{
	"id": "ae62b4d5-27d3-4d19-a785-81f058f7f319",
	"created_at": "2026-04-06T00:11:46.628235Z",
	"updated_at": "2026-04-10T13:12:16.693594Z",
	"deleted_at": null,
	"sha1_hash": "3d761dea89536bf0c182f222cbed4ca34fa59848",
	"title": "FIN7 Uses Trusted Brands and Sponsored Google Ads to Distribute MSIX Payloads",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 5026124,
	"plain_text": "FIN7 Uses Trusted Brands and Sponsored Google Ads to Distribute\r\nMSIX Payloads\r\nBy eSentire Threat Response Unit (TRU)\r\nArchived: 2026-04-05 18:29:56 UTC\r\n2024-05-13 - This blog has been updated with additional details connecting it to previously observed\r\nFIN7 activity.\r\nAdversaries don’t work 9-5 and neither do we. At eSentire, our 24/7 SOCs are staffed with Elite Threat Hunters\r\nand Cyber Analysts who hunt, investigate, contain and respond to threats within minutes.\r\nWe have discovered some of the most dangerous threats and nation state attacks in our space – including the\r\nKaseya MSP breach and the more_eggs malware.\r\nOur Security Operations Centers are supported with Threat Intelligence, Tactical Threat Response and Advanced\r\nThreat Analytics driven by our Threat Response Unit – the TRU team.\r\nIn TRU Positives, eSentire’s Threat Response Unit (TRU) provides a summary of a recent threat investigation. We\r\noutline how we responded to the confirmed threat and what recommendations we have going forward.\r\nHere’s the latest from our TRU Team…\r\nWhat did we find?\r\nIn April 2024, eSentire’s Threat Response Unit (TRU) observed multiple incidents involving FIN7, a financially\r\nmotivated threat group based in Russia that has been active since 2013. The threat actors used malicious websites\r\nto impersonate well-known brands, including AnyDesk, WinSCP, BlackRock, Asana, Concur, The Wall Street\r\nJournal, Workable, and Google Meet.\r\nIn this TRU Positive, we will look at recently observed cases delivering NetSupport RAT via MSIX app installer\r\nfiles. These cases bear several similarities to previously reported FIN7 activity by Microsoft and Red Canary\r\nwhich is described at the end of this article.\r\nUsers visiting the malicious website via sponsored Google Ads would receive a fake pop-up prompting them to\r\ndownload a fake browser extension (Figure 1). The fake browser extension payload appears to be an MSIX file, a\r\nWindows app packaging format.\r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 1 of 12\n\nFigure 1: Malicious website serving the malicious payload\r\nWe found other websites controlled by FIN7 impersonating trusted brands using URLScan. You can find them\r\nhere.\r\nThe MSIX files we have observed are signed with “SOFTWARE SP Z O O” and “SOFTWARE BYTES LTD”. We\r\nsubmitted the request to GlobalSign to get the certificates successfully revoked.\r\nInfection Case One\r\nLet’s look at the first case involving the infection with NetSupport RAT.\r\nUpon extracting the MSIX file, we see that it contains the malicious PowerShell script (Figure 2).\r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 2 of 12\n\nFigure 2: Contents of the malicious MSIX file\r\nThe snippet of the malicious PowerShell script is shown below (Figure 3).\r\nFigure 3: Snippet of the PowerShell payload (1)\r\nThe PowerShell script collects system information such as the OS version and domain, retrieves the names of\r\ninstalled antivirus products, and generates a GUID. It then constructs a URL incorporating these details to\r\ndownload and Base64-decode a script from the C2 (Command and Control) server.\r\nIf the server response includes “usradm”, the script runs further commands to retrieve payloads from the C2 server.