FIN7 (aka ‘Carbanak’) has been involved in cyberattacks and money-stealing campaigns since 2015 when they first appeared in the cybercrime space, including infecting ATMs with MITM-enabling malware. FIN7 set up a fake cybersecurity company called Bastion Secure to lure legitimate IT specialists. The company claims to be based out of England, but the site serves Russian-language 404 error pages. A spokesperson for the legitimate cybersecurity firm Convergent Network Solutions Ltd. confirmed that the site is unaffiliated with their company.”]