Gold Open Source
ExplorePackagesVulnerabilitiesCWEsMCP ServersScan
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Certified Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Groups/G0061
MITRE ATT&CK Group

FIN8 (G0061)

Syssphinx
ShareXLinkedInRedditHN

[FIN8](https://attack.mitre.org/groups/G0061) is a financially motivated threat group that has been active since at least January 2016, and known for targeting organizations in the hospitality, retail, entertainment, insurance, technology, chemical, and financial sectors. In June 2021, security researchers detected [FIN8](https://attack.mitre.org/groups/G0061) switching from targeting point-of-sale (POS) devices to distributing a number of ransomware variants.(Citation: FireEye Obfuscation June 2017)(Citation: FireEye Fin8 May 2016)(Citation: Bitdefender Sardonic Aug 2021)(Citation: Symantec FIN8 Jul 2023)

▪Techniques used (36)

T1078Valid AccountsT1048.003Exfiltration Over Unencrypted Non-C2 ProtocolT1033System Owner/User DiscoveryT1518.001Security Software DiscoveryT1021.001Remote Desktop ProtocolT1003.001LSASS MemoryT1588.002ToolT1204.002Malicious FileT1588.003Code Signing CertificatesT1068Exploitation for Privilege EscalationT1546.003Windows Management Instrumentation Event SubscriptionT1566.002Spearphishing LinkT1053.005Scheduled TaskT1204.001Malicious LinkT1102Web ServiceT1027.010Command ObfuscationT1070.004File DeletionT1566.001Spearphishing AttachmentT1071.001Web ProtocolsT1021.002SMB/Windows Admin SharesT1685.005Clear Windows Event LogsT1560.001Archive via UtilityT1074.002Remote Data StagingT1105Ingress Tool TransferT1082System Information DiscoveryT1059.001PowerShellT1059.003Windows Command ShellT1573.002Asymmetric CryptographyT1055.004Asynchronous Procedure CallT1018Remote System DiscoveryT1486Data Encrypted for ImpactT1482Domain Trust DiscoveryT1112Modify RegistryT1134.001Token Impersonation/TheftT1016.001Internet Connection DiscoveryT1047Windows Management Instrumentation

▪Software used (11)

S0097PingtoolS1081BADHATCHmalwareS0196PUNCHBUGGYmalwareS0481Ragnar LockermalwareS0197PUNCHTRACKmalwareS0105dsquerytoolS0039NettoolS0359NltesttoolS1085SardonicmalwareS0029PsExectoolS0357Impackettool
G0061on MITRE ATT&CK →

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.