Threat intelligence / Malware

FinFisher

[FinFisher](https://attack.mitre.org/software/S0182) is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including [Wingbird](https://attack.mitre.org/software/S0176). (Citation: FinFisher Citation) (Citation: Microsoft SIR Vol 21) (Citation: FireEye FinSpy Sept 2017) (Citation: Securelist BlackOasis Oct 2017) (Citation: Microsoft FinFisher March 2018)

Malware

TypeMalware

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

Labels

malware

23 recorded

Relationships

uses

from Dark Caracal

Group

uses

to Bootkit

Technique

uses

to Bypass User Account Control

Technique

uses

to Clear Windows Event Logs

Technique

uses

to Credential API Hooking

Technique

uses

to Deobfuscate/Decode Files or Information

Technique

uses

to DLL

Technique

uses

to Dynamic-link Library Injection

Technique

uses

to File and Directory Discovery

Technique

uses

to Junk Code Insertion

Technique

uses

to KernelCallbackTable

Technique

uses

to Match Legitimate Resource Name or Location

Technique

uses

to Obfuscated Files or Information

Technique

uses

to Process Discovery

Technique

uses

to Query Registry

Technique

uses

to Registry Run Keys / Startup Folder

Technique

uses

to Screen Capture

Technique

uses

to Security Software Discovery

Technique

uses

to Software Packing

Technique

uses

to System Checks

Technique

uses

to System Information Discovery

Technique

uses

to Token Impersonation/Theft

Technique

uses

to Windows Service

Technique

8 external

References

mitre-attack

S0182

open

FinFisher

—

FinSpy

—

Microsoft FinFisher March 2018

https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/

open

Microsoft SIR Vol 21

http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf

open

FinFisher Citation

https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html

open

FireEye FinSpy Sept 2017

https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html

open

Securelist BlackOasis Oct 2017

https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/

open