FinFisher

Description

FinFisher is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated, uses multiple anti-analysis techniques, and has variants that researchers track under separate names such as Wingbird.

Stats

First seen: March 2022
Last seen: October 2026

Also known as

FinSpyFinfisher

MITRE ATT&CK techniques

22 techniques across 6 tactics.

TA0003 Persistence

T1543Create or Modify System Process
- T1543.003Windows Service
T1547Boot or Logon Autostart Execution
- T1547.001Registry Run Keys / Startup Folder

TA0004 Privilege Escalation

T1548Abuse Elevation Control Mechanism
- T1548.002Bypass User Account Control

TA0005 Stealth

T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1027.016Junk Code Insertion
T1027Obfuscated Files or Information
- T1027.002Software Packing
- T1027.016Junk Code Insertion
T1036Masquerading
- T1036.005Match Legitimate Resource Name or Location
T1055Process Injection
- T1055.001Dynamic-link Library Injection
T1134Access Token Manipulation
- T1134.001Token Impersonation/Theft
T1140Deobfuscate/Decode Files or Information
T1497Virtualization/Sandbox Evasion
- T1497.001System Checks
T1542Pre-OS Boot
- T1542.003Bootkit
T1574Hijack Execution Flow
- T1574.001DLL
- T1574.013KernelCallbackTable

TA0007 Discovery

T1012Query Registry
T1057Process Discovery
T1082System Information Discovery
T1083File and Directory Discovery
T1518Software Discovery
- T1518.001Security Software Discovery

TA0009 Collection

T1056Input Capture
- T1056.004Credential API Hooking
T1113Screen Capture

TA0112 Defense Impairment

T1685Disable or Modify Tools
- T1685.005Clear Windows Event Logs

Associated groups

G0070Dark Caracal

Alert name variants

Alert Name	Engine
Android.Spyware.FinSpy	ATP Sandbox Adv. Heuristics
Backdoor.Finfisher.C	AV
ByteCode-MSIL.Spyware.FinSpy	ATP Sandbox Adv. Heuristics
Gen:Variant.Backdoor.FinSpy.3	AV
Gen:Variant.MAC.FinSpy.2	AV
Gen:Variant.Trojan.MAC.FinSpy.3	AV
Linux.Backdoor.FinFisher	ATP Sandbox Adv. Heuristics
Linux.Infostealer.FinFisher	ATP Sandbox Adv. Heuristics
Linux.Spyware.FinSpy	ATP Sandbox Adv. Heuristics
MacOS.Infostealer.FinFisher	ATP Sandbox Adv. Heuristics
MacOS.Spyware.FinSpy	ATP Sandbox Adv. Heuristics
Trojan.FinSpy.1	AV
Trojan.Linux.FinSpy.1	AV
Trojan.MAC.FinSpy.6	AV
Win32.Infostealer.FinFisher	ATP Sandbox Adv. Heuristics
Win32.Spyware.FinSpy	ATP Sandbox Adv. Heuristics

Related families

InvisiMole PlugX Metamorfo QakBot Clambling