Recently, cybersecurity analysts at Prodraft’s threat intelligence team detected that the hacker group FIN7 was actively exploiting vulnerabilities in Microsoft Exchange and SQL injection through an automated attack system in an attempt to perform the following illicit activities:-
For years now, this security organization has closely followed the operations of FIN7. There are a number of details revealed by Prodaft about FIN7’s behind-the-scenes:-
FIN7 is a Russian-speaking threat group that has been active at least since 2012, and its motivations seem to be financial.
A number of attacks have been linked to this threat group including:-
There is a system for automatic attacks called Checkmarks that has been discovered by Prodaft. So, in this scenario Checkmarks works as a scanner that scans for vulnerabilities that could result in remote code execution or privilege elevation in Microsoft Exchange, including:-
Since June 2021 it’s actively using Checkmarks for finding the corporate networks’ vulnerable endpoints and exploiting them by using PowerShell to drop web shells which enabled FIN7 to gain access to corporate networks.
As part of its attack, FIN7 used multiple exploits, including its own custom code and publicly available Proof Of Concepts, to gain access to the target networks.
There are some other vulnerabilities that can be exploited with the Checkmarks attack platform in addition to the MS Exchange flaws. There is also a SQL injection module that uses SQLMap to scan for potential vulnerabilities on a website that may be exploited.
Following the scanning of over 1.8 million targets with FIN7’s Checkmarks platform, 8,147 companies have already been infiltrated. Here the most interesting thing is that all these companies are mainly based in the United States.
Apart from this, from the retrieved Jabber logs, the security analysts also found extensive evidence that multiple ransomware groups were in communication with FIN7, including:-
There is one particular detail that is noteworthy in these logs is that FIN7 is fond of keeping an SSH backdoor on the networks of victims who have been extorted by ransomware, even after paying the demanded ransom.
While this might be done to sell access to other groups or to test a new attack in the future. As part of FIN7’s arsenal of backdoors, this SSH backdoor is an entirely new sophisticated addition.
As a part of the FIN7 group, Checkmarks is one of the sophisticated platforms that demonstrates just how easy it will be for threat actors to take advantage of public exploits to perform wide-scale attacks that could impact the entire world.
Further, with the help of this type of platform threat actors are also actively industrializing public exploits.
Secure Web Gateway – Web Filter Rules, Activity Tracking & Malware Protection – Download Free E-Book
The Evasive Panda group deployed a new C# framework named CloudScout to target a Taiwanese…
Researchers warn of ongoing spear-phishing attacks by Russian threat actor Midnight Blizzard targeting individuals in…
The Ukrainian Cyber Emergency Response Team discovered a targeted phishing campaign launched by UAC-0215 against…
Researchers have identified a network of compromised devices, CovertNetwork-1658, used by Chinese threat actors to…
A security researcher discovered a vulnerability in Windows theme files in the previous year, which…
The ongoing Meta malvertising campaign, active for over a month, employs an evolving strategy to…