High end cybercrime group FIN7 stays one step ahead of defenders by changing their lures within a couple days of being identified.