FinFisher
FinFisher, also referred to as FinSpy, is a commercial government spyware suite developed and marketed by Gamma International / FinFisher. The content describes it as surveillance malware sold to government law enforcement and intelligence customers and used in multiple countries, including reported use against activists, journalists, lawyers, and dissidents in Bahrain, Ethiopia, Egypt, Turkmenistan, Myanmar, and elsewhere. Reported infrastructure associated with FinFisher/FinSpy has been identified in dozens of countries.
The malware supports intrusive surveillance on both desktop and mobile platforms. Reported capabilities include remote control of infected systems; capture of screen images and screenshots; keylogging; recording of Skype calls and chats; interception of email, instant messaging, VoIP, SMS messages, and call logs; access to contacts, text messages, emails, locations, photos, and other device data; extraction of saved passwords from more than 20 browsers, email, and chat programs; activation of cameras and microphones; audio recording; file transfer monitoring; and exfiltration of collected data to command-and-control servers. The content also notes mobile variants for iPhone, Android, Nokia/Symbian, Windows Phone, and BlackBerry, and desktop variants for Windows, macOS, and Linux.
Observed infection vectors include malicious email attachments, including infected Microsoft Word, Excel, PowerPoint, PDF, and archive files; exploit delivery through Office vulnerabilities such as CVE-2017-0199 and CVE-2017-8759; web-based delivery via FinFly Web; USB and MBR-based infection options; and mobile trojan deployment. In one documented case cited by EFF, a victim in the United States was infected after opening a malicious Word document, after which FinSpy downloaded from an Ethiopian IP address and recorded Skype calls, emails, web activity, and other usage.
On Windows, the content states that FinFisher creates a new Windows service with the malicious executable for persistence and queries Registry values as part of anti-sandbox checks. It is also described as using sophisticated anti-analysis and obfuscation, including a custom virtual machine with 32 opcode handlers, anti-debug checks, spaghetti code, and a second VM embedded inside a 64-bit payload. The content further notes that FinSpy has appeared in the context of UEFI bootkits and has been associated with exploitation of CVE-2017-0199 and CVE-2017-8759.
Known indicators and artifacts directly mentioned in the content include the malware name FinSpy within samples, the distinctive server response string "Hallo Steffi," and an Ethiopian FinSpy command-and-control IP address 213.55.99.74 identified in reporting and litigation. The content also references leaked support and licensing records for the FinFisher suite, including products such as FinSpy, FinSpy Mobile, FinFly Web, FinFly LAN, FinFly USB, FinIntrusion Kit, FinUSB Suite, and FinFireWire, documenting operational use, stealth requests, antivirus evasion issues, and surveillance workflows.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2017-8759 Vulnerable Products: Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 Associated Malware: FINSPY, FinFisher, WingBird Mitigation: Update affected Microsoft products with the latest security patches | CVE-2017-0199 ... Associated Malware: FINSPY, LATENTBOT, Dridex | CVE-2017-8759 ... Associated Malware: FINSPY, FinFisher, WingBird | CVE-2017-0199 Vulnerable Products: Microsoft Office 2007 SP3/2010 SP2/2013 SP1/2016, Vista SP2, Server 2008 SP2, Windows 7 SP1, Windows 8.1 Associated Malware: FINSPY, LATENTBOT, Dridex | CVE-2017-8759 Vulnerable Products: Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 Associated Malware: FINSPY, FinFisher, WingBird
CVE-2017-0199 ... Associated Malware: FINSPY, LATENTBOT, Dridex | CVE-2017-0199 Vulnerable Products: Microsoft Office 2007 SP3/2010 SP2/2013 SP1/2016, Vista SP2, Server 2008 SP2, Windows 7 SP1, Windows 8.1 Associated Malware: FINSPY, LATENTBOT, Dridex | CVE-2017-0199 Vulnerable Products: Microsoft Office 2007 SP3/2010 SP2/2013 SP1/2016, Vista SP2, Server 2008 SP2, Windows 7 SP1, Windows 8.1 Associated Malware: FINSPY, LATENTBOT, Dridex Mitigation: Update affected Microsoft products with the latest security patches
FinSpy We may only intercept data when we have a warrant from the judge... So what we would like to do is putting the rootkit asleep at the last day of the warrant, and waken the rootkit again on the first day of the new warrant.
helper2 : Python exploit for CVE-2015-5889. This first stage uses the exploits to get root access. | FinSpy is a commercial spyware suite produced by the Munich-based company FinFisher Gmbh... FinSpy is a full-fledged surveillance software suite, capable of intercepting communications, accessing private data, and recording audio and video, from the computer or mobile devices it is silently installed on.
We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.
We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.
We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.
Groups observed using it
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
FinFisher is a spyware product manufactured by the Gamma Group, a British company that sells surveillance technology... Bill Marczak... and Morgan Marquis-Boire... analyzed the e-mails and found evidence that they contained FinSpy, part of the FinFisher spyware tool kit.
EFF has filed a lawsuit in federal court in Washington, DC alleging that the government of Ethiopia, using notorious surveillance malware known as FinSpy, illegally wiretapped and invaded the privacy of our client, a U.S. citizen on U.S. soil.
FinFisher is a sophisticated computer spyware suite, written by Munich-based FinFisher GmbH, and sold exclusively to governments for intelligence and law enforcement purposes.
FinFisher, one of the original suppliers of so-called "lawful intercept" spyware, has repeatedly been criticized for selling malware to countries with poor human rights records such as Bahrain, Egypt and Ethiopia.
FinSpy is a commercial spyware suite produced by the Munich-based company FinFisher Gmbh... FinSpy is a full-fledged surveillance software suite, capable of intercepting communications, accessing private data, and recording audio and video, from the computer or mobile devices it is silently installed on.
Techniques & procedures
37 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
1 technique
Resource Development
The October 2024 European Commission guidelines define listed export controls for six types of surveillance technology, including intrusion software: “software that allows operators to covertly and remotely access electronic devices, in order to obtain data, track users or eavesdrop using a device's built-in microphone or cameras.”
Initial Access
5 techniques
Initial Access
Bootable USB Key Failure FinSpy Version 3.0. When building an infection and requesting creation of a bootable usb key... | Unable to create bootable iso image and bootable infection dongle ... tried both bootable iso image and bootable infection dongle
ClamAV blocked Webinfection ... silently were blocking our injected Javascript Code. as soon as the AV was disabled, the injected code was executed. | FinFly Web ... I tried updating it online but I get a /.../bin/update not accessible message.
At the time, members of the advocacy group Bahrain Watch in Washington, D.C., and London had been targeted via email by what appeared to be malware.
Malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology. OLE allows documents to contain embedded content from other applications such as spreadsheets. | According to U.S. Government technical analysis, malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology. OLE allows documents to contain embedded content from other applications such as spreadsheets. | Malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology.
Execution
2 techniques
Execution
U.S. Government reporting has identified the top 10 most exploited vulnerabilities by state, nonstate, and unattributed cyber actors from 2016 to 2019 as follows: CVE-2017-11882, CVE-2017-0199, CVE-2017-5638, CVE-2012-0158, CVE-2019-0604, CVE-2017-0143, CVE-2018-4878, CVE-2017-8759, CVE-2015-1641, and CVE-2018-7600. | Malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology. OLE allows documents to contain embedded content from other applications such as spreadsheets. | U.S. Government reporting has identified the top 10 most exploited vulnerabilities by state, nonstate, and unattributed cyber actors from 2016 to 2019 as follows: CVE-2017-11882, CVE-2017-0199, CVE-2017-5638, CVE-2012-0158, CVE-2019-0604, CVE-2017-0143, CVE-2018-4878, CVE-2017-8759, CVE-2015-1641, and CVE-2018-7600. According to U.S. Government technical analysis, malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology. | U.S. Government reporting has identified the top 10 most exploited vulnerabilities... malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology... the three vulnerabilities used most frequently across state-sponsored cyber actors from China, Iran, North Korea, and Russia are CVE-2017-11882, CVE-2017-0199, and CVE-2012-0158. | U.S. Government reporting has identified the top 10 most exploited vulnerabilities by state, nonstate, and unattributed cyber actors from 2016 to 2019 as follows: CVE-2017-11882, CVE-2017-0199, CVE-2012-0158, CVE-2018-4878, CVE-2017-8759, and CVE-2015-1641. According to U.S. Government technical analysis, malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology.
Persistence
4 techniques
Persistence
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
Secure Boot is designed to thwart UEFI bootkits, a form of malware that alters the Unified Extensible Firmware Interface, the successor to the BIOS, both of which begin the initial boot sequence. Because these bootkits load before the OS and most other code, they can be difficult to detect.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, or .lnk files in the Startup folder.
