← Back to Actors
FIN7
FIN7GOLD NIAGARAITG14Carbon SpiderELBRUSSangria Tempest
[FIN7](https://attack.mitre.org/groups/G0046) is a financially-motivated threat group that has been active since 2013. [FIN7](https://attack.mitre.org/groups/G0046) has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of [FIN7](https://attack.mitre.org/groups/G0046) was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, [FIN7](https:/...
68
Techniques
62
Covered
6
Gaps
91%
Coverage
Coverage62/68
GAPS (6)
COVERED (62)
T1005Data from Local System51 det.T1008Fallback Channels5 det.T1021.001Remote Desktop Protocol55 det.T1021.004SSH38 det.T1021.005VNC2 det.T1027.010Command Obfuscation42 det.T1033System Owner/User Discovery62 det.T1036.004Masquerade Task or Service7 det.T1036.005Match Legitimate Resource Name or Location49 det.T1047Windows Management Instrumentation88 det.T1053.005Scheduled Task100 det.T1057Process Discovery24 det.T1059Command and Scripting Interpreter552 det.T1059.001PowerShell384 det.T1059.003Windows Command Shell89 det.T1059.005Visual Basic71 det.T1059.007JavaScript64 det.T1069.002Domain Groups45 det.T1071.004DNS37 det.T1078Valid Accounts320 det.T1078.003Local Accounts24 det.T1082System Information Discovery91 det.T1087.002Domain Account58 det.T1091Replication Through Removable Media8 det.T1102.002Bidirectional Communication17 det.T1105Ingress Tool Transfer199 det.T1113Screen Capture19 det.T1124System Time Discovery4 det.T1125Video Capture3 det.T1140Deobfuscate/Decode Files or Information59 det.T1190Exploit Public-Facing Application240 det.T1195.002Compromise Software Supply Chain24 det.T1204.001Malicious Link11 det.T1204.002Malicious File468 det.T1210Exploitation of Remote Services40 det.T1218.005Mshta51 det.T1218.011Rundll3278 det.T1219Remote Access Tools51 det.T1486Data Encrypted for Impact400 det.T1543.003Windows Service80 det.T1546.011Application Shimming11 det.T1547.001Registry Run Keys / Startup Folder53 det.T1553.002Code Signing4 det.T1558.003Kerberoasting35 det.T1559.002Dynamic Data Exchange1 det.T1562.004Disable or Modify System Firewall50 det.T1564.001Hidden Files and Directories26 det.T1564.003Hidden Window11 det.T1566.001Spearphishing Attachment1144 det.T1566.002Spearphishing Link1194 det.T1567.002Exfiltration to Cloud Storage33 det.T1569.002Service Execution65 det.T1571Non-Standard Port17 det.T1572Protocol Tunneling62 det.T1583.001Domains69 det.T1583.006Web Services1 det.T1587.001Malware10 det.T1588.002Tool13 det.T1591.004Identify Roles2 det.T1608.001Upload Malware3 det.T1620Reflective Code Loading17 det.T1686Disable or Modify System Firewall19 det.