FIN7 Cybercrime Gang Rises Again
The FIN7 cybercrime group continues to wage cyberattacks even in the wake of the arrest last year of three of its key members: researchers say FIN7 now is deploying new tactics and continuing to target the financial accounts of hospitality chains, restaurants, and financial firms.
Since 2013, the group has stolen more than an estimated $1.2 billion. That includes the sale of 15 million pilfered credit- and debit-card records from at least 100 companies in 47 states in the United States as well as Australia, France, and the United Kingdom. Among the companies hit by the FIN7 group are Chipotle Mexican Grill, Arby’s, and Hudson’s Bay Brands’ Saks Fifth Avenue.
According to new research from Flashpoint, FIN7 most recently has deployed an administrative Web interface for managing specific operations and used a unique tactic of connecting to an SQL database to download updated code to compromised systems. The hacking group embeds scripts in documents sent to targets, and when those documents are opened, the scripts reach out to the attacker-controlled database, says Jason Reaves, a principal threat researcher at Flashpoint, which this issued an advisory on FIN7’s most recent operations.
“FIN7 is active again,” he says. “They were perhaps inactive around the time of the arrests … but returned to active campaigning in October or November 2018.” ..Read more..