FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.1234
- FireEye Obfuscation June 2017
- FireEye Fin8 May 2016
- Bitdefender Sardonic Aug 2021
- Symantec FIN8 Jul 2023
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1078 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1048.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1033 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1518.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1068 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1546.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1204.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1102 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1027.010 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1566.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1573.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1055.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1486 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1482 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1112 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1134.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1016.001 | Internet Connection Discovery | — |
| T1018 | Remote System Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1027.010 | Command Obfuscation | — |
| T1033 | System Owner/User Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1048.003 | Exfiltration Over Unencrypted Non-C2 Protocol | — |
| T1053.005 | Scheduled Task | — |
| T1055.004 | Asynchronous Procedure Call | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1068 | Exploitation for Privilege Escalation | — |
| T1070.004 | File Deletion | — |
| T1071.001 | Web Protocols | — |
| T1074.002 | Remote Data Staging | — |
| T1078 | Valid Accounts | — |
| T1082 | System Information Discovery | — |
| T1102 | Web Service | — |
| T1105 | Ingress Tool Transfer | — |
| T1112 | Modify Registry | — |
| T1134.001 | Token Impersonation/Theft | — |
| T1204.001 | Malicious Link | — |
| T1204.002 | Malicious File | — |
| T1482 | Domain Trust Discovery | — |
| T1486 | Data Encrypted for Impact | — |
| T1518.001 | Security Software Discovery | — |
| T1546.003 | Windows Management Instrumentation Event Subscription | — |
| T1560.001 | Archive via Utility | — |
| T1566.001 | Spearphishing Attachment | — |
| T1566.002 | Spearphishing Link | — |
| T1573.002 | Asymmetric Cryptography | — |
| T1588.002 | Tool | — |
| T1588.003 | Code Signing Certificates | — |
| T1685.005 | Clear Windows Event Logs | — |
Aliases
FIN8 · Syssphinx
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.