{
	"id": "5f5264cd-bda4-4920-ae0b-efb09c1e502f",
	"created_at": "2026-04-06T00:07:25.095469Z",
	"updated_at": "2026-04-10T03:32:56.550886Z",
	"deleted_at": null,
	"sha1_hash": "24b5752e860d164c4551b0b30b3d1ae712485dfd",
	"title": "FIN4, Wolf Spider - Threat Group Cards: A Threat Actor Encyclopedia",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 49834,
	"plain_text": "FIN4, Wolf Spider - Threat Group Cards: A Threat Actor\nEncyclopedia\nArchived: 2026-04-05 17:22:25 UTC\nHome \u003e List all groups \u003e FIN4, Wolf Spider\n APT group: FIN4, Wolf Spider\nNames\nFIN4 (FireEye)\nWolf Spider (CrowdStrike)\nG0085 (MITRE)\nCountry Romania\nMotivation Financial crime\nFirst seen 2013\nDescription\n(FireEye) FireEye tracks a threat group that we call “FIN4,” whose intrusions seem to\nhave a different objective: to obtain an edge in stock trading. FIN4 appears to conduct\nintrusions that are focused on a single objective: obtaining access to insider information\ncapable of making or breaking the stock prices of public companies. The group\nspecifically targets the emails of C-level executives, legal counsel, regulatory, risk, and\ncompliance personnel, and other individuals who would regularly discuss confidential,\nmarket-moving information.\nFIN4 has targeted over 100 companies since at least mid-2013. All of the targeted\norganizations are either public companies or advisory firms that provide services to\npublic companies (such as investor relations, legal, and investment banking firms). Over\ntwo-thirds of the targeted organizations are healthcare and pharmaceutical companies.\nFIN4 probably focuses on these types of organizations because their stocks can move\ndramatically in response to news of clinical trial results, regulatory decisions, or safety\nand legal issues.\nObserved Sectors: Financial, Healthcare, Pharmaceutical.\nTools used UpDocX.\nInformation\nMITRE ATT\u0026CK https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1a7f67d2-c05e-48f6-b62e-76b2bea6d174\nPage 1 of 2\n\nLast change to this card: 16 August 2025\r\nDownload this actor card in PDF or JSON format\r\nSource: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1a7f67d2-c05e-48f6-b62e-76b2bea6d174\r\nhttps://apt.etda.or.th/cgi-bin/showcard.cgi?u=1a7f67d2-c05e-48f6-b62e-76b2bea6d174\r\nPage 2 of 2",
	"extraction_quality": 1,
	"language": "EN",
	"sources": [
		"ETDA"
	],
	"references": [
		"https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1a7f67d2-c05e-48f6-b62e-76b2bea6d174"
	],
	"report_names": [
		"showcard.cgi?u=1a7f67d2-c05e-48f6-b62e-76b2bea6d174"
	],
	"threat_actors": [
		{
			"id": "2799bc47-e502-49f0-a289-87e3cc95ecc6",
			"created_at": "2022-10-25T15:50:23.706367Z",
			"updated_at": "2026-04-10T02:00:05.34551Z",
			"deleted_at": null,
			"main_name": "FIN4",
			"aliases": [
				"FIN4"
			],
			"source_name": "MITRE:FIN4",
			"tools": null,
			"source_id": "MITRE",
			"reports": null
		},
		{
			"id": "5f6ade4c-e2db-46f0-b1b4-529ea52d040b",
			"created_at": "2022-10-25T16:07:23.611546Z",
			"updated_at": "2026-04-10T02:00:04.687074Z",
			"deleted_at": null,
			"main_name": "FIN4",
			"aliases": [
				"FIN4",
				"G0085",
				"Wolf Spider"
			],
			"source_name": "ETDA:FIN4",
			"tools": [
				"UpDocX"
			],
			"source_id": "ETDA",
			"reports": null
		},
		{
			"id": "3571da12-0890-45e7-85d3-04fac7070b52",
			"created_at": "2023-01-06T13:46:38.414772Z",
			"updated_at": "2026-04-10T02:00:02.964831Z",
			"deleted_at": null,
			"main_name": "WOLF SPIDER",
			"aliases": [
				"FIN4",
				"G0085"
			],
			"source_name": "MISPGALAXY:WOLF SPIDER",
			"tools": [],
			"source_id": "MISPGALAXY",
			"reports": null
		}
	],
	"ts_created_at": 1775434045,
	"ts_updated_at": 1775791976,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/24b5752e860d164c4551b0b30b3d1ae712485dfd.pdf",
		"text": "https://archive.orkl.eu/24b5752e860d164c4551b0b30b3d1ae712485dfd.txt",
		"img": "https://archive.orkl.eu/24b5752e860d164c4551b0b30b3d1ae712485dfd.jpg"
	}
}