Cataloged
IdentityAlias: GOLD NIAGARA
Reviewed identity mapping approved on this date.
FIN7
Also known as GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest
Tracked as
G0046
FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.
Activity timeline
A dated ledger of actor-claimed victims, campaigns, indicators, identity mappings, relationships, and CVE links. Each date states what it measures. For extensive leak-site histories, victim entries are limited to the 100 most recent distinct listings.
Cataloged
IdentityAlias: ITG14
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Carbon Spider
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: ELBRUS
Reviewed identity mapping approved on this date.
Cataloged
IdentityAlias: Sangria Tempest
Reviewed identity mapping approved on this date.
Cataloged
IdentityTracking identifier: G0046
Reviewed identity mapping approved on this date.
Cataloged
CVECVE-2017-0199 linked to this actor
Cataloged
CVECVE-2017-11882 linked to this actor
Identity and attribution
Exact names and tracking identifiers resolve to this canonical profile. Rebrands, affiliations, and overlapping clusters remain separate confidence-rated relationships.
Name map
FIN7Canonical Name
Carbon SpiderAlias
ELBRUSAlias
GOLD NIAGARAAlias
ITG14Alias
Sangria TempestAlias
G0046Tracking Id
Loading CVEs, techniques, indicators, malware, victims, and activity...