Loading malware…
FinFisher, also referred to as FinSpy, is a commercial spyware and lawful-intercept malware suite developed and marketed by Gamma Group / Gamma International / FinFisher GmbH and sold to government law enforcement and intelligence customers. The content describes FinSpy as a component of the FinFisher product line and notes support for Windows, macOS, Linux, iPhone, Android, Nokia/Symbian, Windows Phone, and BlackBerry targets. Reported capabilities include full remote access to compromised systems; keylogging; screenshot and screen recording; webcam and microphone activation; recording Skype calls and chats; capture of encrypted data and communications; extraction of saved passwords; collection of emails, web activity, file transfers, contacts, SMS messages, call logs, locations, photos, and other device data; and exfiltration of collected information to command-and-control infrastructure.
Observed behavior in the content includes anti-analysis and evasion measures such as querying Registry values as anti-sandbox checks, probing for antimalware processes, and heavy obfuscation using a custom virtual machine with 32 opcode handlers, anti-debug checks, spaghetti code, and a second VM embedded in a 64-bit payload. For persistence, FinFisher creates a new Windows service with the malicious executable. The content also places FinSpy among known UEFI bootkits and associates it with exploitation of CVE-2017-8759 and CVE-2017-0199 in some reporting. Support-ticket material references numerous delivery and operational methods across the broader FinFisher suite, including infected Office documents, PDFs, USB-based infection, web delivery, MBR infection options, and mobile trojans.
The malware is repeatedly linked in the content to government surveillance and politically motivated targeting. High-confidence examples include reported use against Bahraini activists and opposition figures, including Moosa Abd-Ali and other Bahraini dissidents; alleged use by the Ethiopian government against a U.S.-based victim via a malicious Word document; and reporting that governments in Egypt, Bahrain, Turkmenistan, and Myanmar used the software. Additional leaked records and reporting cited in the content indicate deployments or customer relationships involving Bahrain and numerous other countries, and note that Germany-based FinFisher shut down in 2022 after a multi-year investigation by German prosecutors into alleged unlicensed spyware exports to Turkey.
Indicators and infrastructure directly mentioned in the content include the distinctive FinFisher network response string "Hallo Steffi" used to identify related servers, and an alleged Ethiopian FinSpy command-and-control server at IP address 213.55.99.74. The content also references the transmission string "C3PO-r2d2-POE" in a separate government-trojan context and multiple leaked support requests that mention FinSpy relay, proxy, and master infrastructure, antivirus detections, and operational issues.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
7 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
CVE-2017-8759 Vulnerable Products: Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 Associated Malware: FINSPY, FinFisher, WingBird Mitigation: Update affected Microsoft products with the latest security patches | CVE-2017-0199 ... Associated Malware: FINSPY, LATENTBOT, Dridex | CVE-2017-8759 ... Associated Malware: FINSPY, FinFisher, WingBird | CVE-2017-0199 Vulnerable Products: Microsoft Office 2007 SP3/2010 SP2/2013 SP1/2016, Vista SP2, Server 2008 SP2, Windows 7 SP1, Windows 8.1 Associated Malware: FINSPY, LATENTBOT, Dridex | CVE-2017-8759 Vulnerable Products: Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 Associated Malware: FINSPY, FinFisher, WingBird
CVE-2017-0199 ... Associated Malware: FINSPY, LATENTBOT, Dridex | CVE-2017-0199 Vulnerable Products: Microsoft Office 2007 SP3/2010 SP2/2013 SP1/2016, Vista SP2, Server 2008 SP2, Windows 7 SP1, Windows 8.1 Associated Malware: FINSPY, LATENTBOT, Dridex | CVE-2017-0199 Vulnerable Products: Microsoft Office 2007 SP3/2010 SP2/2013 SP1/2016, Vista SP2, Server 2008 SP2, Windows 7 SP1, Windows 8.1 Associated Malware: FINSPY, LATENTBOT, Dridex Mitigation: Update affected Microsoft products with the latest security patches
FinSpy We may only intercept data when we have a warrant from the judge... So what we would like to do is putting the rootkit asleep at the last day of the warrant, and waken the rootkit again on the first day of the new warrant.
helper2 : Python exploit for CVE-2015-5889. This first stage uses the exploits to get root access. | FinSpy is a commercial spyware suite produced by the Munich-based company FinFisher Gmbh... FinSpy is a full-fledged surveillance software suite, capable of intercepting communications, accessing private data, and recording audio and video, from the computer or mobile devices it is silently installed on.
