FIN8
FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.
- ATT&CK ID
- G0061
- Techniques
- 31
- Tools
- 11
Also tracked as Syssphinx
Vulnerabilities it has exploited
Techniques
Resource Development
Initial Access
Execution
Windows Management InstrumentationScheduled Task/JobCommand and Scripting InterpreterUser Execution
Persistence
Scheduled Task/JobValid AccountsModify RegistryEvent Triggered Execution
Privilege Escalation
Scheduled Task/JobProcess InjectionExploitation for Privilege EscalationValid AccountsAccess Token ManipulationEvent Triggered Execution
Stealth
Obfuscated Files or InformationProcess InjectionIndicator RemovalValid AccountsAccess Token Manipulation
Defense Impairment
Modify RegistryDisable or Modify Tools
Credential Access
Discovery
System Network Configuration DiscoveryRemote System DiscoverySystem Owner/User DiscoverySystem Information DiscoveryDomain Trust DiscoverySoftware Discovery
Lateral Movement
Collection
Data StagedArchive Collected Data
Command and Control
Application Layer ProtocolWeb ServiceIngress Tool TransferEncrypted Channel
Exfiltration
Exfiltration Over Alternative Protocol
Impact
Software
BADHATCH · Impacket · Net · Nltest · PUNCHBUGGY · PUNCHTRACK · Ping · PsExec · Ragnar Locker · Sardonic · dsquery