FIN7 Spear Phishing Campaign Targets Personnel Involved in SEC Filings

FireEye observed a FIN7 spear-phishing campaign targeting personnel involved in SEC filings using spoofed EDGAR emails and malicious Word attachments that dropped VBS/PowerShell backdoors (POWERSOURCE and TEXTMATE) leveraging DNS TXT for command-and-control; operators also delivered Cobalt Strike stagers and CARBANAK samples. The campaign targeted 11 U.S.-based organizations across multiple sectors, presented fileless and registry/ADS persistence techniques that complicate detection, and prompted a coordinated FireEye Community Protection Event to deploy detections and contain the activity.