FIN7 Threat Actor Profile: Card Theft to Ransomware

FIN7 is a financially motivated group that spent years stealing payment card data from restaurants, hotels and retailers and then moved into ransomware, where it has been linked to several of the best known ransomware-as-a-service brands. This profile draws on MITRE ATT&CK, US Department of Justice prosecutions, Mandiant and Microsoft to describe who FIN7 is, how it gets in, how it turns stolen credentials into domain-wide access, and which controls break its playbook. It is written for security operations, threat intelligence and identity teams. Attribution follows each source's own wording, and the profile reflects public reporting as of October 2026, based on sources available.

Key takeaways

A business, not a hobby. The DOJ described a group of more than 70 people organised into business units, with a fake penetration testing company, Combi Security, used to recruit staff.
Two eras, one method. The first era targeted card data at point-of-sale terminals; from 2020 MITRE and Microsoft record a shift to big game hunting ransomware, including Maze, REvil and FIN7's own DarkSide operation.
Initial access is broad and inventive. Spearphishing backed by phone calls, mailed malicious USB devices, exploited Exchange flaws, trojanized software downloads and stolen RDP credentials all appear in the record.
Credentials carry the intrusion. MITRE records harvested administrative credentials, Kerberoasting, Mimikatz and ZeroLogon exploitation against domain controllers, so privileged identity hygiene decides how far FIN7 gets.
Defence is mostly basics done well. Patched internet-facing services, phishing-resistant MFA, LAPS and tiered admin accounts, removable media control, RMM allowlisting and behavioural detection of PowerShell cover most documented techniques.

Who they are (names and aliases)

MITRE ATT&CK tracks FIN7 as G0046 and describes a financially motivated group active since 2013 (Microsoft dates ELBRUS operations to 2012). MITRE notes FIN7 may be linked to the Carbanak group, but because several groups have used the Carbanak malware, the two are tracked separately. Vendor names overlap rather than map one to one, so record which source each name comes from. See the Threat Actor Groups Guide for how naming conventions differ.

Name	Source	Notes
FIN7 (G0046)	MITRE ATT&CK, Mandiant	Primary name; Mandiant merged eight previously uncategorised (UNC) clusters into FIN7 in January 2022 and suspects 17 more are affiliated
ELBRUS, later Sangria Tempest	Microsoft	ELBRUS in Microsoft's May 2022 ransomware-as-a-service report; Sangria Tempest is listed by MITRE as an associated name under Microsoft's current naming
Carbon Spider	CrowdStrike (via MITRE)	Associated name in ATT&CK
GOLD NIAGARA, ITG14	Secureworks and IBM (via MITRE)	Associated names in ATT&CK
Combi Security, Bastion Security	DOJ, Microsoft	Front companies posing as security firms to recruit people for supposed penetration testing work

Law enforcement: on 1 August 2018 the DOJ announced that three Ukrainian nationals, Dmytro Fedorov, Fedir Hladyr and Andrii Kolpakov, had been arrested in Germany, Poland and Spain and charged in Seattle with 26 felony counts. On 16 April 2021 Hladyr, described as FIN7's systems administrator, was sentenced to ten years in prison and ordered to pay USD 2.5 million in restitution after pleading guilty to conspiracy to commit wire fraud and conspiracy to commit computer hacking. Microsoft notes that campaigns continued after the 2018 arrests and the arrest of another alleged associate in May 2020.

Targeting and motivation

Motivation: financial, throughout. First card data resold through criminal markets, later extortion through ransomware.
Card theft era: the DOJ said FIN7 breached businesses in all 50 US states and the District of Columbia, stealing more than 20 million customer card records from over 6,500 point-of-sale terminals at more than 3,600 business locations, mainly in restaurants, gaming and hospitality, with further intrusions in the UK, Australia and France. The DOJ estimated total damage at more than USD 3 billion.
Sectors: MITRE lists retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical and utilities organisations in the United States.
Victim selection: MITRE records FIN7 filtering companies by revenue using a commercial company data service (T1591) and identifying IT staff with higher administrative rights (T1591.004), which is how a ransomware operator picks targets able to pay.
Ransomware era: Microsoft reports that ELBRUS deployed Maze and REvil in 2020, then ran its own RaaS, DarkSide, retired in May 2021, and its successor BlackMatter from July to November 2021.

Attribution caution: Mandiant's April 2022 report is more hedged than Microsoft's. Mandiant says it had not attributed any direct ransomware deployment to FIN7, while finding FIN7 intrusions that preceded Maze and Ryuk encryption in 2020 and ALPHV in 2021, and assessing "at least some" FIN7 role in DarkSide operations based on shared code signing certificates and other evidence. Treat claims of specific ransomware brands as links, not settled fact. See the Ransomware Groups Guide.

