Mandiant Threat Intelligence researchers have identified FIN11, a financially-motivated hacking group behind bold, large and long-running malware campaigns. The hackers have expanded their range of targets the past two years while using increasingly aggressive ransomware attacks.
"In some ways, FIN11 is reminiscent of APT1," write the researchers, "as they are notable not for their sophistication, but for their sheer volume of activity. There are significant gaps in FIN11’s phishing operations, but when active, the group conducts up to five high-volume campaigns a week. While many financially motivated threat groups are short lived, FIN11 has been conducting these widespread phishing campaigns since at least 2016. From 2017 through 2018, the threat group primarily targeted organizations in the financial, retail, and hospitality sectors. However, in 2019 FIN11’s targeting expanded to include a diverse set of sectors and geographic regions. At this point, it would be difficult to name a client that FIN11 hasn’t targeted."