Fin7 Ramps Up Campaigns With Two Fresh Malware Samples

guest · Mar 20, 2019

Fin7 Ramps Up Campaigns With Two Fresh Malware Samples
March 20, 2019
https://threatpost.com/fin7-ramps-up-campaigns-with-two-fresh-malware-samples/142975/

Despite the arrest of several Fin7 members in 2018, the cybercrime group has ramped up its efforts in a series of widespread campaigns hitting businesses with two never-before-seen malware samples.

“Despite the arrests of three prominent members of the Fin7 cybercrime gang beginning in January 2018, attacks targeting businesses and customer payment-card information did not cease,” Flashpoint Principal Threat Researchers Joshua Platt and Jason Reaves said in a Wednesday analysis.
New Malware, Attack Panel
The group is using a new attack panel, called Astra, which has its back end installed on a Windows server with Microsoft SQL. [...] The attack panel was found being used in a series of campaigns, which typically initially infects machines through phishing emails containing malicious attachments.

“The campaigns maintain persistence on machines by creating two daily scheduled task entries,” researchers said. “The code, meanwhile, is still controlled by the Fin7 actors and may be leveraged in future attacks by the group.”
Click to expand...

Minimalist · May 8, 2019

FIN7.5: the infamous cybercrime rig “FIN7” continues its activities

On August 1, 2018, the US Department of Justice announced that it had arrested several individuals suspected of having ties to the FIN7 cybercrime rig. FIN7 operations are linked to numerous intrusion attempts having targeted hundreds of companies since at least as early as 2015. Interestingly, this threat actor created fake companies in order to hire remote pentesters, developers and interpreters to participate in their malicious business. The main goal behind its malicious activities was to steal financial assets from companies, such as debit cards, or get access to financial data or computers of finance department employees in order to conduct wire transfers to offshore accounts.

In 2018-2019, researchers of Kaspersky Lab’s Global Research and Analysis Team analyzed various campaigns that used the same Tactics Tools and Procedures (TTPs) as the historic FIN7, leading the researchers to believe that this threat actor had remained active despite the 2018 arrests. In addition, during the investigation, we discovered certain similarities to other attacker groups that seemed to share or copy the FIN7 TTPs in their own operations.
Click to expand...

https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/

guest · Oct 10, 2019

Notorious FIN7 crooks have new malicious code up their sleeves
October 10, 2019
https://www.cyberscoop.com/fin7-fireeye-new-malware/

Cybersecurity researchers have discovered two new tools used by a prolific hacking group known as FIN7, highlighting how, despite a law enforcement crackdown, the group appears to be thriving and making a lot of money in the process.

The Eastern European hacking crew, which researchers say has stolen over $1 billion from victims in recent years, is using a new “dropper” to deliver its malicious code, as well as a payload that tampers with a remote IT administration tool, cybersecurity company FireEye said Thursday.
One of the new FIN7 tools is designed to manipulate a remote software tool used to manage systems in the payment card industry. The malware allows the crooks to “monitor and tamper with legitimate connections” made by the remote administration software, which is made by IT company NCR Corp, FireEye said.

The news is the latest sign that FIN7 is resurgent after a period of relative quiet in late 2018 and early 2019.
Click to expand...

FireEye: Mahalo FIN7: Responding to the Criminal Operators’ New Tools and Techniques

During several recent incident response engagements, FireEye Mandiant investigators uncovered new tools in FIN7’s malware arsenal and kept pace as the global criminal operators attempted new evasion techniques. In this blog, we reveal two of FIN7’s new tools that we have called BOOSTWRITE and RDFSNIFFER.
Click to expand...

guest · Dec 27, 2019

FIN7 Hackers' BIOLOAD Malware Drops Fresher Carbanak Backdoor
December 27, 2019
https://www.bleepingcomputer.com/ne...load-malware-drops-fresher-carbanak-backdoor/

Malware researchers have uncovered a new tool used by the financially-motivated cybercriminal group known as FIN7 to load fresher builds of the Carbanak backdoor.
Dubbed BIOLOAD, the malware loader has a low detection rate and shares similarities with BOOSTWRITE, another loader recently identified to be part of FIN7's arsenal.
Abusing legitimate Windows methods
The malware relies on a technique called binary planting that abuses a method used by Windows to search for DLLs required to load into a program. An attacker can thus increase privileges on the system or achieve persistence.
Similar to newer FIN7 loader
According to Fortinet's analysis, the BIOLOAD samples were compiled in March and July 2019, while BOOSTWRITE's date is from May.
Despite the nine-month compilation date, BIOLOAD’s detection is largely undetected. At the time of writing, only nine out of 68 antivirus engines on VirusTotal scanning platform recognize the WinBio.dll as malicious.
As for the payload dropped on compromised systems, it is a newer version of the Carbanak backdoor, with timestamps from January and April 2019.
Click to expand...