Tactics and techniques (MITRE ATT&CK)

The table selects techniques from the ATT&CK v20 entry for G0046 that matter most to defenders. All IDs were checked against ATT&CK v20.

Tactic	Technique	What FIN7 did (per ATT&CK and cited sources)
Reconnaissance	T1591.004 Identify Roles	Identified IT staff and employees with higher administrative rights
Initial access	T1566.001 Spearphishing Attachment, T1566.002 Spearphishing Link	Malicious Word and RTF attachments and broad link campaigns; the DOJ says emails were often followed by phone calls to persuade the recipient
Initial access	T1091 Replication Through Removable Media, T1674 Input Injection	Mailed USB devices that emulated keystrokes to launch PowerShell and download malware (FBI FLASH cited by MITRE)
Initial access	T1190 Exploit Public-Facing Application	Exploited Exchange CVE-2021-31207 (ProxyShell set)
Initial access	T1195.002 Compromise Software Supply Chain	Compromised a software download site to serve a trojanized Atera agent installer hosted on Amazon S3
Initial access, persistence	T1078 Valid Accounts, T1078.003 Local Accounts	Harvested administrative credentials; used compromised credentials for SYSTEM access on Exchange servers
Execution	T1059.001 PowerShell, T1047 Windows Management Instrumentation	PowerShell loaders and backdoors (POWERPLANT, POWERSOURCE); WMI to install malware
Persistence	T1053.005 Scheduled Task, T1547.001 Registry Run Keys, T1546.011 Application Shimming	Scheduled tasks masquerading as software updaters, Run keys and shim databases
Credential access	T1558.003 Kerberoasting	Kerberoasting to obtain service account credentials for lateral movement
Lateral movement	T1210 Exploitation of Remote Services, T1021.001 RDP	Exploited ZeroLogon (CVE-2020-1472) against domain controllers; RDP, SSH and VNC between hosts
Command and control	T1219 Remote Access Tools, T1572 Protocol Tunneling	Abused the Atera RMM agent; tunnelled C2 over OpenSSH
Defence impairment	T1686 Disable or Modify System Firewall	Added firewall rules to open ports for its own SSH service
Exfiltration	T1567.002 Exfiltration to Cloud Storage	Exfiltrated data to the MEGA file sharing service
Impact	T1486 Data Encrypted for Impact	Encrypted virtual disk volumes on ESXi servers using a version of DarkSide

Tooling to know by name: ATT&CK lists Carbanak, GRIFFON, JSS Loader (BIRDWATCH in Mandiant naming), POWERSOURCE, Lizar, Pillowmint (a point-of-sale scraper), Cobalt Strike, Mimikatz, AdFind and CrackMapExec. Mandiant described POWERPLANT, a PowerShell backdoor first seen in 2020, as FIN7's primary tool by 2022. MITRE also records FIN7 signing Carbanak payloads with legally purchased code signing certificates (T1553.002), so a valid signature is not proof of good intent. See the Code Signing Security Guide.

How they abuse identities and credentials

Most FIN7 intrusions turn on credentials at some point. The pattern is consistent across the card theft and ransomware eras: get a foothold as an ordinary user, then collect and reuse privileged credentials until the domain is open.

Low-privilege to SYSTEM: Microsoft reports that in April 2022 ELBRUS used CVE-2021-31207 to turn compromised low-privileged user credentials into SYSTEM access on Exchange servers, aimed at organisations that had patched only the unauthenticated ProxyShell flaws.
Stolen remote access: Mandiant observed compromised RDP credentials used for initial access in a 2021 engagement. See the Remote Desktop (RDP) Security Guide.
Service accounts: Kerberoasting (T1558.003) targets service accounts with service principal names and weak passwords. Group managed service accounts with long random passwords remove most of the value. See the Service Account Security Guide.
Memory and directory theft: Mimikatz and AdFind appear in ATT&CK for FIN7. Microsoft's RaaS analysis found that nearly all successful ransomware deployments it studied involved domain admin level or consistent local administrator credentials. See the Credential Dumping Guide.
Domain controller takeover: ZeroLogon (CVE-2020-1472, in the CISA KEV catalogue) lets an attacker reset the domain controller machine account, so an unpatched DC turns any foothold into domain compromise.
Machine identities as cover: a trojanized Atera agent and a legitimately purchased code signing certificate both give FIN7 trusted software identities. Inventory which RMM agents and signers are approved and alert on anything else. See the RMM Tool Security Guide.

