{
  "id": "fin8",
  "name": "FIN8",
  "aliases": [
    "Syssphinx"
  ],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Financially motivated group",
      "src": [
        "mitre-g0061"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2016,
      "src": [
        "mitre-g0061"
      ],
      "conf": "medium",
      "note": "At least 2016"
    },
    {
      "k": "attack_id",
      "v": "G0061",
      "src": [
        "mitre-g0061"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors.",
      "src": [
        "mitre-g0061"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 36,
      "src": [
        "mitre-g0061"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "BADHATCH, dsquery, Impacket, Net, Nltest, Ping, PsExec, PUNCHBUGGY, PUNCHTRACK, Ragnar Locker, Sardonic",
      "src": [
        "mitre-g0061"
      ],
      "conf": "high",
      "note": "11 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "FIN8 is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected FIN8 switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0061)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/fin8.html",
  "sources": {
    "mitre-g0061": {
      "title": "FIN8, Group G0061",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0061/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}