Russian-linked FIN7 (aka Sangria Tempest, ATK32, Carbon Spider, Coreid, ELBRUS, G0008, G0046, and GOLD NIAGARA) is a financial cybercrime group that has been around since 2013 and it specifically targets the US industries.
To achieve this goal, it uses spearphishing, ransomware, malicious browser extensions, and drive-by compromises.
Even after repeated attempts to bring them down, they have still managed to keep operating mainly through the theft of data and credit card information.
Cybersecurity researchers at Silent Push recently identified that more than 4000 domains used by FIN7 actors have been mimicking popular brands.
Are you from SOC/DFIR Teams? – Sign up for a free ANY.RUN account! to Analyse Advanced Malware Files
FIN7 Actors Mimic Popular Brands
FIN7 is a group of hackers who are largely based in Russia, and it is made up of more than 70 individuals working in various departments.
They have been involved in elaborate cyber attacks before and they continue to pose a major risk to the global security framework.
However, it still remains active as shown in the current observations by both Microsoft Threat Intelligence and Silent Push.
The group has maintained its TTPs, which are spear phishing campaigns that use shell domains to impersonate various genuine companies.
This new domain, cybercloudsec[.]com shares similarities with one of the previous front businesses of FIN7 known as Combi Security which indicates that the group is still operational despite some of its members being arrested.
To target famous brands, FIN7 employs a complex strategy of turning shell domains into phishing sites.
Targeting particular users through the morphing content, these domains often associate with other similar ones.
The group deploys redirects, multistage phishing campaigns, and sometimes impersonates legitimate-looking open directories that could have such files that are potentially harmful.
FIN7 achieves this by targeting different brands such as tech firms, financial industry players, and property management systems in an elusive manner.
By using bulletproof hosts like Stark Industries with dedicated IPs they do so. In some cases, the MSIX malware is spread via Google ads with a popup for “Requires Browser Extension”.
For example, their tactics consist of misusing technological platforms such as SAP Concur, Microsoft SharePoint, and also developer tools as well.
Investigations into a sample LexisNexis.msix malware disclosed that it is designed to target domain-joined machines in order to gain access to Administrative rights or Active Directory accounts.
This includes opening real websites as diversions and checking the active directory membership. It involves deploying a NetSupport RAT for remote administration after a phishing attack strategy has been performed on them.
Two dedicated IOFA Feeds were created by the cybersecurity researchers under which all the FIN7 domains and IPs were mentioned.
While this data may be exported in different formats or accessed through an API.
Apart from that, a TLP Amber report is being developed for enterprise customers.
The report contains queries, lookups, and scans used to identify FIN7 infrastructure including private parameters omitted from public disclosure for security purposes.
IOFAS
103.113.70[.]142
103.35.191[.]28
89.105.198[.]190
2024sharepoint[.]lat
accountverify.business-helpcase718372649[.]click/
affinitycloudenergy[.]com
americangiftsexpress[.]com
androiddeveloperconsole[.]com
app.rmscloud[.]pro
app-trello[.]com
ariba[.]one
autodesk[.]pm
bloomberg-t[.]com
book.louvre-ticketing[.]com
concur[.]cfd
concur[.]pm
concur[.]re
concuur[.]com
costsco1[.]com
cybercloudsec[.]com
cybercloudsecure[.]com
dr1ve[.]xyz
driv3[.]net
driv7[.]com
escueladeletrados[.]com
ggooleauth[.]xyz
go-ia[.]info
go-ia[.]site
harvardyardcollection[.]com
hcm-paycor[.]org
https-twitter[.]com
hotnotepad[.]com
identity-wpengine[.]com/session_id/login/
kun-quang-api.lordofscan[.]pro/LoginProcess/api/login_submit
lexisnexis[.]day
ln[.]run/supportcenterbusiness
louvre-event[.]com
louvrebil[.]click
miidjourney[.]net
multyimap[.]com
netepadtee[.]com
netfiix-abofrance[.]com
onepassreglons[.]com
paris-journey[.]com
paybx[.]world
quicken-install[.]com
redfinneat[.]com
restproxy[.]com
rupaynews[.]com
techevolveproservice[.]com
themetasupporrtbusiness.nexuslink[.]click
themetasupporrtbusiness.nexuslink[.]click/
thomsonreuter[.]info
tredildlngviw[.]shop
tredildlngviw[.]xyz
treidingviw-web[.]lol
treidingviw-web[.]shop
treidingviw-web[.]xyz
trezor-web[.]io
trydropbox[.]com
wal-streetjournal[.]com
webex-install[.]com
westlaw[.]top
womansvitamin[.]com
wpenglneweb[.]com
www.tivi2[.]com
www.wpenglneweb[.]com
xn--manulfe-kza[.]com
xn--bitwardn-h1a[.]com
zoomms-info[.]com
“Is Your System Under Attack? Try Cynet XDR: Automated Detection & Response for Endpoints, Networks, & Users!”- Free Demo
The post 4000+ Domains Used By FIN7 Actors Mimic Popular Brands appeared first on Cyber Security News.