FinFisher
Software · ATTACK:enterprise:S0182
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0182",
"title": "FinFisher",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0182",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "malware--a5528622-3a8a-4633-86ce-8cdaf8423858",
"external_id": "S0182",
"domain": "enterprise",
"created": "2018-01-16T16:13:52.465Z",
"modified": "2024-09-12T17:23:46.687Z",
"version": "1.4",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "FinFisher"
},
{
"source_name": "FinSpy"
},
{
"source_name": "Microsoft FinFisher March 2018",
"url": "https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/"
},
{
"source_name": "Microsoft SIR Vol 21",
"url": "http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf"
},
{
"source_name": "FinFisher Citation",
"url": "https://web.archive.org/web/20171222050934/http://www.finfisher.com/FinFisher/index.html"
},
{
"source_name": "FireEye FinSpy Sept 2017",
"url": "https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html"
},
{
"source_name": "Securelist BlackOasis Oct 2017",
"url": "https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/"
}
]
}Explicit source assertions (23)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1134.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0b10d358-b59f-4fc0-8eaf-37352be9c80b
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1113
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0c1f6d5f-3094-4834-94a9-5a615e7c319c
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1547.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0f60b67a-c6a5-4855-991e-00ec6fe5f9ac
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1685.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--18d8109f-d3da-4cc8-9414-3e399f206d04
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1497.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2af8a4f4-fcac-4081-86f9-ba74140580dc
Microsoft FinFisher March 2018ATTACK:enterprise:G0070 → uses → ATTACK:enterprise:S0182
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--312950f2-80d2-4941-bfce-b97b2cb7a1ff
Lookout Dark Caracal Jan 2018ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1574.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--328825fa-a589-4c16-abef-7e3663f1f6ec
Microsoft FinFisher March 2018 · FinFisher Citation · Securelist BlackOasis Oct 2017ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1056.004
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b4f48d3-eb5d-4d7e-9f0b-86f68951207d
FinFisher Citation · Elastic Process Injection July 2017ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1027.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4636d747-9b81-4139-b86d-6e4edbc4111e
FinFisher Citation · Securelist BlackOasis Oct 2017ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1055.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d0ea359-36b3-46f8-818a-5aaff3de574a
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1548.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--659462ab-e1ed-4370-9810-aa3efcb060bf
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1083
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--714ecf14-6200-4edf-9a9c-dd9830831266
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1542.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--753093c1-6586-4a17-9068-25648111ef33
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1012
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--79cebb53-3154-4512-9343-2942b1f72ff5
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1543.003
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9ee064f9-05bc-4b9e-ad95-d1ae4f1c048a
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1027.016
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b10b7d66-3bee-4ebc-98c2-2eec2259e19e
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1036.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c7c24601-7125-4079-9d48-138594b3f86c
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1140
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d4bffc31-3d7a-4f05-a85d-fdaaaa70853d
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1057
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d878a055-0053-45a9-a724-52f59e0486c7
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1518.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d9b8e0cf-8906-45a4-8dd2-5ef9971e1a6d
FinFisher Citation · Securelist BlackOasis Oct 2017ATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1082
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db46b437-c406-4c36-a0fe-bf1f2c32a6fe
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1027
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f75caad1-161a-4833-b3ec-f4538e1603fe
Microsoft FinFisher March 2018 · FinFisher CitationATTACK:enterprise:S0182 → uses → ATTACK:enterprise:T1574.013
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa5b5933-f9e3-4bbb-b734-f1c5984ded97
FinFisher exposed