Threat actor
FIN7
Russia · Ukraine · financial
Tracked by CyberSIXT since 5 Nov 2025
- Articles · all time
- 1
- Articles · last 30 days
- 0
- CVEs exploited · attributed · all time
- 0
- Research reports · all time
- 1
One article so far, 5 Nov 2025. A pattern appears once more outlets cover FIN7.
Names and sources
- FIN7
- Named by CyberSIXT coverage
- ATK32
- Named by Malpedia · fin7
- CARBON SPIDER
- Named by Malpedia · fin7
- Calcium
- Named by Malpedia · fin7
- Carbanak
- Named by Malpedia · fin7
- Coreid
- Named by Malpedia · fin7
- ELBRUS
- Named by Malpedia · fin7
- FIN7
- Named by Malpedia · fin7
All 36 names
- G0008
- Named by Malpedia · fin7
- G0046
- Named by Malpedia · fin7
- GOLD NIAGARA
- Named by Malpedia · fin7
- JokerStash
- Named by Malpedia · fin7
- Sangria Tempest
- Named by Malpedia · fin7
- WILD COMET
- Named by Malpedia · fin7
- CARBON SPIDER
- Named by Microsoft · Sangria Tempest
- ELBRUS
- Named by Microsoft · Sangria Tempest
- Sangria Tempest
- Named by Microsoft · Sangria Tempest
- ATK32
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- CARBON SPIDER
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- Calcium
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- Carbanak
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- Coreid
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- ELBRUS
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- FIN7
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- G0008
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- G0046
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- GOLD NIAGARA
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- JokerStash
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- Sangria Tempest
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- WILD COMET
- Named by MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb
- Carbon Spider
- Named by MITRE ATT&CK® · G0046
- ELBRUS
- Named by MITRE ATT&CK® · G0046
- FIN7
- Named by MITRE ATT&CK® · G0046
- GOLD NIAGARA
- Named by MITRE ATT&CK® · G0046
- ITG14
- Named by MITRE ATT&CK® · G0046
- Sangria Tempest
- Named by MITRE ATT&CK® · G0046
Attributed facts
- category
- financial (Microsoft · Sangria Tempest)
- motivation
- financial (Microsoft · Sangria Tempest)
- motivation
- financial (MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb)
- origin
- Russia (MISP Galaxy · 00220228-a5a4-4032-a30d-826bb55aa3fb)
- origin
- Ukraine (Microsoft · Sangria Tempest)
Malware and tools
Mimikatz (MITRE ATT&CK® · G0046) Carbanak (MITRE ATT&CK® · G0046) POWERSOURCE (MITRE ATT&CK® · G0046) TEXTMATE (MITRE ATT&CK® · G0046) HALFBAKED (MITRE ATT&CK® · G0046) Cobalt Strike (MITRE ATT&CK® · G0046) PowerSploit (MITRE ATT&CK® · G0046) SQLRat (MITRE ATT&CK® · G0046) BOOSTWRITE (MITRE ATT&CK® · G0046) RDFSNIFFER (MITRE ATT&CK® · G0046) GRIFFON (MITRE ATT&CK® · G0046) Maze (MITRE ATT&CK® · G0046) CrackMapExec (MITRE ATT&CK® · G0046) REvil (MITRE ATT&CK® · G0046) Pillowmint (MITRE ATT&CK® · G0046) AdFind (MITRE ATT&CK® · G0046) JSS Loader (MITRE ATT&CK® · G0046) Lizar (MITRE ATT&CK® · G0046) SystemBC (MITRE ATT&CK® · G0046) Griffon (Malpedia · fin7) PowerNet (Malpedia · fin7) POWERPLANT (Malpedia · fin7) POWERTRASH (Malpedia · fin7) Anubis Backdoor (Malpedia · fin7) BOATLAUNCH (Malpedia · fin7) Carbanak (Malpedia · fin7) Cobalt Strike (Malpedia · fin7) GOTROJ (Malpedia · fin7) win.rekoobe (Malpedia · fin7)
MITRE ATT&CK® techniques
From MITRE ATT&CK® · G0046
Tactics pending refresh
- T1005
- Data from Local System
- T1008
- Fallback Channels
- T1021.001
- Remote Desktop Protocol
- T1021.004
- SSH
- T1021.005
- VNC
- T1027.010
- Command Obfuscation
- T1027.016
- Junk Code Insertion
- T1033
- System Owner/User Discovery
- T1036.004
- Masquerade Task or Service
- T1036.005
- Match Legitimate Resource Name or Location
- T1047
- Windows Management Instrumentation
- T1053.005
- Scheduled Task
© 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. All techniques on MITRE ATT&CK
- FIN7 Hackers Leverage Windows SSH Backdoor for Stealthy Remote Access and PersistenceGBHackers · first in our coverage