Cybersecurity experts have unearthed new infrastructure associated with a financially motivated cybercriminal group identified as FIN7.
Recent findings from a joint investigation by Team Cymru, Silent Push, and Stark Industries Solutions reveal that two distinct clusters of activity suggest interactions with FIN7’s infrastructure from IP addresses linked to Post Ltd (Russia) and SmartApe (Estonia). This information expands on an earlier Silent Push report, which had identified Stark Industries’ IP addresses being used exclusively for FIN7 operations.
The newest analysis points to the possibility that the servers used by this e-crime syndicate were obtained through one of Stark’s resellers.
“Reseller programs are a common practice in the hosting sector, with many top VPS (virtual private server) providers offering such services,” explained the cybersecurity firm. “Entities acquiring infrastructure through resellers are typically required to adhere to the service terms set by the primary provider.”
Additionally, Team Cymru has pinpointed further infrastructure linked to FIN7, revealing four IP addresses associated with Post Ltd, a broadband provider in Southern Russia, and three IP addresses from SmartApe, a cloud hosting company based in Estonia.
The first group of IP addresses has been noted for its outbound connections to at least 15 Stark-assigned hosts, previously identified by Silent Push over the last month. Similarly, the second group from Estonia has been found to interact with at least 16 Stark-assigned hosts.
“Furthermore, 12 of the hosts in the Post Ltd group were also detected in the SmartApe group,” Team Cymru reported. Stark has since suspended these services following a responsible disclosure.
“Analysis of the metadata for these interactions confirmed they were genuine connections, as evidenced by the evaluation of TCP flags and sampled data transfer volumes.”
