Cyb3rWard0g/ATTCKGroups huggingface dataset:
FIN4 - G0085

Created: 2019-01-31T02:01:45.129Z

Modified: 2023-02-01T21:27:44.778Z

Contributors:

Aliases

FIN4

Description

FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye FIN4 Stealing Insider NOV 2014) FIN4 is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)

Techniques Used

FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)|
|mitre-attack|enterprise-attack|Windows,Office 365,Linux,macOS,Google Workspace|T1564.008|Email Hiding Rules|

FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked," "phish," and “malware" in a likely attempt to prevent organizations from communicating about their activities.(Citation: FireEye Hacking FIN4 Dec 2014)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|
FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

FIN4 has used VBA macros to display a dialog box and collect victim credentials.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)|
|mitre-attack|enterprise-attack|Windows,macOS,Linux,Network|T1056.001|Keylogging|

FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)|
|mitre-attack|enterprise-attack|macOS,Windows,Linux|T1056.002|GUI Input Capture|

FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

FIN4 has used spearphishing emails (often sent from compromised accounts) containing malicious links.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)|
|mitre-attack|enterprise-attack|Office 365,Windows,Google Workspace|T1114.002|Remote Email Collection|

FIN4 has accessed and hijacked online email communications using stolen credentials.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1090.003|Multi-hop Proxy|
FIN4 has used Tor to log in to victims' email accounts.(Citation: FireEye Hacking FIN4 Dec 2014)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

FIN4 has used legitimate credentials to hijack email communications.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

FIN4 has used HTTP POST requests to transmit data.(Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)|
FIN5 - G0053

Created: 2018-01-16T16:13:52.465Z

Modified: 2021-10-16T19:48:37.809Z

Contributors: Walker Johnson

Aliases

FIN5

Description

FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. (Citation: FireEye Respond Webinar July 2017) (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)

Techniques Used

FIN5 has obtained and used a customized version of

PsExec, as well as use other tools such as

pwdump,

SDelete, and

Windows Credential Editor.(Citation: Mandiant FIN5 GrrCON Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1074.001|Local Data Staging|

FIN5 scripts save memory dump data into a specific directory on hosts in the victim environment.(Citation: Mandiant FIN5 GrrCON Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1070.004|File Deletion|

FIN5 uses

SDelete to clean up the environment and attempt to prevent detection.(Citation: Mandiant FIN5 GrrCON Oct 2016)|
|mitre-attack|enterprise-attack|Windows,Linux,Containers,macOS|T1133|External Remote Services|

FIN5 has used legitimate VPN, Citrix, or VNC credentials to maintain access to a victim environment.(Citation: FireEye Respond Webinar July 2017)(Citation: DarkReading FireEye FIN5 Oct 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|
FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.(Citation: Mandiant FIN5 GrrCON Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

FIN5 has used the open source tool Essential NetTools to map the network and build a list of targets.(Citation: Mandiant FIN5 GrrCON Oct 2016)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

FIN5 has used legitimate VPN, RDP, Citrix, or VNC credentials to maintain access to a victim environment.(Citation: FireEye Respond Webinar July 2017)(Citation: DarkReading FireEye FIN5 Oct 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

FIN5 scans processes on all victim systems in the environment and uses automated scripts to pull back the results.(Citation: Mandiant FIN5 GrrCON Oct 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1090.002|External Proxy|

FIN5 maintains access to victim environments by using

FLIPSIDE to create a proxy for a backup RDP tunnel.(Citation: Mandiant FIN5 GrrCON Oct 2016)|
|mitre-attack|enterprise-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1110|Brute Force|

FIN5 has has used the tool GET2 Penetrator to look for remote login and hard-coded credentials.(Citation: DarkReading FireEye FIN5 Oct 2015)(Citation: Mandiant FIN5 GrrCON Oct 2016)|
|mitre-attack|enterprise-attack|Windows|T1070.001|Clear Windows Event Logs|

