LiveActive security incident?Get immediate response
MITRE ATT&CK® Malware

S1085: Sardonic

Sardonic is a backdoor written in C and C++ that is known to be used by FIN8, as early as August 2021 to target a financial institution in the United States. Sardonic has a plugin system that can load specially made DLLs and execute their functions.[1][2]

EnterpriseS1085MalwareObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceMedium

Sardonic matters because it is a Windows backdoor associated in ATT&CK with FIN8 and a prior financial-sector targeting report. Its plugin-based DLL capability means defenders should treat it as more than a single executable: the operational risk is follow-on execution, discovery, tool transfer, persistence, and concealed command-and-control activity after initial compromise.

Executive priority

Prioritize Sardonic as a validation case for Windows endpoint visibility, incident response readiness, and financially motivated intrusion playbooks. Leaders should ask whether the organization can prove collection and alerting for WMI abuse, PowerShell and command-shell execution, process injection indicators, suspicious DLL/plugin loading, discovery commands, unusual network egress, and evidence tampering. This is especially relevant for sectors noted in the FIN8 relationship context, including hospitality, retail, entertainment, insurance, technology, chemical, and financial organizations, but local exposure depends on the environment.

Technical view

ATT&CK provides no dedicated detection text for Sardonic, so coverage should be built from its mapped behaviors. Validate Windows telemetry for execution through WMI, PowerShell, cmd, and native APIs; persistence through WMI event subscriptions; stealth through obfuscation, command obfuscation, deobfuscation, indicator removal, and APC process injection; discovery of services, processes, system information, network configuration, network connections, and shares; collection from local systems; ingress tool transfer; and C2 patterns involving non-application-layer protocols, non-standard ports, standard encoding, and symmetric or asymmetric cryptography.

Likely telemetry

  • Windows process creation and command-line telemetry
  • PowerShell script block, module, and transcription logs where enabled
  • WMI activity logs, including event filter/consumer/binding creation
  • Endpoint detection telemetry for DLL loading, process injection, APC activity, and native API usage
  • File creation, modification, deletion, and decoding/deobfuscation artifacts

Detection direction

  • Map detections to the related ATT&CK techniques rather than relying on a Sardonic-specific signature, because official detection guidance is not provided.
  • Correlate discovery bursts with suspicious execution sources such as WMI, PowerShell, cmd, or unusual parent-child process chains.
  • Tune for administrative false positives: WMI, PowerShell, service queries, network discovery, and share enumeration can be legitimate, so prioritize unusual users, hosts, timing, command structure, and follow-on C2 or file activity.
  • Review visibility gaps around encoded commands, obfuscated command lines, DLL/plugin loading, APC-style injection, and native API behaviors, which may be underrepresented in basic logging.
  • Hunt for network behavior that violates expected protocol-port pairings or uses non-application-layer protocols, while recognizing that encryption and standard encoding may limit payload inspection.

Mitigation priorities

  • Start with telemetry assurance: confirm Windows endpoint, PowerShell, WMI, process, file, and network logs are collected and retained for investigation.
  • Harden and monitor administrative execution paths, especially WMI, PowerShell, and command shell usage, with least privilege and change-control expectations.
  • Restrict unnecessary outbound connectivity and monitor non-standard protocol/port usage to reduce C2 opportunities.
  • Control DLL loading and unapproved tool transfer through application control, endpoint policy, and software inventory practices where feasible.
  • Prepare IR procedures for plugin-capable backdoors: scope for additional DLLs, transferred tools, persistence mechanisms, discovery output, and possible evidence removal.
Additional notes and limits

Sardonic is documented by ATT&CK as a C/C++ Windows backdoor with a plugin system that can load specially made DLLs and execute their functions. ATT&CK links it to FIN8 and maps it to execution, discovery, collection, stealth, persistence/privilege escalation, and command-and-control techniques through relationships. The strongest defensive value is validating whether the organization can see the behaviors around the malware, not merely whether a named malware alert exists.

