CybercrimeMITRE G0061
FIN8
Also known as ATK113, G0061, PUNCH COMET, Syssphinx
0mentions, 7 days
0mentions, 30 days
nonelast mentioned
FIN8 is a financially motivated group targeting the retail, hospitality and entertainment industries. The actor had previously conducted several tailored spearphishing campaigns using the downloader PUNCHBUGGY and POS malware PUNCHTRACK.
CVEs in recent coverage
No CVEs named alongside this actor in the last 90 days.
Recent victims
No leak-site posts on record for this group.
ATT&CK techniques
T1003.001 LSASS MemoryT1016.001 Internet Connection DiscoveryT1018 Remote System DiscoveryT1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1027.010 Command ObfuscationT1033 System Owner/User DiscoveryT1047 Windows Management InstrumentationT1048.003 Exfiltration Over Unencrypted Non-C2 ProtocolT1053.005 Scheduled TaskT1055.004 Asynchronous Procedure CallT1059.001 PowerShellT1059.003 Windows Command ShellT1068 Exploitation for Privilege EscalationT1070.004 File DeletionT1071.001 Web ProtocolsT1074.002 Remote Data StagingT1078 Valid AccountsT1082 System Information DiscoveryT1102 Web ServiceT1105 Ingress Tool TransferT1112 Modify RegistryT1134.001 Token Impersonation/TheftT1204.001 Malicious LinkT1204.002 Malicious FileT1482 Domain Trust DiscoveryT1486 Data Encrypted for ImpactT1518.001 Security Software DiscoveryT1546.003 Windows Management Instrumentation Event SubscriptionT1560.001 Archive via UtilityT1566.001 Spearphishing AttachmentT1566.002 Spearphishing LinkT1573.002 Asymmetric CryptographyT1588.002 ToolT1588.003 Code Signing CertificatesT1685.005 Clear Windows Event Logs
Recent activity
No posts or advisories have named this actor recently.
References
- https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html
- https://www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html
- https://www.root9b.com/sites/default/files/whitepapers/PoS%20Malware%20ShellTea%20PoSlurp.pdf
- https://afyonluoglu.org/PublicWebFiles/Reports-TR/2017%20FireEye%20M-Trends%20Report.pdf
- https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html
- https://attack.mitre.org/groups/G0061
- https://cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-actor-naming-system/
- https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor
- https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html
- https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf
From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.