NEW: Group Profiler — instant APT intel lookup. Try it →

← threatfilter.dev / all groups / FIN8

FIN8

G0061 MITRE ATT&CK →

Also known as: Syssphinx

Overview

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.

Targets

Entertainment · Hospitality · Retail

Capabilities

Custom malware/implant development — ATT&CK: 5 attributed custom malware families

TTPs — 36 techniques across 13 tactics

Resource Development

T1588.002 Tool
T1588.003 Code Signing Certificates

Initial Access

T1566.001 Spearphishing Attachment
T1566.002 Spearphishing Link

Execution

T1047 Windows Management Instrumentation
T1053.005 Scheduled Task
T1059.001 PowerShell
T1059.003 Windows Command Shell
T1204.001 Malicious Link
T1204.002 Malicious File

Privilege Escalation

T1068 Exploitation for Privilege Escalation
T1546.003 Windows Management Instrumentation Event Subscription

Stealth

Defense Impairment

T1112 Modify Registry
T1685.005 Clear Windows Event Logs

Credential Access

T1003.001 LSASS Memory

Discovery

T1016.001 Internet Connection Discovery
T1018 Remote System Discovery
T1033 System Owner/User Discovery
T1082 System Information Discovery
T1482 Domain Trust Discovery
T1518.001 Security Software Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol
T1021.002 SMB/Windows Admin Shares

Collection

T1074.002 Remote Data Staging
T1560.001 Archive via Utility

Command and Control

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Impact

T1486 Data Encrypted for Impact

Tools & malware (11)

Ping · BADHATCH · PUNCHBUGGY · Ragnar Locker · PUNCHTRACK · dsquery · Net · Nltest · Sardonic · PsExec · Impacket

Reporting (3)

FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware — Symantec Threat Hunter Team
FIN8 Threat Actor Goes Agile with New Sardonic Backdoor — Budaca, E., et al
Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques — Bohannon, D. & Carr N