Tracking FIN7 malware honeypots, new AI deepfake lures

Wednesday 2 October 16:00 - 16:30, Red room

Zach Edwards (Silent Push)

FIN7 (also known as Sangria Tempest) is a financially motivated threat group with links to Russia, that has been operating since at least 2013, and that was previously thought to have been eliminated by the DOJ.

From a single origin point, Silent Push threat analysts uncovered an extensive series of ongoing FIN7 campaigns, including several hundred active phishing, spoofing, shell and malware delivery domains and IPs targeting the numerous enterprise organizations and products.

We found thousands of parked FIN7 domains, and by monitoring these daily for changes, we’ve been able to find malicious infrastructure as soon as it launches. One of the most recent FIN7 malware delivery lures is being used across several domains and promotes 'AI Deepfake Nude Generating Software', which leads to D3F@ck Loader and at least one additional payload.

Other software being targeted with fake websites and malicious payloads includes 7-zip, PuTTY, ProtectedPDFViewer, AIMP, Notepad++, Advanced IP Scanner, AnyDesk, pgAdmin, AutoDesk, Bitwarden, Rest Proxy, Python, Sublime Text, and Node.js.

Our presentation will highlight current methods FIN7 is using to target enterprise organizations with ransomware payloads, and details about the malware we’ve seen across the group's infrastructure in 2024.

• Download slides for this talk

Zach Edwards Zach Edwards is a senior threat researcher at Silent Push, joining the team in 2024, with a focus on understanding and tracking how APT groups are evolving. His expertise includes a deep knowledge of global data supply chains and advertising systems. Zach is passionate about data privacy, is active in numerous communities, and has been involved in high-profile GDPR complaints, including cases against online dating apps and Google auction systems. Zach has presented at high-profile events, including a 2023 Black Hat USA  session titled 'Kids in the Ad Fraud Crosshair: Why International Threat Actors are Targeting Children to Steal Money from Banks and Major Corporations'.

Back to VB2024 Programme page

Back to VB2024 conference page

Other VB2024 papers