FRIENDSPEAK
FRIENDSPEAK is a malware downloader observed by Mandiant in operations attributed to FIN11, a financially motivated threat actor linked in the provided reporting to the broader Cl0p/FIN11 cybercrime ecosystem. Mandiant reported that FIN11 used spear-phishing messages to distribute FRIENDSPEAK. The content also states that FIN11 has distributed malware families including FlawedAmmyy, FRIENDSPEAK, and MIXLABEL. No additional technical details on FRIENDSPEAK’s payloads, persistence, command-and-control, or platform-specific behavior are provided in the source content. High-confidence context from the reporting is that FRIENDSPEAK functioned as a downloader used in FIN11 intrusion activity and was delivered via spear-phishing. The reporting further notes FIN11 has targeted multiple industries since at least August 2020 and has been associated with Clop ransomware deployment, but the content does not directly state that FRIENDSPEAK itself performs ransomware or data theft functions.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Vulnerabilities exploited
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
Oracle released an emergency patch to address a critical vulnerability, tracked as CVE-2025-61882 (CVSS 9.8) in its E-Business Suite... The flaw was exploited by the Cl0p ransomware group in data theft attacks. Unauthenticated remote attackers can exploit the flaw to take control of the Oracle Concurrent Processing component.
Groups observed using it
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
At the time, researchers from FireEye’s Mandiant observed FIN11 hackers using spear-phishing messages to distribute a malware downloader dubbed FRIENDSPEAK.
Recent activity
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Malware downloader distributed via spear-phishing by FIN11 to deliver additional payloads.
FRIENDSPEAK is a malware family distributed by FIN11, though specific details about its functionality are not provided in the content.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.