Threat intelligence / Group

FIN8

[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected [FIN8](https://attack.mitre.org/groups/G0061) switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender Sardonic Aug 2021)(Citation: Symantec FIN8 Jul 2023)

Group

TypeGroup

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected [FIN8](https://attack.mitre.org/groups/G0061) switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender Sardonic Aug 2021)(Citation: Symantec FIN8 Jul 2023)

47 recorded

Relationships

uses

to Archive via Utility

Technique

uses

to Asymmetric Cryptography

Technique

uses

to Asynchronous Procedure Call

Technique

uses

Malware

uses

to Clear Windows Event Logs

Technique

uses

to Code Signing Certificates

Technique

uses

to Command Obfuscation

Technique

uses

to Data Encrypted for Impact

Technique

uses

to Domain Trust Discovery

Technique

uses

Tool

uses

to Exfiltration Over Unencrypted Non-C2 Protocol

Technique

uses

to Exploitation for Privilege Escalation

Technique

uses

to File Deletion

Technique

uses

Tool

uses

to Ingress Tool Transfer

Technique

uses

to Internet Connection Discovery

Technique

uses

to LSASS Memory

Technique

uses

to Malicious File

Technique

uses

to Malicious Link

Technique

uses

to Modify Registry

Technique

uses

to Net

Tool

uses

Tool

uses

Tool

uses

Technique

uses

Tool

uses

Malware

uses

Malware

uses

to Ragnar Locker

Malware

uses

to Remote Data Staging

Technique

uses

to Remote Desktop Protocol

Technique

uses

to Remote System Discovery

Technique

uses

Malware

uses

to Scheduled Task

Technique

uses

to Security Software Discovery

Technique

uses

to SMB/Windows Admin Shares

Technique

uses

to Spearphishing Attachment

Technique

uses

to Spearphishing Link

Technique

uses

to System Information Discovery

Technique

uses

to System Owner/User Discovery

Technique

uses

to Token Impersonation/Theft

Technique

uses

Technique

uses

to Valid Accounts

Technique

uses

to Web Protocols

Technique

uses

Technique

uses

to Windows Command Shell

Technique

uses

to Windows Management Instrumentation

Technique

uses

to Windows Management Instrumentation Event Subscription

Technique

7 external

References

mitre-attack

G0061

FIN8

—

Syssphinx

—

FireEye Obfuscation June 2017

https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html

Bitdefender Sardonic Aug 2021

https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf

FireEye Fin8 May 2016

https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html

Symantec FIN8 Jul 2023

https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor