LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0061: FIN8

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.[1][2][3][4]

EnterpriseG0061GroupObject v2.0Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

FIN8 is a financially motivated ATT&CK group associated with payment-card/POS activity and, per cited research, later distribution of ransomware variants. For leaders, the value of this object is less about a single indicator and more about validating whether the organization can detect and respond to a Windows-heavy intrusion path involving discovery, credential access, lateral movement, remote administration tools, backdoors, possible data theft, and ransomware-related activity.

Executive priority

Prioritize FIN8 as a resilience and payment/data-risk planning scenario for sectors named by ATT&CK: hospitality, retail, entertainment, insurance, technology, chemical, and financial organizations. Useful executive questions include: are POS and business Windows environments segmented; can the SOC see credential theft against LSASS, RDP/SMB lateral movement, WMI, PowerShell, scheduled tasks, and admin-tool abuse; and is incident response prepared for both payment-data theft and ransomware decision points? This object supports budget and audit discussions around identity controls, endpoint visibility, network segmentation, logging retention, and ransomware readiness, but it does not by itself prove exposure or current targeting of any specific organization.

Technical view

ATT&CK provides no group-level detection text and no group-level platform list, so defenders should anchor validation to the related software and techniques. FIN8 is related to Windows-oriented tools and behaviors including PsExec, Net, dsquery, Nltest, WMI, PowerShell, Windows Command Shell, scheduled tasks, RDP, SMB/admin shares, LSASS memory access, command obfuscation, APC injection, and backdoors such as PUNCHBUGGY, BADHATCH, and Sardonic. It is also related to PUNCHTRACK POS malware and Ragnar Locker ransomware. SOC and IR teams should test whether they can reconstruct an intrusion timeline across endpoint process activity, authentication, domain enumeration, lateral movement, persistence, exfiltration, and malware execution without relying on a single signature.

Likely telemetry

  • Endpoint process creation and command-line logging for PowerShell, cmd, PsExec, Net, dsquery, Nltest, WMI, scheduled task creation, and unusual administrative execution
  • Windows security logs and identity telemetry for logons, privileged account use, RDP sessions, SMB/admin share access, and domain enumeration patterns
  • Endpoint detection telemetry for LSASS memory access, process injection/APC-style behavior, suspicious DLL/plugin loading, and backdoor execution indicators
  • Network telemetry for internal discovery, ping/network probing, SMB/RDP movement, and outbound transfers over unencrypted non-C2 protocols such as HTTP, FTP, or DNS where applicable
  • POS environment telemetry where POS networks exist, including host integrity, process execution, network segmentation evidence, and payment-system access patterns

Detection direction

  • Because no official detection guidance is supplied for FIN8, validate detections against the related ATT&CK techniques rather than the group name alone.
  • Tune for suspicious combinations: domain discovery with dsquery/Nltest/Net, followed by RDP/SMB or PsExec/WMI activity, followed by credential access or scheduled task creation.
  • Treat legitimate administration tools as dual-use. Reduce false positives by baselining approved administrator hosts, service accounts, maintenance windows, and normal command-line patterns.
  • Confirm visibility into command obfuscation for PowerShell and Windows Command Shell; simple string matching may miss altered or encoded commands.
  • Validate controls for LSASS access and credential dumping attempts, especially where administrative privileges are common or poorly separated.

Mitigation priorities

  • Start with identity hardening: least privilege, separation of administrative accounts, strong authentication for remote access, and review of privileged service account use.
  • Restrict and monitor lateral movement paths, especially RDP, SMB/admin shares, PsExec-style execution, and WMI remote execution.
  • Harden Windows endpoints against credential theft and script abuse, including tighter PowerShell controls, command-line logging, and protection of LSASS where supported by the environment.
  • Segment POS and other critical business systems from general user networks, and ensure monitoring spans both sides of segmentation boundaries.
  • Control scheduled task creation and remote administration tooling through policy, change control, and alerting rather than assuming all use is benign.
Additional notes and limits

The ATT&CK object identifies FIN8 aliases as FIN8 and Syssphinx and describes activity since at least January 2016, sectors historically targeted, a shift reported in June 2021 from POS targeting to ransomware variant distribution, and relationships to multiple tools, malware families, and techniques. The practical defensive takeaway is to use FIN8 as an emulation and coverage-review scenario spanning POS risk, Windows enterprise intrusion tradecraft, identity compromise, and ransomware readiness.

