FIN10: Anatomy of a Cyber Extortion OperationFireEye has identified a set of financially motivated intrusion
operations being carried out by a threat actor we have dubbed FIN10.
FIN10 is known for compromising networks, stealing sensitive data, and
directly engaging victim executives and board members in an attempt to
extort them into paying between 100 and 500 bitcoins (valued at
between $125,000 and $600,000 as of mid-April 2017).
For some victims that did not give into the demand, FIN10 escalated
their operation and destroyed critical production systems and leaked
stolen data to journalists in an attempt to increase visibility of the
compromise and coerce victims into paying up.
The first known FIN10 operation was in 2013 and their operations
have continued until at least 2016. To date, we are primarily aware of
Canadian victims – specifically casinos and mining organizations.
Given the release of sensitive victim data, extortion, and destruction
of systems, FireEye considers FIN10 to be one of the most disruptive
threat actors observed in the region so far.
Download our report,
FIN10: Anatomy
of a Cyber Extortion Operation, to learn more about FIN10, including:
- The tactics, techniques and procedures used by FIN10 to
conduct their operations. - The multiple monikers used by
FIN10 such as “Tesla Team”, “Angels of Truth”, and “Anonymous Threat
Agent” to throw false flags. - Lessons learned when
responding to FIN10 breaches, including considerations for engaging
the threat actor and complying with extortion demands.
Learn more
about FIN10 and how to combat the threat.
Source:
FIN10: Anatomy of a Cyber Extortion Operation
