Home / Threat actors / FIN8

FIN8 G0061

🔔 Create alert

Also known as: Syssphinx

Updated at source on Jul 31, 2026 · View on MITRE ATT&CK

1

associated CVEs

45

Techniques

11

Malware and tools

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.

Ransomware operations linked to this group ransomware.live

ragnarlocker via Ragnar Locker

Exploited vulnerabilities

CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.

CVE-2016-0167 High · 7.8 KEV Ransomware Microsoft Win32k Privilege Escalation Vulnerability

“FIN8 has exploited the CVE-2016-0167 local vulnerability.”

Techniques by tactic

Resource Development

T1588.002 Tool T1588.003 Code Signing Certificates

Initial Access

T1078 Valid Accounts T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execution

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1204.001 Malicious Link T1204.002 Malicious File

Persistence

T1053.005 Scheduled Task T1078 Valid Accounts T1112 Modify Registry T1546.003 Windows Management Instrumentation Event Subscription

Privilege Escalation

T1053.005 Scheduled Task T1055.004 Asynchronous Procedure Call T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1134.001 Token Impersonation/Theft T1546.003 Windows Management Instrumentation Event Subscription

Stealth

T1027.010 Command Obfuscation T1055.004 Asynchronous Procedure Call T1070.004 File Deletion T1078 Valid Accounts T1134.001 Token Impersonation/Theft

Defense Impairment

T1112 Modify Registry T1685.005 Clear Windows Event Logs

Credential Access

T1003.001 LSASS Memory

Discovery

T1016.001 Internet Connection Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1082 System Information Discovery T1482 Domain Trust Discovery T1518.001 Security Software Discovery

Lateral Movement

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares

Collection

T1074.002 Remote Data Staging T1560.001 Archive via Utility

Command and Control

T1071.001 Web Protocols T1102 Web Service T1105 Ingress Tool Transfer T1573.002 Asymmetric Cryptography

Exfiltration

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Impact

T1486 Data Encrypted for Impact

Malware and tools

BADHATCHMalwareS1081
PUNCHBUGGYMalwareS0196
PUNCHTRACKMalwareS0197
Ragnar LockerMalwareS0481
SardonicMalwareS1085
dsqueryToolS0105
ImpacketToolS0357
NetToolS0039
NltestToolS0359
PingToolS0097
PsExecToolS0029

© The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.