FIN7 G0046
Also known as GOLD NIAGARA, ITG14, Carbon Spider, ELBRUS, Sangria Tempest.
FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.
Documented targeting: Financial Services, Healthcare, Energy & Utilities, Retail & Hospitality, Media & Entertainment, Transportation & Logistics
Methodology
Relevance is a match on your industry sector and technology stack against the MITRE ATT&CK v19.1 group graph (174 groups, 821 software families, 56 campaigns). It is computed deterministically from that data, with no language model in the request path. It is a relevance match, not threat-intelligence probability data: it tells you which documented actors and techniques are worth emulating for an org like yours, not a forecast that any specific group will act.
TurboPentest can autonomously exercise 5 of 67 of this actor's documented techniques today (7%). 22 are out of scope for automated testing (social engineering, denial of service, physical).
+31 coming soonmore unlock with our internal pentesting agent, currently in private beta.
These counts are computed from the vendored MITRE ATT&CK graph and the published coverage map, and are reproducible from source.
In-scope techniques to emphasize
Known software
Mimikatz, Carbanak, POWERSOURCE, TEXTMATE, HALFBAKED, Cobalt Strike, PowerSploit, SQLRat, BOOSTWRITE, RDFSNIFFER, GRIFFON, Maze, CrackMapExec, REvil, Pillowmint, AdFind, JSS Loader, Lizar, SystemBC.
Emulate FIN7. Audit-Ready pentest, $99.
Finds nothing? Your next pentest is free. If a pentest surfaces zero actionable findings, we credit you a free re-pentest. Once per target; does not apply to retests or Recon. You always walk away with real findings or a free redo.
Launch this pentestFrequently asked questions
Who is FIN7 (G0046)?
FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.
What sectors does FIN7 target?
Based on MITRE ATT&CK, FIN7 has been observed targeting Financial Services, Healthcare, Energy & Utilities, Retail & Hospitality, Media & Entertainment, Transportation & Logistics.
Can TurboPentest test for FIN7?
TurboPentest can autonomously exercise 5 of 67 of this actor's documented techniques today. 31 more need internal or assumed-breach access (the Adversarial-Depth tier), and the rest are out of scope for automated testing.
What does it cost to emulate FIN7?
An Audit-Ready pentest starts at $99 per target. If it surfaces zero actionable findings, your next pentest is free.
Reviewed by
Michel Chamberland, Founder & CEO of IntegSec. CISSP, OSCP, OSCE, with 20+ years in offensive security, alumni of IBM X-Force Red and Trustwave SpiderLabs.
Last reviewed July 30, 2026.