LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S0182: FinFisher

FinFisher is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including Wingbird. [1] [2] [3] [4] [5]

EnterpriseS0182MalwareObject v1.4Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

FinFisher matters because ATT&CK describes it as heavily obfuscated commercial surveillance spyware with Windows and Android relevance, including relationships to credential collection, screen/audio/location capture, discovery, persistence, privilege escalation, and anti-analysis behaviors. For leaders, the practical issue is not just malware blocking; it is whether the organization can prove it has endpoint, mobile, identity, and incident response visibility when a targeted implant is designed to hide and collect sensitive information.

Executive priority

Treat this as a coverage validation scenario for targeted surveillance risk: high-value users, sensitive investigations, executive devices, legal/compliance teams, and mobile endpoints may need stronger monitoring and response playbooks than standard commodity-malware assumptions. Budget and risk discussions should focus on whether Windows persistence and privilege-escalation controls, Android permission governance, vulnerability prioritization, and forensic readiness can support decisions when official ATT&CK detection guidance is not provided.

Technical view

ATT&CK provides no official detection text for FinFisher, so SOC and IR teams should build coverage from the mapped relationships: Windows registry querying and run keys, Windows service creation/modification, DLL injection, token impersonation/theft, UAC bypass, bootkit persistence, process/system/file/security-software discovery, screen capture, credential API hooking, packed or junk-code-obfuscated files, deobfuscation behavior, and system checks for analysis environments. For Android, validate visibility into privilege-escalation exploitation indicators and application access to microphone and location capabilities. Dark Caracal is listed as using this object in enterprise and mobile ATT&CK context, but local detections should remain behavior-based rather than assuming attribution.

Likely telemetry

  • Windows process creation and command-line telemetry for discovery activity against registry, processes, files, system information, and security software
  • Windows Registry auditing for Run keys, startup locations, service configuration, and suspicious resource naming or placement
  • Windows service creation/modification events and associated executable paths
  • Endpoint memory/module telemetry that can support investigation of DLL injection, API hooking, token impersonation, and packed or unpacking code behavior
  • File metadata and binary analysis results for packed, obfuscated, junk-code-heavy, or masqueraded executables

Detection direction

  • Do not rely on a single signature or sandbox verdict; ATT&CK notes heavy obfuscation and multiple anti-analysis techniques, and relationships include software packing, junk code insertion, deobfuscation, and system checks.
  • Correlate weak signals: discovery of security tools plus process/system/file enumeration, followed by persistence changes, injection-like behavior, or collection events is more meaningful than any one event alone.
  • Tune Windows detections for false positives from administrators, inventory tools, software installers, endpoint agents, and legitimate services that query the registry or system state.
  • Validate mobile controls separately from desktop controls; Android microphone, location, and privilege-escalation signals require mobile telemetry that many SOC programs do not collect by default.
  • Use the mapped Dark Caracal relationship as threat-intelligence context only; do not label incidents with attribution without independent evidence.

Mitigation priorities

  • Prioritize vulnerability management for exposed user endpoints and document patch timelines, especially because cited references include research on zero-day-based FinSpy distribution.
  • Harden Windows privilege pathways: restrict local admin rights, monitor elevation, review UAC exposure, and control service creation and registry persistence locations.
  • Use application control and endpoint protection policies that reduce execution of unknown, packed, or suspiciously placed binaries, while recognizing obfuscation may limit static detection.
  • Strengthen mobile device governance for Android: manage application sources, review high-risk permissions such as microphone and location, and ensure mobile telemetry is available for high-risk users.
  • Prepare IR procedures for stealthy persistence, including escalation paths for suspected boot-level compromise where normal OS-level remediation may be insufficient.
Additional notes and limits

This take is derived from the ATT&CK FinFisher malware object S0182, its official description, external references, platforms, and supplied relationship context. The most decision-useful content comes from the technique relationships because the object itself has no tactic list and no official detection section. The supplied relationships show a blend of surveillance collection, credential access, discovery, stealth, persistence, and privilege-escalation behaviors across Windows and Android-relevant contexts.

ATT&CK does not provide official detection guidance for this object, aliases are not supplied, and the malware object lists tactics as not specified. The relationship set supports defensive validation themes but does not prove current exploitation, customer exposure, or detection coverage in any environment. Local telemetry, asset criticality, mobile management scope, and forensic evidence are required to turn this into an operational assessment.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

FinFisher

FinFisher is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including Wingbird. [1] [2] [3] [4] [5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

22 rows
DomainIDNameRelationship / procedure
EnterpriseT1134.001Token Impersonation/TheftSub-technique

FinFisher uses token manipulation with NtFilterToken as part of UAC bypass.[1][5]

EnterpriseT1113Screen Capture

FinFisher takes a screenshot of the screen and displays it on top of all other windows for few seconds in an apparent attempt to hide some messages showed by the system during the setup process.[1][5]

