CrowdStrike Carbon Spider August 2021

FIN7 has collected files and other sensitive information from a compromised network.

FIN7 has used RDP to move laterally in victim environments.

FIN7 has used SSH to move laterally through victim environments.

FIN7 has used TightVNC to control compromised hosts.

FIN7 has used fragmented strings, environment variables, standard input (stdin), and native character-replacement functionalities to obfuscate commands.

FIN7 has attempted to run Darkside ransomware with the filename sleep.exe. Additionally, FIN7 has mimicked WsTaskLoad.exe, which is associated with the Wondershare software suite, by using a malicious executable under the same name.

JSS Loader has the ability to launch scheduled tasks to establish persistence.

JSS Loader has the ability to download and execute PowerShell scripts.

FIN7 used VBS scripts to help perform tasks on the victim's machine.

JSS Loader can download and execute VBScript files.

JSS Loader can download and execute JavaScript files.

FIN7 has harvested valid administrative credentials for lateral movement.

JSS Loader has the ability to download malicious executables to a compromised host.

FIN7 has used malicious links to lure victims into downloading malware.

FIN7 lured victims to double-click on images in the attachments they sent which would then execute the hidden LNK file. Additionally, FIN7 has used malicious Microsoft Word and Excel files and Leo VBS to distribute an updated version of JSS Loader and to distribute the Harpy backdoor.

FIN7 has exploited ZeroLogon (CVE-2020-1472) against vulnerable domain controllers.

FIN7 has encrypted virtual disk volumes on ESXi servers using a version of Darkside ransomware. Additionally, FIN7 has deployed ransomware as the end payload during big game hunting.

FIN7 has used Kerberoasting PowerShell commands such as, `Invoke-Kerberoast` for credential access and to enable lateral movement.

FIN7 sent spearphishing emails with either malicious Microsoft Documents or RTF files attached.

FIN7 has conducted broad phishing campaigns using malicious links. Additionally, FIN7 has sent spearphishing emails containing a typosquatted link to “ip-sccanner[.]com.”

FIN7 has exfiltrated stolen data to the MEGA file sharing site.