FIN 12: Un groupe cybercriminel aux multiples rançongiciels

ANSSI reports on a March 2023 compromise of a CHU Brest server attributed to the FIN12 mode-of-operation (aka PISTACHE TEMPEST), describing initial access via exposed remote desktop using valid credentials, deployment of SystemBC and Cobalt Strike, attempts at privilege escalation and credential harvesting (Mimikatz, SharpRoast, AccountRestore), exploitation artifacts for multiple CVEs, and a catalog of IOCs and Malleable C2 configuration; ANSSI links this incident to a broader series of ransomware campaigns (Ryuk, Conti, Hive, Play, Royal, Nokoyawa) active since 2019 and provides TTP and infrastructure correlations.