fin11

FIN11, a threat actor group also known as Lace Tempest or TA505, has been linked to the development and deployment of Cl0p ransomware. This malicious software is believed to be a variant of another ransomware, CryptoMix, and is typically used by FIN11 to encrypt files on a victim's network after stealing information. However, early versions of Cl0p did not show evidence of FIN11 exploiting victim data. Notably, the Clop threat-actor group has associations with other groups identified as TA505 and FIN11, indicating a complex web of cybercriminal activity. In recent years, FIN11 has heavily invested in zero-day exploitation, demonstrating a significant focus on identifying and exploiting such vulnerabilities. From late 2020 to early 2021, the group exploited multiple zero-day vulnerabilities in Accellion’s legacy File Transfer Appliance (FTA). In total, the financially motivated actors exploited ten zero-day vulnerabilities, with FIN11 being one of the most active, exploiting three separate zero-day flaws. Other ransomware groups, including Akira, Clop, LockBit, and Nokoyawa, separately exploited an additional four zero-days. The group has also targeted U.S. healthcare organizations using double extortion tactics, involving both data theft and ransom demands. The Microsoft Threat Intelligence team discovered that Lace Tempest (aka FIN11 and TA505) exploited a zero-day vulnerability in SysAid, a comprehensive IT Service Management software, to gain access to corporate servers and deploy Clop ransomware. Furthermore, this same group was responsible for the MOVEit data theft and extortion campaign, highlighting their wide-ranging and persistent cybercriminal activities.