LiveActive security incident?Get immediate response
MITRE ATT&CK® Group

G0085: FIN4

FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013.[1][2] FIN4 is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.[1][3]

EnterpriseG0085GroupObject v1.2Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

FIN4 matters because the ATT&CK description frames it as financially motivated and focused on confidential market-moving information, especially in healthcare and pharmaceutical contexts, without relying on typical persistent malware. The practical risk is not just endpoint compromise; it is unauthorized use of legitimate credentials to access email and non-public correspondence, which can bypass controls that are overly malware-centric.

Executive priority

Leaders should treat this as an identity, email, and sensitive-information protection problem. Priority questions include: can the organization prove who accessed executive, legal, finance, R&D, or deal-related mailboxes; are mailbox rule changes audited; and would incident response quickly revoke credentials, sessions, and tokens if a high-value mailbox were suspected compromised? This behavior also supports compliance evidence around access monitoring, privileged communications, and protection of confidential business information.

Technical view

ATT&CK provides no official detection text for FIN4, so defenders should validate coverage through the related techniques: spearphishing links and attachments, malicious link/file user execution, Visual Basic execution, credential capture through keylogging or GUI input capture, valid account abuse, remote email collection, email hiding rules, and web-protocol or multi-hop proxy command-and-control context. SOC teams should avoid relying only on malware alerts and should correlate email delivery, user clicks, identity sign-ins, mailbox access, inbox rule changes, and endpoint scripting activity.

Likely telemetry

  • Email security gateway and phishing investigation logs for targeted links and attachments
  • User-reported phishing and message trace data
  • Identity provider authentication logs, including MFA, conditional access, source IP, device, and session context
  • Mailbox audit logs for Exchange, Office 365, or Google Workspace access and search activity
  • Inbox rule creation/modification/deletion events, especially rules that move, mark read, or delete mail

Detection direction

  • Validate detections that join phishing delivery or click activity with subsequent unusual identity sign-ins and mailbox access.
  • Tune mailbox monitoring for new or modified hiding rules, especially on executives, finance, legal, investor-relations, healthcare, pharmaceutical, or other sensitive correspondence roles where applicable.
  • Hunt for valid-account activity from unusual locations, devices, user agents, or proxy infrastructure, while accounting for legitimate travel, VPN, and remote-work patterns.
  • Review endpoint and email controls for document or script execution paths, including Visual Basic-related execution, rather than assuming malware persistence will be present.
  • Use relationship context to prioritize correlation across initial access, execution, credential access, collection, stealth, and command-and-control techniques; no single event class is likely to be sufficient.

Mitigation priorities

  • Prioritize strong identity controls for email and remote access, including MFA, conditional access, least privilege, and rapid credential/session revocation processes.
  • Ensure mailbox auditing is enabled and retained long enough to support investigations into remote email collection and inbox rule abuse.
  • Harden email security and user-reporting workflows for targeted links and attachments, with special attention to high-value business users.
  • Restrict or monitor risky document/script execution paths, including Visual Basic-related execution where business use allows.
  • Define IR playbooks for suspected mailbox compromise: preserve logs, disable malicious rules, revoke sessions/tokens, reset credentials, and review exposed correspondence.
Additional notes and limits

The most important decision value is that FIN4, as described by ATT&CK, shifts defensive emphasis from malware persistence to credential abuse and email collection. For managed detection, identity monitoring and mailbox auditing are as important as endpoint telemetry. For incident response, the key question is whether investigators can reconstruct mailbox access and rule changes after credentials are captured.

Platforms and tactics are not specified on the FIN4 group object itself, and ATT&CK provides no official detection text. Platform and tactic context in this take comes from the supplied relationships to techniques. The source material supports historical targeting and behavior descriptions, but local exposure, current activity, and detection coverage must be established from the organization’s own telemetry.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

FIN4

FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013.[1][2] FIN4 is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.[1][3]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

12 rows
DomainIDNameRelationship / procedure
EnterpriseT1078Valid Accounts

FIN4 has used legitimate credentials to hijack email communications.[1][3]

EnterpriseT1059.005Visual BasicSub-technique

FIN4 has used VBA macros to display a dialog box and collect victim credentials.[1][3]

EnterpriseT1090.003Multi-hop ProxySub-technique

FIN4 has used Tor to log in to victims' email accounts.[1]

EnterpriseT1204.002Malicious FileSub-technique

FIN4 has lured victims to launch malicious attachments delivered via spearphishing emails (often sent from compromised accounts).[1][3]

EnterpriseT1564.008Email Hiding RulesSub-technique

FIN4 has created rules in victims' Microsoft Outlook accounts to automatically delete emails containing words such as “hacked," "phish," and “malware" in a likely attempt to prevent organizations from communicating about their activities.[1]

