ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Malware & tools

S0182malware

FinFisher

a.k.a. FinSpy

FinFisher is a government-grade commercial surveillance spyware reportedly sold exclusively to government agencies for use in targeted and lawful criminal investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has other variants including Wingbird.

Platforms: Windows, Android

MITRE ATT&CK ↗

Linked entities · 23

usesT1134.001Token Impersonation/Theft usesT1113Screen Capture usesT1547.001Registry Run Keys / Startup Folder usesT1685.005Clear Windows Event Logs usesT1497.001System Checks usesT1574.001DLL usesT1056.004Credential API Hooking usesT1027.002Software Packing usesT1055.001Dynamic-link Library Injection usesT1548.002Bypass User Account Control usesT1083File and Directory Discovery usesT1542.003Bootkit usesT1012Query Registry usesT1543.003Windows Service usesT1027.016Junk Code Insertion usesT1036.005Match Legitimate Resource Name or…usesT1140Deobfuscate/Decode Files or Infor…usesT1057Process Discovery usesT1518.001Security Software Discovery usesT1082System Information Discovery usesT1027Obfuscated Files or Information usesT1574.013KernelCallbackTable uses byG0070Dark Caracal