Maverick fast-attack ransomware group FIN12 is quickly expanding

FIN12 hits hospitals even during pandemic

Today, security company Mandiant issued a report tracking the growth of a ransomware attack group it calls FIN12. 

The company said the group is one of the most aggressive ransomware attackers ever seen, making up a fifth of all the cases it has handled since September 2020. FIN12 is also shifting its techniques and targets as it evolves. 

FIN12 hits big targets with average annual revenues of $6 billion, said Mandiant. Although it has focused largely on North American victims since emerging in 2018, it has expanded to hit organizations in Australia, Colombia, France, Indonesia, Ireland, the Philippines, South Korea, Spain, the United Arab Emirates, and the United Kingdom. 

The attackers differ from other groups in important ways. Unlike many of its peers, FIN12 relies on a large number of quick attacks and rarely bothers with double-dipping attacks that threaten to publish victims’ stolen data. This saves it time dwelling in a victim's network to exfiltrate data. 

FIN12’s attacks take less than two days on average, compared to an industry median of five days. It also relies on third-party criminal groups to gain initial access to victims' systems and create a steady pipeline of targets. 

Related Resource

The best defence against ransomware

How ransomware is evolving and how to defend against it

Blue padlock Free download

FIN12 has a history of targeting hospitals, even during the pandemic when many other groups avoided hitting health care providers. Around one in five of its victims are in the healthcare industry, Mandiant said. 

The attack group began by partnering with threat actors that used the TrickBot banking trojan and Empire PowerShell-based malware for post-breach exploitation, but recently sought new tools to expand its capabilities. 

It began using the Bazarloader malware in September 2020, and Cobalt Strike Beacon is also a key part of its arsenal. Once it has established a footprint in its targets' networks, it almost always deploys the Ryuk ransomware tool to encrypt its victims' data. 

Mandiant believes FIN12 is a Russian-speaking group likely residing in the Commonwealth of Independent States (CIS). It has not targeted organizations in that region, the report noted. 

Featured Resources

The ultimate law enforcement agency guide to going mobile

Best practices for implementing a mobile device program

Free download

The business value of Red Hat OpenShift

Platform cost savings, ROI, and the challenges and opportunities of Red Hat OpenShift

Free download

Managing security and risk across the IT supply chain: A practical approach

Best practices for IT supply chain security

Free download

Digital remote monitoring and dispatch services’ impact on edge computing and data centres

Seven trends redefining remote monitoring and field service dispatch service requirements

Free download

Recommended

Microsoft touts new cyber security help for nonprofits
cyber security

Microsoft touts new cyber security help for nonprofits

22 Oct 2021
Ofcom report reveals alarming uptick in smishing attacks
scams

Ofcom report reveals alarming uptick in smishing attacks

22 Oct 2021
Graylog launches new cyber security solution to address legacy issues
cyber security

Graylog launches new cyber security solution to address legacy issues

21 Oct 2021
US to ban surveillance software exports to authoritarian governments
cyber security

US to ban surveillance software exports to authoritarian governments

21 Oct 2021

Most Popular

Best Linux distros 2021
operating systems

Best Linux distros 2021

11 Oct 2021
Windows 11 has problems with Oracle VirtualBox
Microsoft Windows

Windows 11 has problems with Oracle VirtualBox

5 Oct 2021
What is cyber warfare?
Security

What is cyber warfare?

15 Oct 2021