{ "id": "dc43274e-1c42-425d-96c3-62ecebba4215", "created_at": "2026-10-18T03:24:16.341757Z", "updated_at": "2026-10-20T09:17:27.500945Z", "deleted_at": null, "sha1_hash": "76a25afbb8706001695f36651c29abead7e06648", "title": "FIN8: BADHATCH Threat Indicator Enrichment", "llm_title": "", "authors": "", "file_creation_date": "0001-01-01T00:00:00Z", "file_modification_date": "0001-01-01T00:00:00Z", "file_size": 40444, "plain_text": "FIN8: BADHATCH Threat Indicator Enrichment\n\nBy S2 Research Team\n\nPublished: 2021-03-15 · Archived: 2026-10-18 02:40:08 UTC\n\nINTRODUCTION\n\nhttps://team-cymru.com/blog/2021/03/15/fin8-badhatch-threat-indicator-enrichment/\n\nFIN8 research identifies ongoing campaigns against entities in Germany, Sweden and the US.\n\nLast week (10 March 2021), Bitdefender released a whitepaper on the recent activities of the FIN8 threat actor\n\ngroup, focusing particularly on their BADHATCH toolkit[1]. The research found that FIN8, a financially\n\nmotivated group, had used this toolkit to target victims in the chemicals, insurance, retail and technology sectors.\n\nWe‚Äôve expanded on Bitdefender‚Äôs findings by using Pure Signal‚Ñ¢ Recon to identify infrastructure\n\ncurrently in use by the group.\n\nMETHODOLOGY\n\nand were used as seeds for this investigation:\n\n104.168.145[.]204 (HOSTWINDS, US)\n\n192.52.167[.]199 (QUADRANET, US)\n\nTCP/22 and TCP/80.\n\nTCP/22: SSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u2\n\nTCP/80: HTTP/1.1 404 Server: nginx/1.14.1 Content-Type: text/plain; charset=utf-8 Content-Length: 14\n\nConnection: Close\n\nTwo IP addresses were provided in the Bitdefender paper, described as BADHATCH command and control IOCs,\n\nBanner information was obtained for both IP addresses during December 2020, showing identical strings on ports\n\nPivoting on the string observed on TCP/80 ‚ÄòHTTP/1.1 404 Server: nginx/1.14.1 Content-Type: text/plain;\n\ncharset=utf-8 Content-Length: 14 Connection: Close‚Äô, two further IP addresses were identified hosting the\n\nsame banner information:\n\n89.45.4[.]192 (M247, US)\n\n108.62.118[.]100 (LEASEWEB, US)\n\nA further set of queries for the two ‚Äònew‚Äô IP addresses identified the same banner information being hosted\n\non TCP/22 ‚ÄòSSH-2.0-OpenSSH_7.9p1 Debian-10+deb10u2‚Äô, as observed with the original seeds.\n\nGiven the low volume of IP addresses [2] hosting the same banner information as observed on the seed IP\n\naddresses, the two strings (when viewed in combination) were considered a viable fingerprint for connected FIN8\n\nactivity.\n\nPage 1 of 2\n\nhttps://team-cymru.com/blog/2021/03/15/fin8-badhatch-threat-indicator-enrichment/\n\nNetwork traffic data was obtained for both 89.45.4[.]192 and 108.62.118[.]100 in order to help confirm this\n\nassertion. These findings are summarised as follows:\n\nRepeated established inbound connections, during the period 24 January ‚Äì 13 March 2021 (i.e., present\n\nday), to TCP/443 on both 89.45.4[.]192 and 108.62.118[.]100 sourced from numerous potential victims:\n\nCONCLUSION\n\nTECHNICAL APPENDIX\n\nFIN8 C2s:\n\nA Germany-based logistics company\n\nA Sweden-based engineering company\n\nAn US-based bank\n\nAn US-based credit union\n\nAn US-based engineering company\n\nSome evidence to suggest 89.45.4[.]192 taking over as the primary C2 on or around 20 February 2021.\n\nNote that the potential victims described above were notified of this activity prior to the release of this blog.\n\nThis investigation has highlighted two FIN8 command and control IP addresses, believed to be in active use by the\n\nthreat actors in targeting potential victims in Germany, Sweden and the United States.\n\n89.45.4[.]192\n\n108.62.118[.]100\n\n[1] https://labs.bitdefender.com/2021/03/fin8-group-is-back-in-business-with-improved-badhatch-kit/\n\nSource: https://team-cymru.com/blog/2021/03/15/fin8-badhatch-threat-indicator-enrichment/\n\nPage 2 of 2", "extraction_quality": 1, "language": "EN", "sources": [ "ETDA" ], "origins": [ "web" ], "references": [ "https://team-cymru.com/blog/2021/03/15/fin8-badhatch-threat-indicator-enrichment/" ], "report_names": [ "fin8-badhatch-threat-indicator-enrichment" ], "threat_actors": [ { "id": "5bdde906-0416-42ee-9100-5ebd95dda77a", "created_at": "2023-01-06T13:46:38.601977Z", "updated_at": "2026-10-20T02:00:07.494011Z", "deleted_at": null, "main_name": "FIN8", "aliases": [ "PUNCH COMET", "ATK113", "G0061" ], "source_name": "MISPGALAXY:FIN8", "tools": [], "source_id": "MISPGALAXY", "reports": null }, { "id": "72d09c17-e33e-4c2f-95db-f204848cc797", "created_at": "2022-10-25T15:50:23.832551Z", "updated_at": "2026-10-20T02:00:12.275704Z", "deleted_at": null, "main_name": "FIN8", "aliases": [ "FIN8", "Syssphinx" ], "source_name": "MITRE:FIN8", "tools": [ "BADHATCH", "PUNCHBUGGY", "Ragnar Locker", "PUNCHTRACK", "dsquery", "Nltest", "Sardonic", "PsExec", "Impacket" ], "source_id": "MITRE", "reports": null }, { "id": "fc80a724-e567-457c-82bb-70147435e129", "created_at": "2022-10-25T16:07:23.624289Z", "updated_at": "2026-10-20T02:00:11.628093Z", "deleted_at": null, "main_name": "FIN8", "aliases": [ "ATK 113", "G0061", "Storm-0288", "Syssphinx" ], "source_name": "ETDA:FIN8", "tools": [ "ALPHV", "ALPHVM", "BadHatch", "BlackCat", "Noberus", "PSVC", "PUNCHTRACK", "PoSlurp", "Powersniff", "PunchBuggy", "Ragnar Loader", "Ragnar Locker", "RagnarLocker", "Sardonic", "ShellTea" ], "source_id": "ETDA", "reports": null }, { "id": "96ffdf43-1b53-4306-9805-d4bf161b7aa7", "created_at": "2026-09-17T02:00:03.95754Z", "updated_at": "2026-10-20T02:00:08.311959Z", "deleted_at": null, "main_name": "GOLD HUXLEY", "aliases": [ "CTG-6969 ", "FIN8 " ], "source_name": "Secureworks:GOLD HUXLEY", "tools": [ "Gozi ISFB", "Powersniff" ], "source_id": "Secureworks", "reports": null } ], "ts_created_at": 1792293856, "ts_updated_at": 1792487847, "ts_creation_date": 0, "ts_modification_date": 0, "files": { "pdf": "https://archive.orkl.eu/76a25afbb8706001695f36651c29abead7e06648.pdf", "text": "https://archive.orkl.eu/76a25afbb8706001695f36651c29abead7e06648.txt", "img": "https://archive.orkl.eu/76a25afbb8706001695f36651c29abead7e06648.jpg" } }