FIN7 Reboot | Cybercrime Gang Enhances Ops with New EDR Bypasses and Automated Attacks

MITRE Techniques

• [T1562.001] Impair Defenses – AvNeutralizer tampering with security solutions. Bracket content: ‘the updated version implements previously unseen techniques to tamper with some specific implementations of protected processes.’
• [T1190] Exploit Public-Facing Application – Checkmarks automated attack system primarily aimed at exploiting public-facing Microsoft Exchange servers. Bracket content: ‘Checkmarks platform, developed by the FIN7 group as an automated attack system … exploiting public-facing Microsoft Exchange servers.’
• [T1055.012] Process Injection – Reflective loading in memory (ReflectiveLoader) to run modules without dropping to disk. Bracket content: ‘loading them directly in memory and sending the output back to the attacker through an encrypted channel.’
• [T1059.001] PowerShell – Powertrash droppers with multi-layer obfuscation delivering payloads. Bracket content: ‘Observed exploitation activities involve PowerShell droppers with multiple layers of obfuscation, ultimately leading to the final URL that downloads and executes the implant.’
• [T1499] Endpoint Denial of Service – New technique to disable endpoint security solutions using ProcLaunchMon.sys to cause a DoS in protected processes. Bracket content: ‘to create a DoS condition in some protected processes implementations …’
• [T1053.005] Scheduled Task – Persistence via a scheduled task so it can survive reboots. Bracket content: ‘configured as a scheduled task so it can survive reboots.’
• [T1041] Exfiltration Over C2 Channel – SSH-based backdoor creates a reverse SSH tunnel to stealthily exfiltrate files. Bracket content: ‘the reverse tunnel is configured as a scheduled task so it can survive reboots. With this setup, the attacker can stealthily exfiltrate files from the compromised machine at any time.’
• [T1105] Ingress Tool Transfer – Powertrash loaders pulled from staging servers to deliver backdoors (Core Impact, Diceloader). Bracket content: ‘Powertrash loaders delivering Core Impact implants …’