FIN4, Wolf Spider - Threat Group Cards: A Threat Actor
Encyclopedia
Archived: 2026-04-05 17:22:25 UTC
Home > List all groups > FIN4, Wolf Spider
 APT group: FIN4, Wolf Spider
Names
FIN4 (FireEye)
Wolf Spider (CrowdStrike)
G0085 (MITRE)
Country Romania
Motivation Financial crime
First seen 2013
Description
(FireEye) FireEye tracks a threat group that we call “FIN4,” whose intrusions seem to
have a different objective: to obtain an edge in stock trading. FIN4 appears to conduct
intrusions that are focused on a single objective: obtaining access to insider information
capable of making or breaking the stock prices of public companies. The group
specifically targets the emails of C-level executives, legal counsel, regulatory, risk, and
compliance personnel, and other individuals who would regularly discuss confidential,
market-moving information.
FIN4 has targeted over 100 companies since at least mid-2013. All of the targeted
organizations are either public companies or advisory firms that provide services to
public companies (such as investor relations, legal, and investment banking firms). Over
two-thirds of the targeted organizations are healthcare and pharmaceutical companies.
FIN4 probably focuses on these types of organizations because their stocks can move
dramatically in response to news of clinical trial results, regulatory decisions, or safety
and legal issues.
Observed Sectors: Financial, Healthcare, Pharmaceutical.
Tools used UpDocX.
Information
MITRE ATT&CK https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1a7f67d2-c05e-48f6-b62e-76b2bea6d174
Page 1 of 2

Last change to this card: 16 August 2025
Download this actor card in PDF or JSON format
Source: https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1a7f67d2-c05e-48f6-b62e-76b2bea6d174
https://apt.etda.or.th/cgi-bin/showcard.cgi?u=1a7f67d2-c05e-48f6-b62e-76b2bea6d174
Page 2 of 2