Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in
Get started About
User Guide
Log in Get started
Threat Actors FIN8

FIN8

G0061 TLP:CLEAR
Active
Kill Chain Analysis Generate Graph Hunt Package

Also known as: Syssphinx, ATK113, G0061, PUNCH COMET

Description

FIN8 is a financially motivated cyber threat group identified as early as January 2016. Initially known for targeting point-of-sale (POS) systems across various industries including hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. The group gained significant attention in June 2021 when researchers observed a shift in its tactics to distributing ransomware variants. This evolution highlights FIN8's adaptability and focus on maximizing financial gains through sophisticated cyberattacks. The group has been linked to several malware families and tools, including Sardonic, BADHATCH, Ragnar Locker, PUNCHBUGGY, and PUNCHTRACK, which are used to compromise systems, exfiltrate data, and deploy ransomware payloads. FIN8's operational persistence over multiple years underscores its capabilities and strategic targeting of high-value industries.

Goals & Targeting

Targeted Sectors

Hospitality

AI Analysis

· 1 week ago

Executive Summary

FIN8, also known as Syssphinx or G0061, is a financially motivated threat group primarily targeting sectors with high revenue potential such as hospitality, retail, and finance. Since at least 2016, FIN8 has shifted its tactics over time, initially focusing on compromising point-of-sale (POS) devices before evolving to distribute ransomware variants in recent years.

Goals & Targeting

FIN8's primary motivation is financial gain, achieved through the deployment of malware to steal sensitive information and disrupt business operations. The group strategically targets sectors with significant revenue potential, including hospitality, retail, technology, and finance, to maximize the impact of its campaigns.Typical victims include businesses with point-of-sale systems, financial institutions, and organizations with valuable intellectual property or customer data。

Enhanced Description

Key Capabilities

  • Malware development and deployment
  • Ransomware distribution
  • Point-of-sale system compromise
  • Email phishing campaigns
  • Spear-phishing attacks
  • Data exfiltration techniques
  • Persistence mechanisms

MITRE ATT&CK Tactics

Lateral Movement
Exfiltration
Data Destruction
Credential Access
Execution
Discovery
Persistence
Reconnaissance
Impact
Privilege Escalation
Defense Evasion
Collection

ATT&CK Techniques

T1053.005: Scheduled Task
T1560.001: Archive via Utility
T1016.001: Internet Connection Discovery
T1204.002: Malicious File
T1566.002: Spearphishing Link
T1074.002: Remote Data Staging
T1112: Modify Registry
T1003.001: LSASS Memory
T1685.005: Clear Windows Event Logs
T1482: Domain Trust Discovery
T1102: Web Service
T1134.001: Token Impersonation/Theft
T1059.001: PowerShell
T1588.002: Tool
T1068: Exploitation for Privilege Escalation
T1486: Data Encrypted for Impact
T1573.002: Asymmetric Cryptography
T1518.001: Security Software Discovery
T1059.003: Windows Command Shell
T1027.010: Command Obfuscation
T1070.004: File Deletion
T1071.001: Web Protocols
T1018: Remote System Discovery
T1021.001: Remote Desktop Protocol
T1204.001: Malicious Link
T1048.003: Exfiltration Over Unencrypted Non-C2 Protocol
T1047: Windows Management Instrumentation
T1033: System Owner/User Discovery
T1566.001: Spearphishing Attachment
T1082: System Information Discovery
T1021.002: SMB/Windows Admin Shares
T1055.004: Asynchronous Procedure Call
T1546.003: Windows Management Instrumentation Event Subscription
T1078: Valid Accounts
T1105: Ingress Tool Transfer

Software / Tooling

Sardonic
BADHATCH
Ragnar Locker
PUNCHBUGGY
PUNCHTRACK

Campaigns & Victims

FIN8's campaigns demonstrate a focus on high-revenue industries and strategic use of malware for financial gain. The group has been observed compromising POS systems, stealing card data, and deploying ransomware to disrupt operations and demand payouts. Notable campaigns include the use of PUNCHBUGGY and PUNCHTRACK malware families for initial access and lateral movement within targeted networks. The shift in 2021 to distributing ransomware indicates a strategic evolution to capitalize on emerging opportunities in cyber extortion.

