Trusted Design

FIN8

G0061 · MITRE Pageへのリンク

脅威アクターの詳細

[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected [FIN8](https://attack.mitre.org/groups/G0061) switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender Sardonic Aug 2021)(Citation: Symantec FIN8 Jul 2023)

別名・別称

FIN8
Syssphinx

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1560.001 - Archive via Utility
• T1047 - Windows Management Instrumentation
• T1033 - System Owner/User Discovery
• T1016.001 - Internet Connection Discovery
• T1204.002 - Malicious File
• T1566.002 - Spearphishing Link
• T1566.001 - Spearphishing Attachment
• T1082 - System Information Discovery
• T1074.002 - Remote Data Staging
• T1021.002 - SMB/Windows Admin Shares
• T1112 - Modify Registry
• T1070.001 - Clear Windows Event Logs
• T1003.001 - LSASS Memory
• T1482 - Domain Trust Discovery
• T1055.004 - Asynchronous Procedure Call
• T1102 - Web Service
• T1134.001 - Token Impersonation/Theft
• T1546.003 - Windows Management Instrumentation Event Subscription
• T1059.001 - PowerShell
• T1588.002 - Tool
• T1078 - Valid Accounts
• T1068 - Exploitation for Privilege Escalation
• T1486 - Data Encrypted for Impact
• T1573.002 - Asymmetric Cryptography
• T1518.001 - Security Software Discovery
• T1059.003 - Windows Command Shell
• T1027.010 - Command Obfuscation
• T1070.004 - File Deletion
• T1071.001 - Web Protocols
• T1018 - Remote System Discovery
• T1105 - Ingress Tool Transfer
• T1588.003 - Code Signing Certificates
• T1021.001 - Remote Desktop Protocol
• T1204.001 - Malicious Link
• T1048.003 - Exfiltration Over Unencrypted Non-C2 Protocol