\r\nAdditionally, the script manages exceptions during its execution and reports errors back to the C2 server via URL\r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 3 of 12\n\nparameters (Figure 4).\r\nFigure 4: Snippet of the PowerShell payload (2)\r\nThe decoded script (Figure 5) downloads the NetSupport archive from the C2 server using a specific URL format:\r\nhxxps://cdn46[.]space/974afa0a-d334-48ec-a0d4-4cc14efa730c-1d3d044a-e654-41e3-ad32-38a2934393e4?\r\naklshdjahsjdh=25\u0026ajhsdjhasjhd=nsd\u0026iud=$iudValue and user-agent “myUserAgentHere”.\r\nNext, it extracts the contents of the zip file and stores the files under C:\\ProgramData\\netsupport path. Finally, the\r\nscript executes the extracted NetSupport RAT executable.\r\nFigure 5: The base64-decoded content\r\nInfection Case Two\r\nThe infection chain for the second case is like the first one, the user visited the malicious website meet-go[.]click\r\nto download a fake MSIX MeetGo installer. The MSIX payload dropped NetSupport RAT on the user’s machine.\r\nThe threat actor connected to the machine approximately three hours later via NetSupport RAT. \r\nThe threat actors used curl to retrieve csvde.exe (MD5: b6f12d39edbfe3b33952be4329064b35) via\r\nhxxp://91.219.238[.]214:4673/01/csvde.exe, which is a command-line tool for Windows that allows the import and\r\nexport of Active Directory data. The tool was used to execute the command:\r\ncsvde.exe  -r \"(\u0026(objectClass=Computer))\" -l\r\nsamAccountName,description,IPv4Address,info,operatingSystem -f 01cp.txt\r\nThe command exports data about computer objects into a text file (01cp.txt), including specific attributes like the\r\naccount name, description, IP address, general info, and operating system details. Next, the threat actor used curl to\r\nretrieve “Adobe_017301.zip” (MD5: e7b1fb0ef5dd20f4522945b902803f10) zip archive via\r\nhxxp://91.219.238[.]214:4673/01/Adobe_017301.zip. \r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 4 of 12\n\nThe contents (Figure 6) of the zip file are then extracted to c:\\programdata\\ with the command:\r\ntar  -zxvf c:\\programdata\\Adobe_017301.zip -C c:\\programdata\r\nsvchostc.exe is the renamed python.exe file (MD5: 0740803404a58d9c1c1f4bd9edaf4186) and svchostc.py (MD5:\r\n782621d1062a8fc7d626ceb68af314e5) is the Python payload.\r\nFigure 6: Contents of Adobe_017301.zip\r\nThe threat actor then performed additional reconnaissance by running the command “whoami /upn”, which\r\ndisplays the user principal name (UPN) of the currently logged-in user.\r\nThe host's persistence is achieved via scheduled tasks. The threat actor created the scheduled task “Updater” to run\r\nthe Python payload “svchostc.py.”\r\nSCHTASKS  /create /f /tn \"Microsoft\\Windows\\Updater\" /tr \"cmd /c\r\nc:\\programdata\\Adobe_017301\\svchostc.exe c:\\programdata\\Adobe_017301\\svchostc.py\" /sc minute /mo 1\r\n/RU \"NT AUTHORITY\\SYSTEM\"\r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 5 of 12\n\nThe Python payload's decryption and execution are implemented in the lambda function (_), which performs\r\ndecryption operations such as string reversal and base64 decoding.\r\nzlib decompression to retrieve the original executable content (Figure 7).\r\nFigure 7: Content of svchostc.py\r\nThe decrypted output would contain the encrypted DiceLoader payload and the encrypted instructions to allocate\r\nmemory with execute permissions, copy the decrypted payload into memory, and create and execute a new thread\r\nthat runs the payload, effectively performing a process injection (Figure 8).