IOC Patterns

  • Spear-phishing emails with malicious links or attachments
  • Distribution of ransomware payloads following initial compromise
  • Use of Cobalt Strike-like frameworks for internal network movement
  • Scheduled tasks and registry modifications to maintain persistence
  • Exfiltration of data over unencrypted protocols
  • Staging malicious files on compromised systems
  • Installation of tools like Sardonic, BADHATCH, or Ragnar Locker

Recommended Actions

  • Implement multi-layered email filtering to detect and block spear-phishing attempts.
  • Monitor for known FIN8 TTPs, including scheduled tasks and registry modifications.
  • Segment network access to limit lateral movement after initial compromise.
  • Deploy endpoint detection and response (EDR) solutions to identify malicious file drops and process activity anomalies.
  • Conduct regular backups and ensure they are isolated from the network to prevent ransomware impact on recoverability.
  • Enforce strong encryption for sensitive data at rest and in transit.
  • Perform regular security audits to identify and patch known vulnerabilities exploited by FIN8.

Suggested Tags

Financially-Motivated
Ransomware
Malware
Point-of-Sale (POS)
Hospitality
Retail

Confidence Assessment

Confidence in FIN8's threat intelligence is moderately high, with substantial linked intelligence on its tools, techniques, and campaign patterns. However, gaps remain regarding the group's exact origin, initial access vectors, and long-term strategic objectives beyond financial gain. Limited reporting on specific APT-like campaigns further complicates comprehensive understanding of this active cyber threat.

ATT&CK Techniques

Discovery
6 techniques
T1016.001

Internet Connection Discovery

FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.(Citation: Bitdefender Sardonic Aug 2021)

T1018

Remote System Discovery

FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used <code>nltest.exe /dclist</code> to retrieve a list of domain controllers.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Bitdefender FIN8 July 2021)
T1033

System Owner/User Discovery

FIN8 has executed the command `quser` to display the session details of a compromised machine.(Citation: Symantec FIN8 Jul 2023)

T1082

System Information Discovery

FIN8 has used PowerShell Scripts to check the architecture of a compromised machine before the selection of a 32-bit or 64-bit version of a malicious .NET loader.(Citation: Symantec FIN8 Jul 2023)
T1482

Domain Trust Discovery

FIN8 has retrieved a list of trusted domains by using <code>nltest.exe /domain_trusts</code>.(Citation: Bitdefender FIN8 July 2021)
T1518.001

Security Software Discovery

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
Execution
6 techniques
T1047

Windows Management Instrumentation

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Symantec FIN8 Jul 2023)
T1053.005

Scheduled Task

FIN8 has used scheduled tasks to maintain RDP backdoors.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
T1059.001

PowerShell

FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Symantec FIN8 Jul 2023)
T1059.003

Windows Command Shell

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016) FIN8 has also executed commands remotely via `cmd.exe`.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)(Citation: Symantec FIN8 Jul 2023)
T1204.001

Malicious Link

FIN8 has used emails with malicious links to lure victims into installing malware.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
T1204.002

Malicious File

FIN8 has used malicious e-mail attachments to lure victims into executing malware.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
Stealth
5 techniques
T1027.010

Command Obfuscation

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Bitdefender FIN8 July 2021)
T1055.004

Asynchronous Procedure Call

FIN8 has injected malicious code into a new svchost.exe process.(Citation: Bitdefender FIN8 July 2021)
T1070.004

File Deletion

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Symantec FIN8 Jul 2023)
T1078

Valid Accounts

FIN8 has used valid accounts for persistence and lateral movement.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
T1134.001

Token Impersonation/Theft

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.(Citation: Bitdefender FIN8 July 2021)(Citation: Symantec FIN8 Jul 2023)

Campaigns / Victims

No campaigns linked yet.

Observed Data

No observed data linked yet.

Indicators of Compromise

No IOCs linked yet.

References

  1. FireEye Obfuscation June 2017 — Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.
  2. Bitdefender Sardonic Aug 2021 — Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.
  3. FireEye Fin8 May 2016 — Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.
  4. Symantec FIN8 Jul 2023 — Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

Intel Summary

36

Techniques

8

Tools

0

Campaigns

0

IOCs

0

Observed Data

13

Tactics

Tags

Ransomware
Financial Targeting
Healthcare Targeting
Financially-Motivated
Malware
Point-of-Sale (POS)
Hospitality
Retail

Details

MITRE ID
G0061
Type
Unknown
Resource Level
Government
Primary Motivation
Financial gain
Country of Origin
Russia (RU)
Confidence
90%
Added
May 2, 2026
STIX ID
intrusion-set--fd19bd82-1b14-49a1-a176-6cdc46b8a826
Notes
0
Log in to add a note
No notes yet. Click "Add Note" to create the first analysis note.
Opinions
0
Log in to add an opinion
No opinions yet. Be the first to assess this intelligence.
Leaving Threaticon

This link opens an external site that isn't part of the platform.