{"id":46057,"date":"2022-04-05T16:12:49","date_gmt":"2022-04-05T16:12:49","guid":{"rendered":"https:\/\/packetstormsecurity.com\/news\/view\/33292\/FIN7-Hackers-Evolve-Operations-With-Ransomware-Novel-Backdoor.html"},"modified":"2022-04-05T16:12:49","modified_gmt":"2022-04-05T16:12:49","slug":"fin7-hackers-evolve-operations-with-ransomware-novel-backdoor","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/","title":{"rendered":"FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor"},"content":{"rendered":"<p>The FIN7 hacking group is back with a campaign that shows off a novel backdoor and other new malicious tools. <\/p>\n<p>FIN7 is considered a <a href=\"https:\/\/www.zdnet.com\/article\/fingers-point-to-lazarus-cobalt-fin7-as-key-hacking-groups-focused-on-finance-industry\/\" target=\"_blank\" rel=\"noopener\">key threat actor<\/a> today and has severely impacted countless financial organizations worldwide. <\/p>\n<div class=\"relatedContent alignRight\" readability=\"7.6363636363636\">\n<h3 class=\"heading\"> <span class=\"int\">ZDNet Recommends<\/span> <\/h3>\n<div class=\"thumb\"> <a href=\"https:\/\/www.zdnet.com\/article\/best-security-key\/\" data-omniture-track=\"moduleClick\" data-omniture-track-data=\"{&quot;moduleInfo&quot;: &quot;pinbox&quot;, &quot;pageType&quot;: &quot;article&quot;}\"> <span class=\"img \"><img loading=\"lazy\" decoding=\"async\" src=\"https:\/\/www.zdnet.com\/a\/img\/resize\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\/2020\/03\/18\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp\" class alt=\"The best security key\" height=\"165\" width=\"220\"><\/span> <\/a> <\/div>\n<p class=\"title\"> <a href=\"https:\/\/www.zdnet.com\/article\/best-security-key\/\" data-omniture-track=\"moduleClick\" data-omniture-track-data=\"{&quot;moduleInfo&quot;: &quot;pinbox&quot;, &quot;pageType&quot;: &quot;article&quot;}\"> The best security key <\/a> <\/p>\n<p class=\"dek\">While robust passwords help you secure your valuable online accounts, hardware-based two-factor authentication takes that security to the next level.<\/p>\n<p class=\"read-more\"> <a href=\"https:\/\/www.zdnet.com\/article\/best-security-key\/\" data-omniture-track=\"moduleClick\" data-omniture-track-data=\"{&quot;moduleInfo&quot;: &quot;pinbox&quot;, &quot;pageType&quot;: &quot;article&quot;}\">Read More<\/a> <\/p>\n<\/p><\/div>\n<p>This money-motivated cyberattack group, also tracked as Carbanak, specializes in Business Email Compromise (BEC) scams and point-of-sale (PoS) system intrusions. The group attempts to steal consumer payment card data and, in recent years, has continued to innovate and refine its intrusion methods. <\/p>\n<p>Active since at least 2015, FIN7 has a range of custom malware in its toolset, including backdoors, information stealers, the <a href=\"https:\/\/www.zdnet.com\/article\/global-cybergang-fin7-returns-with-new-sqlrat-malware\/\" target=\"_blank\" rel=\"noopener\">SQLRat<\/a> SQL script dropper, the Loudout downloader, and has even used <a href=\"https:\/\/www.zdnet.com\/article\/fbi-cybercriminals-are-mailing-out-usb-drives-that-will-install-ransomware\/\" target=\"_blank\" rel=\"noopener\">mailed USB drives<\/a> sent to businesses in the past to infect its victims with malware. <\/p>\n<p>Recently, cybersecurity researchers tied FIN7 to ransomware operators, including REvil, Darkmatter, and Alphv.<\/p>\n<p>Despite <a href=\"https:\/\/www.zdnet.com\/article\/doj-arrests-indicts-three-ukrainian-nationals-from-fin7-cybercrime-group\/\" target=\"_blank\" rel=\"noopener\">arrests<\/a> and the sentencing of <a href=\"https:\/\/www.zdnet.com\/article\/pen-tester-fin7-hacking-group-member-sent-behind-bars-for-seven-years\/\" target=\"_blank\" rel=\"noopener\">high-level FIN7<\/a> members, the attack waves continue, with the latest including the &#8220;use of novel malware, incorporation of new initial access vectors, and likely shift in monetization strategies,&#8221; according to Mandiant.<\/p>\n<p>In <a href=\"https:\/\/www.mandiant.com\/resources\/evolution-of-fin7\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">a deep dive<\/a> on the threat actor&#8217;s latest activities, Mandiant said that FIN7 had continued to evolve its initial intrusion methods beyond BEC scams and phishing attempts. Now, the group is also leveraging supply chains, RDP, and stolen credentials to infiltrate enterprise networks. <\/p>\n<p>Mandiant researchers said that a new &#8216;novel&#8217; backdoor is being favored in recent attacks. Dubbed Powerplant, the PowerShell-based backdoor &#8212; also known as KillACK &#8212; is delivered via <a href=\"https:\/\/securelist.com\/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities\/90703\/\" target=\"_blank\" rel=\"noopener noreferrer nofollow\" data-component=\"externalLink\">Griffon<\/a>, a lightweight Java implant, and is used to maintain persistent access to a target system and steal information, including credentials. <\/p>\n<p>Powerplant also facilitates the deployment of other malicious modules, including the Easylook reconnaissance tool and the Birdwatch downloader. New variants of the .NET Birdwatch downloader, tracked as Crowview and Fowlgaze by the research team, are being used to grab malicious payloads via HTTP, write them to disk, and then execute them. <\/p>\n<p>The malware can also package and send reconnaissance information to its command-and-control (C2) server, such as network configuration data, web browser usage, running process lists, and more. <\/p>\n<p>Crowview is slightly different as it also includes a self-destruct mechanism, configuration changes, and unlike the original, can house a payload embedded in its code. <\/p>\n<p>Another backdoor malware variant, Beacon, may be used in attacks as a backup entry mechanism. Other malicious tools include the Powertrash dropper, the Termite shellcode loader, Weirdloop, Diceloader, Pillowmint, and Boatlaunch.