Can software vendors block a notorious criminal group’s attacks? MITRE wants to find out

First Cozy Bear, now FIN7.

The Eastern European hacking group FIN7 has stolen an estimated $1 billion in recent years by sweeping up payment card data processed by hotels and other organizations.

The fortune amassed by FIN7, despite the arrest of some of its senior members, has made it one of the most potent criminal threats to organizations around the world. Changes the group has made to its hacking tools in recent months have meant more breaches, and likely more money, for FIN7.

Now, a U.S. government-funded organization is trying to put a dent in FIN7 hacks by evaluating the group’s attack techniques against widely used cybersecurity software. Vendors will be assessed on their ability to block FIN7-like intrusions and, with the results made public next year, hopefully improve their products.

While FIN7 is the subject of the evaluation, the attack techniques tested will “be applicable across a broad spectrum of adversaries,” said Frank Duff, MITRE’s lead for evaluations that use the organization’s ATT&CK framework.

MITRE has previously done evaluations for techniques used by hacking groups linked with the Chinese and Russian governments, including the Russian group best known for hacking the Democratic National Committee in 2016. Big software security vendors like CrowdStrike, FireEye, and Microsoft have participated in previous evaluations.

MITRE’s non-profit technology foundation, Engenuity, will conduct this latest evaluation.

Jeremy Kennelly, part of a research team at FireEye focused on financially-motivated hackers, said the MITRE evaluation could help measure defenses against FIN7, which for periods of time uses the same malware families in their attacks.

But Kennelly also sounded a note of caution.

“Network defenders should still not allow these types of validation efforts to lull them into a false sense of security,” Kennelly, who does not work on FireEye products tested by MITRE, told CyberScoop in an email.

Successful criminal hacking groups like FIN7 have enough resources and guile to adapt their hacking tools to meet their objectives, he said, “regardless of the technology defenses employed by the organizations they target.”

U.S. law enforcement officials notched a significant win against FIN7 in September when an alleged FIN7 systems administrator pleaded guilty to wire fraud and conspiracy to commit computer hacking.

But the group has been undeterred, launching successful attacks last year.

The U.S. hospitality industry has been the prime target of recent FIN7 operations, with the group using social engineering to try to hack organizations through their customer service representatives, Kennelly said.

Government

• FBI officials say AI is bolstering adversaries, emphasizing need to focus on cyber basics, patching

• Feds accuse China of ‘systematic’ distillation of U.S. AI models

• CIA’s Michael Ellis says cyber intelligence is changing how the agency operates

• The G7 tells industry to hurry up and prep for post-quantum encryption

Technology

• European parliament members call for slowdown of Serbia’s EU entry over spyware use

• FCC proposes public scorecard to rate telecoms on anti-robocall efforts

• Pegasus, NoviSpy variant spyware found on devices of Serbian activists

• Wyden seeks upgraded NSA security guidance on commercial VPN use

Threats

• Chinese espionage groups swarm to exploit triple-link chain of zero-days

• Microsoft discloses two actively exploited zero-days among 974 vulnerabilities

• Attackers exploit zero-days in consistently besieged SonicWall product

• Jail time for Maine child in 764 marks turning point in federal law enforcement

Policy

• Whistleblower says USPS deploying new, ‘untested’ IT systems governing mail-in ballots

• ‘Watershed 250’ test program in Texas looks to private sector for water cybersecurity help

• Former sexual abuse victims say Grok used their images, videos to train deepfake capabilities

• Cyber threats nudge Trump to sign executive order on foreign equipment in U.S. energy infrastructure