ATT&CK supplies no official detection text, no group-level platforms, and no environment-specific indicators in the provided fields. The related techniques and software support defensive validation themes, but local telemetry, asset inventory, sector exposure, POS presence, identity architecture, and incident history are required to determine actual risk and coverage.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

FIN8

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.[1][2][3][4]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

36 rows
DomainIDNameRelationship / procedure
EnterpriseT1078Valid Accounts

FIN8 has used valid accounts for persistence and lateral movement.[5]

EnterpriseT1048.003Exfiltration Over Unencrypted Non-C2 ProtocolSub-technique

FIN8 has used FTP to exfiltrate collected data.[5]

EnterpriseT1033System Owner/User Discovery

FIN8 has executed the command `quser` to display the session details of a compromised machine.[4]

EnterpriseT1518.001Security Software DiscoverySub-technique

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.[5]

EnterpriseT1021.001Remote Desktop ProtocolSub-technique

FIN8 has used RDP for lateral movement.[5]

EnterpriseT1003.001LSASS MemorySub-technique

FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).[5]

EnterpriseT1588.002ToolSub-technique

FIN8 has used open-source tools such as Impacket for targeting efforts.[3]

EnterpriseT1204.002Malicious FileSub-technique

FIN8 has used malicious e-mail attachments to lure victims into executing malware.[1][2][5]

EnterpriseT1588.003Code Signing CertificatesSub-technique

FIN8 has used an expired open-source X.509 certificate for testing in the OpenSSL repository, to connect to actor-controlled C2 servers.[3]

EnterpriseT1068Exploitation for Privilege Escalation

FIN8 has exploited the CVE-2016-0167 local vulnerability.[2][5]

EnterpriseT1546.003Windows Management Instrumentation Event SubscriptionSub-technique

FIN8 has used WMI event subscriptions for persistence.[7]

EnterpriseT1566.002Spearphishing LinkSub-technique

FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.[5]

EnterpriseT1053.005Scheduled TaskSub-technique

FIN8 has used scheduled tasks to maintain RDP backdoors.[5]

EnterpriseT1204.001Malicious LinkSub-technique

FIN8 has used emails with malicious links to lure victims into installing malware.[1][2][5]

EnterpriseT1102Web Service

FIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.[7]

EnterpriseT1027.010Command ObfuscationSub-technique

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.[1][5][7]

EnterpriseT1070.004File DeletionSub-technique

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.[5][4]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.[1][2][5]

EnterpriseT1071.001Web ProtocolsSub-technique

FIN8 has used HTTPS for command and control.[7]

EnterpriseT1021.002SMB/Windows Admin SharesSub-technique

FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context. FIN8 has also used smbexec from the Impacket suite for lateral movement.[5][3]

EnterpriseT1685.005Clear Windows Event LogsSub-technique

FIN8 has cleared logs during post compromise cleanup activities.[5]

EnterpriseT1560.001Archive via UtilitySub-technique

FIN8 has used RAR to compress collected data before exfiltration.[5]

EnterpriseT1074.002Remote Data StagingSub-technique

FIN8 aggregates staged data from a network into a single location.[5]

EnterpriseT1105Ingress Tool Transfer

FIN8 has used remote code execution to download subsequent payloads.[2][7]

EnterpriseT1082System Information Discovery

FIN8 has used PowerShell Scripts to check the architecture of a compromised machine before the selection of a 32-bit or 64-bit version of a malicious .NET loader.[4]

EnterpriseT1059.001PowerShellSub-technique

FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.[1][7][5][4]

EnterpriseT1059.003Windows Command ShellSub-technique

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities.[5] FIN8 has also executed commands remotely via `cmd.exe`.[1][7][4]

EnterpriseT1573.002Asymmetric CryptographySub-technique

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.[5]

EnterpriseT1055.004Asynchronous Procedure CallSub-technique

FIN8 has injected malicious code into a new svchost.exe process.[7]

EnterpriseT1018Remote System Discovery

FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.[5][7]

EnterpriseT1486Data Encrypted for Impact

FIN8 has deployed ransomware such as Ragnar Locker, White Rabbit, and attempted to execute Noberus on compromised networks.[4]

EnterpriseT1482Domain Trust Discovery

FIN8 has retrieved a list of trusted domains by using nltest.exe /domain_trusts.[7]

EnterpriseT1112Modify Registry

FIN8 has deleted Registry keys during post compromise cleanup activities.[5]

EnterpriseT1134.001Token Impersonation/TheftSub-technique

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.[7][4]

EnterpriseT1016.001Internet Connection DiscoverySub-technique

FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.[3]

EnterpriseT1047Windows Management Instrumentation

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.[1][7][5][4]

Associated objects

Groups, software, and campaigns

ToolEnterprise

S0097: Ping

Ping is an operating system utility commonly used to troubleshoot and verify network connections. [1]

MalwareEnterprise

S1081: BADHATCH

BADHATCH is a backdoor that has been utilized by FIN8 since at least 2019. BADHATCH has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.[1][2]

Windows
ToolEnterprise

S0105: dsquery

dsquery is a command-line utility that can be used to query Active Directory for information from a system within a domain. [1] It is typically installed only on Windows Server versions but can be installed on non-server variants through the Microsoft-provided Remote Server Administration Tools bundle.