FIN5 has cleared event logs from victims.(Citation: Mandiant FIN5 GrrCON Oct 2016)|
FIN6 - G0037

Created: 2017-05-31T21:32:06.015Z

Modified: 2023-03-22T03:50:17.471Z

Contributors: Center for Threat-Informed Defense (CTID),Drew Church, Splunk

Aliases

FIN6,Magecart Group 6,ITG08,Skeleton Spider

Description

FIN6 is a cyber crime group that has stolen payment card data and sold it for profit on underground marketplaces. This group has aggressively targeted and compromised point of sale (PoS) systems in the hospitality and retail sectors.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

Techniques Used

FIN6 has obtained and used tools such as

Mimikatz,

Cobalt Strike, and

AdFind.(Citation: Security Intelligence More Eggs Aug 2019)(Citation: FireEye FIN6 Apr 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.003|Windows Command Shell|

FIN6 has used

FIN6 has used Metasploit Bind and Reverse TCP stagers.(Citation: Trend Micro FIN6 October 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS,SaaS,Office 365,Google Workspace,IaaS|T1213|Data from Information Repositories|

FIN6 has collected schemas and user accounts from systems running SQL Server.(Citation: Visa FIN6 Feb 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1048.003|Exfiltration Over Unencrypted Non-C2 Protocol|

FIN6 has sent stolen payment card data to remote servers via HTTP POSTs.(Citation: Trend Micro FIN6 October 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.007|JavaScript|

FIN6 has used malicious JavaScript to steal payment card data from e-commerce sites.(Citation: Trend Micro FIN6 October 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1070.004|File Deletion|
FIN6 has removed files from victim machines.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1027.010|Command Obfuscation|

FIN6 has used encoded PowerShell commands.(Citation: Visa FIN6 Feb 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1555|Credentials from Password Stores|

FIN6 has used the Stealer One credential stealer to target e-mail and file transfer utilities including FTP.(Citation: Visa FIN6 Feb 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1555.003|Credentials from Web Browsers|

FIN6 has used the Stealer One credential stealer to target web browsers.(Citation: Visa FIN6 Feb 2019)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

FIN6 has targeted victims with e-mails containing malicious attachments.(Citation: Visa FIN6 Feb 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.002|Malicious File|

FIN6 has used malicious documents to lure victims into allowing execution of PowerShell scripts.(Citation: Visa FIN6 Feb 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

FIN6 has collected and exfiltrated payment card data from compromised systems.(Citation: Trend Micro FIN6 October 2019)(Citation: RiskIQ British Airways September 2018)(Citation: RiskIQ Newegg September 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux,Containers,IaaS|T1562.001|Disable or Modify Tools|

FIN6 has deployed a utility script named
FIN6 has deployed a utility script named

FIN6 has used has used Metasploit’s named-pipe impersonation technique to escalate privileges.(Citation: FireEye FIN6 Apr 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Office 365,Azure AD,Network|T1110.002|Password Cracking|

FIN6 has extracted password hashes from ntds.dit to crack offline.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.003|NTDS|

FIN6 has used Metasploit’s

PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019) |
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS|T1074.002|Remote Data Staging|

FIN6 actors have compressed data from remote systems and moved it to another staging system before exfiltration.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1566.003|Spearphishing via Service|

FIN6 has used fake job advertisements sent via LinkedIn to spearphish targets.(Citation: Security Intelligence More Eggs Aug 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1047|Windows Management Instrumentation|

FIN6 has used WMI to automate the remote execution of PowerShell scripts.(Citation: Security Intelligence More Eggs Aug 2019)  |
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows|T1553.002|Code Signing|

FIN6 has used Comodo code-signing certificates.(Citation: Security Intelligence More Eggs Aug 2019)    |
|mitre-attack|enterprise-attack,ics-attack|Windows|T1569.002|Service Execution|
FIN6 has used Comodo code-signing certificates.(Citation: Security Intelligence More Eggs Aug 2019)    |
|mitre-attack|enterprise-attack,ics-attack|Windows|T1569.002|Service Execution|

