FIN7Threat actor

“The longest documented gap was a FIN7 domain detected 305 days before it reached the customer’s SIEM.”

“documented similar campaigns with links to Black Basta and FIN7  in January of 2025.”

“…btle, that—Stark Industries quickly became infrastructure-of-choice for DDoS campaigns, disinformation operations, and threat actors like FIN7.”

“Further research uncovered connections with various ransomware families (for example Trickbot, Nokoyawa, Royal, Ryuk, FIN7, ALPHV, and Cl0p).”

“In January 2021, a Joker’s Stash owner with the username JokerStash announced that their platform for selling bank card data was closing.”

“This technique was used by notorious Carbanak/FIN7 for persistence.”

“For example, the group’s first attacks misled experts, who discovered the use of DNS Messenger, commonly associated with the group FIN7.”

“Financially motivated APT groups which focus efforts on targeted attacks on the financial sector such as — Anunak, Corkow, Buhtrap — usually managed botnets using developed or modified banking Trojans.”

“… possibility that the remaining members of the Cobalt group were conducting a joint operation with other criminal groups, in particular, Anunak.”

“The basic principles of targeted attacks on financial institutions have not changed since 2013 when the Anunak, Corkow, Buhtrap, and Lurk groups began conducting the first attacks on Russian banks.”

“In 2014, there were only two known hacker groups, Anunak and Corkow, which conducted targeted attacks, whereas in 2015 there were three (Anunak, Corkow and Andromeda), and in 2016 four of them (Buhtrap, Lurk, Cobalt and MoneyTaker).”