FIN8

Techniques (MITRE ATT&CK)36

SourceMITRE ATT&CK

Also known as:Syssphinx

Vexday analysis

FIN8 (também conhecido como Syssphinx) é um grupo de ameaça com motivação financeira ativo pelo menos desde janeiro de 2016, identificado no MITRE ATT&CK como G0061. O grupo tem como alvos organizações nos setores de hotelaria, varejo, entretenimento, seguros, tecnologia, química e financeiro. A partir de junho de 2021, pesquisadores de segurança identificaram uma mudança no foco operacional do grupo, que passou a distribuir variantes de ransomware em substituição ao seu histórico de ataques a dispositivos de ponto de venda (POS). Ao grupo são atribuídas 36 técnicas documentadas no MITRE ATT&CK e 1 CVE de exploração conhecida.

Techniques (MITRE ATT&CK) 36

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Tool Code Signing Certificates

Initial access

Spearphishing Attachment Spearphishing Link

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell Malicious Link Malicious File

Privilege escalation

Exploitation for Privilege Escalation Windows Management Instrumentation Event Subscription

Credential access

LSASS Memory

Discovery

Internet Connection Discovery Remote System Discovery System Owner/User Discovery System Information Discovery Domain Trust Discovery Security Software Discovery

Lateral movement

Remote Desktop Protocol SMB/Windows Admin Shares

Collection

Remote Data Staging Archive via Utility

Command and control

Web Protocols Web Service Ingress Tool Transfer Asymmetric Cryptography

Exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

Impact

Data Encrypted for Impact

defense-impairment

Modify Registry Clear Windows Event Logs

stealth

Command Obfuscation Asynchronous Procedure Call File Deletion Valid Accounts Token Impersonation/Theft

Exploited vulnerabilities 1

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2016-0167HIGHEPSS 6%KEV

FIN8 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →