FIN7

Also known as:GOLD NIAGARA · ITG14 · Carbon Spider · ELBRUS · Sangria Tempest

Overview

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.

Naming & attribution

FIN7 is tracked under 6 names across the industry. It uses 67 documented ATT&CK techniques — more than 92% of the 174 groups tracked here. Activity attributed since 2013.

Who calls this group what — MITRE lists each alias with the report that used it, but not which vendor coined it.
Name	First reported by
GOLD NIAGARA	CTU
ITG14	Singleton, C. and Kiefer, C
Carbon Spider	Loui, E. and Reynolds, J
ELBRUS	Microsoft
Sangria Tempest	Microsoft
FIN7	Miller, S., et al

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

T1546.011 Application Shimming — used by 1 of 174 groups
T1674 Input Injection — used by 1 of 174 groups
T1497.002 User Activity Based Checks — used by 2 of 174 groups
T1558.003 Kerberoasting — used by 3 of 174 groups
T1608.005 Link Target — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

OilRig Iran — 33 shared techniques (30% overlap)
MuddyWater Iran — 31 shared techniques (30% overlap)
Gamaredon Group Russia — 31 shared techniques (29% overlap)
Lazarus Group North Korea — 35 shared techniques (28% overlap)
APT32 Vietnam — 32 shared techniques (28% overlap)
Mustang Panda China — 31 shared techniques (26% overlap)

Malware families with tracked indicators

3 families attributed to FIN7, with 16 deduplicated indicators observed across abuse.ch ThreatFox, MalwareBazaar, URLhaus and SSLBL over the corpus's window (up to three years, as of 2026-10-30). MITRE documents what a group does; these are the indicators its malware families have surfaced in that window.

SystemBC10 indicators
Carbanak3 indicators
Maze3 indicators

Browse or copy the indicators by hash, domain, IP or URL, filtered by age from 1 day to 3 years.

Capabilities

Supply-chain compromise — ATT&CK T1195.002
Exploitation of public-facing / client applications — ATT&CK T1190
Custom malware/implant development — ATT&CK: 15 attributed custom malware families

TTPs — 67 techniques across 15 tactics

Reconnaissance

T1591Gather Victim Org Information
T1591.004Identify Roles

Resource Development

T1583.001Domains
T1583.006Web Services
T1587.001Malware
T1588.002Tool
T1608.001Upload Malware
T1608.004Drive-by Target
T1608.005Link Target

Discovery

Lateral Movement

T1021.001Remote Desktop Protocol
T1021.004SSH
T1021.005VNC
T1091Replication Through Removable Media
T1210Exploitation of Remote Services

Collection

Command and Control

Exfiltration

T1567.002Exfiltration to Cloud Storage

Impact

T1486Data Encrypted for Impact

Tools & malware (19)

GRIFFON · Mimikatz · AdFind · JSS Loader · HALFBAKED · REvil · PowerSploit · CrackMapExec · Carbanak · Pillowmint · Cobalt Strike · Maze · POWERSOURCE · RDFSNIFFER · SQLRat · Lizar · TEXTMATE · BOOSTWRITE · SystemBC

Reporting (3)

How Microsoft names threat actors — Microsoft
Ransomware as a service: Understanding the cybercrime gig economy and how to protect yourself — Microsoft
FIN7 Power Hour: Adversary Archaeology and the Evolution of FIN7 — Abdo, B., et al