FIN7
Long-running financially-motivated crew historically tied to the Carbanak intrusion set. Initially targeted point-of-sale systems in the U.S. hospitality and retail sectors (300+ companies, 1,000+ locations breached per DOJ). After three operator arrests in 2018 the group reconstituted and pivoted into ransomware affiliate work, including operating its own short-lived DarkSide-derived brand. Used elaborate fake-company personas to recruit unwitting pen-testers.
Aliases
Motivations
Target sectors
Target countries
Diamond Model
Caltagirone / Pendergast / Betz 2013 — four-vertex attribution framework.
- FIN7
- Unknown
- financial gain
- retail
- hospitality
- financial
- US
- GB
- +1 more
MITRE ATT&CK techniques
Tools & malware
3 entriesTimeline
4 events- ReportMedium2024-07-17·SentinelOne
SentinelLabs ties AvNeutralizer EDR-killer to FIN7 and multiple RaaS gangs
SentinelLabs reported that FIN7 had been developing and marketing the 'AvNeutralizer' (a.k.a. AuKill) EDR-tampering tool on Russian-language criminal forums since at least April 2022, abusing the Windows ProcLaunchMon.sys driver to disable endpoint protection. The tool was observed in intrusions deploying AvosLocker, MedusaLocker, BlackCat, and LockBit ransomware, underlining FIN7's shift from operating its own POS-fraud crews toward enabling other ransomware affiliates.
edr-bypasstoolingransomware-affiliate - ReportHigh2023-12-28·Microsoft Security Response Center
Microsoft links Sangria Tempest (FIN7) to Clop ransomware deployment via App Installer abuse
Microsoft Threat Intelligence reported that Sangria Tempest (ELBRUS / Carbon Spider / FIN7) was abusing the ms-appinstaller URI scheme to distribute the EugenLoader downloader, which in turn delivered the Carbanak backdoor and Gracewire malware as precursors to human-operated ransomware. Microsoft tied the activity to Sangria Tempest's April 2023 Clop ransomware campaign, the group's first ransomware operation since late 2021.
ransomware-affiliatecloploader - IndictmentHigh2018-08-01·Federal Bureau of Investigation
DOJ unseals indictments against three FIN7 leaders
DOJ unsealed indictments in the Western District of Washington against Ukrainian nationals Dmytro Fedorov, Fedir Hladyr, and Andrii Kolpakov, all alleged to be senior members of FIN7. The 26-count indictment charged conspiracy, wire fraud, computer intrusion, access-device fraud, and aggravated identity theft tied to the theft of more than 15 million payment-card records from over 6,500 POS terminals at 3,600 U.S. business locations. FIN7 ran a sham penetration-testing firm, 'Combi Security,' to recruit operators.
dojindictmentcarbanakpos - ReportInfo2017-05-01·MITRE ATT&CK
MITRE ATT&CK catalogs FIN7 as financially-motivated intrusion set
MITRE ATT&CK published its FIN7 group profile (G0046), tracking the financially-motivated cluster active since at least 2013 against U.S. retail, restaurant, and hospitality targets. The profile records aliases including GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, and Microsoft's later 'Sangria Tempest' designation, and links FIN7 to the CARBANAK backdoor (S0030), GRIFFON, POWERSOURCE, and the Lizar/Diceloader implant.
attributionmitrecarbanak
Indicators of compromise
2 indicators| Type | Value | First seen | Source |
|---|---|---|---|
| Name | family · POWERSOURCE PowerShell-based downloader (a.k.a. heavily modified DNSMessenger) tracked by MITRE ATT&CK as S0145 and attributed to FIN7. Used as a first-stage stager in 2017-era FIN7 phishing campaigns to retrieve the TEXTMATE and Carbanak follow-on payloads. | Jan 31, 2017 | MITRE ATT&CK |
| Name | family · Carbanak Full-featured remote backdoor family (a.k.a. Anunak) catalogued by MITRE ATT&CK as S0030 and historically attributed to the Carbanak group (G0008) and FIN7 (G0046). Used by FIN7 as part of post-exploitation toolchains delivered via POWERTRASH / EugenLoader. | Nov 30, 2014 | MITRE ATT&CK |
Related actors
shared ATT&CK techniques- ?? · UnknownBlackSuit2 shared techniques
- RU · RussiaEvil Corp2 shared techniques
- KP · DPRKLazarus Group2 shared techniques
- RU · Russia8Base1 shared technique
- ?? · UnknownAkira1 shared technique
- ?? · UnknownALPHV/BlackCat1 shared technique
References
cite this page
Threat Intel Tracker. (2026-05-19). FIN7 — actor profile. Retrieved from https://threatintel.local/actors/fin7