LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1081: BADHATCH

BADHATCH is a backdoor that has been utilized by FIN8 since at least 2019. BADHATCH has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.[1][2]

EnterpriseS1081MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

BADHATCH is a Windows backdoor that ATT&CK associates with FIN8 activity since at least 2019 and reports as used against insurance, retail, technology, and chemical organizations across several countries. Its defensive significance is not just the malware name: the ATT&CK relationships show a broad post-compromise pattern involving discovery, command execution, persistence through scheduled tasks, process injection, command-and-control over common protocols, proxying, and exfiltration over the C2 channel.

Executive priority

Treat BADHATCH as a validation case for Windows endpoint resilience and incident response readiness in sectors called out by ATT&CK. Leaders should ask whether the organization can prove visibility into Windows execution, WMI, PowerShell, scheduled tasks, identity/group discovery, and outbound web/file-transfer traffic. Because ATT&CK provides no official detection guidance for this object, coverage should be demonstrated through telemetry and tested detections rather than assumed from malware signatures alone.

Technical view

SOC and IR teams should map BADHATCH-related coverage to the linked ATT&CK techniques: Windows command shell and PowerShell execution, WMI abuse, scheduled task creation, process/DLL/APC injection, system/user/group/process/network discovery, file deletion, obfuscation through embedded payloads, compression and command obfuscation, C2 over web and file-transfer protocols, proxy behavior, external web services, and exfiltration over the C2 channel. Prioritize correlation across endpoint process lineage, command-line content, script logging, Windows management activity, task scheduler events, module/memory behavior, and egress network telemetry.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • PowerShell execution and script block/module logging where enabled
  • WMI activity and remote/local management execution evidence
  • Windows scheduled task creation, modification, and execution logs
  • Endpoint file creation, deletion, archive/compression, and payload staging evidence

Detection direction

  • Do not rely on a single BADHATCH signature; ATT&CK does not provide official detection text for this malware object.
  • Build behavior-based detections around the related techniques, especially suspicious combinations of discovery followed by WMI, command shell or PowerShell execution, scheduled task persistence, and outbound C2-like traffic.
  • Tune for administrative false positives: WMI, PowerShell, scheduled tasks, compression, and domain group enumeration are legitimate in many environments, so detections should consider user role, host criticality, parent process, frequency, and destination reputation/context.
  • Validate visibility for process injection behaviors using EDR or equivalent endpoint telemetry; standard Windows logs alone may not expose memory-level activity.
  • Correlate endpoint and network evidence for C2 over web protocols, file-transfer protocols, proxies, and external web services, because these channels may blend into normal business traffic.

Mitigation priorities

  • Confirm baseline Windows hardening and least-privilege controls for users, administrators, service accounts, WMI access, and scheduled task creation.
  • Restrict and monitor script and shell usage, including PowerShell and cmd, with logging sufficient for incident reconstruction.
  • Control outbound traffic through authenticated proxies, egress filtering, and logging that preserves destination, protocol, user, host, and volume context.
  • Harden Active Directory visibility and permissions so domain group enumeration and privileged group exposure can be investigated and reduced where possible.
  • Deploy or validate endpoint controls capable of detecting suspicious process injection, DLL loading, payload staging, and file deletion behaviors.
Additional notes and limits

The most decision-useful part of this object is the relationship set: BADHATCH is connected to many behaviors that give defenders practical test cases for Windows endpoint, identity, and network monitoring. The FIN8 relationship and sector references come from ATT&CK’s official description and external references; they should guide threat-informed prioritization but not be treated as proof of current activity in any specific environment.

ATT&CK provides no official detection text, no aliases, and no object-level tactics for BADHATCH. Local validation is required to determine whether telemetry exists, whether detections are tuned, and whether observed activity is malicious or legitimate administration. This summary does not assert active exploitation or customer exposure.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

BADHATCH

BADHATCH is a backdoor that has been utilized by FIN8 since at least 2019. BADHATCH has been used to target the insurance, retail, technology, and chemical industries in the United States, Canada, South Africa, Panama, and Italy.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

35 rows
DomainIDNameRelationship / procedure
EnterpriseT1135Network Share Discovery

BADHATCH can check a user's access to the C$ share on a compromised machine.[2]

