-group-behind-a-string-of-big-breaches/

## Frequently asked questions

### Who is FIN7?

FIN7 is a threat group thought to operate from Russia. Public reporting links it to 38 attack techniques.

### Where is FIN7 thought to be based?

Public reporting places FIN7 as operating from Russia. Attribution is never certain: it rests on the tools, infrastructure and targets researchers have seen.

### How does FIN7 attack?

Public reporting links FIN7 to 38 attack techniques. Most of them are about keeping contact, getting in and running code.

### How do I know if FIN7 is a risk to my business?

Create an account and tell us the software you run. We match it against known flaws, including those linked to threat groups, rank each one from 0 to 100 and tell you as soon as we spot something that affects you.

## Check whether it matters to your business

A free EdgeProtect account (no card needed) matches the software you run against known flaws, including those linked to threat groups, ranks each one from 0 to 100 and tells you as soon as we spot something that affects you. It also shows which threat groups and ransomware gangs are hitting your sector, with profiles of over 900 groups and a PDF dossier for each.

- Start free: https://www.edgeprotect.io/register
- Book a demo: https://www.edgeprotect.io/contact