rpt-fin-10-anatomy-of-a-cyber-en.pdf

RECORDS, CORRESPONDENCE

AND CUSTOMER PII

100-500

REQUESTED RANSOMS RANGED

FROM 100 TO 500 BITCOINS

FIN10

Anatomy of a Cyber

Extortion Operation

SPECIAL REPORT2

CONTENTS

Introduction 3

Background 4

Targeting 6

FIN10 Tactics, Techniques and Procedures 6

Initial Compromise 7

Early Stage Malware 7

Lateral Movement & Internal Reconnaissance 8

System Disruption 8

End-Stage Operations 9

Outlook 10

Lessons learned from investigating FIN10 and other disruptive breaches 12 Conclusion 14

Appendix - Sample Extortion Email 15…