Threat Group Cards: A Threat Actor Encyclopedia
Archived: 2026-04-05 20:05:50 UTC
 Tool: FinFisher
Names
FinFisher
FinFisher RAT
FinSpy
Category Malware
Type Backdoor, Info stealer
Description
FinFisher is a government-grade commercial surveillance spyware reportedly sold
exclusively to government agencies for use in targeted and lawful criminal
investigations. It is heavily obfuscated and uses multiple anti-analysis techniques. It has
other variants including Wingbird.
Information
MITRE ATT&CK Malpedia
AlienVault OTX Last change to this tool card: 02 November 2021
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0475a304-5916-40c5-9b5b-8fce9f52e783
Page 1 of 2

Download this tool card in JSON format
All groups using tool FinFisher
Changed Name Country Observed
APT groups
  BlackOasis [Middle East] 2015-Oct 2017  
  Dark Caracal 2007-Jun 2024  
  SandCat 2018  
3 groups listed (3 APT, 0 other, 0 unknown)
↑
Source: https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0475a304-5916-40c5-9b5b-8fce9f52e783
https://apt.etda.or.th/cgi-bin/listgroups.cgi?u=0475a304-5916-40c5-9b5b-8fce9f52e783
Page 2 of 2