Loading threat actor…
FinFisher, also widely known as FinSpy, is a commercial surveillance spyware suite developed by FinFisher GmbH, a company based in Munich, Germany. It has been marketed to government and law-enforcement customers and has been documented in operations against civil society targets, including human rights defenders, journalists, activists, and dissidents in multiple countries. FinFisher is best characterized as a commercial cyber-espionage platform rather than a conventional state APT or financially motivated criminal group. FinFisher has supported surveillance across multiple platforms, including Windows, macOS, Android, iOS, and Linux. Documented capabilities include covert collection of private user information, persistent compromise of victim devices, privilege escalation, anti-analysis and obfuscation, encrypted command-and-control communications, and exfiltration of collected data. On macOS, analyzed FinSpy samples used a multi-stage infection chain with anti-debugging and virtual-machine checks, public local privilege-escalation exploits, installation of persistent launch components, and deployment of a kernel-mode rootkit to hide processes. Research has also associated FinFisher tooling with process-injection techniques such as KernelCallbackTable injection. FinFisher has repeatedly appeared in cases involving misuse of commercial spyware against non-criminal targets. Public reporting has linked its deployment to surveillance of individuals in countries including Bahrain, Ethiopia, the United Arab Emirates, and Egypt, and broader mobile FinSpy activity has been observed in nearly 20 countries. Known naming overlaps center on FinFisher as the vendor/product family and FinSpy as the spyware implant name.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
3 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
5 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Mentioned only as a prior user of the KernelCallbackTable process injection technique for comparison/background.
FinFisher (FinSpy) is a commercial spyware suite used for cyber-espionage, targeting activists, journalists, dissidents, and human rights defenders. The suite includes implants for Windows, Android, Linux, and macOS, and is known for its use in surveillance operations by various governments. The macOS variant analyzed here uses privilege escalation exploits, persistence mechanisms, and a kernel-mode rootkit for process hiding.
FinSpy is a commercial surveillance tool used by governments and law enforcement for espionage on mobile and desktop platforms, capable of extensive data collection.
FinFisher is a commercial spyware suite developed by a company based in Germany and the UK, known for being used by governments to target civil society, journalists, and activists. It was used in 2011 in an attempt to compromise Ahmed Mansoor.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.