FIN8

FIN8 is a financially motivated threat actor also tracked as Storm-0288 and Syssphinx. The provided content describes FIN8 as a financial threat actor associated with notably aggressive phishing campaigns. Observed tradecraft includes targeted spearphishing emails with malicious attachments, including Word documents with embedded macros, and malicious email attachments used to lure victims into executing malware. FIN8 has executed spearphishing payloads via PowerShell and used PowerShell scripts to determine host architecture before selecting a 32-bit or 64-bit .NET loader. The group has used WMI to launch malware and spawn cmd.exe, and has also used WMIC and the Impacket suite for lateral movement and post-compromise cleanup. Additional activity includes remote command execution via cmd.exe, use of batch files to automate cleanup, scheduled tasks to maintain RDP backdoors, use of Plink to tunnel RDP to command-and-control infrastructure, HTTPS for command and control, aggregation of staged data from victim networks into a single location, and post-compromise cleanup through deletion of tmp files, prefetch files, PowerShell scripts, and Registry keys.