Researchers have observed a new backdoor dubbed “Domino” that they believe was likely developed by the FIN7 Russian cybercriminal group and is being utilized by former Conti affiliates since at least February 2023. This belief is due to code overlaps between Domino Backdoor and the “Lizar” malware family (also known as “Tirion” and “Diceloader”), which is linked to FIN7. Lizar is known to collect sensitive information from “clipboard, Discord, web browsers, crypto wallets, VPN services, and other apps.” Domino’s focus is to obtain victims’ system information and send the data to its command-and-control (C2) server, where an AES encrypted payload is sent in return. Researchers emphasized that the returned payload, named “Domino Loader”, is a second payload that has coded overlaps with Domino Backdoor. Domino is currently being used to deliver “either the Project Nemesis information stealer or more capable backdoors such as Cobalt Strike” and has been observed using the Dave Loader (which has been linked to Conti/Trickbot). Domino has been active in the wild since at least October of 2022. Additional technical details as well as indicators of compromise (IOCs) can be viewed in the report linked below.