FIN7 Hackers Leverage Windows SSH Backdoor for Stealthy Remote Access and Persistence

FIN7, also known as Savage, continues to rely on a Windows SSH backdoor infrastructure with minimal modifications since 2022, according to threat intelligence analysis. The threat actor employs an install.bat script paired with OpenSSH toolsets to establish reverse SSH and SFTP connections for stealthy remote access and data exfiltration on compromised systems. FIN7 has earned a reputation as a prolific, financially motivated group, routinely targeting retail, hospitality, and financial sector organisations.

The backdoor operates by leveraging legitimately modified SSH tools to blend with normal network traffic, making detection harder for security teams relying on traditional signatures. Once installed, the backdoors enable persistent access and support reverse SSH tunnels and SFTP data transfers, with the reverse SSH architecture initiating outbound connections from the victim network to bypass many inbound blocks.

Notably, FIN7 has shown operating longevity with only incremental changes across three years of deployment, underscoring the continued value of this backdoor approach for its campaigns. 5 November 2025.