Início / Grupos de ameaça / FIN8

FIN8 G0061

🔔 Criar alerta

Também conhecido como: Syssphinx

Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK

1

CVEs associadas

45

Técnicas

11

Malwares e ferramentas

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.

Operações de ransomware ligadas a este grupo ransomware.live

ragnarlocker via Ragnar Locker

Vulnerabilidades exploradas

CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.

CVE-2016-0167 Alta · 7.8 KEV Ransomware Microsoft Win32k Privilege Escalation Vulnerability

“FIN8 has exploited the CVE-2016-0167 local vulnerability.”

Técnicas por tática

Desenvolvimento de recursos

T1588.002 Tool T1588.003 Code Signing Certificates

Acesso inicial

T1078 Valid Accounts T1566.001 Spearphishing Attachment T1566.002 Spearphishing Link

Execução

T1047 Windows Management Instrumentation T1053.005 Scheduled Task T1059.001 PowerShell T1059.003 Windows Command Shell T1204.001 Malicious Link T1204.002 Malicious File

Persistência

T1053.005 Scheduled Task T1078 Valid Accounts T1112 Modify Registry T1546.003 Windows Management Instrumentation Event Subscription

Escalada de privilégios

T1053.005 Scheduled Task T1055.004 Asynchronous Procedure Call T1068 Exploitation for Privilege Escalation T1078 Valid Accounts T1134.001 Token Impersonation/Theft T1546.003 Windows Management Instrumentation Event Subscription

Furtividade

T1027.010 Command Obfuscation T1055.004 Asynchronous Procedure Call T1070.004 File Deletion T1078 Valid Accounts T1134.001 Token Impersonation/Theft

Comprometimento de defesas

T1112 Modify Registry T1685.005 Clear Windows Event Logs

Acesso a credenciais

T1003.001 LSASS Memory

Descoberta

T1016.001 Internet Connection Discovery T1018 Remote System Discovery T1033 System Owner/User Discovery T1082 System Information Discovery T1482 Domain Trust Discovery T1518.001 Security Software Discovery

Movimento lateral

T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares

Coleta

T1074.002 Remote Data Staging T1560.001 Archive via Utility

Comando e controle

T1071.001 Web Protocols T1102 Web Service T1105 Ingress Tool Transfer T1573.002 Asymmetric Cryptography

Exfiltração

T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol

Impacto

T1486 Data Encrypted for Impact

Malwares e ferramentas

BADHATCHMalwareS1081
PUNCHBUGGYMalwareS0196
PUNCHTRACKMalwareS0197
Ragnar LockerMalwareS0481
SardonicMalwareS1085
dsqueryFerramentaS0105
ImpacketFerramentaS0357
NetFerramentaS0039
NltestFerramentaS0359
PingFerramentaS0097
PsExecFerramentaS0029

© The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.