FIN7 Cybercrime Gang Returns with the Lizar Backdoor
The hackers from the FIN7 cybercrime gang are best-known for their involvement in the development and usage of the Carbanak Trojan, one of the most notorious banking Trojans to be released online. Just like other financially motivated threat actors, this group also focuses on stealing financial information from its victims – they do this by employing a wide range of hacking tools and approaches. One of the latest threats to be involved in their attacks is the Lizar Backdoor.
The FIN7 hackers have opted to approach a very peculiar approach to distribute the malicious application. The criminals pretend to be part of a legitimate company involved in cybersecurity, and the Lizar Backdoor payload is advertised as a free Windows penetration-testing tool. This may sound simple, but, in reality, their approach is very sophisticated – they have even hired legitimate people to work from them without revealing that they are part of a cybercrime campaign or that the company they work for is fake.
FIN7 Hackers go after Companies in the IT, Pharmaceutical, Hospitality, and Educational Sectors
FIN7's usual targets are companies in the hospitality, restaurant, and gambling sectors. This time, however, they have opted to expand their reach a bit. The Lizar Backdoor has been found on networks involved with educational institutions, pharmaceutical companies, and a Germany-based software development company.
According to cybersecurity experts, the Lizar Backdoor is very similar to Carbanak in terms of its structure – it also consists of a core module whose functionality can be expanded with the use of plugins. Some of Lizar Backdoor's modules allow it to:
- Execute remote commands.
- Download and initialize a new module.
- Grab passwords from Windows, browsers, or Remote Desktop Protocol (RDP) services.
- Retrieve hardware, software, and configuration data about the infected system.
- Manage running processes.
- Use the Mimikatz tool to obtain passwords.
- Grab screenshots.
- Initialize additional malware (like Carbanak.)
The FIN7 hackers have caused tens of millions of dollars in damages during their campaigns, and the Lizar Backdoor is the latest hacking tool to aid them in their malicious operations. Companies can protect their networks by investing in reputable antivirus and firewall software, as well as by only communicating with trustworthy security vendors and companies.
