FIN8
IntrusionSet · ATTACK:enterprise:G0061
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:G0061",
"title": "FIN8",
"type": "IntrusionSet",
"source_url": "https://attack.mitre.org/groups/G0061",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "intrusion-set--fd19bd82-1b14-49a1-a176-6cdc46b8a826",
"external_id": "G0061",
"domain": "enterprise",
"created": "2018-04-18T17:59:24.739Z",
"modified": "2026-07-31T18:48:28.923Z",
"version": "2.0",
"aliases": [
"FIN8",
"Syssphinx"
],
"tactics": [
],
"source_references": [
{
"source_name": "FIN8"
},
{
"source_name": "Syssphinx"
},
{
"source_name": "FireEye Obfuscation June 2017",
"url": "https://web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html"
},
{
"source_name": "Bitdefender Sardonic Aug 2021",
"url": "https://www.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitepaper-FIN8-creat5619-en-EN.pdf"
},
{
"source_name": "FireEye Fin8 May 2016",
"url": "https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html"
},
{
"source_name": "Symantec FIN8 Jul 2023",
"url": "https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor"
}
]
}Explicit source assertions (47)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--060e7485-d2a9-4aa2-a742-58f7e4e6086a
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1048.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--177950ec-8f25-4243-8d9d-a15e24ff7c98
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1033
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--17bace22-3930-4b7e-9fd1-1473da5496ff
Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1ce61b6a-b1fd-4e21-874a-774a1487fa12
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0097
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--201802a3-afae-4c10-a125-0fc4fd62f1d2
Bitdefender Sardonic Aug 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S1081
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2275a778-0ba1-40a7-8421-1659dc2e38d4
BitDefender BADHATCH Mar 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1021.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31a6eec8-0281-4973-a2af-ebf30e317a9f
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1003.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--331e59e9-0d10-4c2d-ba92-e8eb0de1cc95
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1588.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3a20f6f1-0e1b-4d8e-8461-eb41e4c6b5da
Bitdefender Sardonic Aug 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1204.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3aacea96-941f-4a1d-8981-36d2a0e62cf3
FireEye Obfuscation June 2017 · FireEye Know Your Enemy FIN8 Aug 2016 · FireEye Fin8 May 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1588.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b72eb79-c499-4f2a-b6aa-464bb3bbd42d
Bitdefender Sardonic Aug 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1068
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45626c7f-c401-427b-9589-c91a4b2a4f7f
FireEye Know Your Enemy FIN8 Aug 2016 · FireEye Fin8 May 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1546.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5014ed30-309e-4bed-af86-ec5603736342
Bitdefender FIN8 July 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1566.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--52e319bc-d6ee-4ab5-a3ae-36f0477cac67
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1053.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--55ea8954-9b81-45e4-89c9-a6b55f5b2541
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1204.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5a374aec-ae82-4c99-bbc2-34c4050a9932
FireEye Obfuscation June 2017 · FireEye Know Your Enemy FIN8 Aug 2016 · FireEye Fin8 May 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0196
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b5f2424-ff4e-43ab-a08f-fab2b284041d
FireEye Fin8 May 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1102
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--68a9519f-c65a-451e-9126-5946ac6844c6
Bitdefender FIN8 July 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0481
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--692e5a04-1f20-4597-8f64-15749c9b90e9
Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0197
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6b651165-e444-4272-a218-32e728558208
FireEye Fin8 May 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--76bd87d6-517e-4294-b4c5-a5a01308bf35
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1027.010
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--82ce1bf6-b1a1-4a82-9c86-8ff372d6a873
FireEye Obfuscation June 2017 · FireEye Know Your Enemy FIN8 Aug 2016 · Bitdefender FIN8 July 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1070.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--92bc1e7b-6700-4d11-b82e-24284f30c2d7
FireEye Know Your Enemy FIN8 Aug 2016 · Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1566.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c1ec4da-96d9-4173-b944-77c341a19572
FireEye Obfuscation June 2017 · FireEye Know Your Enemy FIN8 Aug 2016 · FireEye Fin8 May 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1071.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a1c0db19-e187-480b-85d4-6e5672480d33
Bitdefender FIN8 July 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a83e6a0f-fc31-472f-bffd-135dfc5ce683
Bitdefender Sardonic Aug 2021 · FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a97899ea-2470-4612-ab5e-2637556da1cb
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1560.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6e427c5-ae51-4240-b91e-3c417cc4e1f0
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1074.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b8df1d2c-f014-4f51-a277-8050adafb865
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc1c5d97-5e95-4ba3-bf61-ffe3de56d508
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0359
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bf26ba18-224d-421f-8fc7-3748dd2fe9bd
Bitdefender FIN8 July 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1105
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c3dd754d-3e2b-4761-8d21-2e7a52fc6616
FireEye Fin8 May 2016 · Bitdefender FIN8 July 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c8342b87-ceea-40e0-a9ad-11b72aa1378f
Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1059.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd001a55-ed41-4109-9090-41bebed9113a
FireEye Obfuscation June 2017 · FireEye Know Your Enemy FIN8 Aug 2016 · Bitdefender FIN8 July 2021 · Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S1085
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ce5e362a-3403-4d91-b362-cc5314b84a95
Bitdefender Sardonic Aug 2021 · Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0029
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7dd3cdf-f928-4ca3-8fba-0c948eb36c16
Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1059.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e090281c-4ab9-4b6f-ab63-f22606f7e620
FireEye Obfuscation June 2017 · FireEye Know Your Enemy FIN8 Aug 2016 · Bitdefender FIN8 July 2021 · Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1573.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e4c23aa3-edf1-4f6e-ae86-f709d7c306ee
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1055.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eda4c39d-9615-4c5f-8086-64150137df7f
Bitdefender FIN8 July 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ee46b157-d368-42e4-98f6-b76f6e65c9bd
FireEye Know Your Enemy FIN8 Aug 2016 · Bitdefender FIN8 July 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1486
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f36a77f2-dfab-4636-a796-67e6416031ef
Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1482
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f5f833ab-9ee4-477b-854a-b7b4446761ba
Bitdefender FIN8 July 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1112
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f8ff17c3-2921-40c2-b4a9-19ee7678397a
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1134.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f950b817-9082-4299-a310-6b48fc347ebc
Bitdefender FIN8 July 2021 · Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1016.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd135724-b4b3-470a-95c6-43191f99dcb6
Bitdefender Sardonic Aug 2021ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:T1047
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fd763f17-409d-428b-825c-f731b0ad88cc
FireEye Obfuscation June 2017 · FireEye Know Your Enemy FIN8 Aug 2016 · Bitdefender FIN8 July 2021 · Symantec FIN8 Jul 2023ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0357
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--febe1cf5-d8b5-4218-b32d-1e9ea10eab7f
Bitdefender Sardonic Aug 2021 · Bitdefender FIN8 July 2021