DEMO
You are viewing a demo with synthetic data.to connect your own infrastructure.

FIN7 POS Malware Deployment

contained
Attacker Type
HUMAN
Confidence
81%
Kill Chain
Lateral Movement
Events
178
CRS Score
87
Elapsed
15m

EVENT TIMELINE

high13:00:00

Phishing payload executed on finance workstation

critical13:00:30

Lateral movement toward payment network detected

info13:01:00

CIE: Payment network micro-segmented

ATTACK NARRATIVE

A FIN7-attributed attacker is attempting lateral movement toward the payment processing network segment. Entry was through a phishing email targeting a finance department employee. The Network Agent detected anomalous east-west traffic patterns and the CIE has segmented the payment network with micro-segmentation rules. All paths to POS terminals have been sealed.

Affected Assets

workstation-finance-04switch-core-01vlan-payment-processing

Agent Layers Involved

networkappidentity

PREDICTED NEXT MOVES

01Deploy memory scraper on POS terminals
02Establish C2 via DNS tunneling
03Move to payment processing network segment

Pre-Blocked Paths

BLOCKEDDeploy memory scraper on POS terminals
BLOCKEDEstablish C2 via DNS tunneling
BLOCKEDMove to payment processing network segment

COUNTER-ACTIONS EXECUTED

Micro-segmented payment network
13:01:00
100%
Quarantined compromised workstation
13:01:30
100%
Deployed network decoys in compromised VLAN
13:02:00
88%