THREAT ACTOR PROFILE
![](data:image/svg+xml,<svg display="block" role="presentation" viewBox="0 0 512 512" xmlns="http://www.w3.org/2000/svg"><path d="M 0 82.286 L 0 0 L 53.571 0 L 53.571 14.571 L 18 14.571 L 18 32.571 L 50.142 32.571 L 50.142 48 L 18 48 L 18 82.286 Z M 60.6 82.286 L 60.6 0 L 78.6 0 L 78.6 82.286 Z M 87.342 82.286 L 87.342 0 L 102.771 0 L 136.2 48.428 L 136.2 0 L 155.057 0 L 155.057 82.286 L 138.771 82.286 L 105.342 31.714 L 105.342 82.286 Z M 166.8 82.286 L 199.371 14.571 L 161.228 14.571 L 161.228 0 L 218.228 0 L 218.228 14.571 L 185.228 82.286 Z" fill="rgb(37, 101, 195)" height="82.286px" id="QJcEhCGPX" transform="translate(145.929 366.006)" width="218.22799682617188px"/><path d="M 0 0 L 0 59.429 L 18.286 59.429 L 18.286 0 Z" fill="rgb(37, 101, 195)" height="59.428599999999996px" id="hMducidbQ" transform="translate(249.23 59.43)" width="18.28600000000003px"/><path d="M 137.143 95.893 L 137.143 142.657 C 137.774 143.605 138.375 144.574 138.947 145.563 L 164.572 145.563 L 164.572 54.321 L 137.143 35.121 L 137.143 74.568 L 118.857 63.597 L 118.857 0 L 182.857 44.8 L 182.857 172.989 C 182.857 223.484 141.924 264.42 91.429 264.42 C 40.934 264.42 0 223.486 0 172.991 L 0 44.8 L 64 0 L 64 105.162 C 62.948 105.588 61.908 106.038 60.881 106.511 C 35.722 118.093 18.287 143.514 18.286 172.989 C 18.286 213.385 51.033 246.134 91.429 246.134 C 131.825 246.134 164.572 213.385 164.572 172.989 L 164.572 163.848 L 145.528 163.848 C 146.026 166.822 146.286 169.876 146.286 172.991 C 146.286 203.288 121.726 227.848 91.429 227.848 C 61.132 227.848 36.572 203.288 36.572 172.991 C 36.572 152.686 47.603 134.958 64 125.473 L 64 148.801 C 58.31 155.248 54.857 163.716 54.857 172.991 C 54.857 193.189 71.231 209.563 91.429 209.563 C 111.627 209.563 128 193.189 128 172.991 C 128 152.793 111.627 136.42 91.429 136.42 C 88.272 136.42 85.208 136.82 82.286 137.572 L 82.286 72.42 L 98.021 72.42 Z M 100.572 94.085 L 100.572 118.892 C 107.136 119.994 113.304 122.261 118.857 125.473 L 118.857 105.674 Z M 18.286 118.127 C 25.68 108.286 35.013 99.986 45.715 93.796 L 45.715 35.12 L 18.286 54.321 Z" fill="rgb(37, 101, 195)" height="264.4199px" id="TBqBRDdEN" transform="translate(166.944 64.725)" width="182.857px"/></svg>)
FIN7 is one of the most prolific financially motivated cybercrime groups of the last decade, active since around 2013 and tied to the Carbanak bank-theft operations. It has evolved from point-of-sale and ATM theft into a broad criminal enterprise that now feeds ransomware operations and sells access and tooling.
Russia-based
Financial services / Retail
First seen
2013
Latest IOC
-
TABLE OF CONTENTS
NAMES AND ALIASES
-
-
-
-
-
GROUP PROFILE
Facts:
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Initial Access
Russian Federation · GRU
Victims reported in our records and posts:
-
-
-
-
-
-
-
-
ATTACK LIFECYCLE
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
MALWARE AND TOOLING
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
Initial Access
Spear-phishing remains the front door. In the 2026 campaign Hunt.io tracked as Operation Neusploit, APT28 sent convincing spear-phishing from already-compromised government accounts and abused a Microsoft Office security bypass (CVE-2026-21509) to kick off a fileless chain. A separate June 2026 cluster delivered the LameHug malware through spear-phishing ZIP archives using double-extension lures.
CVES EXPLOITED
CVE-2026-21509
A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.
CVE-2026-21509
A Microsoft Office security bypass used to open the fileless chain in Operation Neusploit, and again in the PixyNetLoader intrusion chain. Both campaigns paired the exploit with spear-phishing from compromised accounts rather than mass exploitation.
IOCS FROM HUNT.IO PLATFORM
Latest IOCs
We currently track - IP indicators, - hosts, and - SHA256 hashes for Akira across - intelligence posts, with the most recent indicator dated -. The sample below is limited to indicators from the latest posts. It is not the full set.
NOTABLE CAMPAIGNS
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.
PixyNetLoader tracking
A clustering of roughly 90 loader samples across four sub-families from 2024 to 2026, with steganography and cloud C2, also linking to related APT28 tooling such as SlimAgent and Graphite.