Breaking Down FIN7's New Cybercrime Infrastructure

In a significant development, cybersecurity researchers have uncovered new infrastructure linked to the notorious financially motivated threat actor, FIN7. This discovery adds to the growing body of evidence surrounding the activities of this sophisticated cybercrime group, known for its relentless attacks on businesses worldwide.

Key Findings

Recent investigations by Team Cymru, in collaboration with Silent Push and Stark Industries Solutions, have shed light on two distinct clusters of activity tied to FIN7. These findings are crucial for businesses aiming to bolster their defenses against such advanced threats.

• Two Clusters Identified: The analysis revealed communications directed towards FIN7 infrastructure originating from IP addresses assigned to Post Ltd, a Russian broadband provider, and SmartApe, a cloud hosting provider based in Estonia. These clusters indicate a coordinated effort by FIN7 to maintain a robust and resilient infrastructure.
• Stark Industries Connection: The investigation builds on earlier reports from Silent Push, which identified Stark Industries IP addresses exclusively hosting FIN7 infrastructure. This connection is particularly concerning, highlighting the cybercriminal group's ability to exploit legitimate hosting services.
• Reseller Programs in Focus: One of the most striking revelations is using reseller programs within the hosting industry. Many large Virtual Private Server (VPS) providers offer these services, allowing customers to procure infrastructure through resellers. This practice, while common, presents significant challenges in tracking and mitigating cyber threats like those posed by FIN7.

Detailed Analysis

The researchers identified additional infrastructure linked to FIN7 activity, including:

• Four IP Addresses Linked to Post Ltd: Operating in Southern Russia, these addresses have been associated with outbound communications to at least 15 Stark-assigned hosts identified by Silent Push over the past 30 days.
• Three IP Addresses Linked to SmartApe: Based in Estonia, these addresses have been communicating with no less than 16 Stark-assigned hosts, further reinforcing the connection between FIN7 and these hosting providers.
• Overlap Between Clusters: Notably, 12 hosts identified in the Post Ltd cluster were also observed in the SmartApe cluster. This overlap suggests a coordinated effort by FIN7 to diversify its infrastructure across multiple regions and providers, making it more challenging to detect and disrupt their operations.

Implications for Businesses

The discovery of this new infrastructure tied to FIN7 is a stark reminder of the ever-evolving threat landscape. Businesses must remain vigilant and proactive in their cybersecurity efforts to protect against such advanced and persistent threats. Key takeaways include:

• Strengthening Security Posture: Businesses should review and enhance their security measures, focusing on robust endpoint protection, network monitoring, and threat intelligence. Regularly updating software and systems to patch vulnerabilities is also critical.
• Monitoring for Unusual Activity: Organizations should closely monitor their network traffic for signs of unusual activity, particularly outbound communications to suspicious IP addresses. Implementing advanced threat detection tools can help identify and mitigate potential threats before they cause significant damage.
• Understanding the Risks of Reseller Programs: While reseller programs offer flexibility and convenience, they also introduce risks. Businesses should carefully vet their hosting providers and be aware of the potential for abuse by cybercriminal groups like FIN7.

Conclusion

The ongoing efforts of cybersecurity researchers have once again highlighted the importance of vigilance in the fight against cybercrime. As FIN7 continues to evolve its tactics and infrastructure, businesses must remain proactive in their cybersecurity strategies to stay ahead of these threats. By understanding the risks and taking appropriate action, organizations can better protect themselves from the devastating impact of cyberattacks.