- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Romania(high confidence)
- Motivation
- Financial crime
- Seen
- 2013–2026
- Status
- Active
- ATT&CK
- G0085 · 12 techniques
- Sources
- 6 sources carry it
- Identifier
- GINC-APT-0298 · fin4
RomaniaWhat it is
FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013. FIN4 is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- WOLF SPIDER, FIN4, Wolf Spider
- MITRE ATT&CK
- G0085
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ETDA / ThaiCERTRomania
- MISP Galaxy (CFR tagging)Romania
- ThreatActor.info (Malpedia et al.)Romania
Targets
- Sectors
- Finance, Financial, Health, Healthcare, Pharmaceutical, Pharmacy
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de