FIN7

FIN7 is a financially-motivated threat group active since 2013, targeting various industries including retail, hospitality, and financial services in the United States. The group has used point-of-sale malware and, since 2020, shifted to big game hunting, employing ransomware such as REvil and their own RaaS, Darkside. FIN7 is associated with the aliases GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, and Sangria Tempest. Its operations have sometimes been conducted through a front company called Combi Security.