FIN7, a top-tier threat organization comprised of members from various threat groups, has been discovered showing signs of collusion with ransomware organizations while also increasing its arsenal of malicious programs and payloads. FIN7 is a financially motivated cybercriminal group that commonly targets United States-based entities within the hospitality, restaurant, and retail industries and has been in operation since at least 2015. In a recent campaign, FIN7 compromised the integrity of a digital product shopping website and redirected the download links to an Amazon S3 bucket, which downloaded a malicious Atera agent, leading to the infection from the new PowerPlant malware. Furthermore, FIN7 continues to evolve payloads it already possessed, such as using new versions of the BirdWatch downloader dubbed CrowView and FowlGaze. Based on indicators from recent ransomware compromises, security researchers assess ransomware organizations, such as REvil and ALPHV, appear to be working alongside each other. Further analysis of FIN7 determined that the threat organization likely conducted reconnaissance and intrusion tactics against its targets, which was promptly followed by ransomware infection. Researchers at Mandiant noted a code signing certificate utilized by FIN7 which also signed multiple DarkSide ransomware strains. With the increase in activity from FIN7 and threat actors worldwide, CTIX analysts encourage security teams to ensure their infrastructure is up-to-date and protected by security controls to lessen the chance for threat actor compromise.