<\/p>\n<p>Boatlaunch is of particular note as it is a utility used to patch existing PowerShell processes to bypass Window&#8217;s antimalware scanning software, AntiMalware Scan Interface (AMSI), and will also act as a &#8220;helper&#8221; module during intrusions, according to the cybersecurity researchers. <\/p>\n<p>Mandiant has also tied several campaigns together as the work of FIN7. In total, eight separate, uncategorized (UNC) threat groups have been merged into FIN7 activities, and a further 17 are suspected of links with the cybercriminal outfit. <\/p>\n<p>&#8220;Throughout their evolution, FIN7 has increased the speed of their operational tempo, the scope of their targeting, and even possibly their relationships with other ransomware operations in the cybercriminal underground,&#8221; Mandiant said.<\/p>\n<p><strong>See also<\/strong><\/p>\n<hr>\n<p><strong>Have a tip?<\/strong> Get in touch securely via WhatsApp | Signal at +447713 025 499, or over at Keybase: charlie0<\/p>\n<hr>\n<p> READ MORE <a href=\"https:\/\/packetstormsecurity.com\/news\/view\/33292\/FIN7-Hackers-Evolve-Operations-With-Ransomware-Novel-Backdoor.html\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>READ MORE HERE&#8230;<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[277],"tags":[4819],"class_list":["post-46057","post","type-post","status-publish","format-standard","hentry","category-cybersecurity-blogs","tag-headlinehackermalwarecybercrimefraudbackdoorcryptography"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.5 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-04-05T16:12:49+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.zdnet.com\/a\/img\/resize\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\/2020\/03\/18\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"3 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor\",\"datePublished\":\"2022-04-05T16:12:49+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/\"},\"wordCount\":569,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\\\/2020\\\/03\\\/18\\\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\\\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp\",\"keywords\":[\"headline,hacker,malware,cybercrime,fraud,backdoor,cryptography\"],\"articleSection\":[\"CyberSecurity Blogs\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/\",\"name\":\"FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\\\/2020\\\/03\\\/18\\\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\\\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp\",\"datePublished\":\"2022-04-05T16:12:49+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\\\/2020\\\/03\\\/18\\\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\\\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp\",\"contentUrl\":\"https:\\\/\\\/www.zdnet.com\\\/a\\\/img\\\/resize\\\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\\\/2020\\\/03\\\/18\\\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\\\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"headline,hacker,malware,cybercrime,fraud,backdoor,cryptography\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/tag\\\/headlinehackermalwarecybercrimefraudbackdoorcryptography\\\/\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/","og_locale":"en_US","og_type":"article","og_title":"FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-04-05T16:12:49+00:00","og_image":[{"url":"https:\/\/www.zdnet.com\/a\/img\/resize\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\/2020\/03\/18\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"3 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor","datePublished":"2022-04-05T16:12:49+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/"},"wordCount":569,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\/2020\/03\/18\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp","keywords":["headline,hacker,malware,cybercrime,fraud,backdoor,cryptography"],"articleSection":["CyberSecurity Blogs"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/","url":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/","name":"FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/#primaryimage"},"thumbnailUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\/2020\/03\/18\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp","datePublished":"2022-04-05T16:12:49+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/#primaryimage","url":"https:\/\/www.zdnet.com\/a\/img\/resize\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\/2020\/03\/18\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp","contentUrl":"https:\/\/www.zdnet.com\/a\/img\/resize\/49d9e9b2c43f91c2da4a22f58d74310f2ecd424d\/2020\/03\/18\/7c2e2258-7566-4e66-9059-a1a8aedf00b4\/2020-03-18-at-12-23-32-pm.jpg?width=220&amp;height=165&amp;fit=bounds&amp;auto=webp"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/fin7-hackers-evolve-operations-with-ransomware-novel-backdoor\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"headline,hacker,malware,cybercrime,fraud,backdoor,cryptography","item":"https:\/\/www.threatshub.org\/blog\/tag\/headlinehackermalwarecybercrimefraudbackdoorcryptography\/"},{"@type":"ListItem","position":3,"name":"FIN7 Hackers Evolve Operations With Ransomware, Novel Backdoor"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46057","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=46057"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46057\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=46057"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=46057"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=46057"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}