EnterpriseT1204.001Malicious LinkSub-technique

FIN4 has lured victims to click malicious links delivered via spearphishing emails (often sent from compromised accounts).[1][3]

EnterpriseT1056.001KeyloggingSub-technique

FIN4 has captured credentials via fake Outlook Web App (OWA) login pages and has also used a .NET based keylogger.[1][3]

EnterpriseT1056.002GUI Input CaptureSub-technique

FIN4 has presented victims with spoofed Windows Authentication prompts to collect their credentials.[1][3]

EnterpriseT1566.002Spearphishing LinkSub-technique

FIN4 has used spearphishing emails (often sent from compromised accounts) containing malicious links.[1][3]

EnterpriseT1566.001Spearphishing AttachmentSub-technique

FIN4 has used spearphishing emails containing attachments (which are often stolen, legitimate documents sent from compromised accounts) with embedded malicious macros.[1][3]

EnterpriseT1071.001Web ProtocolsSub-technique

FIN4 has used HTTP POST requests to transmit data.[1][3]

EnterpriseT1114.002Remote Email CollectionSub-technique

FIN4 has accessed and hijacked online email communications using stolen credentials.[1][3]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1078: Valid AccountsEnterpriseuses · TechniqueT1059.005: Visual BasicEnterpriseuses · TechniqueT1090.003: Multi-hop ProxyEnterpriseuses · TechniqueT1204.002: Malicious FileEnterpriseuses · TechniqueT1564.008: Email Hiding RulesEnterpriseuses · TechniqueT1204.001: Malicious LinkEnterpriseuses · TechniqueT1056.001: KeyloggingEnterpriseuses · TechniqueT1056.002: GUI Input CaptureEnterpriseuses · TechniqueT1566.002: Spearphishing LinkEnterpriseuses · TechniqueT1566.001: Spearphishing AttachmentEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1114.002: Remote Email CollectionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.2
Created
Modified
Raw hash
1fae6e0438ae07b7...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.2Current bundle1fae6e0438ae…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  2. [2]
    FireEye FIN4 Stealing Insider NOV 2014

    Dennesen, K. et al.. (2014, November 30). FIN4: Stealing Insider Information for an Advantage in Stock Trading?. Retrieved November 17, 2024.

    Open source URL
  3. [3]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  4. [4]
    FIN4

    (Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye FIN4 Stealing Insider NOV 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)

  5. [5]
    FIN4

    (Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye FIN4 Stealing Insider NOV 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)

  6. [6]
    FIN4

    (Citation: FireEye Hacking FIN4 Dec 2014)(Citation: FireEye FIN4 Stealing Insider NOV 2014)(Citation: FireEye Hacking FIN4 Video Dec 2014)

  7. [7]
    FireEye FIN4 Stealing Insider NOV 2014

    Dennesen, K. et al.. (2014, November 30). FIN4: Stealing Insider Information for an Advantage in Stock Trading?. Retrieved November 17, 2024.

    Open source URL
  8. [8]
    FireEye FIN4 Stealing Insider NOV 2014

    Dennesen, K. et al.. (2014, November 30). FIN4: Stealing Insider Information for an Advantage in Stock Trading?. Retrieved November 17, 2024.

    Open source URL
  9. [9]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  10. [10]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  11. [11]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  12. [12]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  13. [13]
    mitre-attackG0085
    Open source URL
  14. [14]
    mitre-attackG0085
    Open source URL
  15. [15]
    mitre-attackG0085
    Open source URL
  16. [16]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  17. [17]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  18. [18]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  19. [19]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  20. [20]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  21. [21]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  22. [22]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  23. [23]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  24. [24]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  25. [25]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  26. [26]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  27. [27]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  28. [28]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  29. [29]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  30. [30]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  31. [31]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  32. [32]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  33. [33]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  34. [34]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  35. [35]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  36. [36]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  37. [37]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  38. [38]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  39. [39]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  40. [40]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  41. [41]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  42. [42]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  43. [43]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  44. [44]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  45. [45]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  46. [46]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  47. [47]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  48. [48]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  49. [49]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  50. [50]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  51. [51]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  52. [52]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  53. [53]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  54. [54]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  55. [55]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
  56. [56]
    FireEye Hacking FIN4 Dec 2014

    Vengerik, B. et al.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved December 17, 2018.

    Open source URL
  57. [57]
    FireEye Hacking FIN4 Video Dec 2014

    Vengerik, B. & Dennesen, K.. (2014, December 5). Hacking the Street? FIN4 Likely Playing the Market. Retrieved January 15, 2019.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use