Home / Threat actors / FIN4
FIN4 G0085
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
17
Techniques
0
Malware and tools
FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013. FIN4 is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Initial Access
T1078 Valid AccountsT1566.001 Spearphishing AttachmentT1566.002 Spearphishing Link Execution
T1059.005 Visual BasicT1204.001 Malicious LinkT1204.002 Malicious File Persistence
T1078 Valid Accounts Privilege Escalation
T1078 Valid Accounts Stealth
T1078 Valid AccountsT1564.008 Email Hiding Rules Credential Access
T1056.001 KeyloggingT1056.002 GUI Input Capture Collection
T1056.001 KeyloggingT1056.002 GUI Input CaptureT1114.002 Remote Email Collection Command and Control
T1071.001 Web ProtocolsT1090.003 Multi-hop Proxy © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.