FIN7

FIN7 is a financially motivated threat group that has been active since 2013. FIN7 has primarily targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, and utilities industries in the U.S. A portion of FIN7 was run out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to a big game hunting (BGH) approach, including use of REvil ransomware and their own Ransomware as a Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but there appear to be several groups using Carbanak malware and are therefore tracked separately.

FIN7 is an advanced persistent threat (APT) group that has been active since at least 2016 and is responsible for several high-profile cyber attacks on businesses in various industries, including restaurants, hotels, and retail stores. The group uses a combination of social engineering tactics to gain access to their targets\' networks and then steals sensitive information such as credit card numbers or personally identifiable information (PII). FIN7 is known for its sophisticated techniques, including the use of custom malware and the exploitation of vulnerabilities in point-of-sale systems. The group has been linked to several high-profile cyber attacks on businesses such as Chipotle Mexican Grill, Arby\'s Restaurant Group, Sonic Drive-In, Red Robin Gourmet Burgers, Wendy\'s, and others.

Techniques, tactics and practices:

FIN7 is an advanced persistent threat group that uses a combination of social engineering tactics to gain access to their targets\' networks. They then steal sensitive information such as credit card numbers or personally identifiable information (PII). The group has been linked to several high-profile cyber attacks on businesses, including Chipotle Mexican Grill, Arby\'s Restaurant Group, Sonic Drive-In, Red Robin Gourmet Burgers, Wendy\'s and others. FIN7 is known for its sophisticated techniques, such as the use of custom malware and exploitation of vulnerabilities in point-of-sale systems.