Quick links
Press Enter to search, Esc to close
Threat group profile
Attributed by the US Department of Justice to a financially motivated criminal conspiracy of dozens of computer specialists, FIN7 is described in US court papers as stealing tens of millions of payment card records from…
In short
Attributed by the US Department of Justice to a financially motivated criminal conspiracy of dozens of computer specialists, FIN7 is described in US court papers as stealing tens of millions of payment card records from US businesses, and the FBI has warned about its mailed USB devices used to deliver ransomware. It hacks company networks to steal card data and, in later years, to deploy ransomware.
Public reports use several names for this activity.
| Name | Where it appears |
|---|---|
| FIN7 | MITRE ATT&CK G0046 (group name) and US Department of Justice court papers[1, 2, 3] |
| Carbanak Group | US Department of Justice court papers (named as another name for the conspiracy). MITRE says FIN7 may be linked to it and tracks the two separately[1, 2, 3] |
| Navigator Group | US Department of Justice court papers[2, 3] |
| GOLD NIAGARA | MITRE ATT&CK Associated Groups[1] |
| ITG14 | MITRE ATT&CK Associated Groups (MITRE says it shares campaign overlap with FIN7)[1] |
| Carbon Spider | MITRE ATT&CK Associated Groups[1] |
| ELBRUS | MITRE ATT&CK Associated Groups[1] |
| Sangria Tempest | MITRE ATT&CK Associated Groups[1] |
Attribution is a judgment by the body named. It is shown here as attributed, not as proven fact.
US Department of Justice Filed as a court exhibit 27 July 2018
In the superseding indictment of Dmytro Fedorov (alias "hotdima"), said FIN7 is a financially motivated cybercriminal conspiracy known as FIN7, the Carbanak Group and the Navigator Group, and that FIN7 created a front company, Combi Security.[2]
US Department of Justice Filed as a court exhibit 27 July 2018
In the indictment of Andrii Kolpakov, made the same statements about the conspiracy and the front company, and set the period of the charges from no later than September 2015 to on or after 20 June 2018.[3]
US Department of Justice and Andrii Kolpakov 16 November 2020
In the plea agreement, Kolpakov admitted the facts that FIN7 is a financially motivated hacking group of dozens of computer specialists in multiple countries, that it stole information for tens of millions of payment cards, and that Combi Security carried out no legitimate work.[4]
US District Court, Western District of Washington 16 April 2021
Recorded that Fedir Hladyr pleaded guilty to conspiracy to commit wire fraud and conspiracy to commit computer hacking, and sentenced him to 120 months and 60 months in prison, served at the same time.[5]
FBI 6 January 2022
Warned that the cyber criminal group known as FIN7 mailed USB devices to US businesses and seeks to deploy ransomware. The FLASH was coordinated with DHS/CISA.[6]
MITRE ATT&CK Group page version 4.1, last modified 31 July 2026
Describes FIN7 as a financially motivated threat group active since 2013, and says a portion of it operated out of the front company Combi Security.[1]
MITRE ATT&CK Group page version 4.1, last modified 31 July 2026
Says FIN7 may be linked to the Carbanak Group but tracks them separately because several groups have used Carbanak.[1]
Sources differ on the start date. MITRE says FIN7 has been active since 2013. The US indictments set the charged period from no later than September 2015, and the Kolpakov plea statement says attacks began no later than August 2015.
Sources differ on the Carbanak Group. The US indictments name FIN7, the Carbanak Group and the Navigator Group as one conspiracy. MITRE says FIN7 may be linked to the Carbanak Group but tracks them separately, because several groups have used the Carbanak malware.
Combi Security is described differently by two sources. The indictments say it presented itself as a penetration testing company based in Moscow and Haifa. The plea statement says it carried out no legitimate work. MITRE calls it a front company.
Each entry is attributed to the group by the sources cited.
MITRE says FIN7 has been active since 2013.[1]
Kolpakov admits membership from at least April 2016 until his arrest.[4]
The plea statement says Fedir Hladyr opened an internal tracking ticket for Jason's Deli on this date.[4]
The plea statement says a large cache of payment card data stolen from Jason's Deli was offered for sale on this date.[4]
The Fedorov indictment charges conduct through on or after this date.[2]
The Kolpakov indictment charges conduct through on or after this date.[3]
Spanish police arrested Kolpakov in Lepe, Spain, per his plea statement.[4]
The FBI says it discovered FIN7 mailing malicious USB devices to US businesses.[6]
The FBI issued FLASH MI-000120-MW, later updated.[6]
MITRE says FIN7 shifted to big game hunting, using REvil and its own Darkside service.[1]
The FBI says packages with items such as teddy bears or gift cards were sent from at least this month.[6]
A plea agreement in the Kolpakov case was filed in court.[4]
Hladyr received 120 months for conspiracy to commit wire fraud and 60 months for conspiracy to commit computer hacking, served at the same time.[5]
The FBI says transportation and insurance businesses began receiving USB devices.[6]
The FBI says it observed FIN7 targeting the US defense industry with a package including a USB device.[6]
The FBI published FLASH MU-000160-MW, coordinated with DHS/CISA.[6]
Indictments, sanctions and advisories that name the group or its alleged members.