\r\nFigure 8: Decrypted code responsible for processing injection and memory allocation\r\nDiceLoader stores its C2 IPs and ports in the .data section. The data is XOR’ed with a hardcoded key located\r\nwithin the same section (Figure 10).  \r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 6 of 12\n\nFigure 9: XOR key and encrypted data in DiceLoader payload\r\nThe incidents of FIN7 exploiting trusted brand names and using deceptive web ads to distribute NetSupport RAT\r\nfollowed by DiceLoader highlight the ongoing threat, particularly with the abuse of signed MSIX files by these\r\nactors, which has proven effective in their schemes.\r\nConnections to Known FIN7 Activity\r\nPowerShell Script\r\nWe compared the latest version of the PowerShell script we observed with one from the MSIX payloads provided\r\nby Microsoft (MD5: 5b0b82f5c82a59d0b2c7b1bdaabd1848) in November 2023. The MSIX payload provided by\r\nMicrosoft, SHA256: 2ba527fb8e31cb209df8d1890a63cda9cd4433aa0b841ed8b86fa801aff4ccbd (first observed in\r\nNovember 2023). Both scripts contained similar host fingerprinting instructions, as well as the \"usradm\" string and\r\nthe \"73689d8a-25b4-41cf-b693-05591ed804a7-7433f7b1-9997-477b-aadc-5a6e8d233c61\" substring as shown in\r\nthe screenshot below. Notably the variable names have been obfuscated in the latest sample.\r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 7 of 12\n\nFigure 10: Comparison of PowerShell scripts seen in April 2024 and November 2023. Note, opening\r\nthe image in a new tab will display it at full resolution\r\nC2 Infrastructure\r\nsun47281[.]space, linked to FIN7 in Red Canary’s blog uses a similar ccTLD and name structure (alphabetic string\r\n+ numeric string + .space) as cdn46[.]space described in this report. The JARM fingerprint\r\n(15d3fd16d29d29d00042d43d000000fe02290512647416dcf0a400ccbc0b6b), also aligns between the two, as well\r\nas the other cdn*.space domains included in the IoCs section of this report. The aforementioned JARM fingerprint\r\nalso matches storageplace[.]pro, which was observed by both Microsoft and Red Canary.\r\nC2 URL Structure\r\nAs mentioned above, the C2 URLs bear similar path strings between previous and recent observations.\r\nExample of Previously Reported URLs:\r\nhxxp://sun47281[.]space/73689d8a-25b4-41cf-b693-05591ed804a7-7433f7b1-9997-477b-aadc-5a6e8d233c61?\r\nav\r\nhxxp://storageplace[.]pro/73689d8a-25b4-41cf-b693-05591ed804a7-7433f7b1-9997-477b-aadc-5a6e8d233c61?\r\nav\r\nhxxp://sun1[.]space/73689d8a-25b4-41cf-b693-05591ed804a7-7433f7b1-9997-477b-aadc-5a6e8d233c61?\r\nav=$names\u0026domain=$domain\u0026os=$urlencodedoscaption\u0026m=1\r\nRecently Observed:\r\nhxxps://cdn41[.]space/73689d8a-25b4-41cf-b693-05591ed804a7-7433f7b1-9997-477b-aadc-5a6e8d233c61?\r\nqKuKXnXZfhqq=$Se\u0026...\r\nhxxp://cdn46[.]space/73689d8a-25b4-41cf-b693-05591ed804a7-7433f7b1-9997-477b-aadc-5a6e8d233c61?\r\nhflrkvxabogf=\u0026...\r\nNetSupport RAT Signature\r\nThe NetSupport RAT client (MD5: 9497aece91e1ccc495ca26ae284600b9) we retrieved was signed with “Crosstec\r\nCorporation” (the entity was also mentioned by Red Canary in NetSupport RAT clients they observed) as shown\r\nbelow.\r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 8 of 12\n\nMSIX Creation Tool\r\nRecent samples discussed below were created with MSIX Packaging Tool version 1.2023.1005.0. This tool and\r\nversion were used to create November 2023 samples linked to FIN7 such as 2ac5924081c7976cd114def3e603a178\r\n(SHA256).\r\nWhat did we do?\r\nOur team of 24/7 SOC Cyber Analysts isolated the affected hosts and notified the customer of suspicious activities.