fin7

# FIN7 — Adversary Emulation Playbook > Tier-2 financially-motivated crew that evolved from point-of-sale theft to **big-game-hunting > ransomware** (REvil / DarkSide / Black Basta links). Signature traits: revenue-selected > targets, convincing business-themed spearphishing reinforced by **phone calls**, and mature > **EDR-evasion** tooling (AvNeutralizer / AuKill). Authorized red-team emulation only. ## When to emulate FIN7 - The client wants a realistic **ransomware-precursor** test: phishing resilience, EDR tamper-resistance, AD attack-path hardening, and backup/recovery readiness. - Retail, hospitality, financial, software, medical, or other high-revenue targets (see the industry → actor map in `../../references/apt-groups.md`). ## ThreatProfile seed (`plan/threat-profile.json`) ```json { "engagement_name": "<fill>", "actor_name": "FIN7-like (Carbon Spider / Sangria Tempest)", "actor_aliases": ["Carbon Spider", "Sangria Tempest", "GOLD NIAGARA", "ELBRUS", "ITG14"], "group_id": "G0046", "tier": "tier-2", "sophistication": "high", "motivation": "financial", "initial_access": ["T1566.001", "T1566.002", "T1204.002"], "key_ttps": ["T1059.001", "T1547.001", "T1053.005", "T1562.001", "T1003.001", "T1558.003", "T1021.001", "T1486", "T1567.002"], "tools": ["Phishing kit + phone follow-up", "Sliver", "NetExec", "Impacket", "EDR-test/BYOVD (authorized)", "canary encryptor"], "infrastructure": ["Business-themed lure domains", "Sliver HTTPS C2", "Engagement-owned exfil bucket"], "recent_cti_delta": "Since 2020 shifted to big-game-hunting ransomware (REvil/DarkSide; Black Basta TTP overlap); AvNeutralizer/AuKill EDR-killer; targets shortlisted by revenue via Crunchbase/D&B/ZoomInfo, ransom sized to revenue.", "confidence": "probable" } ``` ## Kill-chain emulation | # | Phase | MITRE | Emulated action | Executing agent → skill | |---|-------|-------|-----------------|-------------------------| | 1 | Recon | T1591 | Revenue-based target + staff shortlist (Crunchbase/D&B/ZoomInfo) | recon → `/skills/standard/recon/osint/SKILL.md`, `/skills/standard/osint/SKILL.md` | | 2 | Initial Access | T1566.001 | Business-themed spearphish attachment + phone follow-up | phisher → `/skills/standard/phisher/SKILL.md` | | 3 | Execution / C2 | T1204.002 / T1059.001 | Macro → loader → Sliver beacon | post-exploit → `/skills/standard/post-exploit/c2-sliver/SKILL.md` | | 4 | Persistence | T1547.001 / T1053.005 | Run key + scheduled task | post-exploit → `/skills/standard/post-exploit/privilege-escalation/SKILL.md` | | 5 | Defense Evasion | T1562.001 | EDR tamper / BYOVD (AvNeutralizer pattern, authorized) | post-exploit → `/skills/standard/post-exploit/privilege-escalation/SKILL.md` (shared `defense-evasion` auto-loaded) | | 6 | Credential Access | T1003.001 | LSASS dump | post-exploit → `/skills/standard/post-exploit/credential-access/SKILL.md` | | 7 | Discovery / AD | T1558.003 | BloodHound the domain; Kerberoast | ad → `/skills/standard/ad/bloodhound-query/SKILL.md`, `/skills/standard/ad/kerberoasting/SKILL.md` | | 8 | Lateral | T1021.001 / T1570 | RDP/SMB + lateral tool transfer | post-exploit → `/skills/standard/post-exploit/lateral-movement/SKILL.md`; `/skills/standard/ad/netexec/SKILL.md` | | 9 | Priv Esc to DA | T1003.006 | DCSync to domain dominance | ad → `/skills/standard/ad/dcsync/SKILL.md` | | 10 | Exfiltration | T1567.002 | Stage + exfil to engagement bucket | post-exploit → `/skills/standard/post-exploit/reporting/SKILL.md` | | 11 | Impact **(CANARY)** | T1486 | Demonstrate ransomware capability on canary only | post-exploit → `/skills/standard/post-exploit/reporting/SKILL.md` | ## CONOPS kill_chain (copy into `conops.json`) 1. `recon` — revenue-based target + staff selection (1). 2. `initial-access` — spearphish attachment + phone follow-up (2). 3. `post-exploit` — loader exec, EDR tamper, LSASS, AD recon/Kerberoast, lateral, DA via DCSync (3-9). 4. `c2` — Sliver (within 3). 5. `exfiltration` — data theft + canary ransomware impact (10-11). ## OPSEC & signature fidelity - **Phone-reinforced phishing** is the fidelity-defining move — pair the email lure with a follow-up call (authorized) to mirror FIN7's hands-on approach. - **EDR evasion is the headline.** The test is whether the EDR survives a BYOVD/tamper attempt; mirror AvNeutralizer's intent (disable endpoint telemetry) using an authorized test driver. - Dwell days-to-weeks; double extortion (exfil before encrypt). ## RoE / safety gates - Phishing + phone pretext require explicit authorization + lure-deconfliction (`/skills/standard/phisher/lure-deconfliction/SKILL.md`); name in-scope staff. - **EDR tampering / BYOVD can destabilize endpoints** — authorize it, run on a lab/canary host first, and confirm rollback. Add an `EMERGENCY` abort: *"production endpoint protection disabled outside the authorized test host, or production data encrypted/exfiltrated."* - Ransomware impact is **canary-only**. ## Deconfliction - Record lure domains, the Sliver implant, EDR-tamper test host, and exfil destination in `deconfliction.json` + `cleanup.json`. - Agree an EDR-tamper window with the SOC; the DA-path and ransomware-readiness findings are the deliverable, not a surprise outage. ## Fidelity notes (deviations) - **No real Carbanak/AvNeutralizer binaries** — emulate the loader chain with Sliver and the EDR-tamper with an authorized test, or simulate when no lab host is available. - Impact is a canary marker proving DA + deploy capability; the deliverable distinguishes "ransomware-ready (canary proven)" from "production encryption" (never the latter).