The Stark Truth Behind the Resurgence of Russia’s Fin7
Summary: Fin7, a Russia-based cybercrime group that U.S. authorities declared defunct in 2023 after three of its members were convicted and imprisoned, has rebuilt infrastructure of more than 4,000 hosts in 2024, according to Silent Push. The group registers typosquatting domains mimicking brands including Microsoft 365, Google, Cisco (Webex), Zoom and Reuters, advertises them as sponsored Google search results, and hosts much of the infrastructure on Stark Industries Solutions, a provider that appeared two weeks before Russia's invasion of Ukraine.
What you should know: Fin7 has cost victim organizations an estimated $3 billion since 2013, and its current campaign targets people downloading tools such as PuTTY, Notepad++ and AnyDesk, plus tourists seeking Louvre tickets for the Summer Olympics. Prosecutions and prison sentences did not end the group; it took six to nine months to ramp back up.
Read the original at Krebs on Security ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026