EnterpriseT1620Reflective Code Loading

BADHATCH can copy a large byte array of 64-bit shellcode into process memory and execute it with a call to `CreateThread`.[1]

EnterpriseT1059.001PowerShellSub-technique

BADHATCH can utilize `powershell.exe` to execute commands on a compromised host.[1][2]

EnterpriseT1055Process Injection

BADHATCH can inject itself into an existing explorer.exe process by using `RtlCreateUserThread`.[1][2]

EnterpriseT1018Remote System Discovery

BADHATCH can use a PowerShell object such as, `System.Net.NetworkInformation.Ping` to ping a computer.[2]

EnterpriseT1057Process Discovery

BADHATCH can retrieve a list of running processes from a compromised machine.[2]

EnterpriseT1082System Information Discovery

BADHATCH can obtain current system information from a compromised machine such as the `SHELL PID`, `PSVERSION`, `HOSTNAME`, `LOGONSERVER`, `LASTBOOTUP`, OS type/version, bitness, and hostname.[1][2]

EnterpriseT1113Screen Capture

BADHATCH can take screenshots and send them to an actor-controlled C2 server.[2]

EnterpriseT1027.009Embedded PayloadsSub-technique

BADHATCH has an embedded second stage DLL payload within the first stage of the malware.[1]

EnterpriseT1124System Time Discovery

BADHATCH can obtain the `DATETIME` and `UPTIME` from a compromised machine.[2]

EnterpriseT1053.005Scheduled TaskSub-technique

BADHATCH can use `schtasks.exe` to gain persistence.[2]

EnterpriseT1027.010Command ObfuscationSub-technique

BADHATCH malicious PowerShell commands can be encoded with base64.[2]

EnterpriseT1071.001Web ProtocolsSub-technique

BADHATCH can use HTTP and HTTPS over port 443 to communicate with actor-controlled C2 servers.[1][2]

EnterpriseT1033System Owner/User Discovery

BADHATCH can obtain logged user information from a compromised machine and can execute the command `whoami.exe`.[2]

EnterpriseT1090Proxy

BADHATCH can use SOCKS4 and SOCKS5 proxies to connect to actor-controlled C2 servers. BADHATCH can also emulate a reverse proxy on a compromised machine to connect with actor-controlled C2 servers.[2]

EnterpriseT1106Native API

BADHATCH can utilize Native API functions such as, `ToolHelp32` and `Rt1AdjustPrivilege` to enable `SeDebugPrivilege` on a compromised machine.[1]

EnterpriseT1055.001Dynamic-link Library InjectionSub-technique

BADHATCH has the ability to execute a malicious DLL by injecting into `explorer.exe` on a compromised machine.[1]

EnterpriseT1046Network Service Discovery

BADHATCH can check for open ports on a computer by establishing a TCP connection.[2]

EnterpriseT1105Ingress Tool Transfer

BADHATCH has the ability to load a second stage malicious DLL file onto a compromised machine.[1]

EnterpriseT1573.002Asymmetric CryptographySub-technique

BADHATCH can beacon to a hardcoded C2 IP address using TLS encryption every 5 minutes.[1]

EnterpriseT1027.015CompressionSub-technique

BADHATCH can be compressed with the ApLib algorithm.[2]

EnterpriseT1102Web Service

BADHATCH can be utilized to abuse `sslip.io`, a free IP to domain mapping service, as part of actor-controlled C2 channels.[2]

EnterpriseT1070.004File DeletionSub-technique

BADHATCH has the ability to delete PowerShell scripts from a compromised machine.[1]

EnterpriseT1546.003Windows Management Instrumentation Event SubscriptionSub-technique

BADHATCH can use WMI event subscriptions for persistence.[2]

EnterpriseT1069.002Domain GroupsSub-technique

BADHATCH can use `net.exe group "domain admins" /domain` to identify Domain Administrators.[2]

EnterpriseT1550.002Pass the HashSub-technique

BADHATCH can perform pass the hash on compromised machines with x64 versions.[2]

EnterpriseT1482Domain Trust Discovery

BADHATCH can use `nltest.exe /domain_trusts` to discover domain trust relationships on a compromised machine.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

BADHATCH can use `cmd.exe` to execute commands on a compromised host.[1][2]