FIN6 has created Windows services to execute encoded PowerShell commands.(Citation: FireEye FIN6 Apr 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1102|Web Service|

FIN6 has used Pastebin and Google Storage to host content for their operations.(Citation: FireEye FIN6 Apr 2019)

FIN6 has renamed the "psexec" service name to "mstdc" to masquerade as a legitimate Windows service.(Citation: FireEye FIN6 Apr 2019)  |
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|

FIN6 used RDP to move laterally in victim networks.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1572|Protocol Tunneling|

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,IaaS,SaaS|T1119|Automated Collection|

FIN6 has used a script to iterate through a list of compromised PoS systems, copy and remove data to a log file, and to bind to events from the submit payment button.(Citation: FireEye FIN6 April 2016)(Citation: Trend Micro FIN6 October 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|To move laterally on a victim network,
FIN6 has used credentials stolen from various systems on which it gathered usernames and password hashes.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)(Citation: Visa FIN6 Feb 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1560.003|Archive via Custom Method|

FIN6 has encoded data gathered from the victim with a simple substitution cipher and single-byte XOR using the 0xAA key, and Base64 with character permutation.(Citation: FireEye FIN6 April 2016)(Citation: Trend Micro FIN6 October 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1560|Archive Collected Data|Following data collection,

FIN6 has compressed log files into a ZIP archive prior to staging and exfiltration.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1573.002|Asymmetric Cryptography|

FIN6 used the Plink command-line utility to create SSH tunnels to C2 servers.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1068|Exploitation for Privilege Escalation|

FIN6 has used tools to exploit Windows vulnerabilities in order to escalate privileges. The tools targeted CVE-2013-3660, CVE-2011-2005, and CVE-2010-4398, all of which could allow local users to access kernel-level privileges.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1003.001|LSASS Memory|

FIN6 has used

Windows Credential Editor for credential dumping.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)

FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and
FIN6 has used scheduled tasks to establish persistence for various malware it uses, including downloaders known as HARDTACK and SHIPBREAD and

FrameworkPOS.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1547.001|Registry Run Keys / Startup Folder|

FIN6 has used Registry Run keys to establish persistence for its downloader tools known as HARDTACK and SHIPBREAD.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network,Office 365,Azure AD,IaaS,Google Workspace|T1059|Command and Scripting Interpreter|

FIN6 has used scripting to iterate through a list of compromised PoS systems, copy data to a log file, and remove the original data files.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1087.002|Domain Account|

FIN6 has used Metasploit’s

PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1018|Remote System Discovery|

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Windows,IaaS,Linux,macOS,Containers,Network|T1046|Network Service Discovery|

FIN6 used publicly available tools (including Microsoft's built-in SQL querying tool, osql.exe) to map the internal network and conduct reconnaissance against Active Directory, Structured Query Language (SQL) servers, and NetBIOS.(Citation: FireEye FIN6 April 2016)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.001|PowerShell|
FIN6 has used PowerShell to gain access to merchant's networks, and a Metasploit PowerShell module to download and execute shellcode and to set up a local listener.(Citation: FireEye FIN6 April 2016)(Citation: FireEye FIN6 Apr 2019)(Citation: Visa FIN6 Feb 2019)|
FIN7 - G0046

Created: 2017-05-31T21:32:09.460Z

Modified: 2023-03-22T03:51:04.185Z

Contributors: Edward Millington

Aliases

FIN7,GOLD NIAGARA,ITG14,Carbon Spider

Description

FIN7 is a financially-motivated threat group that has been active since 2013 primarily targeting the U.S. retail, restaurant, and hospitality sectors, often using point-of-sale malware. A portion of

FIN7 was run out of a front company called Combi Security. Since 2020

FIN7 shifted operations to a big game hunting (BGH) approach including use of

REvil ransomware and their own Ransomware as a Service (RaaS), Darkside.

