HC3 Analyst Note TIP White - FIN11 Cybercrime Group Moves into Ransomware and Extortion

Mandiant recently elevated a tracked threat cluster to the named threat group FIN11. Beginning in 2016 with phishing campaigns, this group has moved into double extortion ransomware operations utilizing CLOP ransomware. They indiscriminately attack organizations in every sector, including the pharmaceutical industry, via large phishing campaigns. Mitigations for the Healthcare and Public Health (HPH) sector can be found at the end of the report.