"Our visibility into FIN4 is limited to their network operations, so we cannot say for certain what happens after they gain access to insider information," the FireEye report says. "What we can say is that FIN4's network activities must reap enough benefit to make these operations worth supporting for over a year and in fact, FIN4 continues to compromise new victims as we finish this report."
What to do?
For companies seeking to defend against FIN4, FireEye has posted a list of indicators that flag FIN4 traffic in order to help organizations detect the attacks.
FireEye recommends that companies block these domains, which are known to be command-and-control domains used in the attacks:
In addition the company recommends disabling VBA macros in Microsoft Office and enabling two-factor authentication for Outlook Web Access to decrease the value of stolen credentials.
Concerned companies can check their logs for OWA logins from known Tor exit nodes, which legitimate users generally don't use.
Sign up for CIO Asia eNewsletters.