Russian cybercrime group FIN7 has been identified using a sophisticated Python backdoor called Anubis to gain remote access to compromised Windows systems. According to cybersecurity firm PRODAFT, this malware enables attackers to execute shell commands and system operations, providing complete control over infected machines.

FIN7, also known by aliases such as Carbon Spider, ELBRUS, and Savage Ladybug, has continuously evolved its malware arsenal for initial access and data exfiltration. The group has reportedly shifted toward ransomware operations in recent years. In July 2024, FIN7 was observed marketing a security tool disabler called AuKill (AvNeutralizer), suggesting efforts to diversify its revenue streams.

The Anubis backdoor typically spreads through malicious spam campaigns that trick victims into executing payloads hosted on compromised SharePoint sites. The infection begins with a ZIP archive containing a Python script that decrypts and executes the main payload directly in memory, avoiding disk-based detection.

Once activated, Anubis establishes Base64-encoded communications with command servers over TCP sockets. The backdoor’s capabilities include:

– Gathering host IP information
– Uploading and downloading files
– Navigating directory structures
– Accessing environment variables
– Modifying Windows Registry entries
– Loading DLL files into memory
– Self-termination when needed

GDATA’s analysis revealed that Anubis can also run operator-provided commands directly on victim systems. PRODAFT notes that this lightweight design allows attackers to perform advanced operations like keylogging, screenshot capture, and password theft without storing these capabilities on the infected system, reducing detection risk while maintaining operational flexibility.