Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · FIN7 · Unknown · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

FIN7

  • CARBON SPIDER
  • GOLD NIAGARA
  • Calcium
  • ATK32
  • G0046
  • G0008
  • Coreid
  • Carbanak

MITRE G0008 ↗

FIN7 — ATT&CK roseFI

attack rose · 9 techniques across 5 tactics

What changed

ledger · newest first
  1. —todaynew CVE6 new CVEs: CVE-2014-4114, CVE-2015-1641, CVE-2015-1770, CVE-2015-2545, CVE-2020-1472, CVE-2021-31207

Analyst brief

misp-galaxy + mitre-attack

Groups targeting financial organizations or people with significant financial assets.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

9 techniques · 5 of 15 tactics

  1. Resource development

    1 technique

  2. Persistence

    1 technique

  3. Stealth

    4 techniques

  4. Defense impairment

    1 technique

  5. Command and control

    2 techniques

select a technique

Arsenal

1 malware · 3 tools
Malware
Malware · 1ATT&CK
CarbanakS0030 ↗
Tools
Tools · 3ATT&CK
MimikatzS0002 ↗
PsExecS0029 ↗
netshS0108 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs FIN7 is cited as exploiting

none on KEV
  1. CVE-2015-16412026-10-17
    1. “CVE-2015-1770 CVE-2015-1641”

      cited as exploiting · named nearby · source: crowdstrike.com ↗ · 2026-10-17

  2. CVE-2014-41142026-10-17
    1. “CVE-2015-2545 CVE-2014-4114”

      cited as exploiting · named nearby · source: crowdstrike.com ↗ · 2026-10-17

  3. CVE-2015-17702026-10-17
    1. “CVE-2014-4114 CVE-2015-1770”

      cited as exploiting · named nearby · source: crowdstrike.com ↗ · 2026-10-17

  4. CVE-2015-25452026-10-17
    1. “As with other clusters, the primary infection vector is targeted spear phishing emails that use exploits for a variety of vulnerabilities in Microsoft Office: CVE-2015-2545”

      cited as exploiting · named nearby · source: crowdstrike.com ↗ · 2026-10-17

  5. CVE-2021-312072026-10-17
    1. “ELBRUS has also been abusing CVE-2021-31207 in Exchange to compromise organizations in April of 2022”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    2. “ELBRUS has also been abusing CVE-2021-31207 in Exchange to compromise organizations in April of 2022”

      cited as exploiting · source: microsoft.com ↗ · 2026-10-17

    3. “FIN7 has compromised targeted organizations through exploitation of CVE-2021-31207 in Exchange.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

  6. CVE-2020-14722026-10-17
    1. “FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Primary-source reports

via APTnotes · linked, never re-hosted
  1. 2019CARBANAK Week Part One: A Rare OccurrenceFireEye ↗
  2. 2019CARBANAK Week Part Two: Continuing the CARBANAK Source Code AnalysisFireEye ↗
  3. 2019CARBANAK Week Part Three: Behind the CARBANAK BackdoorFireEye ↗
  4. 2019CARBANAK Week Part Four: The CARBANAK Desktop Video PlayerFireEye ↗
  5. 2017The Digital Plagiarist Campaign: TelePorting the Carbanak Crew to a New Dimensiontr1adx ↗
  6. 2017The Carbanak/Fin7 syndicateRSA ↗

Take it with you

keyless · no signup

References

39 sources
  1. 1.en.wikipedia.org/wiki/Carbanak
  2. 2.app.box.com/s/p7qzcury97tuwk26694uutujwqmwqyhe
  3. 3.2014.zeronights.ru/assets/files/slides/ivanovb-zeronights.pdf
  4. 4.web.archive.org/web/20161223002016/https://www.symantec.com/connect/bl…
  5. 5.proofpoint.com/us/threat-insight/post/fin7carbanak-threat-actor-unlea…
  6. 6.icebrg.io/blog/footprints-of-fin7-tracking-actor-patterns
  7. 7.crowdstrike.com/blog/arrests-put-new-focus-on-carbon-spider-adversary-…
  8. 8.europol.europa.eu/newsroom/news/mastermind-behind-eur-1-billion-cyber-ba…
  9. 9.computerweekly.com/news/252446153/Three-Carbanak-cyber-heist-gang-members…
  10. 10.media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064518/Carbanak_…
  11. +29 more in the JSON record

Track FIN7 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.