WOLF SPIDER· RO

WOLF SPIDER (FIN4) is a financially motivated cybercriminal group targeting confidential market information in health, finance, and pharmacy sectors.

Analyst brief

WOLF SPIDER (also known as FIN4) is a financially motivated cybercriminal group. They target the health, finance, and pharmacy sectors to steal confidential information related to public financial markets. The group's primary TTPs include spearphishing (attachments and links), Visual Basic macros, leveraging valid accounts, email hiding rules, keylogging, and C2 communication via web protocols with multi-hop proxies. Defenders must enforce strong multi-factor authentication against credential theft, enhance email security posture, and regularly audit inbox rules for stealthy forwarding anomalies.

WOLF SPIDER

FIN4G0085

unknown

FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013. FIN4 is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.

origin (suspected)

ROattribution confidence: medium (50)

target sectors

HealthFinancePharmacy

techniques · ATT&CK

Spearphishing Attachment Spearphishing Link Visual Basic Malicious File Valid Accounts Email Hiding Rules Keylogging GUI Input Capture+2

source: misp-galaxy + mitre-attackG0085 9 refs →

Kill-chain playbook5

01
initial-access
T1566.001 T1566.002
Use email gateway security solutions to detect and block suspicious spearphishing attachments and links.
02
execution
T1059.005 T1204.002
Use endpoint security solutions to detect and block suspicious Visual Basic scripts and malicious files.
03
stealth
T1078 T1564.008
Monitor abnormal authentication activity to detect valid account abuse and regularly review email rules.
04
collection
T1056.001 T1056.002
Use endpoint security solutions and monitoring tools to detect GUI input capture and keylogging activity.
05
command-and-control
T1071.001 T1090.003
Use network security solutions and multi-hop proxy detection tools to detect and block suspicious Web Protocols traffic.

FAQ2

Which sectors does the WOLF SPIDER group primarily target?

WOLF SPIDER (FIN4) primarily targets the health, finance, and pharmacy sectors to steal confidential information related to public financial markets.

What measure must defenders take against WOLF SPIDER's credential theft?

Defenders must enforce strong multi-factor authentication (MFA) against credential theft, enhance email security posture, and regularly audit inbox rules for stealthy forwarding anomalies.

WOLF SPIDER· RO

Analyst brief

WOLF SPIDER

Kill-chain playbook5

initial-access

execution

stealth

collection

command-and-control

FAQ2

See also6

WOLF SPIDER· RO

Analyst brief

WOLF SPIDER

Kill-chain playbook5

initial-access

execution

stealth

collection

command-and-control

FAQ2

See also6