FIN8

FIN8, also known as STORM-0288 and Syssphinx, is a financially motivated threat group active since at least January 2016. It is historically associated with payment-card theft from point-of-sale systems in retail, hospitality, and entertainment organizations. Its victims also include financial institutions, insurers, technology companies, and chemical companies. Documented targeting spans the United States, Canada, Italy, South Africa, Panama, and Puerto Rico. FIN8 uses targeted spearphishing emails containing malicious macro-enabled documents or links to those documents. It has exploited Windows vulnerabilities, including CVE-2016-0167 for local privilege escalation. Following compromise, the group enumerates hosts, domain controllers, privileged accounts, and domain relationships using Active Directory utilities and native Windows commands. It harvests credentials with Invoke-Mimikatz and Windows Credential Editor, abuses valid accounts for persistence and lateral movement, and moves through networks using RDP, WMI, and Impacket's WMIExec and SMBExec tools. Persistence mechanisms include scheduled tasks maintaining RDP backdoors and WMI event subscriptions. Collected data has been compressed with RAR before exfiltration. The group's backdoor arsenal includes BADHATCH and Sardonic. BADHATCH supports reconnaissance, command execution, file transfer, screenshots, proxy tunneling, token impersonation, and credential-based lateral movement, including pass-the-hash functionality. Sardonic supports system-information collection, shell-command execution, and dynamically loaded DLL plugins executed in memory. FIN8 deploys these tools through multistage PowerShell, .NET, and shellcode execution chains, using in-memory loading and process injection. Its defense-evasion techniques include encrypted or encoded payloads, obfuscated macros and command-line arguments, disguised command-and-control requests, and automated post-compromise cleanup.