Loading malware…
FinFisher, also known as FinSpy, is a commercial surveillance malware family developed and marketed by Gamma Group and associated FinFisher entities. Used for remote espionage, it enables operators to access communications, files, and internet activity, exfiltrate data, and activate compromised devices’ cameras and microphones. It can also record phone conversations. The family includes variants for Windows, Linux, and macOS and has been associated with surveillance of political dissidents and civil-society targets in multiple countries.
FinFisher employs extensive defense-evasion and anti-analysis techniques, including process injection, DLL side-loading, sandbox and debugger detection, instruction obfuscation, mixed Boolean-arithmetic expressions, and control-flow flattening. Its process-injection behavior varies with the integrity level under which it executes. Environment checks examine parent processes and system characteristics to identify analysis environments. During installation, it can temporarily overlay a captured desktop image to conceal system messages. Some variants incorporate master boot record or EFI System Partition boot components for persistence.
Delivery campaigns have exploited Microsoft Office OLE handling through CVE-2017-0199 and Microsoft .NET Framework through CVE-2017-8759. Its deployment combines intrusive remote surveillance with measures intended to conceal execution and complicate reverse engineering.
8 CVEs Mallory has correlated with this family across public research and vendor advisories. Each card links to the full Mallory page for that vulnerability.
7 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The claimants alleged that, starting in 2011, their devices in the United Kingdom were targeted with FinSpy spyware; the alleged conduct included installing and running the spyware, exfiltrating data, and activating microphones and cameras.
FinFisher is a spyware product manufactured by the Gamma Group, a British company that sells surveillance technology... Bill Marczak... and Morgan Marquis-Boire... analyzed the e-mails and found evidence that they contained FinSpy, part of the FinFisher spyware tool kit.
EFF has filed a lawsuit in federal court in Washington, DC alleging that the government of Ethiopia, using notorious surveillance malware known as FinSpy, illegally wiretapped and invaded the privacy of our client, a U.S. citizen on U.S. soil.
FinFisher is a sophisticated computer spyware suite, written by Munich-based FinFisher GmbH, and sold exclusively to governments for intelligence and law enforcement purposes.
FinFisher, one of the original suppliers of so-called "lawful intercept" spyware, has repeatedly been criticized for selling malware to countries with poor human rights records such as Bahrain, Egypt and Ethiopia.
FinSpy is a commercial spyware suite produced by the Munich-based company FinFisher Gmbh... FinSpy is a full-fledged surveillance software suite, capable of intercepting communications, accessing private data, and recording audio and video, from the computer or mobile devices it is silently installed on.
+1 more in the app. View in Mallory
22 distinct techniques documented for this family, organized by ATT&CK tactic.
67 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Values are masked here and available in full in Mallory.
166 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.