FIN7

FIN7, also called Carbon Spider, ELBRUS, or Sangria Tempest, is a Russian criminal advanced persistent threat group that has primarily targeted the U.S. retail, restaurant, and hospitality sectors since mid-2015. A portion of FIN7 is run out of the front company Combi Security. It has been called one of the most successful criminal hacking groups in the world. FIN7 is also associated with GOLD NIAGARA, ITG14, ALPHV and BlackCat.

History
In March 2017 FIN7 engaged in a spearfishing campaign of company employees involved with SEC filings.

In August 2018 three members of FIN7 were charged by the United States Department of Justice for cybercrimes that impacted more than 100 U.S. companies.

In November 2018 it was reported that FIN7 were behind data breaches of Red Robin, Chili's, Arby's, Burgerville, Omni Hotels and Saks Fifth Avenue.

In March 2020, the FBI issued a warning that members of FIN7 have been targeting companies in the retail, restaurant, and hotel industries with BadUSB attacks designed to deliver REvil or BlackMatter ransomware. Packages have been sent to employees in IT, executive management, and human resources departments. One intended target was sent a package in the mail which contained a fake gift card from Best Buy as well as a USB flash drive with a letter stating that the recipient should plug the drive into their computer to access a list of items that could be purchased with the gift card. When tested, the USB drive emulated a keyboard, and then initiated a series of keystrokes which opened a PowerShell window and issued commands to download malware to the test computer, and then contacted servers in Russia.

In December 2020 it was reported that FIN7 may be a close collaborator of Ryuk.

In April 2021 a "high-level manager" of FIN7 Fedir Hladyr from Ukraine was sentenced to 10 years of prison in the United States after he pleaded guilty to charges of conspiracy to commit wire fraud and one count of conspiracy to commit computer hacking.

In January 2022, the FBI issued a warning that members of FIN7 have been targeting transportation and insurance companies (since August 2021), and defense companies (since November 2021), with BadUSB attacks designed to deliver REvil and or BlackMatter ransomware. The intended targets were sent USB drives in packages claiming to be from Amazon or the United States Department of Health and Human Services, with letters talking about free gift cards or COVID-19 protocols that were purportedly further explained by information on the USB drive. When plugged in, the USB drives emulate a keyboard, and then initiate a series of keystrokes which open a PowerShell window and issue commands to download malware.

In 2021 the group began using software known as ALPHV written in Rust, which was offered to affiliates as Ransomware as a Service.

In February 2023 the group was named in the Irish High Court as being behind the Munster Technological University ransomware attack.