cyber.hendryadrian.com
Threat Research · team-cymru.com

Team Cymru Maps Potential FIN7 Infrastructure Across Two Hosting Clusters

· Original article ↗

Summary

Team Cymru, Silent Push and Stark identified 25 Stark-assigned IPs potentially linked to FIN7 activity and two clusters communicating with those hosts. Stark suspended the reported services; the activity attribution remains an assessment.

Key points

  • Using 70 indicators shared by Silent Push as seeds, the collaborators identified 25 Stark-assigned IP addresses associated with potential FIN7 activity.
  • Four Post Ltd IPs communicated with at least 15 Stark-assigned hosts over TCP/22; observed connection metadata and OpenSSH availability indicated possible SSH management activity.
  • Three SmartApe IPs communicated with at least 16 Stark-assigned hosts over TCP/443. The article says this could reflect researcher access or content testing, but the purpose is uncertain.
  • Twelve hosts appeared in both clusters. Team Cymru and Stark reported the identified hosts, and the customers’ services were suspended.
  • The authors describe the findings as a snapshot of potential activity and recommend blocking, hunting, mitigation and remediation using the listed indicators.

Article Details

Attack Vectors
  • Domains associated with potential FIN7 activity resolved to Stark-assigned hosts; the article says some hosted content may have been spoofed websites.
  • Connections from Post Ltd IP addresses to Stark-assigned hosts on TCP/22 were assessed as potentially indicating SSH-based management.
  • Connections from SmartApe IP addresses to Stark-assigned hosts on TCP/443 were observed, but the article says they may have been research or testing activity.
Defensive Notes
  • The identified hosts were reported to Stark, which suspended customer services that were still active.
  • The article recommends blocking, hunting for, mitigating, and remediating activity related to the listed indicators.
  • Abuse related to Stark can be reported to abuse@stark-industries[.]solutions.

Indicators of compromise

TypeIndicatorContext
DOMAIN2024aimp[.]infoDomain listed in the article's IoCs as associated with both reported clusters and potential FIN7 activity.
DOMAIN2024sharepoint[.]latDomain listed as associated with potential FIN7 activity and hosted on a Stark-assigned IP.
DOMAIN2bonmai[.]buzzDomain listed in the article's IoCs as associated with the Post Ltd cluster and potential FIN7 activity.
DOMAINariba[.]businessDomain listed as associated with potential FIN7 activity and hosted on a Stark-assigned IP.
DOMAINblackrock-alladin[.]proDomain listed in the article's IoCs as associated with both reported clusters and potential FIN7 activity.
DOMAINdr1v3[.]topDomain listed as associated with potential FIN7 activity and hosted on a Stark-assigned IP.
DOMAINgogogononono[.]topDomain listed in the article's IoCs as associated with both reported clusters and potential FIN7 activity.
DOMAINlexisnexis[.]proDomain listed in the article's IoCs as associated with the SmartApe cluster and potential FIN7 activity.
DOMAINmultyimap[.]comDomain listed as associated with potential FIN7 activity and hosted on a Stark-assigned IP.
DOMAINsharepoint2024[.]oneDomain listed as associated with potential FIN7 activity and hosted on a Stark-assigned IP.
DOMAINthomsonreuter[.]infoDomain listed as associated with potential FIN7 activity and hosted on a Stark-assigned IP.
DOMAINttlpcs[.]latDomain listed in the article's IoCs as associated with both reported clusters and potential FIN7 activity.
DOMAINunicredibank[.]topDomain listed in the article's IoCs as associated with the SmartApe cluster and potential FIN7 activity.
DOMAINwuriye[.]comDomain listed in the article's IoCs as associated with the Post Ltd cluster and potential FIN7 activity.
IPV4103[.]35[.]188[.]245Host listed in the article's IoCs as associated with the Post Ltd cluster and potential FIN7 activity.
IPV4103[.]35[.]189[.]143Host listed in the article's IoCs as associated with both reported clusters and potential FIN7 activity.
IPV4103[.]35[.]189[.]39Stark-assigned host reported as serving domains associated with potential FIN7 activity.
IPV4103[.]35[.]189[.]46Stark-assigned host reported as serving domains associated with potential FIN7 activity.
IPV4103[.]35[.]189[.]90Stark-assigned host reported as serving domains associated with potential FIN7 activity.
IPV4103[.]35[.]190[.]40Host listed in the article's IoCs as associated with both reported clusters and potential FIN7 activity.
IPV4103[.]35[.]191[.]112Stark-assigned host reported as serving a domain associated with potential FIN7 activity.
IPV4103[.]35[.]191[.]137Host listed in the article's IoCs as associated with the SmartApe cluster and potential FIN7 activity.
IPV4103[.]35[.]191[.]87Stark-assigned host reported as serving a domain associated with potential FIN7 activity.
IPV4141[.]98[.]168[.]183Stark-assigned host reported as serving a domain associated with potential FIN7 activity.
IPV445[.]150[.]65[.]100Host listed in the article's IoCs as associated with both reported clusters and potential FIN7 activity.
IPV445[.]150[.]65[.]46Host listed in the article's IoCs as associated with the Post Ltd cluster and potential FIN7 activity.
IPV445[.]89[.]53[.]175Host listed in the article's IoCs as associated with both reported clusters and potential FIN7 activity.
IPV45[.]252[.]22[.]213Host listed in the article's IoCs as associated with the SmartApe cluster and potential FIN7 activity.
IPV486[.]104[.]72[.]16Stark-assigned host included in Silent Push's indicators and observed in the reported infrastructure clusters.

MITRE ATT&CK

T1021.004 · SSHConnections to Stark-assigned hosts on TCP/22 were assessed as potentially indicating SSH-based management from Post Ltd IP addresses.

Threat Actors

FIN7Described as a financially motivated threat group; the article reports infrastructure potentially linked to FIN7 or to other actors mimicking its TTPs.

Vendors

Post LtdThe two clusters indicate communications inbound to FIN7 infrastructure from IP addresses assigned to Post Ltd (Russia) and Smart Ape (Estonia), respectively.SmartApeSmartApe (AS62212)StarkFirst and foremost, our thanks go to the threat research team at Silent Push and the security team at Stark Industries Solutions (referred to as “Stark” from this point forwards) for their enthusiastic cooperation in

Countries

EstoniaThe two clusters indicate communications inbound to FIN7 infrastructure from IP addresses assigned to Post Ltd (Russia) and Smart Ape (Estonia), respectively.RussiaThe two clusters indicate communications inbound to FIN7 infrastructure from IP addresses assigned to Post Ltd (Russia) and Smart Ape (Estonia), respectively.

Related Articles