FIN7__2021__Morphisec_The_Evolution_of_the_FIN7_JssLoader.pdf

## Executive Summary Morphisec Labs documents a December 2020 FIN7 campaign that used phishing links to SharePoint to deliver VBScript/WSF droppers which staged a minimized .NET RAT called JSSLoader; JSSLoader collects host and AD information, persists via LNK shortcuts/scheduled tasks, accepts numerous remote commands (including in-memory PowerShell, DLL run, and auto-update), and can deliver a Takeout PowerShell that reflectively maps and executes Carbanak in memory. The report traces the malware's evolution, provides code excerpts showing anti-debugging and exfiltration behavior, and lists IOCs (hashes and C2 domains) to aid detection and response.