Procedure examples

FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).

FIN8 has used the Ping command to check connectivity to actor-controlled C2 servers.

FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.

FIN8 has used RDP for lateral movement.

FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context. FIN8 has also used smbexec from the Impacket suite for lateral movement.

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.

FIN8 has executed the command `quser` to display the session details of a compromised machine.

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.

FIN8 has used FTP to exfiltrate collected data.

FIN8 has used scheduled tasks to maintain RDP backdoors.

FIN8 has injected malicious code into a new svchost.exe process.

FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via `cmd.exe`.

FIN8 has exploited the CVE-2016-0167 local vulnerability.

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.

FIN8 has used HTTPS for command and control.

FIN8 aggregates staged data from a network into a single location.

FIN8 has used valid accounts for persistence and lateral movement.

FIN8 has used PowerShell Scripts to check the architecture of a compromised machine before the selection of a 32-bit or 64-bit version of a malicious .NET loader.

FIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.

FIN8 has used remote code execution to download subsequent payloads.

FIN8 has deleted Registry keys during post compromise cleanup activities.

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.

FIN8 has used emails with malicious links to lure victims into installing malware.

FIN8 has used malicious e-mail attachments to lure victims into executing malware.

FIN8 has retrieved a list of trusted domains by using nltest.exe /domain_trusts.

FIN8 has deployed ransomware such as Ragnar Locker, White Rabbit, and attempted to execute Noberus on compromised networks.

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.

FIN8 has used WMI event subscriptions for persistence.

FIN8 has used RAR to compress collected data before exfiltration.

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.

FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.

FIN8 has used open-source tools such as Impacket for targeting efforts.

FIN8 has used an expired open-source X.509 certificate for testing in the OpenSSL repository, to connect to actor-controlled C2 servers.

FIN8 has cleared logs during post compromise cleanup activities.