FIN7 may be linked to the

Carbanak Group, but there appears to be several groups using

Carbanak malware and are therefore tracked separately.(Citation: FireEye FIN7 March 2017)(Citation: FireEye FIN7 April 2017)(Citation: FireEye CARBANAK June 2017)(Citation: FireEye FIN7 Aug 2018)(Citation: CrowdStrike Carbon Spider August 2021)

Techniques Used

FIN7 actors have mailed USB drives to potential victims containing malware that downloads and installs various backdoors, including in some cases for ransomware operations.(Citation: FBI Flash FIN7 USB)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Network|T1005|Data from Local System|

FIN7 has collected files and other sensitive information from a compromised network.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1567.002|Exfiltration to Cloud Storage|

FIN7 has exfiltrated stolen data to the MEGA file sharing site.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1021.005|VNC|
FIN7 has used TightVNC to control compromised hosts.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,IaaS|T1486|Data Encrypted for Impact|

FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1210|Exploitation of Remote Services|

FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1021.001|Remote Desktop Protocol|

FIN7 has used RDP to move laterally in victim environments.(Citation: CrowdStrike Carbon Spider August 2021)
|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS|T1021.004|SSH|

FIN7 has used SSH to move laterally through victim environments.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,Azure AD,Office 365,SaaS,IaaS,Linux,macOS,Google Workspace,Containers,Network|T1078|Valid Accounts|

FIN7 has harvested valid administrative credentials for lateral movement.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1558.003|Kerberoasting|

FIN7 has used Kerberoasting for credential access and to enable lateral movement.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Containers|T1036.005|Match Legitimate Name or Location|
FIN7 has attempted to run Darkside ransomware with the filename sleep.exe.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows,Office 365,SaaS,Google Workspace|T1566.002|Spearphishing Link|

FIN7 has conducted broad phishing campaigns using malicious links.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1204.001|Malicious Link|

FIN7 has used malicious links to lure victims into downloading malware.(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1047|Windows Management Instrumentation|

FIN7 has used WMI to install malware on targeted systems.(Citation: eSentire FIN7 July 2021)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1583.001|Domains|

FIN7 has registered look-alike domains for use in phishing campaigns.(Citation: eSentire FIN7 July 2021)|
|mitre-attack|enterprise-attack,ics-attack|Linux,Windows,macOS|T1008|Fallback Channels|

FIN7's Harpy backdoor malware can use DNS as a backup channel for C2 if HTTP fails.(Citation: Crowdstrike GTR2020 Mar 2020)|
|mitre-attack|enterprise-attack,ics-attack|PRE|T1587.001|Malware|

FIN7 has developed malware for use in operations, including the creation of infected removable media.(Citation: FBI Flash FIN7 USB)(Citation: FireEye FIN7 Oct 2019)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.007|JavaScript|
FIN7 used JavaScript scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1571|Non-Standard Port|

FIN7 has used port-protocol mismatches on ports such as 53, 80, 443, and 8080 during C2.(Citation: FireEye FIN7 Aug 2018)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1059.005|Visual Basic|

FIN7 used VBS scripts to help perform tasks on the victim's machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows|T1059.003|Windows Command Shell|

FIN7 used the command prompt to launch commands on the victim’s machine.(Citation: FireEye FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019) |
|mitre-attack|enterprise-attack,ics-attack|Linux,macOS,Windows|T1497.002|User Activity Based Checks|

FIN7 used images embedded into document lures that only activate the payload when a user double clicks to avoid sandboxes.(Citation: FireEye FIN7 April 2017)|
|mitre-attack|enterprise-attack,ics-attack|macOS,Windows,Linux|T1566.001|Spearphishing Attachment|

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.(Citation: FireEye FIN7 April 2017)(Citation: DOJ FIN7 Aug 2018)(Citation: Flashpoint FIN 7 March 2019)(Citation: eSentire FIN7 July 2021)(Citation: CrowdStrike Carbon Spider August 2021)|
|mitre-attack|enterprise-attack,ics-attack|Windows,macOS,Linux|T1125|Video Capture|