- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(medium confidence)
- Motivation
- Financial crime
- Seen
- 2016–2026
- Status
- Active
- ATT&CK
- G0061 · 36 techniques
- Sources
- 12 sources carry it
- Identifier
- GINC-APT-0027 · fin8
RussiaWhat it is
FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- Microsoft
- Storm-0288
- MITRE ATT&CK
- G0061
- Thales
- ATK113
- Other names
- ATK 113, PUNCH COMET, Syssphinx
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- ThreatActor.info (Malpedia et al.)Russia · high
Targets
- Countries
- Canada, Italy, Panama, South Africa, United States
- Sectors
- Entertainment, Financial, Food and Agriculture, Healthcare, Hospitality, Retail
Tools
The tools and malware families the sources tie to it.
- BADHATCH
- BlackCat
- Impacket
- Net
- Nltest
- PUNCHBUGGY
- PUNCHTRACK
- Ping
- PoSlurp
- PowerSniff
- PsExec
- Ragnar Locker
- RagnarLocker
- Sardonic
- ShellTea
- dsquery
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de