Hacker group FIN7 is selling EDR evasion tools to other cyber criminals

Around 2021, the gang added ransomware to their repertoire and created several fraudulent info sec firms: Combi Security, Bastion Secure and others. For these attacks, the cyber criminals even hired researchers to work for their fake company and had their “employees” unknowingly conduct ransomware attacks.

After three known leaders of the gang were sent to prison, the U.S. Attorney for Washington state declared, “FIN7 is an entity no more” in May 2023. However, in late 2023, a large automotive manufacturer was attacked with malware that targeted people searching for a free networking scanning tool. BlackBerry wrote in a blog post that it had a high level of confidence that the attacker was FIN7 because the script used in the attack was identical to that used in other FIN7 Powertrash scripts.

Events in the last few years suggest that FIN7 is now in partnership with AvNeutralizer. SentinelOne discovered that FIN7 has been connected to “the use of EDR evasion tools [AvNeutralizer] in ransomware attacks involving the Black Basta group.” By using AvNeutralizer, also known as AuKill, hackers can tamper with security solutions and then launch their own attacks. Originally, experts only saw Black Basta using the tool and assumed it was a partnership between the two groups.

“Since early 2023, our telemetry data reveals numerous intrusions involving various versions of AvNeutralizer,” wrote SentinelOne. “About 10 of these are attributed to human-operated ransomware intrusions that deployed well-known RaaS payloads including AvosLocker, MedusaLocker, BlackCat, Trigona and LockBit.”

The tool has now been linked to five different groups, which now makes it likely that Black Basta was simply an early adopter.

Reports indicate that FIN7 is selling AvNeutralizer on Russian-speaking hacking forums ranging in price from USD 4,000 to USD 15,000. The post advertised that the tool took three years and USD 1 million to develop. Additionally, the tool acts as a post-exploration framework that infiltrates enterprise networks and is not detectable by traditional antivirus software.

SentinelOne wrote that FIN7’s “development and commercialization of specialized tools like AvNeutralizer within criminal underground forums significantly enhance the group’s impact.” Because they are selling their tools, this move means that many other groups with less expertise and experience can now launch exceptionally sophisticated attacks very quickly. Additionally, AvNeutralizer, combined with other FIN7 tools, makes the group even more dangerous than before.

“The proficiency of FIN7 in executing sophisticated cyberattacks relies on their versatile arsenal, which includes tools such as Powertrash, Diceloader, Core Impact, an SSH-based backdoor and AvNeutralizer,” wrote SentinelOne. “Each of these tools supports various attack phases carried out during the intrusions, allowing the group to adeptly infiltrate, exploit, persist and evade detection.”

With the re-emergence of FIN7 as well as the selling of AvNeutralizer, cybersecurity professionals need to track the current actions of the group to reduce vulnerability and spot an attack early. Although cyber gangs evolving is common in cybersecurity, this current development is concerning and one to watch.

To learn how IBM X-Force can help you with anything regarding cybersecurity including incident response, threat intelligence, or offensive security services schedule a meeting here.

If you are experiencing cybersecurity issues or an incident, contact X-Force to help: US hotline 1-888-241-9812 | Global hotline (+001) 312-212-8034.