FIN7 Archives • Daily CyberSecurity

GrayAlpha’s Expanding Arsenal: FIN7-Aligned Threat Actor Deploys Custom Loaders to Spread NetSupport RAT

GrayAlpha’s Expanding Arsenal: FIN7-Aligned Threat Actor Deploys Custom Loaders to Spread NetSupport RAT

Do Son June 17, 2025

GrayAlpha, linked to FIN7, escalates tactics with fake browser/7-Zip updates and TAG-124 TDS, spreading NetSupport RAT in a multi-pronged infection campaign.

FIN7’s New Stealth Weapon: AnubisBackdoor Emerges in the Wild DriverFixer0428, Contagious Interview Cache Smuggling, ClickFix Evasion North Korean Cyber Espionage

DriverFixer0428, Contagious Interview Cache Smuggling, ClickFix Evasion North Korean Cyber Espionage

FIN7’s New Stealth Weapon: AnubisBackdoor Emerges in the Wild

Do Son March 18, 2025

Discover AnubisBackdoor, a Python-based malware that allows full control over infected machines with advanced evasion techniques.

Anonymous VPS Provider BitLaunch Under Fire for Facilitating Ransomware Attacks BitLaunch hosting provider

Anonymous VPS Provider BitLaunch Under Fire for Facilitating Ransomware Attacks

Do Son February 18, 2025

Explore the findings on BitLaunch hosting provider and its potential links to ransomware activities in the cybercrime ecosystem.

STAC5143 and STAC5777: New Ransomware Campaigns Target Microsoft Office 365 Users NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

NATS-as-C2 Sysdig CVE-2026-33017 Langflow RCE Microsoft Phone Link Hijack CloudZ Pheno Plugin Insider Threat BlackCat (ALPHV) OFAC Sanctions DPRK IT Workers Transparent Tribe APT36 React2Shell, EtherRAT SideWinder Espionage, Netlify Phishing DDNS Abuse, C2 Infrastructure Hacking Health Club

STAC5143 and STAC5777: New Ransomware Campaigns Target Microsoft Office 365 Users

Do Son January 23, 2025

Sophos X-Ops uncovers ransomware campaigns STAC5143 and STAC5777 targeting Microsoft Office 365 and Teams. Learn how these campaigns exploit email bombing and vishing techniques.

Unmasking PackXOR: The FIN7 Packer Exposed PackXOR

Unmasking PackXOR: The FIN7 Packer Exposed

Do Son September 7, 2024

Explore the in-depth analysis of PackXOR, a private packer used by threat actors, including FIN7, to evade detection and carry out malicious activities.

Cybersecurity Alert: FIN7 Expands Arsenal with New AvNeutralizer Variant

Do Son July 23, 2024

Researchers found advertisements offering a specialized tool for bypassing security systems called AvNeutralizer

Inside DiceLoader: How FIN7’s Malware Masters Evasion DiceLoader malware

Inside DiceLoader: How FIN7’s Malware Masters Evasion

Do Son February 4, 2024

Notably, DiceLoader has been actively used since 2021, with the malware often delivered via a PowerShell script.