Based on code similarities, techniques and backdoor used, Fortinet attributes BIOLOAD to the FIN7 cybercrime group. Based on the malware compilation dates and its behavior, the researchers believe that this loader is a precursor of BOOSTWRITE.

The malware identified by the researchers shows that FIN7 is actively developing tools to drop their backdoors. While BIOLOAD was used to load Carbanak on an infected host, the more recent BOOSTWRITE loader was used to also deliver RDFSNIFFER, a remote access tool "to hijack instances of the NCR Aloha Command Center Client application and interact with victim systems via existing legitimate 2FA sessions."
Click to expand...

Fortinet: Introducing BIOLOAD: FIN7 BOOSTWRITE’s Lost Twin

guest · Jan 6, 2021

Researchers Disclose Details of FIN7 Hacking Group's Malware
Report Dissects JSSLoader Remote Access Trojan
January 5, 2021
https://www.databreachtoday.com/researchers-disclose-details-fin7-hacking-groups-malware-a-15703

Researchers at Morphisec Labs have published fresh details about a malware variant called JSSLoader that the FIN7 hacking group has used for several years.

Although FIN7 is suspected of using JSSLoader during several campaigns, details about the malware have been elusive. During a failed attack in December, however, the Morphisec researchers recovered a version of this remote access Trojan, which is written in the .NET programming language.

"Though JSSLoader is well known as a minimized .NET RAT, not many details have been publicly available with respect to various capabilities such as exfiltration, persistence, auto-update, malware downloading and more," the researchers note in their analysis. "Furthermore, in the many occasions where JSSLoader is mentioned, there are few details on the complete attack chain."
Click to expand...

Attack Analysis
After the unsuccessful attack in December, the Morphisec researchers examined how FIN7 uses JSSLoader as part of its campaigns. The attack starts with a phishing email that downloads a VBScript, according to the report.
A second VBScript is then downloaded into the infected device's memory, which then attempts to download and install the main JSSLoader payload, the report notes.

The researchers also note that JSSLoader connects to a command-and-control server hosted by a company called "FranTech Solutions" that's been used by the FIN7 group.
Click to expand...

Morphisec: The Evolution of the FIN7 JSSLoader

Morphisec Labs has been tracking FIN7 (Carbanak Group) activity for the past several years. Morphisec’s ability to collect rich forensic data from memory has provided unique visibility into multiple FIN7 campaigns that our researchers were proud to share with MITRE and the InfoSec community at large.
Click to expand...

Minimalist · Jun 22, 2021

FIN7 scammers posed as SEC officials, sick restaurant customers to hack victims

A hacking group known for innovative fraud techniques impersonated angry restaurant customers and targeted specific individuals with unique access to financial information, U.S. prosecutors argue in a court filing that sheds new light on the scammers’ work.
Click to expand...

https://www.cyberscoop.com/fin7-hacking-phishing-sec-restaurant/

guest · Jul 23, 2021

FIN7’s Liquor Lure Compromises Law Firm with Backdoor
July 23, 2021
https://threatpost.com/fin7s-liquor-lure-law-firm-backdoor/168086/

Financial cybercrime gang FIN7 has rebounded after the jailing of some key members, launching a campaign that uses as a lure a legal complaint involving the liquor company that owns Jack Daniels whiskey. The gambit successfully compromised at least one law firm, giving them a shot of the JSSLoader remote-access trojan (RAT), researchers said.

According to eSentire’s Threat Response Unit (TRU), the successful breach for FIN7 (aka Carbanak Group or Navigator Group) was part of a wider, non-targeted email campaign. It purports to relate to a legal complaint centering around liquor giant Brown-Forman.

“One of the victims of the malicious legal complaint campaign was a law firm,” researchers said in a posting this week. “The lure successfully bypassed the law firm’s email filters, and it was not detected as suspicious by any of the firm’s employees.”
The ultimate purpose of installing the backdoor is unclear.
Click to expand...

Savvy Email Lures
The lawsuit campaign was geared to take advantage of a certain amount of zeitgeist, according to the analysis.
While using such a specific lure lawsuit in a wide-scale campaign may seem counterintuitive, it can net lucrative fish, researchers noted.

Notably for the Brown-Forman case, FIN7 threat actors registered the infrastructure months before TRU saw it in action.

“Either the attackers were using it for months before eSentire saw the activity, or they weaponized it after a period of time to evade email filtering by newly registered domains. If that is the case, this shows a degree of planning and sophistication on the part of FIN7.”
Click to expand...

Log in or Sign up

Fin7 Ramps Up Campaigns With Two Fresh Malware Samples

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Log in or Sign up

Fin7 Ramps Up Campaigns With Two Fresh Malware Samples

guest Guest

Minimalist Registered Member

guest Guest

guest Guest

guest Guest

Minimalist Registered Member

guest Guest

Useful Searches