Official ATT&CK detection guidance is not provided, tactics are not specified on the malware object itself, and the relationship descriptions are technique-level summaries rather than environment-specific indicators. This take does not assert current exploitation, customer exposure, or guaranteed detection. Local baselines, asset criticality, network architecture, and available logs are required to turn this into a concrete detection or response plan.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Sardonic

Sardonic is a backdoor written in C and C++ that is known to be used by FIN8, as early as August 2021 to target a financial institution in the United States. Sardonic has a plugin system that can load specially made DLLs and execute their functions.[1][2]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

25 rows
DomainIDNameRelationship / procedure
EnterpriseT1047Windows Management Instrumentation

Sardonic can use WMI to execute PowerShell commands on a compromised machine.[1]

EnterpriseT1027.010Command ObfuscationSub-technique

Sardonic PowerShell scripts can be encrypted with RC4 and compressed using Gzip.[1]

EnterpriseT1082System Information Discovery

Sardonic has the ability to collect the computer name, and CPU manufacturer name from a compromised machine. Sardonic also has the ability to execute the `ver` and `systeminfo` commands.[1]

EnterpriseT1016System Network Configuration Discovery

Sardonic has the ability to execute the `ipconfig` command.[1]

EnterpriseT1573.001Symmetric CryptographySub-technique

Sardonic has the ability to use an RC4 key to encrypt communications to and from actor-controlled C2 servers.[1]

EnterpriseT1546.003Windows Management Instrumentation Event SubscriptionSub-technique

Sardonic can use a WMI event filter to invoke a command-line event consumer to gain persistence.[1]

EnterpriseT1105Ingress Tool Transfer

Sardonic has the ability to upload additional malicious files to a compromised machine.[1]

EnterpriseT1135Network Share Discovery

Sardonic has the ability to execute the `net view` command.[1]

EnterpriseT1140Deobfuscate/Decode Files or Information

Sardonic can first decrypt with the RC4 algorithm using a hardcoded decryption key before decompressing.[2]

EnterpriseT1005Data from Local System

Sardonic has the ability to collect data from a compromised machine to deliver to the attacker.[2]

EnterpriseT1059.003Windows Command ShellSub-technique

Sardonic has the ability to run `cmd.exe` or other interactive processes on a compromised computer.[2]

EnterpriseT1680Local Storage Discovery

Sardonic has the ability to collect the C:\ drive serial number from a compromised machine.[1]

EnterpriseT1571Non-Standard Port

Sardonic has the ability to connect with actor-controlled C2 servers using a custom binary protocol over port 443.[1]

EnterpriseT1057Process Discovery

Sardonic has the ability to execute the `tasklist` command.[1]

EnterpriseT1007System Service Discovery

Sardonic has the ability to execute the `net start` command.[1]

EnterpriseT1106Native API

Sardonic has the ability to call Win32 API functions to determine if `powershell.exe` is running.[1]

EnterpriseT1132.001Standard EncodingSub-technique

Sardonic can encode client ID data in 32 uppercase hex characters and transfer to the actor-controlled C2 server.[1]

EnterpriseT1070Indicator Removal

Sardonic has the ability to delete created WMI objects to evade detections.[1]

EnterpriseT1620Reflective Code Loading

Sardonic has a plugin system that can load specially made DLLs into memory and execute their functions.[1][2]

EnterpriseT1573.002Asymmetric CryptographySub-technique

Sardonic has the ability to send a random 64-byte RC4 key to communicate with actor-controlled C2 servers by using an RSA public key.[1]

EnterpriseT1027Obfuscated Files or Information

Sardonic can use certain ConfuserEx features for obfuscation and can be encoded in a base64 string.[2]

EnterpriseT1059.001PowerShellSub-technique

Sardonic has the ability to execute PowerShell commands on a compromised machine.[1]

