How a Fake Cybersecurity Firm Became a Real Threat

FIN7 operatives built convincingly legitimate front companies (e.g., "Bastion Secure") to recruit and onboard skilled cybersecurity professionals who, believing they were performing penetration tests, mapped networks, created backdoors, and deployed malware—enabling a large-scale criminal campaign that compromised over 6,500 point-of-sale systems, stole more than 100 million payment card records, and caused estimated fraud losses exceeding $1 billion, according to DOJ and industry researchers.