| Date | Who | What |
|---|---|---|
| 28 June 2018 | Spanish police | ArrestArrested Andrii Kolpakov in Lepe, Spain, according to his plea statement.[4] |
| 27 July 2018 | US Department of Justice | Court filingFiled the superseding indictment against Dmytro Fedorov and the indictment against Andrii Kolpakov as exhibits in the Western District of Washington. Fedorov faces 26 counts, including conspiracy, wire fraud, computer hacking, access device fraud and aggravated identity theft.[2, 3] |
| 26 March 2020 | FBI | FLASH noticeIssued FLASH MI-000120-MW on FIN7 USB mailings, later updated.[6] |
| 16 November 2020 | US Department of Justice | Plea agreementPlea agreement with Andrii Kolpakov filed in court.[4] |
| 16 April 2021 | US District Court, Western District of Washington | SentenceSentenced Fedir Hladyr to 120 months and 60 months in prison, served at the same time.[5] |
| 6 January 2022 | FBI | FLASH noticePublished FLASH MU-000160-MW on FIN7 USB keystroke attacks, coordinated with DHS/CISA, with advice for defenders.[6] |
Techniques reported for this group, by MITRE ATT&CK tactic.
Phishing: Spearphishing Attachment T1566.001
Sent targeted emails with malicious documents or RTF files attached. The US plea statement says phishing emails were the main way in.[1, 4]
Phishing: Spearphishing Link T1566.002
Ran broad phishing campaigns using malicious links.[1]
Supply Chain Compromise: Compromise Software Supply Chain T1195.002
Gained initial access by compromising a victim's software supply chain.[1]
Exploit Public-Facing Application T1190
MITRE says FIN7 compromised organizations by exploiting CVE-2021-31207 in Exchange.[1]
Replication Through Removable Media T1091
Mailed USB drives to potential victims. The FBI describes the packages as fake HHS letters or Amazon gifts.[1, 6, 13]
Input Injection T1674
USB devices typed commands to start PowerShell and fetch malware.[1, 6, 14]
User Execution: Malicious File T1204.002
Lured victims into double-clicking images that ran a hidden shortcut file.[1]
Command and Scripting Interpreter: PowerShell T1059.001
Used PowerShell to launch shellcode that fetched more malware.[1, 6]
Carbanak Backdoor
MITRE describes it as a full-featured remote backdoor. The US indictments say it can record video of a victim's screen and steal files.[1, 2, 7]
Cobalt Strike Remote access tool
A commercial remote access tool. MITRE lists it for FIN7 and the FBI names it among the tools used before ransomware.[6, 8]
GRIFFON Backdoor
A JavaScript backdoor used by FIN7, per MITRE. The FBI also lists it.[6, 9]
JSS Loader Remote access trojan
MITRE says FIN7 has used it since at least 2020.[10]
Lizar Remote access tool
A modular tool that MITRE says FIN7 has likely used since at least February 2021. MITRE lists Tirion, Icebot and DiceLoader as associated names, and the FBI names DICELOADER and TIRION.[6, 11]
Pillowmint Point-of-sale malware
Designed to capture credit card information, per MITRE.[12]
REvil Ransomware
MITRE says FIN7 used REvil ransomware. The FBI says REvil and BlackMatter were deployed after USB attacks.[1, 6]
Darkside Ransomware
MITRE says FIN7 ran its own ransomware-as-a-service called Darkside.[1]
Metasploit Attack toolkit
Named by the FBI among tools used to deepen access before ransomware.[6]
The FBI advises monitoring or alerting for endpoints that plug in a USB device with the vendor and product identity given in its FLASH.
Counters T1674
Update to PowerShell version 5 or higher and turn on module logging, script block logging and transcription. Raise the event log size to 1GB or higher.
Counters T1059.001
If your business allows it, disable access to all removable storage in group policy, with administrator access only. The FBI notes this does not stop a USB device that acts as a keyboard.
Counters T1091
Limit handling of the package, keep its contents and the tracking number, preserve memory and disk copies if it was plugged in, and contact your local FBI office.
Counters T1091
The FBI says some packages came with emails or phone calls pressing staff to plug the device in. Treat such pressure as a warning sign and report it.
Counters T1091
Customers can watch for look-alike domains registered to impersonate their brand, a method MITRE lists for this group.
Customers can look for their stolen payment card data and company credentials offered on underground forums, where US court papers say FIN7 sold stolen cards.
Customers can find internet-facing servers that need patching, such as the Exchange flaw MITRE lists for this group.
Customers can follow government warnings and court filings on FIN7 and match the listed techniques to their own controls.
Customers can track ransomware families linked to FIN7 by MITRE and the FBI, such as REvil and Darkside.
The US Department of Justice calls FIN7 a financially motivated cybercriminal conspiracy, also known as the Carbanak Group and the Navigator Group. MITRE describes it as a financially motivated threat group active since 2013.
US court papers describe Combi Security as a front company that posed as a penetration testing firm to recruit hackers. The Kolpakov plea statement says it carried out no legitimate work. MITRE also calls it a front company.
US court papers name Dmytro Fedorov, Andrii Kolpakov and Fedir Hladyr. The court recorded that Hladyr was sentenced on 16 April 2021 to 120 months for wire fraud conspiracy and 60 months for computer hacking conspiracy, served at the same time. Kolpakov signed a plea agreement filed on 16 November 2020.
The US plea statement says it attacked mainly through phishing emails. The FBI also warns of USB devices sent by post that type commands into the computer to download malware.
Do not plug in unknown USB devices, switch on PowerShell logging, and restrict removable storage if your business allows it, as the FBI advises.
Take control of your digital security with an exclusive demo of our AI-driven threat intelligence platform.