H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[GRIFFON](https://attack.mitre.org/software/S0417) is a JavaScript backdoor used by [FIN7](https://attack.mitre.org/groups/G0046). (Citation: SecureList Griffon May 2019)

Labels

malware

9 recorded

Relationships

uses

from FIN7

Group

uses

to Domain Groups

Technique

uses

to JavaScript

Technique

uses

to PowerShell

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Scheduled Task

Technique

uses

to Screen Capture

Technique

uses

to System Information Discovery

Technique

uses

to System Time Discovery

Technique

2 external

References

mitre-attack

S0417

open

SecureList Griffon May 2019

https://securelist.com/fin7-5-the-infamous-cybercrime-rig-fin7-continues-its-activities/90703/

open