We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.
We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.
We have previously reported on BlackOasis using other zero-days in the past; CVE-2016-4117 in May 2016, CVE-2016-0984 in June 2015, and CVE-2015-5119 in June 2015.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
FinFisher is a spyware product manufactured by the Gamma Group, a British company that sells surveillance technology... Bill Marczak... and Morgan Marquis-Boire... analyzed the e-mails and found evidence that they contained FinSpy, part of the FinFisher spyware tool kit.
EFF has filed a lawsuit in federal court in Washington, DC alleging that the government of Ethiopia, using notorious surveillance malware known as FinSpy, illegally wiretapped and invaded the privacy of our client, a U.S. citizen on U.S. soil.
FinFisher is a sophisticated computer spyware suite, written by Munich-based FinFisher GmbH, and sold exclusively to governments for intelligence and law enforcement purposes.
FinFisher, one of the original suppliers of so-called "lawful intercept" spyware, has repeatedly been criticized for selling malware to countries with poor human rights records such as Bahrain, Egypt and Ethiopia.
FinSpy is a commercial spyware suite produced by the Munich-based company FinFisher Gmbh... FinSpy is a full-fledged surveillance software suite, capable of intercepting communications, accessing private data, and recording audio and video, from the computer or mobile devices it is silently installed on.
35 distinct techniques documented for this family, organized by ATT&CK tactic.
The October 2024 European Commission guidelines define listed export controls for six types of surveillance technology, including intrusion software: “software that allows operators to covertly and remotely access electronic devices, in order to obtain data, track users or eavesdrop using a device's built-in microphone or cameras.”
Bootable USB Key Failure FinSpy Version 3.0. When building an infection and requesting creation of a bootable usb key... | Unable to create bootable iso image and bootable infection dongle ... tried both bootable iso image and bootable infection dongle
ClamAV blocked Webinfection ... silently were blocking our injected Javascript Code. as soon as the AV was disabled, the injected code was executed. | FinFly Web ... I tried updating it online but I get a /.../bin/update not accessible message.
At the time, members of the advocacy group Bahrain Watch in Washington, D.C., and London had been targeted via email by what appeared to be malware.
Malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology. OLE allows documents to contain embedded content from other applications such as spreadsheets. | According to U.S. Government technical analysis, malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology. OLE allows documents to contain embedded content from other applications such as spreadsheets. | Malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology.
U.S. Government reporting has identified the top 10 most exploited vulnerabilities by state, nonstate, and unattributed cyber actors from 2016 to 2019 as follows: CVE-2017-11882, CVE-2017-0199, CVE-2017-5638, CVE-2012-0158, CVE-2019-0604, CVE-2017-0143, CVE-2018-4878, CVE-2017-8759, CVE-2015-1641, and CVE-2018-7600. | Malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology. OLE allows documents to contain embedded content from other applications such as spreadsheets. | U.S. Government reporting has identified the top 10 most exploited vulnerabilities by state, nonstate, and unattributed cyber actors from 2016 to 2019 as follows: CVE-2017-11882, CVE-2017-0199, CVE-2017-5638, CVE-2012-0158, CVE-2019-0604, CVE-2017-0143, CVE-2018-4878, CVE-2017-8759, CVE-2015-1641, and CVE-2018-7600. According to U.S. Government technical analysis, malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology. | U.S. Government reporting has identified the top 10 most exploited vulnerabilities... malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology... the three vulnerabilities used most frequently across state-sponsored cyber actors from China, Iran, North Korea, and Russia are CVE-2017-11882, CVE-2017-0199, and CVE-2012-0158. | U.S. Government reporting has identified the top 10 most exploited vulnerabilities by state, nonstate, and unattributed cyber actors from 2016 to 2019 as follows: CVE-2017-11882, CVE-2017-0199, CVE-2012-0158, CVE-2018-4878, CVE-2017-8759, and CVE-2015-1641. According to U.S. Government technical analysis, malicious cyber actors most often exploited vulnerabilities in Microsoft’s Object Linking and Embedding (OLE) technology.
Across the content, malware repeatedly 'adds Registry Run keys', 'creates Registry entries', 'modifies the Windows Registry', or 'overwrites registry keys' to maintain persistence.
Secure Boot is designed to thwart UEFI bootkits, a form of malware that alters the Unified Extensible Firmware Interface, the successor to the BIOS, both of which begin the initial boot sequence. Because these bootkits load before the OS and most other code, they can be difficult to detect.
