The notorious FIN7 hackers return in Clop ransomware attacks

Last month, a cybercriminal syndicate known as FIN7 resurfaced, with analysis indicating that the group is linked to attacks where the ultimate goal is to deploy Clop ransomware payloads on victims' networks.

The financially motivated cybercrime group Sangria Tempest (ELBRUS, FIN7) has emerged from a long period of inactivity. The group was observed deploying Clop ransomware in opportunistic attacks in April 2023, marking its first ransomware campaign since late 2021.

In these recent attacks, FIN7 threat actors leveraged the PowerShell-based POWERTRASH in-memory malware loader to deploy the Lizar post-exploitation tool on compromised devices.

This allowed the attackers to gain a foothold in target networks and move laterally to deploy Clop ransomware using OpenSSH and Impacket. This legitimate Python toolkit can also be used for remote service execution and relay attacks.

Clop ransomware is said to be just the latest payload used by the cybercriminal syndicate to target its victims.

The group was previously associated with REvil and Maze ransomware, following their involvement in the now-defunct BlackMatter and DarkSide Ransomware-as-a-Service (RaaS) operations.

▍FIN7 Tools Used in PaperCut Attacks

Other reports have also linked FIN7 to attacks targeting PaperCut print servers using Clop, Bloody, and LockBit ransomware.

Microsoft detected the financial crime group it tracks as FIN11, as Lace Tempest was found to be using new tools, including the company's inv.ps1 PowerShell script linked to FIN7.

The script was used to deploy FIN7's Lizar post-exploitation toolkit, suggesting that operators of the two threat groups have likely joined forces recently or are sharing their attack tools.

▍A Wily and Deeply Entrenched Hacker Group

Since beginning operations in 2013, the financially motivated FIN7 hacker group has been linked to attacks primarily targeting PoS terminals of banks and companies in various sectors (mostly restaurants, gaming, and hospitality) in Europe and the United States.

The FBI has previously warned US companies about USB drive attacks used by FIN7 targeting the US defense industry, where packages contained malicious USB devices designed to deploy ransomware.

FIN7 operators also impersonated Best Buy to carry out similar attacks against hotels, restaurants, and retail businesses using malicious flash drives sent via USPS, with packages also bundled with teddy bears to trick targets into lowering their guard.

Despite the arrests of several FIN7 members over the years, this new wave of attacks proves that the hacking group remains active and strong.

In April 2022, FIN7 "penetration tester" Denys Iarmak was sentenced to 5 years in prison for cyber penetration and credit card theft attacks that lasted for at least two years.

Iarmak is the third FIN7 member to be sentenced in the US, following Andrii Kolpakov (another "penetration tester") who was sentenced to seven years in prison in June 2021, and Fedir Hladyr (a senior manager) who was sentenced to ten years in prison in April 2021.

It has been proven that these hacking groups possess resilient survival capabilities, ready to launch attacks at any time, and legal sanctions can hardly dismantle their influence. SecurityVerify always advises enterprises to adopt proactive defensive measures, conducting security validation before attacks arrive to identify and timely optimize vulnerabilities in their security defense systems.

The SecurityVerify attack simulation library already contains the attack methods of the FIN7 group and Clop ransomware. You can search for the keywords "FIN7" and "Clop" in the SecurityVerify platform to obtain relevant attack simulation experiments, thereby verifying whether your security defense system can effectively counter various attack techniques used by this group.