FIN7 is known throughout the threat landscape as a longstanding financially motivated organization often targeting the United States during their operations. The group utilizes a variety of malware strains to carry out their attacks, including those developed by the REvil and Maze threat groups. Recent activity has shown that FIN7 actors have adopted a strain of the Cl0p ransomware variant to deploy during their attacks. Current attacks highlight the use of a PowerShell-based malware dropper script called “POWERTRASH” as first stage deployment in FIN7 attacks. In the second stage deployment, a post-exploitation tool codenamed “Lizar” is executed on the compromised system allowing for remote access into the compromised entity. In addition, threat actors are given the capability to move laterally within the network and spread the Cl0p ransomware strain. Aside from Cl0p, security researchers note additional ransomware strains such as “Bl00dy” and “LockBit” being used in FIN7 attacks. This recent activity shows that the FIN7 organization is continuing to operate even though numerous key members were arrested several months ago. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.