\r\nWhat can you learn from this TRU Positive?\r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 9 of 12\n\nUsers should exercise caution when clicking on sponsored Google Ads, understanding that even legitimate-looking advertisement links can redirect to harmful content.\r\nThe malicious websites impersonating reputable brands demonstrate the effectiveness of social engineering.\r\nUsers should be cautious of downloading files from pop-up prompts, especially when browsing or\r\nredirected by ads.\r\nThe deceptive use of signed MSIX files underscores the need for vigilance even with seemingly legitimate\r\nfiles. Users should verify file sources and be skeptical of any unexpected download prompts.\r\nThe fact that the MSIX files were signed with company names but still contained malicious content\r\nhighlights the importance of checking digital certificates and being aware that certification does not\r\nguarantee safety.\r\nRecommendations from our Threat Response Unit (TRU):\r\nWe recommend implementing the following controls to help secure your organization against FIN7:\r\nConfirm that all devices are protected with Endpoint Detection and Response (EDR) solutions.\r\nImplement a Phishing and Security Awareness Training (PSAT) Program that educates and informs your\r\nemployees on emerging threats in the threat landscape.\r\nControl MSIX execution via AppLocker.\r\nReport certificate misuse.\r\nIndicators of Compromise\r\nYou can access the indicators here.\r\nReferences\r\nhttps://urlscan.io/search/#filename%3A%229e4e27b7-bcfb-4298-bf8f-2cf4a6bdb3bf-9b6b40d6-3f8e-4755-\r\n9063-562658ebdb95%22\r\nhttps://github.com/esThreatIntelligence/iocs/blob/main/FIN7/FIN7_IOCs_5-3-2024.txt\r\nhttps://www.microsoft.com/en-us/security/blog/2023/12/28/financially-motivated-threat-actors-misusing-app-installer/#:~:text=In%20mid%2DNovember%202023%2C%20Microsoft%20observed%20Sangria%20Tempest\r\nhttps://redcanary.com/blog/threat-intelligence/msix-installers/\r\nTo learn how your organization can build cyber resilience and prevent business disruption with eSentire’s Next\r\nLevel MDR, connect with an eSentire Security Specialist now.\r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 10 of 12\n\nGET STARTED\r\nABOUT ESENTIRE’S THREAT RESPONSE UNIT (TRU)\r\nThe eSentire Threat Response Unit (TRU) is an industry-leading threat research team committed to helping your\r\norganization become more resilient. TRU is an elite team of threat hunters and researchers that supports our 24/7\r\nSecurity Operations Centers (SOCs), builds threat detection models across the eSentire XDR Cloud Platform, and\r\nworks as an extension of your security team to continuously improve our Managed Detection and Response\r\nservice. By providing complete visibility across your attack surface and performing global threat sweeps and\r\nproactive hypothesis-driven threat hunts augmented by original threat research, we are laser-focused on defending\r\nyour organization against known and unknown threats.\r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 11 of 12\n\nSource: https://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nhttps://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads\r\nPage 12 of 12",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.esentire.com/blog/fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads"
	],
	"report_names": [
		"fin7-uses-trusted-brands-and-sponsored-google-ads-to-distribute-msix-payloads"
	],
	"threat_actors": [
		{
			"id": "9de1979b-40fc-44dc-855d-193edda4f3b8",
			"created_at": "2025-08-07T02:03:24.92723Z",
			"updated_at": "2026-04-10T02:00:03.755516Z",