EnterpriseT1547.001Registry Run Keys / Startup FolderSub-technique

FinFisher establishes persistence by creating the Registry key HKCU\Software\Microsoft\Windows\Run.[1][5]

EnterpriseT1685.005Clear Windows Event LogsSub-technique

FinFisher clears the system event logs using OpenEventLog/ClearEventLog APIs .[1][5]

EnterpriseT1497.001System ChecksSub-technique

FinFisher obtains the hardware device list and checks if the MD5 of the vendor ID is equal to a predefined list in order to check for sandbox/virtualized environments.[5]

EnterpriseT1574.001DLLSub-technique

FinFisher uses DLL side-loading to load malicious programs.[1][5] A FinFisher variant also uses DLL search order hijacking.[1][4]

EnterpriseT1056.004Credential API HookingSub-technique

FinFisher hooks processes by modifying IAT pointers to CreateWindowEx.[1][7]

EnterpriseT1027.002Software PackingSub-technique

A FinFisher variant uses a custom packer.[1][4]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

FinFisher injects itself into various processes depending on whether it is low integrity or high integrity.[1][5]

EnterpriseT1548.002Bypass User Account ControlSub-technique

FinFisher performs UAC bypass.[1][5]

EnterpriseT1083File and Directory Discovery

FinFisher enumerates directories and scans for certain files.[1][5]

EnterpriseT1542.003BootkitSub-technique

Some FinFisher variants incorporate an MBR rootkit.[1][5]

EnterpriseT1012Query Registry

FinFisher queries Registry values as part of its anti-sandbox checks.[1][5]

EnterpriseT1543.003Windows ServiceSub-technique

FinFisher creates a new Windows service with the malicious executable for persistence.[1][5]

EnterpriseT1027.016Junk Code InsertionSub-technique

FinFisher contains junk code in its functions in an effort to confuse disassembly programs.[1][5]

EnterpriseT1036.005Match Legitimate Resource Name or LocationSub-technique

FinFisher renames one of its .dll files to uxtheme.dll in an apparent attempt to masquerade as a legitimate file.[1][5]

EnterpriseT1140Deobfuscate/Decode Files or Information

FinFisher extracts and decrypts stage 3 malware, which is stored in encrypted resources.[1][5]

EnterpriseT1057Process Discovery

FinFisher checks its parent process for indications that it is running in a sandbox setup.[1][5]

EnterpriseT1518.001Security Software DiscoverySub-technique

FinFisher probes the system to check for antimalware processes.[1][4]

EnterpriseT1082System Information Discovery

FinFisher checks if the victim OS is 32 or 64-bit.[1][5]

EnterpriseT1027Obfuscated Files or Information

FinFisher is heavily obfuscated in many ways, including through the use of spaghetti code in its functions in an effort to confuse disassembly programs. It also uses a custom XOR algorithm to obfuscate code.[1][5]

EnterpriseT1574.013KernelCallbackTableSub-technique

FinFisher has used the KernelCallbackTable to hijack the execution flow of a process by replacing the __fnDWORD function with the address of a created Asynchronous Procedure Call stub routine.[8]

Associated objects

Groups, software, and campaigns

Relationship explorer

All related ATT&CK context

uses · TechniqueT1134.001: Token Impersonation/TheftEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1547.001: Registry Run Keys / Startup FolderEnterpriseuses · TechniqueT1685.005: Clear Windows Event LogsEnterpriseuses · TechniqueT1497.001: System ChecksEnterpriseuses · GroupG0070: Dark CaracalEnterpriseuses · TechniqueT1574.001: DLLEnterpriseuses · TechniqueT1056.004: Credential API HookingEnterpriseuses · TechniqueT1027.002: Software PackingEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1548.002: Bypass User Account ControlEnterpriseuses · TechniqueT1083: File and Directory DiscoveryEnterpriseuses · TechniqueT1542.003: BootkitEnterpriseuses · TechniqueT1012: Query RegistryEnterpriseuses · TechniqueT1543.003: Windows ServiceEnterpriseuses · TechniqueT1027.016: Junk Code InsertionEnterpriseuses · TechniqueT1036.005: Match Legitimate Resource Name or LocationEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1518.001: Security Software DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1574.013: KernelCallbackTableEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.4
Created
Modified
Raw hash
b34bead4ed8213f9...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.4Current bundleb34bead4ed82…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  2. [2]
    Microsoft SIR Vol 21

    Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.

  3. [3]
    FireEye FinSpy Sept 2017

    Jiang, G., et al. (2017, September 12). FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY. Retrieved February 15, 2018.

    Open source URL
  4. [4]
    Securelist BlackOasis Oct 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.

    Open source URL
  5. [5]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  6. [6]
    Lookout Dark Caracal Jan 2018

    Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.

    Open source URL
  7. [7]
    Elastic Process Injection July 2017

    Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.

    Open source URL
  8. [8]
    FinFisher exposed

    Microsoft Defender Security Research Team. (2018, March 1). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved January 27, 2022.

