FireEye Know Your Enemy FIN8 Aug 2016

FIN8 harvests credentials using Invoke-Mimikatz or Windows Credentials Editor (WCE).

PUNCHTRACK scrapes memory for properly formatted payment card data.

FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.

FIN8 has used RDP for lateral movement.

FIN8 has attempted to map to C$ on enumerated hosts to test the scope of their current credentials/context. FIN8 has also used smbexec from the Impacket suite for lateral movement.

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.

PUNCHBUGGY mimics filenames from %SYSTEM%\System32 to hide DLLs in %WINDIR% and/or %TEMP%.

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.

FIN8 has used FTP to exfiltrate collected data.

FIN8 has used scheduled tasks to maintain RDP backdoors.

FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via `cmd.exe`.

FIN8 has exploited the CVE-2016-0167 local vulnerability.

FIN8 has deleted tmp and prefetch files during post compromise cleanup activities. FIN8 has also deleted PowerShell scripts to evade detection on compromised machines.

PUNCHBUGGY can delete files written to disk.

PUNCHBUGGY enables remote interaction and can obtain additional code over HTTPS GET and POST requests.

PUNCHTRACK aggregates collected data in a tmp file.

FIN8 aggregates staged data from a network into a single location.

FIN8 has used valid accounts for persistence and lateral movement.

PUNCHBUGGY can download additional files and payloads to compromised hosts.

FIN8 has deleted Registry keys during post compromise cleanup activities.

PUNCHBUGGY can load a DLL using the LoadLibrary API.

FIN8 has used emails with malicious links to lure victims into installing malware.

FIN8 has used malicious e-mail attachments to lure victims into executing malware.

PUNCHBUGGY can load a DLL using Rundll32.

FIN8 has used Registry keys to detect and avoid executing in potential sandboxes.

PUNCHBUGGY can establish using a AppCertDLLs Registry key.

PUNCHBUGGY has been observed using a Registry Run key.

FIN8 has used RAR to compress collected data before exfiltration.

FIN8 has distributed targeted emails containing Word documents with embedded malicious macros.

FIN8 has distributed targeted emails containing links to malicious documents with embedded macros.

FIN8 has used the Plink utility to tunnel RDP back to C2 infrastructure.

FIN8 has cleared logs during post compromise cleanup activities.