			"deleted_at": null,
			"main_name": "GOLD LOCUST",
			"aliases": [
				"Anunak",
				"Carbanak",
				"Carbon Spider ",
				"FIN7 ",
				"Silicon "
			],
			"source_name": "Secureworks:GOLD LOCUST",
			"tools": [
				"Carbanak"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "bb8702c5-52ac-4359-8409-998a7cc3eeaf",
			"created_at": "2023-01-06T13:46:38.405479Z",
			"updated_at": "2026-04-10T02:00:02.961112Z",
			"deleted_at": null,
			"main_name": "FIN7",
			"aliases": [
				"ATK32",
				"G0046",
				"G0008",
				"Sangria Tempest",
				"ELBRUS",
				"GOLD NIAGARA",
				"Coreid",
				"Carbanak",
				"Carbon Spider",
				"JokerStash",
				"CARBON SPIDER"
			],
			"source_name": "MISPGALAXY:FIN7",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		},
		{
			"id": "f4f16213-7a22-4527-aecb-b964c64c2c46",
			"created_at": "2024-06-19T02:03:08.090932Z",
			"updated_at": "2026-04-10T02:00:03.6289Z",
			"deleted_at": null,
			"main_name": "GOLD NIAGARA",
			"aliases": [
				"Calcium ",
				"Carbanak",
				"Carbon Spider ",
				"FIN7 ",
				"Navigator ",
				"Sangria Tempest ",
				"TelePort Crew "
			],
			"source_name": "Secureworks:GOLD NIAGARA",
			"tools": [
				"Bateleur",
				"Carbanak",
				"Cobalt Strike",
				"DICELOADER",
				"DRIFTPIN",
				"GGLDR",
				"GRIFFON",
				"JSSLoader",
				"Meterpreter",
				"OFFTRACK",
				"PILLOWMINT",
				"POWERTRASH",
				"SUPERSOFT",
				"TAKEOUT",
				"TinyMet"
			],
			"source_id": "Secureworks",
			"reports": null
		},
		{
			"id": "bfded1cf-be73-44f9-a391-0751c9996f9a",
			"created_at": "2022-10-25T15:50:23.337107Z",
			"updated_at": "2026-04-10T02:00:05.252413Z",
			"deleted_at": null,
			"main_name": "FIN7",
			"aliases": [
				"FIN7",
				"GOLD NIAGARA",
				"ITG14",
				"Carbon Spider",
				"ELBRUS",
				"Sangria Tempest"
			],
			"source_name": "MITRE:FIN7",
			"tools": [
				"Mimikatz",
				"AdFind",
				"JSS Loader",
				"HALFBAKED",
				"REvil",
				"PowerSploit",
				"CrackMapExec",
				"Carbanak",
				"Pillowmint",
				"Cobalt Strike",
				"POWERSOURCE",
				"RDFSNIFFER",
				"SQLRat",
				"Lizar",
				"TEXTMATE",
				"BOOSTWRITE"
			],
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "d85adfe3-e1c3-40b0-b8bb-d1bacadc4d82",
			"created_at": "2022-10-25T16:07:23.619566Z",
			"updated_at": "2026-04-10T02:00:04.690061Z",
			"deleted_at": null,
			"main_name": "FIN7",
			"aliases": [
				"APT-C-11",
				"ATK 32",
				"G0046",
				"Gold Niagara",
				"GrayAlpha",
				"ITG14",
				"TAG-CR1"
			],
			"source_name": "ETDA:FIN7",
			"tools": [
				"7Logger",
				"Agentemis",
				"Anubis Backdoor",
				"Anunak",
				"Astra",
				"BIOLOAD",
				"BIRDWATCH",
				"Bateleur",
				"Boostwrite",
				"CROWVIEW",
				"Carbanak",
				"Cobalt Strike",
				"CobaltStrike",
				"DICELOADER",
				"DNSMessenger",
				"FOWLGAZE",
				"HALFBAKED",
				"JSSLoader",
				"KillACK",
				"LOADOUT",
				"Lizar",
				"Meterpreter",
				"Mimikatz",
				"NetSupport",
				"NetSupport Manager",
				"NetSupport Manager RAT",
				"NetSupport RAT",
				"NetSupportManager RAT",
				"POWERPLANT",
				"POWERSOURCE",
				"RDFSNIFFER",
				"Ragnar Loader",
				"SQLRAT",
				"Sardonic",
				"Sekur",
				"Sekur RAT",
				"TEXTMATE",
				"Tirion",
				"VB Flash",
				"cobeacon"
			],
			"source_id": "ETDA",
			"reports": null
		}
	],
	"ts_created_at": 1775434306,
	"ts_updated_at": 1775826736,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/3d761dea89536bf0c182f222cbed4ca34fa59848.pdf",
		"text": "https://archive.orkl.eu/3d761dea89536bf0c182f222cbed4ca34fa59848.txt",
		"img": "https://archive.orkl.eu/3d761dea89536bf0c182f222cbed4ca34fa59848.jpg"
	}
}