FIN8

FIN8, also known as Syssphinx, is a financially motivated cybercrime group that has been active since at least January 2016. This threat actor is notorious for targeting organizations across various sectors including hospitality, retail, entertainment, insurance, technology, chemicals, and finance. FIN8 is known for its sophisticated evasion techniques such as using obfuscation and Windows Management Instrumentation (WMI) to remotely launch their PUNCHTRACK POS-scraping malware. Their activities in 2017 showcased these evasion techniques being implemented at an early stage of compromise. In one instance, they crafted a macro to use WMI to spawn the cmd.exe execution, effectively evading many detections based on parent-child process relationships. Recently, threat researchers from Symantec, a part of Broadcom, observed the FIN8 group deploying a variant of the Sardonic backdoor to deliver the Noberus ransomware. This marks a significant shift in the group's modus operandi, indicating their continuous evolution and adaptability. The Sardonic backdoor has been revamped by FIN8 for this purpose, demonstrating the group's technical prowess and commitment to developing new tools and tactics for their campaigns. The resurgence of FIN8 with the new Sardonic backdoor poses a significant threat to financial institutions and other targeted industries. The group's focus on ransomware, particularly through the delivery of the Noberus and BlackCat variants, underscores their intent to cause substantial harm and disruption. It is imperative for organizations to stay updated about the evolving strategies of threat actors like FIN8 and implement robust cybersecurity measures to protect against such threats.