FIN7__2019__FIN7.5_the_infamous_cybercrime_rig_FIN7_continues_its_activities.pdf

Kaspersky Lab describes continued FIN7 activity despite 2018 arrests, detailing sophisticated spearphishing campaigns that deliver malicious Office documents and a modular JScript implant called GRIFFON which loads reconnaissance, Meterpreter (TinyMet) downloader, screenshot and persistence modules. The report links FIN7 to related clusters (AveMaria infostealer, CobaltGoblin/EmpireMonkey, and a CopyPaste actor), provides extensive IOCs and infrastructure analysis (C2 domains, IPs, typosquatting and decoy 302 redirects), and highlights the group's focus on financial theft and supplier/service targets.