EnterpriseT1071.002File Transfer ProtocolsSub-technique

BADHATCH can emulate an FTP server to connect to actor-controlled C2 servers.[2]

EnterpriseT1047Windows Management Instrumentation

BADHATCH can utilize WMI to collect system information, create new processes, and run malicious PowerShell scripts on a compromised machine.[1][2]

EnterpriseT1548.002Bypass User Account ControlSub-technique

BADHATCH can utilize the CMSTPLUA COM interface and the SilentCleanup task to bypass UAC.[2]

EnterpriseT1055.004Asynchronous Procedure CallSub-technique

BADHATCH can inject itself into a new `svchost.exe -k netsvcs` process using the asynchronous procedure call (APC) queue.[1][2]

EnterpriseT1134.001Token Impersonation/TheftSub-technique

BADHATCH can impersonate a `lsass.exe` or `vmtoolsd.exe` token.[2]

EnterpriseT1049System Network Connections Discovery

BADHATCH can execute `netstat.exe -f` on a compromised machine.[2]

EnterpriseT1041Exfiltration Over C2 Channel

BADHATCH can exfiltrate data over the C2 channel.[1][2]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0061: FIN8

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1620: Reflective Code LoadingEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1055: Process InjectionEnterpriseuses · TechniqueT1018: Remote System DiscoveryEnterpriseuses · GroupG0061: FIN8Enterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1113: Screen CaptureEnterpriseuses · TechniqueT1027.009: Embedded PayloadsEnterpriseuses · TechniqueT1124: System Time DiscoveryEnterpriseuses · TechniqueT1053.005: Scheduled TaskEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1071.001: Web ProtocolsEnterpriseuses · TechniqueT1033: System Owner/User DiscoveryEnterpriseuses · TechniqueT1090: ProxyEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1055.001: Dynamic-link Library InjectionEnterpriseuses · TechniqueT1046: Network Service DiscoveryEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1027.015: CompressionEnterpriseuses · TechniqueT1102: Web ServiceEnterpriseuses · TechniqueT1070.004: File DeletionEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
7adec98982ef0d28...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle7adec98982ef…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  2. [2]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  3. [3]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  4. [4]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  5. [5]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  6. [6]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  7. [7]
    mitre-attackS1081
    Open source URL
  8. [8]
    mitre-attackS1081
    Open source URL
  9. [9]
    mitre-attackS1081
    Open source URL
  10. [10]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  11. [11]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  12. [12]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  13. [13]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  14. [14]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  15. [15]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  16. [16]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  17. [17]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  18. [18]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  19. [19]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  20. [20]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  21. [21]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  22. [22]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  23. [23]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  24. [24]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  25. [25]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  26. [26]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  27. [27]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  28. [28]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  29. [29]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  30. [30]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  31. [31]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  32. [32]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  33. [33]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  34. [34]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  35. [35]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  36. [36]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  37. [37]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  38. [38]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  39. [39]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  40. [40]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  41. [41]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  42. [42]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  43. [43]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  44. [44]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  45. [45]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  46. [46]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  47. [47]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  48. [48]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  49. [49]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  50. [50]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  51. [51]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  52. [52]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  53. [53]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  54. [54]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  55. [55]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  56. [56]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  57. [57]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  58. [58]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  59. [59]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  60. [60]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  61. [61]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  62. [62]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  63. [63]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  64. [64]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  65. [65]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  66. [66]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  67. [67]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  68. [68]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  69. [69]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  70. [70]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  71. [71]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  72. [72]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  73. [73]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  74. [74]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  75. [75]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  76. [76]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  77. [77]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  78. [78]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  79. [79]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  80. [80]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  81. [81]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  82. [82]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  83. [83]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  84. [84]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  85. [85]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  86. [86]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  87. [87]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
  88. [88]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  89. [89]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  90. [90]
    BitDefender BADHATCH Mar 2021

    Vrabie, V., et al. (2021, March 10). FIN8 Returns with Improved BADHATCH Toolkit. Retrieved September 8, 2021.

    Open source URL
  91. [91]
    Gigamon BADHATCH Jul 2019

    Savelesky, K., et al. (2019, July 23). ABADBABE 8BADFOOD: Discovering BADHATCH and a Detailed Look at FIN8's Tooling. Retrieved September 8, 2021.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use