FIN7, the infamous financially motivated and highly skilled group of hackers that have been targeting U.S. businesses since 2015, has been identified using the company “Bastion Secure” as a front for their latest operations. Uncovered by the Gemini Advisory, FIN7 uses this name to recruit unsuspecting penetration testers and security experts to unknowingly hack into companies and exfiltrate sensitive information. Those who were interviewed went through a three (3) step process. After successfully interviewing, applicants signed a non-disclosure agreement (NDA) and were instructed to install several virtual machines. They were then given access to the company’s custom penetration testing tools, which included “Command Manager”, a disguised program that behind-the-scenes operated as the client version of Carbanak, a remote access and data exfiltration tool created and used by FIN7. The job applicant was then given access to a “Bastion Security client’s” network and told to collect information such as domain administrators, file shares, and backup locations. This assignment mimics how an affiliate would be vetted and put to work on a real ransomware operation. The US Department of Justice previously attributed the fake cybersecurity firm “Combi Security” to the FIN7 group in July of 2018, which shows that this is not the first time this group has attempted to leverage legitimate ethical hackers for their criminal operations. CTAPT analysts are monitoring this situation and will update if any other details are released.