Actors/Cybercrime/Europe

FIN7

G0046CRIMERU · Russia

AKA ELBRUS · ITG14 · Calcium

CrowdStrike: CARBON SPIDERKaspersky: CarbanakMicrosoft: Sangria TempestMITRE: G0046Secureworks: GOLD NIAGARA

Targets25

Sectors18

Threat types2

GIRs covered0/480

Active since2013

Also tracked as

6 vendor names · 3 other aliases

Open Rosetta Stone

CrowdStrike

CARBON SPIDER

Kaspersky

Carbanak

Mandiant

FIN7

Microsoft

Sangria Tempest

MITRE

G0046

Secureworks

GOLD NIAGARA

UNATTRIBUTED ALIASESELBRUSITG14Calcium

Victimology

Geographic footprint · 25 countries

origin · Russiatargeted countries · 25

ASIA · 8

United Arab Emirates · Hong Kong · Japan · South Korea · Lebanon · Qatar · Thailand · Yemen

AMERICAS · 5

Argentina · Brazil · Chile · Colombia · Jamaica

OCEANIA · 1

Australia

EUROPE · 9

Belgium · Bulgaria · Czechia · France · United Kingdom · Greece · Ireland · Norway · Romania

AFRICA · 2

Egypt · South Africa

Sectors targeted

18 of 40

Government100 actors Aerospace59 actors Financial Services74 actors Retail & Hospitality33 actors NGOs & Dissidents56 actors Energy / Utilities59 actors Oil and Gas21 actors Education & Research62 actors Manufacturing (man)50 actors Transportation31 actors Logistics22 actors Hospitality33 actors Transport & Logistics7 actors Legal & Professional18 actors Consulting / Professional Services35 actors Chemicals20 actors Consumer Goods / Electronics20 actors Agriculture & Food18 actors

Tactics, techniques, procedures

Threat types + MITRE ATT&CK mapping

THREAT TYPES

FIN · Financial FraudRAN · Ransomware

MITRE ATT&CK · 52 techniques

Reconnaissance · 2

T1591Gather Victim Org Information T1591.004Identify Roles

Resource Development · 2

T1583.006Web Services

Initial Access · 4

T1190Exploit Public-Facing Application T1195.002

Execution · 9

T1047Windows Management Instrumentation

Persistence · 2

T1543.003Windows Service

Credential Access · 1

T1558.003Kerberoasting

Discovery · 3

T1033System Owner/User Discovery

Lateral Movement · 5

T1021.001Remote Desktop Protocol T1021.004SSH

Collection · 3

T1005Data from Local System T1113Screen Capture T1125Video Capture

Exfiltration · 1

T1567.002Exfiltration to Cloud Storage

Impact · 1

T1486Data Encrypted for Impact

Command And Control · 6

T1008Fallback Channels T1071.004DNS

Defense Impairment · 1

T1686Disable or Modify System Firewall

Stealth · 12

T1027.010Command Obfuscation T1036.004Masquerade Task or Service

GIR coverage

0 / 480 requirements satisfied

Open matrix

No GIRs mapped yet for this actor.

Open data

Machine-readable exports of this profile

JSON · RESTActor recordFull profile via the public v1 API STIX 2.1Intrusion-set bundleDeterministic ids · techniques + targeted countries ATT&CK NAVIGATORTechnique layer52 techniques · layer format 4.5

Related actors

By origin and actor type

T1608.005

Link Target

Compromise Software Supply Chain

T1566.001Spearphishing Attachment

T1566.002Spearphishing Link

T1053.005

Scheduled Task

T1059Command and Scripting Interpreter

T1059.001PowerShell

T1059.003Windows Command Shell

T1059.005Visual Basic

T1059.007JavaScript

T1204.001Malicious Link

T1674Input Injection

T1547.001

Registry Run Keys / Startup Folder

T1057

Process Discovery

T1124System Time Discovery

T1021.005

VNC

T1091Replication Through Removable Media

T1210Exploitation of Remote Services

T1102.002

Bidirectional Communication

T1105Ingress Tool Transfer

T1219Remote Access Tools

T1571Non-Standard Port

T1036.005

Match Legitimate Resource Name or Location

T1078Valid Accounts

T1078.003Local Accounts

T1140Deobfuscate/Decode Files or Information

T1218.005Mshta

T1218.011Rundll32

T1497.002User Activity Based Checks

T1564.001Hidden Files and Directories

T1564.003Hidden Window

T1620Reflective Code Loading