FIN7 Uses AI "Nudify" Sites to Distribute Malware
Researchers from Silent Push reported that FIN7, a Russia-based financially motivated threat group, has been operating AI deepfake "nudify" websites to distribute malware infostealers and remote access trojans. The sites, including those under the brand "aiNude.ai," trick users into downloading malicious files while posing as AI nude image generators.
What happened
Researchers from Silent Push observed FIN7, a Russia-based financially motivated threat group, operating at least seven websites promising to generate fake nude images using artificial intelligence. The sites, many under the brand name aiNude.ai, embedded trojans or infostealers in web extensions or other downloadable files that users were directed to download.
FIN7 used two versions of the attack: one offering a free download of a 'Deepnude Generator' tool, and another providing a putative free trial process. When users uploaded photos to the sites, the images were displayed on screen but the site did not actually generate any nude images. Instead, users were then directed to download a file labeled as a 'trial is ready for download.'
Reported impact
FIN7 served up Lumma Stealer, the NetSupport remote access Trojan, and Redline credential stealing malware through these sites. Organizations may become vulnerable as FIN7 lures unsuspecting employees to download these malicious files, which may directly compromise credentials or be used for follow-on campaigns that deploy ransomware.
Index analysis
FIN7, also tracked as Carbon Spider, Elbrus, and Sangria Tempest, has been active since 2013. Security researchers have found indications of its involvement in deploying REvil and DarkSide ransomware, and Microsoft reported the group has ties to the Clop ransomware gang.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.