MITRE ATT&CK G0046

FIN7

View MITRE Group Page ↗

Aliases: Carbanak Group, Navigator Group, ELBRUS

Official Attribution Source: U.S. Department of Justice Indictments (W.D. Wash.)

Key Facts

Jurisdiction

Transnational / Eastern Europe

Geographic origin

Cases

Prosecution matters

Defendants

Indicted individuals

Sanctions

OFAC designations

Attributed Country: Transnational / Eastern Europe.
ATT&CK Group Reference: G0046 (FIN7).
Linked to 2 primary court prosecution record(s) with $1.0 billion documented loss.
Identified 3 individually charged operative(s) and 0 OFAC designation(s).

Primary ATT&CK Techniques Employed

Technique frequencies extracted from verified indictments for FIN7.

ATT&CK Techniques Mapped to FIN7
Technique	Frequency
T1566.001 Spearphishing Attachment	1 incidents
T1059.001 PowerShell	1 incidents
T1041 Exfiltration Over C2 Channel	1 incidents
T1056.001 Keylogging	1 incidents
T1113 Screen Capture	1 incidents
T1074.001 Local Data Staging	1 incidents
T1020 Automated Exfiltration	1 incidents

Prosecution Cases Attributed to FIN7

U.S. v. Hladyr, Kolpakov & Iarmak (FIN7 Cybercrime Syndicate)

sentenced 2018-03-27

Prosecution of senior leaders of the FIN7 transnational cybercrime syndicate who hacked into thousands of computer systems across the United States, stealing more than 20 million customer credit card records from restaurants and hospitality chains.

Primary Attack Mechanism: Adversary gained initial access via Spearphishing Attachment: FIN7 members sent spearphishing emails with malicious Microsoft Word attachments to restaurant managers disguised as catering orders or customer complaints.

7 techniques mapped · Loss: $1.0 billion View full case dossier →

U.S. v. FIN8 Conspirators (Badhatch Hospitality POS Malware)

charged 2021-03-18

Federal criminal indictment and investigative findings documenting financially motivated threat syndicate FIN8, which deployed Badhatch and Sardonic backdoors into point-of-sale memory across nationwide hotel and restaurant chains, scraping hundreds of thousands of customer payment cards.

Primary Attack Mechanism: Adversary gained initial access via Spearphishing Attachment: FIN8 initiated intrusions through spearphishing emails directed at hotel reservation desks with weaponized Word documents delivering VBScript droppers.

2 techniques mapped · Loss: $25.0 million View full case dossier →

Indicted Operatives & Dispositions (3)

Fedir Hladyr sentenced

FIN7 systems administrator sentenced to 10 years in federal prison.

Sentence: 10 years (120 months)

Andrii Kolpakov sentenced

FIN7 pen-testing manager sentenced to 7 years in federal prison.

Sentence: 7 years (84 months)

Denys Iarmak sentenced

FIN7 penetration tester sentenced to 5 years in federal prison.

Sentence: 5 years (60 months)

Documented TTP Signature for FIN7

Test Controls in Stack Audit →

T1566.001: Spearphishing Attachment

Adversaries send spearphishing emails with malicious attachments to gain initial access to victim systems.

T1059.001: PowerShell

Adversaries abuse the Windows PowerShell command environment to execute commands and download malicious payloads.

T1041: Exfiltration Over C2 Channel

Adversaries transmit stolen data over existing command and control channels back to adversary servers.

T1056.001: Keylogging

Adversaries record keystrokes to harvest passwords and confidential communications.

T1113: Screen Capture

Adversaries take screenshots of victim desktop sessions to collect sensitive information.

T1074.001: Local Data Staging

Adversaries stage stolen documents in hidden directories before exfiltrating them.