FIN8 - G0061

Created: 2018-04-18T17:59:24.739Z

Modified: 2023-03-22T03:52:13.089Z

Contributors: Daniyal Naeem, BT Security

Aliases

FIN8

Description

FIN8 is a financially motivated threat group known to launch tailored spearphishing campaigns targeting the retail, restaurant, and hospitality industries. (Citation: FireEye Obfuscation June 2017) (Citation: FireEye Fin8 May 2016)

Techniques Used

FIN8 has injected malicious code into a new svchost.exe process.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1071.001|Web Protocols|

FIN8 has used HTTPS for command and control.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1546.003|Windows Management Instrumentation Event Subscription|

FIN8 has used WMI event subscriptions for persistence.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Windows|T1134.001|Token Impersonation/Theft|

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.(Citation: Bitdefender FIN8 July 2021)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1102|Web Service|

FIN8 has used

FIN8 has retrieved a list of trusted domains by using

Nltest.exe /domain_trusts

FIN8 has used emails with malicious links to lure victims into installing malware.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: FireEye Know Your Enemy FIN8 Aug 2016)|
|mitre-attack|enterprise-attack|Linux,macOS,Windows|T1204.002|Malicious File|