FIN8

Techniques (MITRE ATT&CK)36

SourceMITRE ATT&CK

Also known as:ATK113G0061PUNCH COMETSyssphinx

About the group

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.

Attack chain

Plausible scenario built from the group's real techniques, ordered by the phases of an attack. Each step shows how the group typically operates.

Arsenal severity55

Impact: High

Illustrative chain derived from techniques documented in MITRE ATT&CK — it does not represent a specific past attack. Severity summarizes the known arsenal (kill-chain coverage, actively exploited CVEs, techniques).

Techniques (MITRE ATT&CK) 36

How the group operates, mapped to the MITRE ATT&CK matrix and organized by the phases of an attack.

Resource development

Tool Code Signing Certificates

Initial access

Spearphishing Attachment Spearphishing Link

Execution

Windows Management Instrumentation Scheduled Task PowerShell Windows Command Shell Malicious Link Malicious File

Privilege escalation

Exploitation for Privilege Escalation Windows Management Instrumentation Event Subscription

Credential access

LSASS Memory

Discovery

Internet Connection Discovery Remote System Discovery System Owner/User Discovery System Information Discovery Domain Trust Discovery Security Software Discovery

Lateral movement

Remote Desktop Protocol SMB/Windows Admin Shares

Collection

Remote Data Staging Archive via Utility

Command and control

Web Protocols Web Service Ingress Tool Transfer Asymmetric Cryptography

Exfiltration

Exfiltration Over Unencrypted Non-C2 Protocol

Impact

Data Encrypted for Impact

defense-impairment

Modify Registry Clear Windows Event Logs

stealth

Command Obfuscation Asynchronous Procedure Call File Deletion Valid Accounts Token Impersonation/Theft

Exploited vulnerabilities 1

CVEs this group is known to exploit, per MITRE ATT&CK. Ordered by real-world severity.

CVE-2016-0167HIGHEPSS 6%KEV MITRE ATT&CK

References

FIN8 uses real techniques and exploits real flaws. TrueHacking's AI Autonomous Pentest simulates these attacks against your infrastructure and brings more security to your application.

Explore the AI Autonomous Pentest →