Threat actor
FinFisher
Last fetched
FinFisher is a threat actor tracked in WhisperGraph's MITRE ATT&CK corpus, observed using 0 techniques.
Description
FinFisher, also known as FinSpy, is surveillance software developed by Gamma Group, an Anglo-German technology company specializing in surveillance and monitoring solutions. FinFisher has been used by various governments and law enforcement agencies around the world for surveillance purposes. The software is designed to monitor and intercept communications, gather intelligence, and track individuals' activities. FinFisher is known for its comprehensive surveillance capabilities, which include: remote access, data extraction of information such as emails, SMS, files, and browser history, real-time monitoring of communications and online activities, keylogging to capture passwords and other sensitive information, microphone and camera activiation to record audio and video, as well as geolocation tracking. Gamma Group dissolved its FinFisher unit in 2014, but several German companies have since sold the spyware.
Techniques by tactic
No ATT&CK techniques are recorded for FinFisher in WhisperGraph.
Attributed infrastructure
None published. WhisperGraph carries no ATTRIBUTED_TO edge to FinFisher today — this states the absence of a published link, not that FinFisher has no infrastructure.
References
- https://www.bloomberg.com/news/articles/2022-03-28/spyware-vendor-finfisher-claims-insolvency-amid-investigation
- https://www.theverge.com/2015/1/21/7861645/finfisher-spyware-let-bahrain-government-hack-political-activist
- https://www.eff.org/deeplinks/2012/07/elusive-finfisher-spyware-identified-and-analyzed
- https://citizenlab.ca/2013/03/you-only-click-twice-finfishers-global-proliferation-2/
- https://privacyinternational.org/press-release/1036/ugandan-government-deployed-finfisher-spyware-crush-opposition-track-elected
- https://www.singapore-samizdat.com/p/a-timeline-of-singapore-and-spyware
© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.
Related pages
Pivot from FinFisher into its techniques, tactics and any attributed infrastructure.
Queries
Resolves the slug to this actor, merging every duplicate node sharing the same name.
MATCH (a:ACTOR)
WHERE a.name =~ $pattern OR any(x IN a.aliases WHERE x =~ $pattern)
RETURN a.id AS id, a.name AS name, a.aliases AS aliases, a.description AS description,
a.references AS references, a.campaigns AS campaigns
LIMIT 25Techniques this actor uses, grouped by the tactic each one serves.
MATCH (a:ACTOR {name: $name})-[:USES_TECHNIQUE]->(t:ATTACK_PATTERN)
OPTIONAL MATCH (t)-[:USES_TACTIC]->(tac:ATTACK_PATTERN)
RETURN t.id AS techniqueId, t.name AS techniqueName, tac.id AS tacticId, tac.name AS tacticName
LIMIT 1000Infrastructure publicly attributed to this actor.
MATCH (n)-[:ATTRIBUTED_TO]->(a:ACTOR {name: $name})
RETURN labels(n)[0] AS kind, n.name AS name
LIMIT 25Or query Whisper from your own LLM workflow via the Whisper MCP server.