MITRE ATT&CKgroup

G0061 FIN8

Published 2018-04-18 Modified 2026-07-31 Official page ↗
Domain
enterprise
Aliases
Syssphinx
Version
2.0
Created
2018-04-18

Description

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.

Related

Uses · MITRE ATT&CK (47)

  • T1685.005 Clear Windows Event Logs sub-technique
  • S1085 Sardonic software (malware)
  • S1081 BADHATCH software (malware)
  • T1027.010 Command Obfuscation sub-technique
  • T1016.001 Internet Connection Discovery sub-technique
  • T1588.002 Tool sub-technique
  • T1588.003 Code Signing Certificates sub-technique
  • S0481 Ragnar Locker software (malware)
  • T1573.002 Asymmetric Cryptography sub-technique
  • T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol sub-technique
  • T1071.001 Web Protocols sub-technique
  • T1074.002 Remote Data Staging sub-technique
  • T1204.001 Malicious Link sub-technique
  • T1204.002 Malicious File sub-technique
  • T1059.001 PowerShell sub-technique
  • T1059.003 Windows Command Shell sub-technique
  • T1566.001 Spearphishing Attachment sub-technique
  • T1566.002 Spearphishing Link sub-technique
  • T1518.001 Security Software Discovery sub-technique
  • T1560.001 Archive via Utility sub-technique
  • T1134.001 Token Impersonation/Theft sub-technique
  • T1003.001 LSASS Memory sub-technique
  • T1021.001 Remote Desktop Protocol sub-technique
  • T1021.002 SMB/Windows Admin Shares sub-technique
  • T1070.004 File Deletion sub-technique
  • T1546.003 Windows Management Instrumentation Event Subscription sub-technique
  • T1055.004 Asynchronous Procedure Call sub-technique
  • T1053.005 Scheduled Task sub-technique
  • T1486 Data Encrypted for Impact technique
  • S0359 Nltest software (tool)
Show all 47 ›

References