Network Security
Vulnerability Management
Privileged Access Management
Endpoint Security
Threat Hunting
Unified Endpoint Management
Email & Collaboration Security
Contents:
Andrii Kolpakov, the Ukrainian national that was a supervisor of the FIN7 hacking group has been sentenced to seven years in prison.
Kolpakov was arrested in Spain in 2018 and extradited to the U.S. the following year. In June 2020, he pleaded guilty to one count of conspiracy to commit wire fraud and one count of conspiracy to commit computer hacking.
He was involved with the group starting 2016 and until his arrest was in charge of managing other hackers tasked with breaching the point-of-sale systems of companies, both in the U.S. and elsewhere, in order to deploy malware that was capable of stealing financial information.
FIN7 hacking group is also called Anunak, Carbanak Group, and the Navigator Group, and is known for the engagement it had in a sophisticated malware campaign targeting restaurant, gambling, and hospitality industries in the U.S. in order to obtain credit and debit card numbers that were then used or sold for profit on underground forums.
It looks like the FIN7 hacking group used a firm called Combi Security as a front to recruit hackers — one of them being Kolpakov in an attempt to “provide a veil of legitimacy to the illegal enterprise,” while projecting itself as “one of the leading international companies” that offered penetration testing services to customers worldwide.
According to public documents, since at least 2015, members of FIN7 (also referred to as Carbanak Group and the Navigator Group, among other names) engaged in a highly sophisticated malware campaign to attack hundreds of U.S. companies, predominantly in the restaurant, gambling and hospitality industries. FIN7 hacked into thousands of computer systems and stole millions of customer credit and debit card numbers that were then used or sold for profit. FIN7, through its dozens of members, launched waves of malicious cyberattacks on numerous businesses operating in the United States and abroad. FIN7 carefully crafted email messages that would appear legitimate to a business’s employees and accompanied emails with telephone calls intended to further legitimize the emails. Once an attached file was opened and activated, FIN7 would use an adapted version of the Carbanak malware, in addition to an arsenal of other tools, to access and steal payment card data for the business’s customers. Since 2015, many of the stolen payment card numbers have been offered for sale through online underground marketplaces.
In the United States alone, FIN7 successfully breached the computer networks of businesses in all 50 states and the District of Columbia, stealing more than 20 million customer card records from over 6,500 individual point-of-sale terminals at more than 3,600 separate business locations. According to court documents, victims incurred enormous costs that, according to some estimates, exceeded $1 billion. Additional intrusions occurred abroad, including in the United Kingdom, Australia and France. Companies that have publicly disclosed hacks attributable to FIN7 include Chipotle Mexican Grill, Chili’s, Arby’s, Red Robin and Jason’s Deli.
Kolpakov was involved with FIN7 from at least April 2016 until his arrest in June 2018. He also managed other hackers tasked with breaching the security of victims’ computer systems. During the course of the scheme, Kolpakov received compensation for his participation in FIN7, which far exceeded comparable legitimate employment in Ukraine. Moreover, FIN7 members, including Kolpakov, were aware of reported arrests of other FIN7 members, but nevertheless continued to attack U.S. businesses.
Kolpakov is not the first member of the FIN7 group that was sentenced in the U.S. since the start of the year, as in April Fedir Hladyr was given 10 years in prison for the role he played as a high-level manager and systems administrator responsible for maintaining the server infrastructure that FIN7 used to attack and control victims’ machines.
Dora is a digital marketing specialist within Heimdal™ Security. She is a content creator at heart - always curious about technology and passionate about finding out everything there is to know about cybersecurity.
