🇷🇺

FIN8

APT Group Financial crime 3 zero-day CVEs ETDA ✓

Also Known As 2 names

ATK113 G0061

Target Countries 6

Countries highlighted in red

Canada Egypt Italy Panama United States South Africa

Sectors Targeted

Food and Agriculture Management, Scientific, and Technical Consulting Services 5416 Data Processing, Hosting, and Related Services 51821 Commercial Banking 52211 Entertainment Retail Accommodation 721 Hospitality Healthcare Financial

Details

Origin 🇷🇺 RU

Last Updated 01 Jun 2022

Malware Families 1

poslurp

MITRE ATT&CK 66

T1003 T1003.001 T1007 T1016 T1016.001 T1018 T1021 T1021.001 T1021.002 T1027 T1027.010 T1033 T1036 T1047 T1048 T1048.003 T1053 T1053.005 T1055 T1055.004 T1059 T1059.001 T1059.003 T1068 T1070 T1070.001 T1070.004 T1071 T1071.001 T1074 T1074.002 T1078 T1078.003 T1082 T1102 T1105 T1106 T1112 T1134 T1134.001 T1140 T1204 T1204.001 T1204.002 T1471 T1482 T1486 T1518 T1518.001 T1546 T1546.003 T1547 T1550 T1560 T1560.001 T1566 T1566.001 T1566.002 T1573 T1573.002 T1574 T1588 T1588.002 T1588.003 T1685 T1685.005

Related Zero-Days 3

CVE-2022-26134 CVE-2022-30190 CVE-2022-3236

Known Names 5 entries

FIN8 FireEye

ATK 113 Thales

Syssphinx Symantec

Storm-0288 Microsoft

G0061 MITRE

Observed Target Countries 5

Based on ETDA data — countries highlighted in red

Canada Italy Panama South Africa USA

Description

(FireEye) We attribute the use of this EoP to a financially motivated threat actor. In the past year, not only have we observed this group using similar infrastructure and tactics, techniques, and procedures (TTPs), but they are also the only group we have observed to date who uses the downloader PUNCHBUGGY and POS malware PUNCHTRACK. Designed to scrape both Track 1 and Track 2 payment card data, PUNCHTRACK is loaded and executed by a highly obfuscated launcher and is never saved to disk. This actor has conducted operations on a large scale and at a rapid pace, displaying a level of operational awareness and ability to adapt their operations on the fly. These abilities, combined with targeted usage of an EoP exploit and the reconnaissance required to individually tailor phishing emails to victims, potentially speaks to the threat actors’ operational maturity and sophistication. FireEye identified more than 100 organizations in North America that fell victim to this campaign.

Tools Used 6

BadHatch BlackCat PoSlurp PunchBuggy RagnarLocker Sardonic

Operations 7

2016-03 Tailored spear-phishing campaigns In March 2016, a financially motivated threat actor launched several tailored spear phishing campaigns primarily targeting the retail, restaurant, and hospitality industries. The emails contained variations of Microsoft Word documents with embedded macros that, when enabled, downloaded and executed a malicious downloader that we refer to as PUNCHBUGGY. https://www.fireeye.com/blog/threat-research/2016/05/windows-zero-day-payment-cards.html

2017 In early 2017, FIN8 began using environment variables paired with PowerShell’s ability to receive commands via stdin (standard input) to evade detection based on process command line arguments. In the February 2017 phishing document “COMPLAINT Homer Glynn.doc” https://www.fireeye.com/blog/threat-research/2017/06/obfuscation-in-the-wild.html

2019-03 During the period of March to May 2019, Morphisec Labs observed a new, highly sophisticated variant of the ShellTea / PunchBuggy backdoor malware that attempted to infiltrate a number of machines within the network of a customer in the hotel-entertainment industry. It is believed that the malware was deployed as a result of several phishing attempts. http://blog.morphisec.com/security-alert-fin8-is-back

2019-07 This blog will introduce a new reverse shell from FIN8, dubbed BADHATCH and compare publicly reported versions of ShellTea and PoSlurp to variants observed by Gigamon Applied Threat Research (ATR). https://atr-blog.gigamon.com/2019/07/23/abadbabe-8badf00d:-discovering-badhatch-and-a-detailed-look-at-fin8’s-tooling/

2021-03 Fin8 Group is Back in Business with Improved BADHATCH Kit https://labs.bitdefender.com/2021/03/fin8-group-is-back-in-business-with-improved-badhatch-kit/

2021-07 FIN8 Threat Actor Spotted Once Again with New 'Sardonic' Backdoor https://www.bitdefender.com/blog/labs/fin8-threat-actor-spotted-once-again-with-new-sardonic-backdoor/

2022-12 FIN8 Uses Revamped Sardonic Backdoor to Deliver Noberus Ransomware https://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/syssphinx-fin8-backdoor

ETDA Profile

FIN8

Origin

[Unknown]

First Seen 2016

Motivation

Financial crime

MITRE ATT&CK Groups

https://attack.mitre.org/groups/G0061/

View on ETDA APT Groups ↗