Since June 2021, Checkmarks was used to automatically discover vulnerable endpoints inside organizations’ networks and exploit them to gain access by dropping web shells via PowerShell. FIN7 gained access to networks by using various exploits, including their own custom code and publicly available PoCs.

Read full article on Heimdal Security Blog