Privilege Escalation
3 techniques
Privilege Escalation
Kaspersky warning FinSpy Trojan installs but give a warning on every boot, process id xxx is trying to inject into another process.
During the 2016 Ukraine Electric Power Attack, Sandworm Team used an arbitrary system service to load at system boot for persistence for Industroyer. They also replaced the ImagePath registry value of a Windows service with a new backdoor binary.
The content repeatedly describes malware and threat actors establishing persistence by adding values under HKCU/HKLM\Software\Microsoft\Windows\CurrentVersion\Run or RunOnce, and by placing executables, scripts, or .lnk files in the Startup folder.
Stealth
11 techniques
Stealth
Add flag to put rootkit asleep and to waken the rootkit FinSpy | Add flag to put rootkit asleep and to waken the rootkit ... putting the rootkit asleep at the last day of the warrant, and waken the rootkit again
Обфускация (T1027, Obfuscated Files) Минимальная или ProGuard Многослойная: шифрование строк, VM-упаковщик
Маскировка (T1036, Masquerading) Скрытие иконки, имя «System Service» Инъекция в легитимные процессы
Akira has used legitimate names and locations for files to evade defenses.
Kaspersky warning FinSpy Trojan installs but give a warning on every boot, process id xxx is trying to inject into another process.
Possibility of removing Collected Data from the Target before transfer to Server
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.
Secure Boot is designed to thwart UEFI bootkits, a form of malware that alters the Unified Extensible Firmware Interface, the successor to the BIOS, both of which begin the initial boot sequence. Because these bootkits load before the OS and most other code, they can be difficult to detect.
Defense Impairment
1 technique
Defense Impairment
Credential Access
4 techniques
Credential Access
Keylogger doesnt catch Fn keys ... Keylogger export ... Unable to retrieve Keylogger data | keylogger mixup FinSpy When visualizing data, the keylogger module does not show the correct information.
FinSpy can also record Internet telephone calls, text messages, and file transfers transmitted through Skype
Discovery
5 techniques
Discovery
The content repeatedly describes malware and threat actors querying, enumerating, searching, reading, or checking Windows Registry keys and values, e.g., "ADVSTORESHELL can enumerate registry keys," "APT41 queried registry values to determine items such as configured RDP ports and network configurations," and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content repeatedly describes malware and threat actors collecting host details such as OS version, hostname, architecture, CPU, memory, BIOS, domain, language, and other configuration data; e.g., "APT41 uses multiple built-in commands such as systeminfo and net config Workstation to enumerate victim system basic configuration information."
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Several entries describe malware examining running processes to determine if a debugger, sandbox, virtual environment, or analysis/security tools are present, such as AsyncRAT checking for a debugger, RogueRobin enumerating Wireshark and Sysinternals processes, and P8RAT checking for processes associated with virtual environments.
Lateral Movement
1 technique
Lateral Movement
Bootable USB Key Failure FinSpy Version 3.0. When building an infection and requesting creation of a bootable usb key... | Unable to create bootable iso image and bootable infection dongle ... tried both bootable iso image and bootable infection dongle
Collection
6 techniques
Collection
recover non-downloaded data from the target machine ... file access module ... download selected files
Keylogger doesnt catch Fn keys ... Keylogger export ... Unable to retrieve Keylogger data | keylogger mixup FinSpy When visualizing data, the keylogger module does not show the correct information.
timestamp screenshots FinSpy ... screenshots taken from the target are not individually timestamped. | Title based screen recording ... Dual Screen Capture ... screenshots taken from the target
Security researchers who studied the spyware last month said it can ... remotely turn on cameras and microphones...
Command and Control
1 technique
Command and Control
the sample attempts to connect to both Internet-based and SMS-based command & control servers... net.rmi.device.api.fsmbb.core.com.* Appears to contain the mechanics of communication with the command & control server, including the plaintext TLV-based wire protocol. | The ‘logind’ process attempts to talk to a remote command and control server... After the user accepts these permissions, the sample attempts to connect to both Internet-based and SMS-based command & control servers.
IOCs tracked for this family
66 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
111 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A named UEFI bootkit mentioned among more recent firmware-level threats.
Spyware reportedly deployed on the phones of critics of Turkey’s government.
Коммерческое spyware, описанное как государственный инструмент наблюдения, отличающийся скрытностью, сложной обфускацией и эксплуатацией уязвимостей вместо примитивного sideload.
Spyware malware noted here for using multi-layered VM-based obfuscation, anti-debugging, and nested virtual machines to hinder analysis.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.