FIN11

Executive Summary

FIN11 is a financially motivated cybercriminal group active since 2017, known for shifting between POS malware, ransomware, and hybrid extortion tactics. The group leverages criminal service providers to scale operations, targeting organizations globally with spear-phishing campaigns and deploying CLOP ransomware. Recent activities emphasize data exfiltration and extortion, reflecting evolving monetization strategies.

Goals & Targeting

FIN11's primary objective is financial gain through ransomware extortion, data theft, and initial access sales. The group targets organizations across multiple sectors, with a focus on industries holding sensitive data or critical infrastructure. Victims are typically selected based on perceived vulnerability, sector profitability, and geolocation, with a particular emphasis on businesses in regions with weaker cybersecurity postures. The group's dynamic monetization strategies reflect a broader trend among financially motivated actors to exploit post-compromise opportunities for ransom extraction.

FIN11, also known as TEMP.Warlock and UNC902, is a financially driven threat actor with a history of adapting its tactics to maximize monetization. Initially associated with POS malware operations in 2018, the group transitioned to ransomware deployment in 2019 and adopted hybrid extortion models in 2020, involving both data encryption and exfiltration for leverage. The group's operations often begin with spear-phishing campaigns using malicious Office documents, followed by lateral movement and data theft. Notably, FIN11's use of third-party criminal services—such as anonymous domain registration and bulletproof hosting—allows it to maintain operational resilience and anonymity. While FireEye and Mandiant have observed numerous intrusions, successful monetization remains limited, suggesting a reliance on volume-based phishing to identify high-value targets. FIN11's activities overlap with TA505 (Graceful Spider) in certain periods but should not be conflated due to differing attribution timelines and operational structures.

Key Capabilities

• Spear-phishing campaigns with malicious Office documents
• Deployment of CLOP ransomware
• Data exfiltration and extortion tactics
• Use of bulletproof hosting and anonymous domain services
• Integration with third-party criminal service providers
• Lateral movement and credential harvesting via tools like Mimikatz

MITRE ATT&CK Tactics

ATT&CK Techniques

Software / Tooling

Campaigns & Victims

FIN11's campaigns are characterized by a high operational tempo, with phishing campaigns serving as the primary entry vector. The group has demonstrated a pattern of evolving monetization methods, transitioning from POS malware to ransomware and hybrid extortion models. Campaigns often involve data exfiltration to pressure victims into paying ransoms, with a focus on sectors such as finance, healthcare, and critical infrastructure. Notable operations include the use of CLOP ransomware and the exploitation of third-party services to obfuscate infrastructure and maintain persistence.

IOC Patterns

• Spear-phishing with macro-laced Office documents
• C2 communication over DNS tunneling using fast-flux domains
• Staging infrastructure on bulletproof hosting services
• CLOP ransomware file encryption signatures
• Exfiltration of sensitive data via compromised email servers

Recommended Actions

• Implement advanced phishing simulations and employee training to reduce susceptibility to spear-phishing
• Deploy network-based detection tools to identify DNS tunneling and C2 traffic anomalies
• Conduct regular vulnerability assessments to mitigate lateral movement risks
• Enforce multi-factor authentication (MFA) to protect against credential theft
• Monitor for CLOP ransomware indicators and maintain offline backups of critical data

Suggested Tags