FIN8

Techniques (MITRE ATT&CK)36

SourceMITRE ATT&CK

Also known as:ATK113G0061PUNCH COMETSyssphinx

Vexday analysis

FIN8 (também conhecido como Syssphinx) é um grupo de ameaça com motivação financeira ativo pelo menos desde janeiro de 2016, identificado no MITRE ATT&CK como G0061. O grupo tem como alvos organizações nos setores de hotelaria, varejo, entretenimento, seguros, tecnologia, química e financeiro. A partir de junho de 2021, pesquisadores de segurança identificaram uma mudança no foco operacional do grupo, que passou a distribuir variantes de ransomware em substituição ao seu histórico de ataques a dispositivos de ponto de venda (POS). Ao grupo são atribuídas 36 técnicas documentadas no MITRE ATT&CK e 1 CVE de exploração conhecida.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity56

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 36

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Tool Code Signing Certificates

Initial access

Spearphishing Attachment Spearphishing Link

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell Malicious Link Malicious File

Privilege escalation

Exploitation for Privilege Escalation Windows Management Instrumentation Event Subscription

Credential access

LSASS Memory

Discovery

Internet Connection Discovery Remote System Discovery System Owner/User Discovery System Information Discovery Domain Trust Discovery Security Software Discovery

Lateral movement

Remote Desktop Protocol SMB/Windows Admin Shares

Collection

Remote Data Staging Archive via Utility

Command and control

Web Protocols Web Service Ingress Tool Transfer Asymmetric Cryptography

Exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

Impact

Data Encrypted for Impact

defense-impairment

Modify Registry Clear Windows Event Logs

stealth

Command Obfuscation Asynchronous Procedure Call File Deletion Valid Accounts Token Impersonation/Theft

Exploited vulnerabilities 1

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2016-0167HIGHEPSS 6%KEV

References

FIN8 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →