A group of cybersecurity experts have found new infrastructure associated with a financially driven threat actor identified as FIN7.
The revelation of two sets of prospectively suspicious FIN7 entities “point to incoming communication directed to FIN7 infrastructure originating from IP addresses linked to Post Ltd (Russia) and SmartApe (Estonia),” as stated by Team Cymru in a report released this week in collaboration with Silent Push and Stark Industries Solutions.
The findings expand on a recent document issued by Silent Push, which identified multiple Stark Industries IP addresses exclusively utilized for hosting FIN7 infrastructure.
The latest examination suggests that the servers associated with the criminal group may have been obtained through one of Stark’s third-party sellers.
“Reseller schemes are prevalent in the web hosting sector; many major VPS (virtual private server) providers offer such services,” the cybersecurity firm stated. “Clients procuring infrastructure from resellers typically need to comply with the terms of service set by the ‘parent’ company.”
In addition, Team Cymru noted its ability to discover more infrastructure associated with FIN7 operations, encompassing four IP addresses allocated to Post Ltd, a broadband provider situated in Southern Russia, as well as three IP addresses allotted to SmartApe, a cloud hosting provider operating from Estonia.
The initial cluster has been observed participating in outgoing communications with a minimum of 15 Stark-assigned hosts previously unearthed by Silent Push (e.g., 86.104.72[.]16) within the last 30 days. Similarly, the second group from Estonia has been identified as communicating with no fewer than 16 Stark-assigned hosts.
“Furthermore, 12 of the hosts identified in the Post Ltd cluster were also noted in the SmartApe cluster,” as pointed out by Team Cymru. The amenities have now been disabled by Stark subsequent to a responsible disclosure.
“An evaluation of observed TCP flags and sampled data transfer volumes confirmed these connections to be established communication channels,” Team Cymru stated.
About Author
