Loading threat actor…
Gamma Group is a commercial surveillance vendor known for developing the FinFisher spyware suite, also referred to as FinSpy. The company has been associated with government and law-enforcement use of intrusive monitoring capabilities against targets worldwide. FinFisher is designed for covert surveillance and has been reported to provide remote access, keylogging, audio and video recording, and real-time monitoring of victim activity. Gamma Group and FinSpy have also been referenced in connection with malware tradecraft such as dynamic library hijacking on macOS, reflecting the use of stealthy execution and persistence mechanisms in spyware deployments. The actor is best characterized not as a traditional intrusion set or nation-state APT, but as a private-sector spyware developer whose tooling has enabled surveillance operations by state customers. Its activity aligns primarily with intelligence collection and monitoring rather than financially motivated cybercrime or ransomware.
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
13 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
1 malware family attributed to this actor across reporting.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commercial spyware operator historically associated with macOS implants using dylib hijacking.
Gamma Group is known for developing FinFisher (FinSpy), a spyware tool used by governments and law enforcement for surveillance, interception, and intelligence gathering.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.