H3XA — Operational Evidence

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[PUNCHBUGGY](https://attack.mitre.org/software/S0196) is a backdoor malware used by [FIN8](https://attack.mitre.org/groups/G0061) that has been observed targeting POS networks in the hospitality industry. (Citation: Morphisec ShellTea June 2019)(Citation: FireEye Fin8 May 2016) (Citation: FireEye Know Your Enemy FIN8 Aug 2016)

Labels

malware

18 recorded

Relationships

uses

from FIN8

Group

uses

to AppCert DLLs

Technique

uses

to Archive via Utility

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to File Deletion

Technique

uses

to Ingress Tool Transfer

Technique

uses

to Local Account

Technique

uses

to Local Data Staging

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Obfuscated Files or Information

Technique

uses

Technique

uses

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

Technique

uses

to Security Software Discovery

Technique

uses

to Shared Modules

Technique

uses

to System Information Discovery

Technique

uses

to Web Protocols

Technique

6 external

References

mitre-attack

S0196

PUNCHBUGGY

—

ShellTea

—

FireEye Know Your Enemy FIN8 Aug 2016

https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html

Morphisec ShellTea June 2019

http://blog.morphisec.com/security-alert-fin8-is-back

FireEye Fin8 May 2016

https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html