FIN12

FIN12, also known as DEV-0237 and Pistachio Tempest, is a threat actor group notorious for its malicious cyber activities. Tracked by Microsoft, this group is primarily engaged in the distribution of Hive, Conti, and Ryuk ransomware. The group has been responsible for several high-profile ransomware attacks, notably on U.S. hospitals in 2020. However, it has since broadened its targeting range. A unique aspect of FIN12's operations is its simultaneous activity with other threat actors like FIN7 on the same victim system, utilizing different infrastructure and tradecraft, which highlights the challenges of technical attribution for cybercriminal threats. FIN12 has been particularly active against the healthcare industry, as reported by the HHS in 2022. In one notable incident, the group used valid credentials belonging to a healthcare professional to gain backdoor access to a French hospital's network in Brest. They employ tools such as SystemBC alongside Cobalt Strike or CS Beacon to deploy ransomware. Additionally, DAVESHELL, a tool used by nearly 30 threat groups including FIN12, has been observed loading DICELOADER in a manner unique to a small cluster of threat activity. The group is linked to Wizard Spider, a financially motivated hacking group, and has shown connections to Exotic Lily, a Russian financially-motivated cybercrime group. Furthermore, research has identified over two dozen different threat actors, including FIN12, hosting command-and-control (C2) servers on Cloudzy infrastructure. This diverse list includes Chinese, Indian, Iranian, North Korean, Pakistani, Russian, Vietnamese actors, Israeli spyware vendor Candiru, and various cybercriminal groups. These associations underscore the interconnected nature of the cybercrime landscape and the significant threat posed by FIN12.