Cервис управления информационной безопасностью
Cервис управления информационной безопасностью
Поиск
Вход Регистрация
MITRE ATT&CK - Преступная группа FIN8
Риски
Каталоги
MITRE ATT&CK
Преступная группа
FIN8
Куда я попал?
SECURITM это SGRC система, ? автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.
Подробнее
Наш канал

FIN8

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender Sardonic Aug 2021)(Citation: Symantec FIN8 Jul 2023)
ID: G0061
Associated Groups: Syssphinx
Version: 2.0
Created: 18 Apr 2018
Last Modified: 16 Apr 2025

Associated Group Descriptions
Name Description
Syssphinx (Citation: Symantec FIN8 Jul 2023)

Techniques Used
Domain ID Name Use
Enterprise T1134 .001 Access Token Manipulation: Token Impersonation/Theft

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.(Citation: Bitdefender FIN8 July 2021)(Citation: Symantec FIN8 Jul 2023)
Enterprise T1071 .001 Application Layer Protocol: Web Protocols

FIN8 has used HTTPS for command and control.(Citation: Bitdefender FIN8 July 2021)
Enterprise T1560 .001 Archive Collected Data: Archive via Utility

FIN8 has used RAR to compress collected data before exfiltration.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
Enterprise T1059 .001 Command and Scripting Interpreter: PowerShell

FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Symantec FIN8 Jul 2023)
.003 Command and Scripting Interpreter: Windows Command Shell

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016) FIN8 has also executed commands remotely via `cmd.exe`.(Citation: FireEye Obfuscation June 2017)(Citation: Bitdefender FIN8 July 2021)(Citation: Symantec FIN8 Jul 2023)

Enterprise T1074 .002 Data Staged: Remote Data Staging

FIN8 aggregates staged data from a network into a single location.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
Enterprise T1573 .002 Encrypted Channel: Asymmetric Cryptography

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
Enterprise T1546 .003 Event Triggered Execution: Windows Management Instrumentation Event Subscription

FIN8 has used WMI event subscriptions for persistence.(Citation: Bitdefender FIN8 July 2021)
Enterprise T1048 .003 Exfiltration Over Alternative Protocol: Exfiltration Over Unencrypted Non-C2 Protocol

FIN8 has used FTP to exfiltrate collected data.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
Enterprise T1070 .001 Indicator Removal: Clear Windows Event Logs

FIN8 has cleared logs during post compromise cleanup activities.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
.004 Indicator Removal: File Deletion

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Symantec FIN8 Jul 2023)

Enterprise T1003 .001 OS Credential Dumping: LSASS Memory

FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
Enterprise T1027 .010 Obfuscated Files or Information: Command Obfuscation

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Bitdefender FIN8 July 2021)
Enterprise T1588 .002 Obtain Capabilities: Tool

FIN8 has used open-source tools such as Impacket for targeting efforts.(Citation: Bitdefender Sardonic Aug 2021)
.003 Obtain Capabilities: Code Signing Certificates

FIN8 has used an expired open-source X.509 certificate for testing in the OpenSSL repository, to connect to actor-controlled C2 servers.(Citation: Bitdefender Sardonic Aug 2021)

Enterprise T1566 .001 Phishing: Spearphishing Attachment

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
.002 Phishing: Spearphishing Link

FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)

Enterprise T1055 .004 Process Injection: Asynchronous Procedure Call

FIN8 has injected malicious code into a new svchost.exe process.(Citation: Bitdefender FIN8 July 2021)
Enterprise T1021 .001 Remote Services: Remote Desktop Protocol

FIN8 has used RDP for lateral movement.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
.002 Remote Services: SMB/Windows Admin Shares

FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context. FIN8 has also used smbexec from the Impacket suite for lateral movement.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)(Citation: Bitdefender Sardonic Aug 2021)

Enterprise T1053 .005 Scheduled Task/Job: Scheduled Task

FIN8 has used scheduled tasks to maintain RDP backdoors.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
Enterprise T1518 .001 Software Discovery: Security Software Discovery

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
Enterprise T1016 .001 System Network Configuration Discovery: Internet Connection Discovery

FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.(Citation: Bitdefender Sardonic Aug 2021)

Enterprise T1204 .001 User Execution: Malicious Link

FIN8 has used emails with malicious links to lure victims into installing malware.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)
.002 User Execution: Malicious File

FIN8 has used malicious e-mail attachments to lure victims into executing malware.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)

