FinFisher RAT

Aliases: FinSpy

First seen
2011-08-01 00:00:00
Malware type
rat, spyware
Family
Malware family
Profile updated
2026-07-07 12:55:28

Targeted industries: government-and-public-sector education-and-nonprofits media-and-entertainment

Context

FinFisher is a commercial software used to steal information and spy on affected victims. It began with few functionalities which included password harvesting and information leakage, but now it is mostly known for its full Remote Access Trojan (RAT) capabilities. It is mostly known for being used in governmental targeted and lawful criminal investigations. It is well known for its anti-detection capabilities and use of VMProtect.

Related threat objects

Reports & references

  • Kaspersky — 82732 (report)
  • Mandiant — Zero Day Used To Distribute Finspy (report)
  • Kaspersky — 91897 (report)
  • elastic.co — Ten Process Injection Techniques Technical Survey Common And Trending Process (report)
  • amnesty.org — German Made Finspy Spyware Found In Egypt And Mac And Linux Versions Revealed (report)
  • Kaspersky — 104322 (report)
  • netzpolitik.org — Our Criminal Complaint German State Malware Company Finfisher Raided (report)
  • blackberry.com — Report Bb 2021 Threat Report (report)
  • binarly.io — Index (report)
  • malpedia.caad.fkie.fraunhofer.de — Win.Finfisher (report)
  • msreverseengineering.com — Devirtualizing Finspy Phase 3 Fixing The Function Related Issues (report)
  • ESET — Wp Finfisher (report)
  • msreverseengineering.com — Finspy Vm Unpacking Tutorial Part 3 Devirtualization (report)
  • msreverseengineering.com — Devirtualizing Finspy Phase 4 Second Attempt At Devirtualization (report)
  • artemonsecurity.blogspot.de — Finfisher Rootkit Analysis (report)
  • msreverseengineering.com — A Walk Through Tutorial With Code On Statically Unpacking The Finspy Vm Part One X86 Deobfuscation (report)
  • netzpolitik.org — Nach Pfaendung Staatstrojaner Hersteller Finfisher Ist Geschlossen Und Bleibt Es Auch (report)
  • Microsoft — Finfisher Exposed A Researchers Tale Of Defeating Traps Tricks And Complex Virtual Machines (report)
  • github.com — Finspyvm (report)
  • ESET — New Finfisher Surveillance Campaigns (report)
  • msreverseengineering.com — Wsbjxrs1Jjw7Qi4Trk9T3Qy6Hr7Dye (report)
  • msreverseengineering.com — Devirtualizing Finspy Phase 2 First Attempt At Devirtualization (report)
  • codeandsec.com — Finfisher Malware Analysis Part 2 (report)

External references