EnterpriseT1049System Network Connections Discovery

Sardonic has the ability to execute the `netstat` command.[1]

EnterpriseT1055.004Asynchronous Procedure CallSub-technique

Sardonic can use the `QueueUserAPC` API to execute shellcode on a compromised machine.[2]

EnterpriseT1095Non-Application Layer Protocol

Sardonic can communicate with actor-controlled C2 servers by using a custom little-endian binary protocol.[1]

Associated objects

Groups, software, and campaigns

GroupEnterprise

G0061: FIN8

FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.[1][2][3][4]

Relationship explorer

All related ATT&CK context

uses · TechniqueT1047: Windows Management InstrumentationEnterpriseuses · TechniqueT1027.010: Command ObfuscationEnterpriseuses · TechniqueT1082: System Information DiscoveryEnterpriseuses · TechniqueT1016: System Network Configuration DiscoveryEnterpriseuses · TechniqueT1573.001: Symmetric CryptographyEnterpriseuses · TechniqueT1546.003: Windows Management Instrumentation Event SubscriptionEnterpriseuses · TechniqueT1105: Ingress Tool TransferEnterpriseuses · TechniqueT1135: Network Share DiscoveryEnterpriseuses · TechniqueT1140: Deobfuscate/Decode Files or InformationEnterpriseuses · TechniqueT1005: Data from Local SystemEnterpriseuses · TechniqueT1059.003: Windows Command ShellEnterpriseuses · TechniqueT1680: Local Storage DiscoveryEnterpriseuses · TechniqueT1571: Non-Standard PortEnterpriseuses · TechniqueT1057: Process DiscoveryEnterpriseuses · TechniqueT1007: System Service DiscoveryEnterpriseuses · TechniqueT1106: Native APIEnterpriseuses · TechniqueT1132.001: Standard EncodingEnterpriseuses · TechniqueT1070: Indicator RemovalEnterpriseuses · TechniqueT1620: Reflective Code LoadingEnterpriseuses · GroupG0061: FIN8Enterpriseuses · TechniqueT1573.002: Asymmetric CryptographyEnterpriseuses · TechniqueT1027: Obfuscated Files or InformationEnterpriseuses · TechniqueT1059.001: PowerShellEnterpriseuses · TechniqueT1049: System Network Connections DiscoveryEnterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
770b016ead957713...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle770b016ead95…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  2. [2]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  3. [3]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  4. [4]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  5. [5]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  6. [6]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  7. [7]
    mitre-attackS1085
    Open source URL
  8. [8]
    mitre-attackS1085
    Open source URL
  9. [9]
    mitre-attackS1085
    Open source URL
  10. [10]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  11. [11]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  12. [12]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  13. [13]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  14. [14]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  15. [15]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  16. [16]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  17. [17]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  18. [18]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  19. [19]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  20. [20]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  21. [21]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  22. [22]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  23. [23]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  24. [24]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  25. [25]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  26. [26]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  27. [27]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  28. [28]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  29. [29]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  30. [30]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  31. [31]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  32. [32]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  33. [33]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  34. [34]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  35. [35]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  36. [36]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  37. [37]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  38. [38]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  39. [39]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  40. [40]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  41. [41]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  42. [42]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  43. [43]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  44. [44]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  45. [45]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  46. [46]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  47. [47]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  48. [48]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  49. [49]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  50. [50]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  51. [51]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  52. [52]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  53. [53]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  54. [54]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  55. [55]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  56. [56]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  57. [57]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  58. [58]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  59. [59]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
  60. [60]
    Symantec FIN8 Jul 2023

    Symantec Threat Hunter Team. (2023, July 18). FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware. Retrieved August 9, 2023.

    Open source URL
  61. [61]
    Bitdefender Sardonic Aug 2021

    Budaca, E., et al. (2021, August 25). FIN8 Threat Actor Goes Agile with New Sardonic Backdoor. Retrieved August 9, 2023.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use