FIN8
- ID
- G0061
- Associated names
- Syssphinx
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.[1][2][3][4]
Techniques used (36)
- T1003.001 LSASS Memory
- T1016.001 Internet Connection Discovery
- T1018 Remote System Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1027.010 Command Obfuscation
- T1033 System Owner/User Discovery
- T1047 Windows Management Instrumentation
- T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol
- T1053.005 Scheduled Task
- T1055.004 Asynchronous Procedure Call
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1068 Exploitation for Privilege Escalation
- T1070.004 File Deletion
- T1071.001 Web Protocols
- T1074.002 Remote Data Staging
- T1078 Valid Accounts
- T1082 System Information Discovery
- T1102 Web Service
- T1105 Ingress Tool Transfer
- T1112 Modify Registry
- T1134.001 Token Impersonation/Theft
- T1204.001 Malicious Link
- T1204.002 Malicious File
- T1482 Domain Trust Discovery
- T1486 Data Encrypted for Impact
- T1518.001 Security Software Discovery
- T1546.003 Windows Management Instrumentation Event Subscription
- T1560.001 Archive via Utility
- T1566.001 Spearphishing Attachment
- T1566.002 Spearphishing Link
- T1573.002 Asymmetric Cryptography
- T1588.002 Tool
- T1588.003 Code Signing Certificates
- T1685.005 Clear Windows Event Logs
Software used (11)
- S0029 PsExec
- S0039 Net
- S0097 Ping
- S0105 dsquery
- S0196 PUNCHBUGGY
- S0197 PUNCHTRACK
- S0357 Impacket
- S0359 Nltest
- S0481 Ragnar Locker
- S1081 BADHATCH
- S1085 Sardonic