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1486)
• CVE-2015-5749 (T1486)
• CVE-2016-1898 (T1204.001)
• CVE-2016-1897 (T1204.001)
• CVE-2015-7261 (T1204.001)
• CVE-2015-6036 (T1204.001)
• CVE-2015-7262 (T1068)
• CVE-2015-0932 (T1055.004)
• CVE-2010-3081 (T1486)
• CVE-2017-16929 (T1204.001)
• CVE-2025-31125 (T1204.001)
• CVE-2025-68645 (T1204.001)
• CVE-2014-4114 (T1204.001)
• CVE-2017-0143 (T1204.001)
• CVE-2013-6282 (T1486)
• CVE-2015-1770 (T1204.001)
• CVE-2015-2545 (T1204.001)
• CVE-2017-0199 (T1204.001)
• CVE-2012-0158 (T1204.001)
• CVE-2013-3906 (T1027.010)
• CVE-2014-6352 (T1027.010)
• CVE-2015-0016 (T1204.001)
• CVE-2010-3333 (T1204.001)
• CVE-2010-0188 (T1204.001)
• CVE-2010-2884 (T1059.003)
• CVE-2013-0640 (T1059.003)
• CVE-2011-0611 (T1059.003)
• CVE-2015-0071 (T1204.001)
• CVE-2010-1553 (T1204.001)
• CVE-2014-1761 (T1566.001)
• CVE-2015-2853 (T1204.001)
• CVE-2012-1876 (T1204.001)
• CVE-2012-2539 (T1204.001)
• CVE-2013-3660 (T1204.001)
• CVE-2013-7331 (T1018)
• CVE-2009-3129 (T1204.001)
• CVE-2013-5990 (T1204.001)
• CVE-2015-0310 (T1486)
• CVE-2014-4113 (T1204.001)
• CVE-2015-1701 (T1204.001)
• CVE-2015-2360 (T1204.001)
• CVE-2012-1856 (T1204.001)
• CVE-2014-6332 (T1204.001)
• CVE-2012-4792 (T1204.001)
• CVE-2014-0322 (T1204.001)
• CVE-2014-4322 (T1486)
• CVE-2015-0057 (T1204.001)
• CVE-2014-4148 (T1204.001)
• CVE-2010-4398 (T1204.001)
• CVE-2013-2595 (T1486)
• CVE-2016-6532 (T1102)
• CVE-2008-1436 (T1486)
• CVE-2014-6324 (T1204.001)
• CVE-2015-0313 (T1204.001)
• CVE-2010-0806 (T1204.001)
• CVE-2013-2678 (T1204.001)
• CVE-2025-13927 (T1486)
• CVE-2025-24893 (T1204.001)
• CVE-2026-1102 (T1486)
• CVE-2026-20127 (T1204.001)
• CVE-2016-1562 (T1102)
• CVE-2016-2343 (T1486)
• CVE-2015-1761 (T1204.001)
• CVE-2015-2546 (T1204.001)
• CVE-2012-4969 (T1204.001)
• CVE-2015-5897 (T1068)
• CVE-2015-3456 (T1486)
• CVE-2013-2094 (T1204.001)
• CVE-2015-7808 (T1068)
• CVE-2016-1990 (T1068)
• CVE-2016-1019 (T1486)
• CVE-2015-3628 (T1486)
• CVE-2015-6034 (T1068)
• CVE-2017-0263 (T1204.001)
• CVE-2016-9496 (T1204.001)
• CVE-2012-0056 (T1486)
• CVE-2012-1258 (T1486)
• CVE-2014-3153 (T1068)
• CVE-2015-3636 (T1068)
• CVE-2012-4681 (T1204.001)
• CVE-2014-1776 (T1204.001)
• CVE-2010-0738 (T1486)
• CVE-2010-0232 (T1204.001)
• CVE-2012-6422 (T1486)
• CVE-2015-2387 (T1204.001)
• CVE-2011-1255 (T1204.001)
• CVE-2017-0001 (T1204.001)
• CVE-2023-1389 (T1204.001)
• CVE-2025-13928 (T1486)
• CVE-2025-55183 (T1204.001)
• CVE-2015-5119 (T1204.001)
• CVE-2015-5122 (T1204.001)
• CVE-2015-7645 (T1204.001)
• CVE-2015-3043 (T1204.001)
• CVE-2015-3090 (T1204.001)
• CVE-2015-3113 (T1486)
• CVE-2015-2590 (T1204.001)
• CVE-2015-2502 (T1204.001)
• CVE-2014-6271 (T1204.001)
• CVE-2015-8562 (T1204.001)
• CVE-2016-1991 (T1068)
• CVE-2016-1010 (T1204.001)
• CVE-2016-0984 (T1204.001)
• CVE-2016-0998 (T1204.001)
• CVE-2015-0359 (T1204.001)
• CVE-2015-5130 (T1204.001)
• CVE-2015-5134 (T1204.001)
• CVE-2015-5539 (T1204.001)
• CVE-2015-5557 (T1204.001)
• CVE-2015-5563 (T1204.001)
• CVE-2015-5559 (T1204.001)
• CVE-2015-5540 (T1204.001)
• CVE-2015-5561 (T1204.001)
• CVE-2015-5551 (T1204.001)
• CVE-2015-5564 (T1204.001)
• CVE-2015-5565 (T1204.001)
• CVE-2015-5550 (T1204.001)
• CVE-2015-5566 (T1204.001)
• CVE-2015-5127 (T1204.001)
• CVE-2015-5556 (T1204.001)
• CVE-2016-1287 (T1486)
• CVE-2017-0261 (T1204.001)
• CVE-2017-0262 (T1204.001)
• CVE-2016-9494 (T1204.001)
• CVE-2015-0311 (T1204.001)
• CVE-2015-0336 (T1204.001)
• CVE-2010-1297 (T1204.001)
• CVE-2012-0611 (T1204.001)
• CVE-2015-1427 (T1486)
• CVE-2015-3785 (T1486)
• CVE-2017-12149 (T1204.001)
• CVE-2015-2424 (T1204.001)
• CVE-2015-0097 (T1204.001)
• CVE-2016-1001 (T1486)
• CVE-2014-0329 (T1204.001)
• CVE-2015-2852 (T1204.001)
• CVE-2015-2854 (T1204.001)
• CVE-2015-7755 (T1486)
• CVE-2016-9495 (T1204.001)
• CVE-2025-55182 (T1204.001)
• CVE-2012-3213 (T1204.001)
• CVE-2011-3544 (T1204.001)
• CVE-2014-7911 (T1486)
• CVE-2015-3105 (T1486)
• CVE-2014-0497 (T1486)
• CVE-2017-17215 (T1204.001)
• CVE-2013-0074 (T1204.001)
• CVE-2012-0507 (T1204.001)
• CVE-2013-2465 (T1204.001)
• CVE-2014-8439 (T1486)
• CVE-2013-2551 (T1204.001)
• CVE-2014-0569 (T1486)
• CVE-2014-0515 (T1486)
• CVE-2014-0556 (T1204.001)
• CVE-2015-5560 (T1486)
• CVE-2014-9163 (T1486)
• CVE-2012-1723 (T1204.001)
• CVE-2014-8440 (T1204.001)
• CVE-2011-3402 (T1204.001)
• CVE-2010-2883 (T1059.003)
• CVE-2013-0634 (T1486)
• CVE-2014-7247 (T1204.001)
• CVE-2012-5054 (T1486)
• CVE-2015-2426 (T1204.001)
• CVE-2013-0641 (T1059.003)
• CVE-2014-3393 (T1486)
• CVE-2014-3897 (T1204.001)
• CVE-2010-2572 (T1204.001)
• CVE-2015-2419 (T1204.001)
• CVE-2016-0189 (T1204.001)
• CVE-2016-4117 (T1486)
• CVE-2017-7255 (T1018)
• CVE-2025-13335 (T1486)
• CVE-2025-34026 (T1204.001)
• CVE-2025-55184 (T1204.001)
• CVE-2026-0723 (T1486)
• CVE-2014-8361 (T1071.001)
• CVE-2015-1641 (T1204.001)
• CVE-2015-6022 (T1204.001)
• CVE-2015-4902 (T1204.001)
• CVE-2017-8570 (T1204.001)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る