,
9 tweets,
4 min read
Read on Twitter
Although #FIN10 achieved some success targeting the 🇨🇦 casino and mining industry, @FireEye hasn't discussed the actor much since the June, 2017 blog article fireeye.com/blog/threat-re…, because, well… the techniques are a bit abecedarian. (h/t thesaurus.com).
FIN10 has gone from targeting those industries, stealing PII and extorting victims for BTC, to posting particularly lame, decimal encoded phishing lures to Canadian stock market forums, directing victims to EMPIRE downloads. Decimal encoded URLs are a consistent FIN10 TTP. 
To lend some legitimacy to the phishing lures, FIN10 registers masquerade domains and establishes websites using scrapped source code from legitimate domains. #trashtics
In June 2017, using the name Bobby Feng, FIN10 registered a domain newsbtc[.]info (now expired) masquerading as legitimate site newsbtc[.]com, a site covering Bitcoin news.
FIN10 simply scrapped source code from the legit site and clumsily used the code for a fake domain (another FIN10 TTP). Recently FIN10 has established a masquerade domain for newswire[.]com (@inewswire), swiping code from the legit domain and registering canada-newswire[.]com
FIN10 is likely trying to leverage a website using Newswire bona fides to target the Canadian stock trade forums. Amusingly, the domain was suspended shortly after registration because the Registrant email address was not verified, but the source code is still at the noted IP.
FIN10 is certainly a D-List celebrity amongst FireEye’s 40 APT and 10 FIN groups, but it’s entertaining to check-in to see this actor’s current activity. Those accessing 🇨🇦 trading forums should be aware of FIN10 TTPs and be on the lookout for canada-newswire[.]com variants.
Although FIN10 is a bit 😴 now, #AdversaryPursuit will stay on the case. There are no indications that @inewswire, the stock forums, or other legitimate domains were compromised during this ongoing campaign. #threatintel
whoops, copy/paste error. The payload is APH.hta