    Open source URL
  9. [9]
    FinFisher

    (Citation: FinFisher Citation) (Citation: Microsoft SIR Vol 21) (Citation: FireEye FinSpy Sept 2017) (Citation: Securelist BlackOasis Oct 2017)

  10. [10]
    FinFisher

    (Citation: FinFisher Citation) (Citation: Microsoft SIR Vol 21) (Citation: FireEye FinSpy Sept 2017) (Citation: Securelist BlackOasis Oct 2017)

  11. [11]
    FinFisher

    (Citation: FinFisher Citation) (Citation: Microsoft SIR Vol 21) (Citation: FireEye FinSpy Sept 2017) (Citation: Securelist BlackOasis Oct 2017)

  12. [12]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  13. [13]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  14. [14]
    FinSpy

    (Citation: FireEye FinSpy Sept 2017) (Citation: Securelist BlackOasis Oct 2017)

  15. [15]
    FinSpy

    (Citation: FireEye FinSpy Sept 2017) (Citation: Securelist BlackOasis Oct 2017)

  16. [16]
    FinSpy

    (Citation: FireEye FinSpy Sept 2017) (Citation: Securelist BlackOasis Oct 2017)

  17. [17]
    FireEye FinSpy Sept 2017

    Jiang, G., et al. (2017, September 12). FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY. Retrieved February 15, 2018.

    Open source URL
  18. [18]
    FireEye FinSpy Sept 2017

    Jiang, G., et al. (2017, September 12). FireEye Uncovers CVE-2017-8759: Zero-Day Used in the Wild to Distribute FINSPY. Retrieved February 15, 2018.

    Open source URL
  19. [19]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  20. [20]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  21. [21]
    Microsoft SIR Vol 21

    Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.

  22. [22]
    Microsoft SIR Vol 21

    Anthe, C. et al. (2016, December 14). Microsoft Security Intelligence Report Volume 21. Retrieved November 27, 2017.

  23. [23]
    Securelist BlackOasis Oct 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.

    Open source URL
  24. [24]
    Securelist BlackOasis Oct 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.

    Open source URL
  25. [25]
    mitre-attackS0182
    Open source URL
  26. [26]
    mitre-attackS0182
    Open source URL
  27. [27]
    mitre-attackS0182
    Open source URL
  28. [28]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  29. [29]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  30. [30]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  31. [31]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  32. [32]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  33. [33]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  34. [34]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  35. [35]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  36. [36]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  37. [37]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  38. [38]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  39. [39]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  40. [40]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  41. [41]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  42. [42]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  43. [43]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  44. [44]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  45. [45]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  46. [46]
    Lookout Dark Caracal Jan 2018

    Blaich, A., et al. (2018, January 18). Dark Caracal: Cyber-espionage at a Global Scale. Retrieved April 11, 2018.

    Open source URL
  47. [47]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  48. [48]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  49. [49]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  50. [50]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  51. [51]
    Securelist BlackOasis Oct 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.

    Open source URL
  52. [52]
    Securelist BlackOasis Oct 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.

    Open source URL
  53. [53]
    Elastic Process Injection July 2017

    Hosseini, A. (2017, July 18). Ten Process Injection Techniques: A Technical Survey Of Common And Trending Process Injection Techniques. Retrieved December 7, 2017.

    Open source URL
  54. [54]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  55. [55]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  56. [56]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  57. [57]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  58. [58]
    Securelist BlackOasis Oct 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.

    Open source URL
  59. [59]
    Securelist BlackOasis Oct 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.

    Open source URL
  60. [60]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  61. [61]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  62. [62]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  63. [63]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  64. [64]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  65. [65]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  66. [66]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  67. [67]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  68. [68]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  69. [69]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  70. [70]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  71. [71]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  72. [72]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  73. [73]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  74. [74]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  75. [75]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  76. [76]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  77. [77]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  78. [78]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  79. [79]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  80. [80]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  81. [81]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  82. [82]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  83. [83]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  84. [84]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  85. [85]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  86. [86]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  87. [87]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  88. [88]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  89. [89]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  90. [90]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  91. [91]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  92. [92]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  93. [93]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  94. [94]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  95. [95]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  96. [96]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  97. [97]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  98. [98]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  99. [99]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  100. [100]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  101. [101]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  102. [102]
    Securelist BlackOasis Oct 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.

    Open source URL
  103. [103]
    Securelist BlackOasis Oct 2017

    Kaspersky Lab's Global Research & Analysis Team. (2017, October 16). BlackOasis APT and new targeted attacks leveraging zero-day exploit. Retrieved February 15, 2018.

    Open source URL
  104. [104]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  105. [105]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
  106. [106]
    FinFisher Citation

    FinFisher. (n.d.). Retrieved September 12, 2024.

    Open source URL
  107. [107]
    Microsoft FinFisher March 2018

    Allievi, A.,Flori, E. (2018, March 01). FinFisher exposed: A researcher’s tale of defeating traps, tricks, and complex virtual machines. Retrieved July 9, 2018.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use