FIN7

Signature backdoor used in billion-dollar bank heists. Provides full remote access to compromised banking systems including screen recording, keylogging, and ability to manipulate ATM/SWIFT transactions.

JavaScript-based backdoor delivered via spear-phishing. Lightweight initial access tool that profiles victims before deploying heavier Carbanak or Cobalt Strike payloads.

Multi-purpose backdoor with screenshot, keylogging, and file exfiltration capabilities. Used as primary implant in hospitality and restaurant sector attacks.

Point-of-sale (POS) RAM scraper that extracts credit card data from memory of payment processing applications. Deployed on POS terminals in restaurant chains.

Utility module that patches PowerShell processes in memory to bypass AMSI (Antimalware Scan Interface), allowing execution of malicious PowerShell scripts undetected.

PowerShell-based backdoor framework used for persistent access. Supports dynamic module loading and uses multiple layers of obfuscation to evade detection.

.NET-based downloader that retrieves and executes secondary payloads. Used as intermediary between initial spear-phishing access and deployment of main backdoors.

Primary post-exploitation framework. FIN7 uses heavily customized Cobalt Strike with unique malleable C2 profiles to evade network detection signatures.

Open-source penetration testing framework used alongside Cobalt Strike for exploitation, privilege escalation, and payload delivery.

Weaponized USB devices mailed to targets disguised as Best Buy gift cards or COVID-19 guidance. Emulate a keyboard to execute PowerShell commands on insertion.

Credential harvesting tool used to extract POS terminal credentials, domain admin hashes, and Kerberos tickets for lateral movement within retail networks.

Legitimate remote desktop software deployed for persistent access to compromised systems. Used as a fallback if primary C2 channels are disrupted.

Remote access tool deployed on compromised POS management servers. Provides hands-on-keyboard access for manual operations during heist execution.

Network discovery tool used to map internal networks after initial compromise, identifying POS terminals, domain controllers, and payment processing servers.

Central to FIN7 operations — used for fileless execution, AMSI bypass, payload staging, and lateral movement throughout compromised retail/restaurant networks.

Front companies established by FIN7 to recruit penetration testers who unknowingly developed offensive tools and conducted attacks on real targets.

Custom PowerShell-based loader deployed by GrayAlpha sub-cluster via fake software downloads

Batch file-based loader used by GrayAlpha for initial compromise via trojanized downloads

Automated platform for SQL injection attacks against public-facing web servers

EDR bypass tool designed to disable and evade endpoint detection and response solutions

Tunneling tool used for establishing persistent network access and lateral movement