Windows
ToolEnterprise

S0039: Net

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]

Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

Windows
ToolEnterprise

S0359: Nltest

Nltest is a Windows command-line utility used to list domain controllers and enumerate domain trusts.[1]

Windows
MalwareEnterprise

S1085: Sardonic

Sardonic is a backdoor written in C and C++ that is known to be used by FIN8, as early as August 2021 to target a financial institution in the United States. Sardonic has a plugin system that can load specially made DLLs and execute their functions.[1][2]

Windows
ToolEnterprise

S0029: PsExec

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.[1][2]

Windows
ToolEnterprise

S0357: Impacket

Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. Impacket contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.[1]

LinuxmacOSWindows
Relationship explorer

All related ATT&CK context

uses · TechniqueT1078: Valid AccountsEnterpriseuses · TechniqueT1048.003: Exfiltration Over Unencrypted Non-C2 ProtocolEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · ToolS0097: PingEnterpriseuses · MalwareS1081: BADHATCHEnterpriseuses · TechniqueT1021.001: Remote Desktop ProtocolEnterpriseuses · TechniqueT1003.001: LSASS MemoryEnterpriseuses · TechniqueT1588.002: ToolEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1588.003: Code Signing CertificatesEnterpriseuses · TechniqueT1068: Exploitation for Privilege EscalationEnterpriseuses · TechniqueT1546.003: Windows Management Instrumentation Event SubscriptionEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · MalwareS0196: PUNCHBUGGYEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · MalwareS0481: Ragnar LockerEnterpriseuses · MalwareS0197: PUNCHTRACKEnterpriseuses · ToolS0105: dsqueryEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1070.004: File DeletionEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
2.0
Created
Modified
Raw hash
bb5a34d483ce5437...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.12.0Current bundlebb5a34d483ce…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  2. [2]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  3. [3]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  4. [4]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  5. [5]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  6. [6]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  7. [7]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  8. [8]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  9. [9]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  10. [10]
    FIN8

    (Citation: FireEye Obfuscation June 2017)

  11. [11]
    FIN8

    (Citation: FireEye Obfuscation June 2017)

  12. [12]
    FIN8

    (Citation: FireEye Obfuscation June 2017)

  13. [13]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  14. [14]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  15. [15]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  16. [16]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  17. [17]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  18. [18]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  19. [19]
    Syssphinx

    (Citation: Symantec FIN8 Jul 2023)

  20. [20]
    Syssphinx

    (Citation: Symantec FIN8 Jul 2023)

  21. [21]
    Syssphinx

    (Citation: Symantec FIN8 Jul 2023)

  22. [22]
    mitre-attackG0061
    Open source URL
  23. [23]
    mitre-attackG0061
    Open source URL
  24. [24]
    mitre-attackG0061
    Open source URL
  25. [25]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  26. [26]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  27. [27]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  28. [28]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  29. [29]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  30. [30]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  31. [31]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  32. [32]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  33. [33]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  34. [34]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  35. [35]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  36. [36]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  37. [37]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  38. [38]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  39. [39]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  40. [40]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  41. [41]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  42. [42]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  43. [43]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  44. [44]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  45. [45]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  46. [46]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  47. [47]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  48. [48]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  49. [49]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  50. [50]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  51. [51]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  52. [52]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  53. [53]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  54. [54]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  55. [55]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  56. [56]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  57. [57]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  58. [58]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  59. [59]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  60. [60]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  61. [61]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  62. [62]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  63. [63]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  64. [64]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  65. [65]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  66. [66]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  67. [67]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  68. [68]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  69. [69]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  70. [70]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  71. [71]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  72. [72]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  73. [73]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  74. [74]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  75. [75]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  76. [76]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  77. [77]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  78. [78]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  79. [79]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  80. [80]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  81. [81]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  82. [82]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  83. [83]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  84. [84]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  85. [85]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  86. [86]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  87. [87]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  88. [88]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  89. [89]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  90. [90]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  91. [91]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  92. [92]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  93. [93]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  94. [94]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  95. [95]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  96. [96]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  97. [97]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  98. [98]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  99. [99]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  100. [100]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  101. [101]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  102. [102]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  103. [103]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  104. [104]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  105. [105]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  106. [106]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  107. [107]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  108. [108]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  109. [109]
    FireEye Fin8 May 2016

    Kizhakkinan, D., et al. (2016, May 11). Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks. Retrieved February 12, 2018.

    Open source URL
  110. [110]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  111. [111]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  112. [112]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  113. [113]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  114. [114]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  115. [115]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  116. [116]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  117. [117]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  118. [118]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  119. [119]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  120. [120]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  121. [121]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  122. [122]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  123. [123]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  124. [124]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  125. [125]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  126. [126]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  127. [127]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  128. [128]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  129. [129]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  130. [130]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  131. [131]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  132. [132]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  133. [133]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  134. [134]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  135. [135]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  136. [136]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  137. [137]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  138. [138]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  139. [139]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  140. [140]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  141. [141]
    FireEye Know Your Enemy FIN8 Aug 2016

    Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.

    Open source URL
  142. [142]
    FireEye Obfuscation June 2017

    Bohannon, D. & Carr N. (2017, June 30). Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques. Retrieved February 12, 2018.

    Open source URL
  143. [143]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  144. [144]
    Bitdefender FIN8 July 2021

    Martin Zugec. (2021, July 27). Deep Dive Into a FIN8 Attack - A Forensic Investigation. Retrieved September 1, 2021.

    Open source URL
  145. [145]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use