Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · FIN8 · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

FIN8

  • ATK113
  • G0061
  • PUNCH COMET
  • Syssphinx

MITRE G0061 ↗

FIN8 — ATT&CK roseFI

attack rose · 36 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE2 new CVEs: CVE-2016-0167, CVE-2023-48788

Analyst brief

misp-galaxy + mitre-attack

FIN8 is a financially motivated group targeting the retail, hospitality and entertainment industries. The actor had previously conducted several tailored spearphishing campaigns using the downloader PUNCHBUGGY and POS malware PUNCHTRACK.

Observed targets (as stated by the sources)

0 countries · 3 sectors

assessed originnot stated by sourcesobserved targets · 0

sectors · 3

  • Entertainment
  • Hospitality
  • Retail

as stated by MISP galaxy / ransomware.live — not inferred

Kill chain

MITRE ATT&CK Enterprise · tap a technique

36 techniques · 13 of 15 tactics

  1. Resource development

    2 techniques

  2. Initial access

    2 techniques

  3. Execution

    6 techniques

  4. Privilege escalation

    2 techniques

  5. Stealth

    5 techniques

  6. Defense impairment

    2 techniques

  7. Credential access

    1 technique

  8. Discovery

    6 techniques

  9. Lateral movement

    2 techniques

  10. Collection

    2 techniques

  11. Command and control

    4 techniques

  12. Exfiltration

    1 technique

  13. Impact

    1 technique

select a technique

Arsenal

5 malware · 6 tools
Malware
Malware · 5ATT&CK
BADHATCHS1081 ↗
PUNCHBUGGYS0196 ↗
Ragnar LockerS0481 ↗
PUNCHTRACKS0197 ↗
SardonicS1085 ↗
Tools
Tools · 6ATT&CK
PingS0097 ↗
dsqueryS0105 ↗
NetS0039 ↗
NltestS0359 ↗
PsExecS0029 ↗
ImpacketS0357 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs FIN8 is cited as exploiting

none on KEV
  1. CVE-2023-487882026-10-17
    1. “In October and November 2024, a suspected FIN8 threat cluster gained access to a targeted organization by exploiting CVE-2023-48788, deployed SNAKEBITE ransomware”

      cited as exploiting · source: services.google.com ↗ · 2026-10-17

  2. CVE-2016-01672026-10-17
    1. “FIN8 has exploited the CVE-2016-0167 local vulnerability.”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

10 sources
  1. 1.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-…
  2. 2.www2.fireeye.com/WBNR-Know-Your-Enemy-UNC622-Spear-Phishing.html
  3. 3.root9b.com/sites/default/files/whitepapers/PoS%20Malware%20ShellT…
  4. 4.afyonluoglu.org/PublicWebFiles/Reports-TR/2017%20FireEye%20M-Trends%20…
  5. 5.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.h…
  6. 6.attack.mitre.org/groups/G0061
  7. 7.cloud.google.com/blog/topics/threat-intelligence/updated-cyber-threat-a…
  8. 8.web.archive.org/web/20170923102302/https://www.fireeye.com/blog/threat…
  9. 9.bitdefender.com/files/News/CaseStudies/study/401/Bitdefender-PR-Whitep…
  10. 10.symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor

Track FIN8 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.