FIN8

FIN8, also known as Syssphinx and Storm-0288, is a financially motivated cybercrime group active since at least January 2016. Historically associated with payment-card theft from point-of-sale systems, it has targeted retail, hospitality, entertainment, financial services, insurance, technology, and chemical organizations. Identified victims span the United States, Canada, Italy, South Africa, Panama, and Puerto Rico. FIN8 uses spearphishing emails containing malicious macro-enabled documents or links to those documents, and has exploited Windows vulnerabilities, including CVE-2016-0167, for privilege escalation. Its post-compromise activity includes Active Directory and domain-controller discovery, credential dumping with Invoke-Mimikatz and Windows Credential Editor, and lateral movement through RDP, WMI, and Impacket tools. The group abuses valid accounts for persistence and lateral movement, maintains access through scheduled tasks and WMI event subscriptions, and compresses collected data with RAR before exfiltration. Defense-evasion techniques include macro and command-line obfuscation, encrypted payloads, in-memory execution, process injection, and automated cleanup. The group's tooling includes BADHATCH and Sardonic. BADHATCH supports reconnaissance, command execution, credential-based lateral movement, token impersonation, proxy tunneling, file transfer, screenshot capture, and process injection. Its deployment chains use PowerShell and .NET loaders to execute shellcode in memory. Sardonic is a modular C++ backdoor delivered through a multistage PowerShell, WMI, .NET, and shellcode chain; it supports system-information collection, shell-command execution, and dynamically loaded in-memory DLL plugins. FIN8 has repeatedly revised its loaders and backdoors to improve functionality and evade security controls.