Software
ID Name References Techniques
S0039 Net (Citation: FireEye Know Your Enemy FIN8 Aug 2016) (Citation: Microsoft Net Utility) (Citation: Savill 1999) Domain Account, Local Account, Domain Groups, System Service Discovery, Network Share Discovery, Additional Local or Domain Groups, SMB/Windows Admin Shares, Local Account, Domain Account, System Network Connections Discovery, Local Groups, Network Share Connection Removal, Password Policy Discovery, Remote System Discovery, Service Execution, System Time Discovery
S1085 Sardonic (Citation: Bitdefender Sardonic Aug 2021) (Citation: Symantec FIN8 Jul 2023) Windows Management Instrumentation, Standard Encoding, Symmetric Cryptography, System Service Discovery, Network Share Discovery, System Information Discovery, Native API, Data from Local System, Deobfuscate/Decode Files or Information, Reflective Code Loading, System Network Configuration Discovery, Indicator Removal, Asynchronous Procedure Call, System Network Connections Discovery, Process Discovery, Windows Management Instrumentation Event Subscription, PowerShell, Non-Standard Port, Obfuscated Files or Information, Asymmetric Cryptography, Non-Application Layer Protocol, Windows Command Shell, Command Obfuscation, Ingress Tool Transfer
S0357 Impacket (Citation: Bitdefender FIN8 July 2021) (Citation: Bitdefender Sardonic Aug 2021) (Citation: Impacket Tools) Windows Management Instrumentation, Security Account Manager, LSA Secrets, Network Sniffing, Ccache Files, LLMNR/NBT-NS Poisoning and SMB Relay, LSASS Memory, Lateral Tool Transfer, NTDS, Service Execution, Kerberoasting
S1081 BADHATCH (Citation: BitDefender BADHATCH Mar 2021) (Citation: Gigamon BADHATCH Jul 2019) Scheduled Task, Windows Management Instrumentation, Screen Capture, System Owner/User Discovery, Embedded Payloads, Bypass User Account Control, Domain Groups, Network Share Discovery, System Information Discovery, Native API, Process Injection, Reflective Code Loading, Proxy, Domain Trust Discovery, Asynchronous Procedure Call, System Network Connections Discovery, Web Service, Token Impersonation/Theft, Process Discovery, Windows Management Instrumentation Event Subscription, Exfiltration Over C2 Channel, PowerShell, File Transfer Protocols, Asymmetric Cryptography, Windows Command Shell, Command Obfuscation, File Deletion, Web Protocols, Remote System Discovery, Network Service Discovery, Pass the Hash, Ingress Tool Transfer, System Time Discovery, Dynamic-link Library Injection, Compression
S0105 dsquery (Citation: FireEye Know Your Enemy FIN8 Aug 2016) (Citation: TechNet Dsquery) Domain Account, Domain Groups, System Information Discovery, Domain Trust Discovery
S0481 Ragnar Locker (Citation: Cynet Ragnar Apr 2020) (Citation: Sophos Ragnar May 2020) (Citation: Symantec FIN8 Jul 2023) Rundll32, Service Stop, Windows Service, Peripheral Device Discovery, Msiexec, Disable or Modify Tools, Run Virtual Instance, Data Encrypted for Impact, Regsvr32, System Location Discovery, Windows Command Shell, Service Execution, Inhibit System Recovery
S0196 PUNCHBUGGY (Citation: FireEye Fin8 May 2016) (Citation: FireEye Know Your Enemy FIN8 Aug 2016) (Citation: Morphisec ShellTea June 2019) (Citation: ShellTea) Archive via Utility, Rundll32, Shared Modules, Local Data Staging, Match Legitimate Resource Name or Location, Local Account, System Information Discovery, Deobfuscate/Decode Files or Information, AppCert DLLs, PowerShell, Registry Run Keys / Startup Folder, Obfuscated Files or Information, Security Software Discovery, Python, File Deletion, Web Protocols, Ingress Tool Transfer
S0359 Nltest (Citation: Bitdefender FIN8 July 2021) (Citation: Nltest Manual) System Network Configuration Discovery, Domain Trust Discovery, Remote System Discovery
S0097 Ping (Citation: Bitdefender Sardonic Aug 2021) (Citation: TechNet Ping) Remote System Discovery
S0197 PUNCHTRACK (Citation: FireEye Fin8 May 2016) (Citation: FireEye Know Your Enemy FIN8 Aug 2016) (Citation: PSVC) Local Data Staging, Data from Local System, Obfuscated Files or Information
S0029 PsExec (Citation: Russinovich Sysinternals) (Citation: SANS PsExec) (Citation: Symantec FIN8 Jul 2023) Windows Service, SMB/Windows Admin Shares, Domain Account, Lateral Tool Transfer, Service Execution

References

  1. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  2. Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.
  3. Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.
  4. Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.
  5. Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.
  6. Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.
Навигация

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.