FIN8 cybercrime group resurges with improved hacking tool

The financial scammers seem to be back from a hiatus.

A financially-motivated hacking group that appeared to drop off the map a year-and-a-half ago is back with a new and improved backdoor, according to Bitdefender research published Wednesday.

Over the last year the criminal hacking group, known as FIN8, has primarily targeted companies in retail, technology, chemical and insurance industries with its updated point-of-sale malware, and has compromised organizations in the U.S., Canada, South Africa, Puerto Rico, Panama and Italy, according to the research. FIN8, which FireEye researchers first observed in operation in 2016, has historically targeted organizations in the retail, restaurant and hospitality industries with emails containing malicious Microsoft Word documents.

The updated backdoor, known as BADHATCH, has incorporated screen capturing, proxy tunneling and fileless execution, the researchers write. The backdoor has also likely added in credential-stealing capabilities, according to the research.

Bitdefender does not identify which organizations have been compromised.

An earlier version of BADHATCH, which researchers at Gigamon and Trend Micro observed in 2019, allowed attackers to target victims with other malware payloads, including PoSlurp and ShellTea, which enabled the hacking group to scrape for credit card data, access or delete files and lead to additional code execution.

In the latest round of activity, the hackers have since wrapped in efforts to evade detection by using TLS encryption to conceal their Powershell commands, according to Bitdefender.

When the group first emerged, it claimed hundreds of victims across North America, according to FireEye. But part of FIN8’s success is battering targets and then tapering off operations in order to maintain its stealth over the long term, according to Bitdefender.

“The FIN8 group is known for taking long breaks to improve [tactics, techniques and procedures] and increase their rate of success,” the Bitdefender researchers write in a blog.

It’s not the first time researchers have spotted the financially-motivated group reiterating on its tooling to run new attack campaigns. The hacking group attempted to breach a U.S. hotel using a new malware variant in 2019, according to previous Morphisec research.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Dogged Russia-based botnet dismantled after 23-year run

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure