Bitdefender FIN8 July 2021

FIN8 has used dsquery and other Active Directory utilities to enumerate hosts; they have also used nltest.exe /dclist to retrieve a list of domain controllers.

FIN8 has used environment variables and standard input (stdin) to obfuscate command-line arguments. FIN8 also obfuscates malicious macros delivered as payloads.

FIN8's malicious spearphishing payloads use WMI to launch malware and spawn `cmd.exe` execution. FIN8 has also used WMIC and the Impacket suite for lateral movement, as well as during and post compromise cleanup activities.

FIN8 has injected malicious code into a new svchost.exe process.

FIN8's malicious spearphishing payloads are executed as PowerShell. FIN8 has also used PowerShell for lateral movement and credential access.

FIN8 has used a Batch file to automate frequently executed post compromise cleanup activities. FIN8 has also executed commands remotely via `cmd.exe`.

FIN8 has used HTTPS for command and control.

FIN8 has used sslip.io, a free IP to domain mapping service that also makes SSL certificate generation easier for traffic encryption, as part of their command and control.

FIN8 has used remote code execution to download subsequent payloads.

FIN8 has used a malicious framework designed to impersonate the lsass.exe/vmtoolsd.exe token.

FIN8 has retrieved a list of trusted domains by using nltest.exe /domain_trusts.

FIN8 has used WMI event subscriptions for persistence.