Kaspersky warning FinSpy Trojan installs but give a warning on every boot, process id xxx is trying to inject into another process.
Add flag to put rootkit asleep and to waken the rootkit FinSpy | Add flag to put rootkit asleep and to waken the rootkit ... putting the rootkit asleep at the last day of the warrant, and waken the rootkit again
Обфускация (T1027, Obfuscated Files) Минимальная или ProGuard Многослойная: шифрование строк, VM-упаковщик
Маскировка (T1036, Masquerading) Скрытие иконки, имя «System Service» Инъекция в легитимные процессы
Akira has used legitimate names and locations for files to evade defenses.
Kaspersky warning FinSpy Trojan installs but give a warning on every boot, process id xxx is trying to inject into another process.
Possibility of removing Collected Data from the Target before transfer to Server
The content repeatedly describes malware and threat actors decoding, decrypting, deobfuscating, or unpacking payloads, strings, configuration data, commands, and C2 responses prior to execution or use.
Several entries explicitly tie host profiling to anti-analysis or execution gating, such as 'DarkGate uses ... disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment,' 'OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks,' and malware terminating or changing behavior based on language or OS/distribution.
Secure Boot is designed to thwart UEFI bootkits, a form of malware that alters the Unified Extensible Firmware Interface, the successor to the BIOS, both of which begin the initial boot sequence. Because these bootkits load before the OS and most other code, they can be difficult to detect.
Keylogger doesnt catch Fn keys ... Keylogger export ... Unable to retrieve Keylogger data | keylogger mixup FinSpy When visualizing data, the keylogger module does not show the correct information.
The content repeatedly describes malware and threat actors querying, enumerating, opening, and reading Windows Registry keys and values, e.g., "APT41 queried registry values to determine items such as configured RDP ports and network configurations" and "Reg may be used to gather details from the Windows Registry of a local or remote system at the command-line interface."
The content repeatedly describes malware and threat actors obtaining lists of running processes, using utilities such as tasklist, ps, WMI, Get-Process, CreateToolhelp32Snapshot, EnumProcesses, and similar APIs/commands to enumerate active processes on victim systems.
The content is a long ATT&CK-style listing of malware and threat actors that collect host details such as OS version, hostname, architecture, CPU, memory, BIOS, language, and other basic system characteristics; examples include use of commands like systeminfo, ver, uname, sw_vers, and WMI queries.
The content repeatedly describes malware and threat actors listing files and directories, enumerating drives, searching for files by extension/name/path, retrieving file metadata, and browsing file systems (for example: "APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection" and "cmd can be used to find files and directories with native functionality such as dir commands").
Several entries explicitly tie host profiling to anti-analysis or execution gating, such as 'DarkGate uses ... disk size and physical memory as part of the malware's anti-analysis checks for running in a virtualized environment,' 'OopsIE checks for information on the CPU fan, temperature, mouse, hard disk, and motherboard as part of its anti-VM checks,' and malware terminating or changing behavior based on language or OS/distribution.
Bootable USB Key Failure FinSpy Version 3.0. When building an infection and requesting creation of a bootable usb key... | Unable to create bootable iso image and bootable infection dongle ... tried both bootable iso image and bootable infection dongle
Keylogger doesnt catch Fn keys ... Keylogger export ... Unable to retrieve Keylogger data | keylogger mixup FinSpy When visualizing data, the keylogger module does not show the correct information.
timestamp screenshots FinSpy ... screenshots taken from the target are not individually timestamped. | Title based screen recording ... Dual Screen Capture ... screenshots taken from the target
Security researchers who studied the spyware last month said it can ... remotely turn on cameras and microphones...
the sample attempts to connect to both Internet-based and SMS-based command & control servers... net.rmi.device.api.fsmbb.core.com.* Appears to contain the mechanics of communication with the command & control server, including the plaintext TLV-based wire protocol. | The ‘logind’ process attempts to talk to a remote command and control server... After the user accepts these permissions, the sample attempts to connect to both Internet-based and SMS-based command & control servers.
66 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
114 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Commercial spyware referenced as an example of government procurement revealed through FOI requests.
A named UEFI bootkit mentioned among more recent firmware-level threats.
Spyware reportedly deployed on the phones of critics of Turkey’s government.
Коммерческое spyware, описанное как государственный инструмент наблюдения, отличающийся скрытностью, сложной обфускацией и эксплуатацией уязвимостей вместо примитивного sideload.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.