Cybersecurity researchers have unveiled new infrastructure linked to the notorious financially motivated threat actor FIN7. In the investigation, two (2) clusters of potential FIN7 activity were identified with IP addresses from Post Ltd in Russia and SmartApe in Estonia. These findings build on prior discoveries of Stark Industries IP addresses dedicated to hosting FIN7 infrastructure. The analysis indicates that the hosts associated with FIN7 were likely procured through reseller programs, a common practice in the hosting industry. This provides customers with secure infrastructure while adhering to the terms of service of the parent hosting entity. The investigation identified additional infrastructure linked to FIN7, uncovering four (4) IP addresses from Post Ltd and three (3) from SmartApe, all of which communicated with numerous Stark-assigned hosts in recent months. The researchers observed that twelve (12) hosts in the Russian cluster were also present in the Estonian cluster, underscoring the interconnected nature of FIN7’s infrastructure. Following responsible disclosure, Stark Industries has suspended these services to mitigate the threat. The metadata review confirmed the established connections, providing a comprehensive view of FIN7’s operational infrastructure. CTIX Analysts will continue tracking activity related to prolific cybercriminal groups, like FIN7.