FIN7

{
  "id": "ATTACK:ics:G0046",
  "title": "FIN7",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0046",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--3753cc21-2dae-4dfb-8481-d004e74502cc",
  "external_id": "G0046",
  "domain": "ics",
  "created": "2017-05-31T21:32:09.460Z",
  "modified": "2026-07-31T20:48:31.412Z",
  "version": "4.1",
  "aliases": [
    "FIN7",
    "GOLD NIAGARA",
    "ITG14",
    "Carbon Spider",
    "ELBRUS",
    "Sangria Tempest"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Carbon Spider"
    },
    {
      "source_name": "FIN7"
    },
    {
      "source_name": "ELBRUS"
    },
    {
      "source_name": "Sangria Tempest"
    },
    {
      "source_name": "GOLD NIAGARA"
    },
    {
      "source_name": "Mandiant FIN7 Apr 2022",
      "url": "https://www.mandiant.com/resources/evolution-of-fin7"
    },
    {
      "source_name": "FireEye CARBANAK June 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/06/behind-the-carbanak-backdoor.html"
    },
    {
      "source_name": "BiZone Lizar May 2021",
      "url": "https://bi-zone.medium.com/from-pentest-to-apt-attack-cybercriminal-group-fin7-disguises-its-malware-as-an-ethical-hackers-c23c9a75e319"
    },
    {
      "source_name": "FireEye FIN7 April 2017",
      "url": "https://www.fireeye.com/blog/threat-research/2017/04/fin7-phishing-lnk.html"
    },
    {
      "source_name": "FireEye FIN7 Aug 2018",
      "url": "https://www.fireeye.com/blog/threat-research/2018/08/fin7-pursuing-an-enigmatic-and-evasive-global-criminal-operation.html"
    },
    {
      "source_name": "Secureworks GOLD NIAGARA Threat Profile",
      "url": "https://www.secureworks.com/research/threat-profiles/gold-niagara"
    },
    {
      "source_name": "FireEye FIN7 Shim Databases",
      "url": "https://www.fireeye.com/blog/threat-research/2017/05/fin7-shim-databases-persistence.html"
    },
    {
      "source_name": "Morphisec FIN7 June 2017",
      "url": "http://blog.morphisec.com/fin7-attacks-restaurant-industry"
    },
    {
      "source_name": "ITG14"
    },
    {
      "source_name": "CrowdStrike Carbon Spider August 2021",
      "url": "https://www.crowdstrike.com/blog/carbon-spider-embraces-big-game-hunting-part-1/"
    },
    {
      "source_name": "Microsoft Threat Actor Naming July 2023",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/intelligence/microsoft-threat-actor-naming?view=o365-worldwide"
    },
    {
      "source_name": "Microsoft Ransomware as a Service",
      "url": "https://www.microsoft.com/en-us/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/"
    },
    {
      "source_name": "FireEye FIN7 March 2017",
      "url": "https://web.archive.org/web/20180808125108/https:/www.fireeye.com/blog/threat-research/2017/03/fin7_spear_phishing.html"
    },
    {
      "source_name": "IBM Ransomware Trends September 2020",
      "url": "https://securityintelligence.com/posts/ransomware-2020-attack-trends-new-techniques-affecting-organizations-worldwide/"
    }
  ]
}