Cybersecurity experts have uncovered new infrastructure tied to the notorious FIN7 cybercrime group. The discovery was made during a joint investigation by Team Cymru, Silent Push, and Stark Industries Solutions, revealing two clusters of potential FIN7 activity.
These clusters show inbound communications to FIN7 infrastructure from IP addresses associated with Post Ltd in Russia and SmartApe in Estonia. The latest findings build upon a recent Silent Push report, which identified several Stark Industries IP addresses that appear exclusively dedicated to hosting FIN7 infrastructure. It’s suspected that these IP addresses were procured through one of Stark’s resellers.
The analysis further uncovered four IP addresses from Post Ltd and three from SmartApe linked to FIN7 activities. Notably, the Post Ltd cluster has been found communicating with at least 15 Stark-assigned hosts, while the Estonian cluster interacted with 16 Stark-assigned hosts.
Researchers Uncover New Infrastructure Tied to FIN7 Cybercrime Group
— IT Security News – www.itsecuritynews.info (@IT_securitynews) August 19, 2024
Additionally, 12 of the hosts from the Post Ltd cluster were also observed within the SmartApe cluster, confirming established connections based on evaluated TCP flags and data transfer volumes. Following responsible disclosure, Stark has since suspended the identified services.
[email protected]
Abdul is a tech-savvy, coffee-fuelled, and creatively driven marketer who loves keeping up with the latest software updates and tech gadgets. He's also a skilled technical writer who can explain complex concepts simply for a broad audience. Abdul enjoys sharing his knowledge of the Cloud industry through user manuals, documentation, and blog posts.
