FIN10__2017__rpt-fin10.pdf

FireEye describes FIN10, a financially motivated extortion group active since at least 2013 that targeted North American casinos and mining firms (focus on Canada). The report summarizes initial compromise via spear-phishing, use of Meterpreter/Metasploit, PowerShell Empire and SplinterRAT for persistence and lateral movement, use of RDP/VPN and stolen credentials for access, exfiltration and public posting of stolen data, extortion demands of 100–500 BTC, and destructive batch scripts to delete Windows system files; it also provides mitigation lessons and a sample extortion email.