FIN7 Campaign Targets Global Organizations With Phishing, Edge Exploits and Cloud Account Abuse

FIN7 Campaign Shows Continued Risk From Hybrid Intrusion Techniques

Insomnia threat-intelligence analysts are tracking what they describe as an active campaign attributed with high confidence to FIN7, also known as Carbanak and Sangria Tempest.

According to the September 21, 2026 report, the activity has targeted organizations across retail, hospitality, restaurants and financial services. The reported campaign combines several established intrusion methods, including spearphishing, exploitation of internet-facing infrastructure and the abuse of valid cloud-account credentials.

Insomnia assesses the reported operational objectives as payment-card theft and large-scale extortion.

The report says the activity has been observed across 22 countries, with 291 confirmed victims and a median dwell time of 110 days. It also reports that 102 command-and-control domains have been identified as burned infrastructure.

These figures are specific to Insomnia's observed campaign data and should not be interpreted as a measurement of FIN7's total global activity.

FIN7's Reported Attack Surface

The campaign described by Insomnia does not rely on a single entry technique. Instead, attackers reportedly use different routes depending on the target.

The three main initial-access paths identified in the report are:

• Tailored spearphishing emails

• Exploitation of unpatched edge-facing appliances

• Stolen or purchased valid-account credentials

Insomnia estimates that approximately 41% of the engagements it analyzed began with tailored spearphishing emails.

Another 29% reportedly started through exploitation of unpatched edge infrastructure, including products from Fortinet, Citrix, Ivanti and Microsoft Exchange.

The remaining engagements were attributed to stolen or purchased valid credentials.

This combination is significant because it places both human users and externally exposed infrastructure within the reported attack surface.

What Happens After Initial Access?

Insomnia reports that once attackers establish a foothold, they can move rapidly through the environment.

The report states that operators pivot into domain credentials within approximately four to six hours. It also describes activity involving Active Directory discovery, enumeration of hybrid Azure AD environments and the establishment of persistence through OAuth application consents.

OAuth application consent is particularly relevant in cloud environments because applications can receive permissions to access organizational resources. If attackers obtain inappropriate permissions, they may be able to maintain access without relying solely on traditional endpoint persistence.

Insomnia specifically highlights unusual OAuth application registrations in Entra ID as a detection opportunity.

The report recommends paying particular attention to applications requesting permissions such as Mail.Read or Directory.Read.

Reported FIN7 Techniques Mapped to MITRE ATT&CK

Insomnia mapped the observed activity to several MITRE ATT&CK techniques and states that each listed technique was witnessed in at least three separate incidents during the quarter covered by its analysis.

The techniques identified include:

• T1566.002 - Spearphishing Link

• T1059.001 - PowerShell

• T1218.005 - Mshta

• T1055.012 - Process Hollowing

• T1047 - Windows Management Instrumentation

These techniques cover different stages of an intrusion, from initial access and execution to process manipulation and system administration.

For defenders, this illustrates why detection based on a single indicator can be insufficient. Multiple behaviors may need to be correlated across email, endpoint, identity and network telemetry.

Malware Families Associated With the Campaign

The report identifies four malware families in its campaign overview:

The report's table associates different capabilities with each family. These classifications are presented here as reported by Insomnia rather than as an independent assessment.

The presence of multiple malware families also shows that the campaign cannot be understood through one malware signature alone. Detection programs may need to combine malware indicators with behavioral signals and identity activity.

Persistence Through OAuth Applications

One of the more notable elements of the reported intrusion chain is the use of OAuth application consents for persistence.

Traditional endpoint-focused monitoring often concentrates on processes, files, scheduled tasks and other host-level activity. Cloud identity environments introduce another layer where attackers may attempt to maintain access through authorized applications and permissions.

Insomnia recommends monitoring unusual OAuth application registrations in Entra ID, particularly when applications request permissions such as Mail.Read or Directory.Read.

For organizations using hybrid identity environments, this highlights the importance of monitoring both endpoint behavior and cloud identity changes.

Detection Signals Highlighted by Insomnia

Insomnia provides several indicators that defenders can use when hunting for activity associated with the campaign.

1. Unusual OAuth Applications

Organizations should monitor unexpected application registrations in Entra ID and investigate applications requesting sensitive directory or mail permissions.

2. Suspicious Scheduled Tasks

The report highlights scheduled tasks created by non-interactive SYSTEM sessions, especially tasks that execute during logon and use PowerShell to decode Base64 data.

3. LSASS Memory Access

Insomnia recommends looking for LSASS memory-read activity from processes other than expected trusted processes and security tooling.

4. Suspicious Outbound TLS Connections

The report also recommends investigating outbound TLS connections to newly registered domains with valid Let's Encrypt certificates and correlating them with JA3 fingerprints found in known-bad feeds.

These signals should be treated as hunting leads rather than proof of compromise. Individual indicators can have legitimate explanations in enterprise environments and should be investigated in context.

What the Report Means for Defenders

The FIN7 activity described by Insomnia demonstrates how modern intrusions can combine several security layers.

An attacker may begin with an email or exposed infrastructure, move into credentials and directory services, and then use cloud identity mechanisms for persistence. This means organizations cannot depend exclusively on endpoint antivirus or perimeter security.

A broader defensive approach can include:

• Monitoring phishing and suspicious email activity

• Maintaining internet-facing appliances and services with current security updates

• Protecting privileged and cloud credentials

• Reviewing OAuth application registrations and permissions

• Monitoring Active Directory and hybrid identity environments

• Correlating endpoint, identity, DNS and network telemetry

• Investigating suspicious PowerShell and scheduled-task activity

• Monitoring unusual access to LSASS memory

• Tracking newly registered domains and suspicious outbound connections

The report also recommends that organizations with exposure indicators assume potential compromise, isolate suspicious endpoints and conduct a broader investigation.

Insomnia's Threat-Hunting Tools

Insomnia includes several command-line examples in its report for customers using its threat-hunting capabilities.

The examples cover running a FIN7 threat-actor playbook against telemetry, sweeping firewall, DNS and proxy logs for current indicators, and generating a threat report.

The report also states that an apt:fin7 automated scan profile was added to its latest CVE data pack for customers using automatic updates.

Additional details about the underlying detection rules were not disclosed in the announcement.

Why Identity Security Matters in Modern Intrusions

The reported FIN7 campaign illustrates a broader industry shift toward attacks that cross traditional security boundaries.

An organization can have endpoint protection, network monitoring and vulnerability management in place while still facing risk through compromised credentials or unauthorized cloud application permissions.

For enterprises, this could mean that identity telemetry needs to be considered alongside traditional endpoint and network signals.

The reported use of OAuth persistence is particularly relevant because cloud applications and identity permissions can remain active even when an organization is focused primarily on removing malicious files from endpoints.

Final Takeaway

Insomnia's September 21, 2026 report describes an active FIN7 campaign using a combination of spearphishing, exploitation of exposed infrastructure and valid-account abuse.

The reported intrusion chain extends from initial access into credential theft, Active Directory discovery, hybrid identity enumeration and OAuth-based persistence.

For defenders, the key lesson is the importance of connecting signals across email, endpoints, identity systems and network infrastructure rather than treating each security layer separately.

The campaign details presented by Insomnia are based on the company's own threat-intelligence observations. Organizations should validate relevant indicators against their own telemetry before concluding that FIN7 activity is present in their environments.