FIN7.5: the infamous cybercrime rig “FIN7” continues its activities
securelist.com · Undated · Licence: not assessed; coordinator-only cache; do not redistribute
CVEs this report names
1 CVE- CVE-2017-11882Microsoft Office Memory Corruption VulnerabilityMicrosoft · OfficeKEVRansomwarePublic exploitHigh · 7.8T1566.001Spearphishing AttachmentT1059Command and Scripting Interpreter13 reports99.9%Top 0.03%88.5priority
Where it names them
CVE-2017-11882 Original (opens in a new tab) ↗
To deliver their malware, the cyber criminals use spearphishing emails with various types of attachments: MS Office documents or spreadsheet files exploiting some known vulnerability like CVE-2017-11882, or documents with Ole2Link and SCT.
Techniques drawn from this report
NoneNo passage in this report has been tied to an ATT&CK technique.