Notable incidents

Period	Activity	Source
Up to 2018	Card theft campaign against US restaurant, gaming and hospitality chains; more than 20 million card records and 6,500 point-of-sale terminals	DOJ, 2018 indictment and 2021 sentencing
January to June 2018	Arrests of Hladyr, Fedorov and Kolpakov; Hladyr sentenced to ten years in April 2021	DOJ
2020	Shift to ransomware; Microsoft links ELBRUS to Maze and REvil; Mandiant finds FIN7 intrusions preceding Maze and Ryuk	Microsoft, Mandiant
2020 to May 2021	DarkSide RaaS, which Microsoft says ELBRUS ran; DarkSide was retired in May 2021	Microsoft
2021	Mailed BadUSB devices; supply chain compromise via a trojanized Atera installer	FBI FLASH via MITRE, Mandiant
April 2022	Exchange exploitation (CVE-2021-31207) with low-privilege credentials	Microsoft

DarkSide is the ransomware behind the Colonial Pipeline ransomware attack, where an unused VPN account without MFA provided entry. That attack was carried out under the DarkSide affiliate model, and no source used here attributes the intrusion itself to FIN7 operators; it is cited because it shows how a RaaS brand that Microsoft links to FIN7 turned one dormant credential into a national incident.

Detection and defence

Controls mapped to FIN7 techniques

FIN7 behaviour	Control	NIST SP 800-53 Rev. 5 / CSF 2.0
Phishing with phone follow-up	Attachment sandboxing, macro blocking, staff told that an unexpected call "confirming" an email is a red flag	AT-2, SI-4 / PR.AA-03
Mailed USB devices with keystroke injection	Block unapproved HID and storage devices, report unsolicited hardware	MP-7, CM-7
Exchange and DC exploitation	Patch KEV-listed flaws on internet-facing and identity systems first	SI-2 / ID.RA-01, PR.PS-02
Stolen RDP and valid accounts	No internet-exposed RDP; MFA on all remote access; disable dormant accounts	AC-17, IA-2, AC-2
Kerberoasting, Mimikatz	gMSA for services, LAPS, tiered admin, Credential Guard	AC-6 / PR.AA-05
RMM abuse and tunnelling	Allowlist approved RMM tools; egress filtering	CM-7, SC-7 / DE.CM-01
Encryption of ESXi and file servers	Offline or immutable backups, tested restores	CP-9 / PR.DS-11

What to monitor

PowerShell: enable Script Block Logging (Event ID 4104) and alert on PowerShell launched with execution policy bypass from Office, mshta or rundll32. Mandiant noted a distinctive bypass launch pattern seen thousands of times in FIN7 activity.
Kerberos: Event ID 4769 service ticket requests using RC4 encryption (0x17) for many SPNs from one account in a short window.
Privileged logons: Event ID 4624 for domain admin accounts on member servers or workstations, which Microsoft recommends monitoring.
Persistence: new scheduled tasks (Event ID 4698), new services (Event ID 7045) and Run key changes, especially names imitating software updaters.
USB: new keyboard class devices appearing at a desk that already has one, logged through device control or Windows PnP events.
Egress: uploads to file sharing services such as MEGA, and SSH or unusual ports outbound from servers.

Metrics that show it is working

Median days to patch KEV-listed vulnerabilities on internet-facing and identity systems.
Percentage of privileged and remote access accounts on phishing-resistant MFA.
Percentage of service accounts converted to gMSA or with passwords of 25 characters or more.
Number of unapproved RMM agents found per month (target: zero).
Mean time to detect PowerShell bypass execution in purple team tests mapped to G0046.

Common failure patterns

Partial patching: fixing the unauthenticated ProxyShell flaws but not CVE-2021-31207 left a path that only needed one stolen password, which is exactly what Microsoft saw ELBRUS use.
Trusting signatures and familiar tools: signed malware and a genuine RMM agent pass naive allowlists. Allowlist by publisher and tool, not just by "is it signed".
Domain admins everywhere: admin credentials cached on workstations hand FIN7 the domain after one Mimikatz run. See the Tiered Administration and Enterprise Access Model Guide.
Weak service account passwords: Kerberoastable accounts with years-old passwords remain common and are cracked offline without any alert.
Ignoring physical vectors: unsolicited USB devices plugged in by curious staff bypass every email control.

Practitioner checklist

Patch all CISA KEV entries on Exchange, VPN and domain controllers, starting with CVE-2021-31207 and CVE-2020-1472.
Remove internet-facing RDP and require phishing-resistant MFA on every remote access path. See the Phishing-Resistant MFA Guide.
Deploy Windows LAPS and keep domain admin credentials off member servers and workstations. See the LAPS Guide.
Convert service accounts to gMSA where possible and rotate the rest to long random passwords.
Block unapproved USB HID and storage devices and tell staff to report unsolicited hardware. See the Removable Media and USB Control Guide.
Allowlist approved RMM tools and alert on any other remote access agent.
Turn on PowerShell Script Block Logging and Kerberos service ticket auditing, and route both to the SIEM.
Run a purple team exercise using the G0046 technique list and measure detection time.
Keep immutable, offline backups of ESXi and file servers and test a full restore.

FIN7 Threat Actor Profile: From Card Theft to Ransomware Partnerships