FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013.12 FIN4 is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.34
- FireEye Hacking FIN4 Dec 2014
- FireEye FIN4 Stealing Insider NOV 2014
- FireEye Hacking FIN4 Dec 2014
- FireEye Hacking FIN4 Video Dec 2014
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | FIN4 | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.003 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.008 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2019 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1114.002 | 2019 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1056.001 | Keylogging | — |
| T1056.002 | GUI Input Capture | — |
| T1059.005 | Visual Basic | — |
| T1071.001 | Web Protocols | — |
| T1078 | Valid Accounts | — |
| T1090.003 | Multi-hop Proxy | — |
| T1114.002 | Remote Email Collection | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1564.008 | Email Hiding Rules | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
Aliases
FIN4
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.