Syssphinx

Syssphinx, also known as FIN8, is a threat actor that has been active since 2016. This group is known for taking extended breaks between attack campaigns to refine its tactics, techniques, and procedures (TTPs). For instance, Syssphinx had used backdoor malware called Badhatch in attacks since 2019, which was updated in December 2020 and then again in January 2021. In June 2021, Syssphinx was seen deploying the Ragnar Locker ransomware onto machines it had compromised in a financial services company in the U.S. The following year, in January 2022, a family of ransomware known as White Rabbit was linked to Syssphinx, with a malicious URL connected to both White Rabbit attacks and Syssphinx. The financially motivated group has recently been spotted using a revamped version of a backdoor tracked as Sardonic to deliver the BlackCat ransomware, also known as Noberus ransomware. Symantec observed an attack by Syssphinx in December 2022, where the attackers attempted to deploy the Noberus ransomware. This attack involved similar techniques to a Syssphinx attack described by Bitdefender researchers in 2021, but with some key differences, including the final payload being the Noberus ransomware and the use of a reworked backdoor. Attacks involving White Rabbit also used a variant of the Sardonic backdoor, a known Syssphinx tool. Syssphinx continues to evolve, developing and improving its capabilities and malware delivery infrastructure to avoid detection. Notably, the group has added a reworked backdoor to its arsenal for delivering ransomware. The group's move to ransomware suggests a strategic shift to diversify their focus in an effort to maximize profits from compromised organizations. Despite alterations made to obfuscate the origins of their tools, known Syssphinx techniques are still being utilized, indicating a persistent and evolving threat to cybersecurity.