FIN8

Names and who uses them

• FIN8Our name
• SyssphinxSymantec

Targets

Sectors: Healthcare, Finance, Retail, Hospitality, Chemical

Known techniques

• T1003.001LSASS Memory
• T1016.001Internet Connection Discovery
• T1018Remote System Discovery
• T1021.001Remote Desktop Protocol
• T1021.002SMB/Windows Admin Shares
• T1027.010Command Obfuscation
• T1033System Owner/User Discovery
• T1047Windows Management Instrumentation
• T1048.003Exfiltration Over Unencrypted Non-C2 Protocol
• T1053.005Scheduled Task
• T1055.004Asynchronous Procedure Call
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1068Exploitation for Privilege Escalation
• T1070.004File Deletion
• T1071.001Web Protocols
• T1074.002Remote Data Staging
• T1078Valid Accounts
• T1082System Information Discovery
• T1102Web Service
• T1105Ingress Tool Transfer
• T1112Modify Registry
• T1134.001Token Impersonation/Theft
• T1204.001Malicious Link
• T1204.002Malicious File
• T1482Domain Trust Discovery
• T1486Data Encrypted for Impact
• T1518.001Security Software Discovery
• T1546.003Windows Management Instrumentation Event Subscription
• T1560.001Archive via Utility
• T1566.001Spearphishing Attachment
• T1566.002Spearphishing Link
• T1573.002Asymmetric Cryptography
• T1588.002Tool
• T1588.003Code Signing Certificates
• T1685.005Clear Windows Event Logs

Malware and tools used