FIN7
Attribution profile
- Type
- Crime Syndicate
- Location
- Russia
- Known incidents
- 1 incident
- Sources
- 12 sources
- First seen
- 2018-08-13
- Last seen
- 2018-08-13
- Updated
- 2026-10-12 10:08
- Aliases
- 3 aliases
STIX characteristics
Threat actor characteristics are available to members.
Profile narrative
FIN7, also known as the Cobalt Group and Carbanak, is a financially motivated cybercriminal group traced to Russia. It primarily targets financial institutions, banks, point‑of‑sale networks, retail and hospitality companies in Eastern Europe, Russia, the United States and Europe, seeking to steal payment card data and facilitate fraud. Initial access is typically gained through spear‑phishing emails that contain weaponized Word documents with obfuscated VBA scripts, malicious JavaScript files or JPEG‑linked binaries, which establish persistence via registry keys and use RC4‑encrypted traffic to command‑and‑control servers. The group employs the Carbanak backdoor, BOOSTWRITE in‑memory loader, RDFSNIFFER RAT, and ATM‑focused malware such as CobInt/COOLPANTS to conduct reconnaissance, steal credentials and dispense cash. Publicly attributed campaigns include attacks on Russian and Romanian banks (NS Bank, Banca Comercialá Carpatica/Patria Bank), the Burgerville restaurant chain breach, and the compromise of Saks Fifth Avenue and Lord & Taylor payment systems. The activity has been linked to a Russian organized cybercrime syndicate suspected of stealing over one billion dollars from banks, retailers and hospitality firms.
Incidents
Attributed incidents are available to members.
1 incidentSources
Sources available to members: 12 sources.