FIN11 APT

The FIN11 APT is a threat actor believed to have been active for over four years. The first traces of its campaigns date back to 2016, but they ramped up the range and frequency of their operations between 2017 and 2018 significantly. The targets of FIN11 APT are very diverse, but the majority of them are concentrated in the retail, hospitality and financial sectors. The group operates all over the world. While they do not use state-of-the-art implants and exploits, they make up for this drawback by exhibiting very high activity – they usually run several operations at a time and target sectors in different areas to maximize their profits. It is not uncommon for the FIN11 APT to take a 'break' between campaigns – often, it has left the field for months before making a comeback with a large-scale attack campaign.

In the case of the FIN11 APT, the selection of their targets usually starts with a phishing campaign that aims to provide them with the ability to execute reconnaissance tasks on compromised systems. Their findings determine which of the targets they will pursue further and which ones will be abandoned. This ensures that FIN11 APT's efforts will not end up being unrewarding.

The hackers from FIN11 use a wide range of malware implants to collect money or extort their victims. They have been spotted using the CLOP Ransomware to extort victims, and for a brief period in 2018, they relied on Point-of-Sale malware to hijack credit cards.

While FIN11 is not the most technically-advanced, financially-motivated threat actors, they are certainly among the most active gangs executing this sort's attacks. By picking seemingly random targets around the world, they make their actions very difficult to predict. Businesses and companies should keep their networks secure from gangs like the FIN11 APT by employing reliable anti-virus and firewall products, as well as ensuring that their employees are following the best safe Web browsing practices.