Mandiant FIN7 Apr 2022

FIN7 has used random junk code to obfuscate malware code.

FIN7 has used the command `cmd.exe /C quser` to collect user session information.

FIN7 used a PowerShell script to launch shellcode that retrieved an additional payload. Additionally, FIN7 has executed a custom obfuscation of the shellcode invoker in PowerSploit called POWERTRASH.

FIN7 used the command prompt to launch commands on the victim’s machine. Additionally, FIN7 has used cmd.exe to open the Run dialog by sending the “Windows + R” keys through malicious USBs acting as virtual keyboards.

FIN7 has used the command `net group "domain admins" /domain` to enumerate domain groups.

FIN7 has downloaded additional malware to execute on the victim's machine, including by using a PowerShell script to launch shellcode that retrieves an additional payload.

FIN7 has gained initial access by compromising a victim's software supply chain.

FIN7 has used `rundll32.exe` to execute malware on a compromised network.

FIN7 has utilized the remote management tool Atera to download malware to a compromised system.

FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware. Additionally, FIN7 has deployed ransomware as the end payload during big game hunting.

FIN7 has used Kerberoasting PowerShell commands such as, `Invoke-Kerberoast` for credential access and to enable lateral movement.

FIN7 has set up Amazon S3 buckets to host trojanized digital products.

FIN7 has utilized a variety of tools such as Cobalt Strike, PowerSploit, and the remote management tool, Atera for targeting efforts.

FIN7 has staged legitimate software, that was trojanized to contain an Atera agent installer, on Amazon S3. FIN7 has also used an open directory web server as a staging server for payloads and other tools, such as OpenSSH and 7zip.

FIN7 has compromised a digital product website and modified multiple download links to point to trojanized versions of offered digital products.