Article

FIN7 Return Drives Increase in Cl0p Ransomware Attacks

The longstanding FIN7 threat group resumed operations in 2024 and is driving an increase in Cl0p ransomware attacks. While the US Attorney for Washington state declared FIN7 “an entity no more” in May 2023, the group became increasingly active in April 2024. Starting in May 2024, Arete observed an increase in FIN7’s trojan communicating from victim environments two to three months prior to those victims being posted to the Cl0p extortion group’s data leak site (DLS).

Separately, the Cl0p group rose to prominence in June 2023 after exploiting a vulnerability in the MOVEit file transfer software. In 2024, Cl0p returned to ransomware deployment operations, with a steady rate of attacks that have increased since June 2024. Importantly, not all Cl0p ransomware attacks are perpetrated by FIN7, and not all FIN7 operations are conducted with the Cl0p group. However, the combination of these threat actors presents an elevated threat to victims due to their deep combined experience in attacking victims.

What’s New and Notable

FIN7 began operating in 2013, but took a nearly year-long hiatus from operations before reestablishing itself in April 2024. Its recent operations are focused on creating malicious advertisements (malvertising) to deliver trojanized applications that give the threat actor access to the victim environment.
One malvertising campaign is delivering a trojan which is commonly observed communicating from a victim environment two to three months prior to the victim appearing on the Cl0p group’s DLS.
In addition to distributing a trojan used prior to a Cl0p ransomware infection, FIN7 is selling an endpoint detection and response (EDR) bypass and evasion tool on dark web forums.
After conducting primarily extortion-only attacks in 2023, the Cl0p group returned to exfiltrating and encrypting data in its recent attacks.

Analyst Comments

FIN7 is an example of an established cybercriminal group whose operations span a broad scope of monetization schemes. The group deploys ransomware, operates ransomware brands, conducts payment fraud, and sells tools other threat actors can use to target victims. With over a decade of experience in the cybercriminal ecosystem and multiple law enforcement actions against them, the group remains sophisticated and viable. Their partnership with Cl0p further magnifies the potential damage these threat actors can inflict. Organizations can defend themselves prior to data exfiltration and encryption by monitoring for suspicious outbound connections to foreign IP addresses.