SYMBOLCOMMON_NAMEaka. SYNONYMS

FIN8  (Back to overview)

aka: ATK113, G0061, PUNCH COMET

FIN8 is a financially motivated group targeting the retail, hospitality and entertainment industries. The actor had previously conducted several tailored spearphishing campaigns using the downloader PUNCHBUGGY and POS malware PUNCHTRACK.

Associated Families
win.badhatch win.poslurp
References
2026-07-24 ⋅ Google ⋅ Google Threat Intelligence Group
Updated Cyber Threat Actor Naming System
APT15 APT20 APT27 APT28 APT29 APT30 APT31 APT33 APT35 APT37 APT39 APT40 APT41 APT42 APT45 APT5 BlackTech Callisto Conference Crew FIN11 FIN6 FIN7 FIN8 MuddyWater MUSTANG PANDA Naikon OilRig Sandworm TEMP.Hermit Tick Tonto Team Turla UAC-0020 UNC1069 UNC1088 UNC2814
2021-08-15 ⋅ Symantec ⋅ Threat Hunter Team
The Ransomware Threat
Babuk BlackMatter DarkSide Avaddon Babuk BADHATCH BazarBackdoor BlackMatter Clop Cobalt Strike Conti DarkSide DoppelPaymer Egregor Emotet FiveHands FriedEx Hades IcedID LockBit Maze MegaCortex MimiKatz QakBot RagnarLocker REvil Ryuk TrickBot WastedLocker
2021-03-15 ⋅ Team Cymru ⋅ Josh Hopkins
FIN8: BADHATCH Threat Indicator Enrichmen
BADHATCH
2021-03-10 ⋅ Bitdefender ⋅ Bogdan Botezatu, Victor Vrabie
FIN8 Returns with Improved BADHATCH Toolkit
BADHATCH
2019-12-31 ⋅ One Night in Norfolk ⋅ Norfolk
Fuel Pumps II – PoSlurp.B
PoSlurp
2019-08-15 ⋅ Twitter (@just_windex) ⋅ Windex
Tweet on PoSlurp.B
PoSlurp
2019-07-23 ⋅ Gigamon ⋅ Ed Miles, Justin Warner, Kristina Savelesky
ABADBABE 8BADF00D: Discovering BADHATCH and a Detailed Look at FIN8’s Tooling
PoSlurp Powersniff
2019-07-23 ⋅ Gigamon ⋅ Ed Miles, Justin Warner, Kristina Savelesky
ABADBABE 8BADF00D: Discovering BADHATCH and a Detailed Look at FIN8’s Tooling
BADHATCH
2019-01-01 ⋅ MITRE ⋅ MITRE ATT&CK
Group description: FIN8
FIN8
2017-06-30 ⋅ FireEye ⋅ Daniel Bohannon, Nick Carr
Obfuscation in the Wild: Targeted Attackers Lead the Way in Evasion Techniques
FIN8
2017-06-19 ⋅ root9b ⋅ root9b
SHELLTEA + POSLURP Malware Memory-resident Point-of-Sale Malware Attacks Industry
FIN8
2017-06-19 ⋅ root9b ⋅ root9b
SHELLTEA + POSLURP Malware Memory-resident Point-of-Sale Malware Attacks Industry
PoSlurp FIN8
2017-04-20 ⋅ Mandiant ⋅ FireEye
M-Trends 2017
FIN8
2017-03-14 ⋅ FireEye ⋅ FireEye
M-Trend 2017: A View From the Front Lines
DistTrack Powersniff FIN8
2016-06-08 ⋅ FireEye ⋅ FireEye
Spear Phishing Attacks: Why They are Successful and How to Stop Them
FIN8
2016-05-11 ⋅ FireEye ⋅ Dan Caselden, Dhanesh Kizhakkinan, Erica Eng, Yu Wang
Threat Actor Leverages Windows Zero-day Exploit in Payment Card Data Attacks
FIN8
Credits: MISP Project