Member of FIN7 Hacking Group Sentenced to 5-Years in Prison

The FIN7 hacking group was deemed to be responsible for the sentence of a Ukrainian national. Denys Iarmak, 32, was sentenced to five years in prison for working as a penetration tester for the FIN7 company as was recently announced by the US Department of Justice (DoJ).

The FIN7 aka Carbanak is active since 2013, and it is a stealthy group that specializes in stealing financial data from:-

  • Corporations
  • Banks

While FIN7 has conducted its attacks against these sectors through:-

  • Business Email Compromise (BEC) scams
  • Attacks against point-of-sale (PoS) systems
  • Supply chain compromise

Prime Targets of FIN7

Here below we have mentioned the primary targets of the FIN7 hacking group:-

  • Banks
  • Retails
  • Restaurants
  • Hospitality industries
  • Financial Institutions

From 2020 onwards, FIN7 has adopted a new approach to its operations, embracing a large game hunting strategy and a new operating approach. In order to be successful, the group constantly evolves its tactics and improves its arsenal.

While in their new approach they have used big ransomware like:-

  • REvil
  • Own Ransomware as a Service (RaaS)
  • Darkside

The operators of the FIN7 hacking group have used the following malware backdoors:-

  • Information stealers
  • Trojans
  • RDP access modules
  • Malicious USB drives

Member of FIN7 Hacking Group Arrested

As a high-level hacker, Denys served as a pentester for FIN7, a task referred to as not only cryptographic but also forensic in nature. In November of 2019, Denys was arrested in Bangkok, Thailand as part of a request from United States government authorities.

There are three FIN7 members who have been sentenced to prison in the United States, and among them, Denys Iarmak is the third member of this group. And here below we have mentioned the name of the other two members as well:-

  • Fedir Hladyr, a member of the FIN7, was sentenced to 10 years in prison on April 16, 2021.
  • Andrii Kolpakov, a FIN7 member was sentenced to 7 years in prison on June 24, 2021.

Activities Conducted

In today’s economy, FIN7 is regarded as one of the biggest threats to the financial sector. Apart from this, the Department of Justice (DoJ) has estimated that the damage caused to US organizations and consumers is at least $1 billion.

From approximately November 2016 until approximately November 2018, Denys Iarmak was involved with FIN7 on a regular basis. 

For coordinating FIN7 malicious activity and managing the numerous network invasions, Denys frequently used JIRA (a project management software) hosted on private virtual servers in different countries.

Here’s what DoJ stated:-

“As one example, Iarmak created a JIRA issue, to which he and other members of the cyber group had access, for a specific victim company, and, on or about March 3, 2017, Iarmak updated that JIRA and uploaded data he had stolen from that company.”

Further, the prosecutors did not disclose how much Denys Iarmak earned, but they did note that his salary was significantly higher than what someone earning a comparable wage in Ukraine would earn.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Gunra Ransomware’s Double‑Extortion Playbook and Global Impact

Gunra Ransomware, has surfaced as a formidable threat in April 2025, targeting Windows systems across…

2 hours ago

Hackers Exploit 21 Apps to Take Full Control of E-Commerce Servers

Cybersecurity firm Sansec has uncovered a sophisticated supply chain attack that has compromised 21 popular…

2 hours ago

Hackers Target HR Departments With Fake Resumes to Spread More_eggs Malware

The financially motivated threat group Venom Spider, also tracked as TA4557, has shifted its focus…

2 hours ago

RomCom RAT Targets UK Organizations Through Compromised Customer Feedback Portals

The Russian-based threat group RomCom, also known as Storm-0978, Tropical Scorpius, and Void Rabisu, has…

2 hours ago

Hackers Use Pahalgam Attack-Themed Decoys to Target Indian Government Officials

The Seqrite Labs APT team has uncovered a sophisticated cyber campaign by the Pakistan-linked Transparent…

2 hours ago

LUMMAC.V2 Stealer Uses ClickFix Technique to Deceive Users into Executing Malicious Commands

The LUMMAC.V2 infostealer malware, also known as Lumma or Lummastealer, has emerged as a significant…

2 hours ago