FIN4

Reports per quarter

Techniques in ATT&CK

Listed by ATT&CK

• T1056.001
• T1056.002
• T1059.005
• T1071.001
• T1078
• T1090.003
• T1114.002
• T1204.001
• T1204.002
• T1564.008
• T1566.001
• T1566.002

No report from the last two years names a technique ID.

CVEs named in reports

• CVE-2015-1701 KEV ransomware
• CVE-2015-2424 KEV
• CVE-2015-2590 KEV
• CVE-2015-3043 KEV
• CVE-2015-7645 KEV ransomware

KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.

Reports

1. 6 April 2026

   FIN4: Stealing Insider Information for an Advantage in Stock Trading? « FIN4: Stealing Insider Information for an Advantage in Stock Trading?

   date ORKL added it fromORKL

   The title opens Wayback Machine, not the publisher’s page. Archived copy on ORKL Detailsfor FIN4: Stealing Insider Information for an Advantage in Stock Trading? « FIN4: Stealing Insider Information for an Advantage in Stock Trading?

2. 21 July 2016

   Please Read

   date in the CCS '25 data FireEye and Microsoft fromORKLCCS '25 data

   The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Please Read

3. 24 June 2015

   FIN4.html

   date in the CCS '25 data PWC fromORKLCCS '25 data

   The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor FIN4.html

4. 2 May 2015

   Hacking The Street? Fin4 Likely Playing The Market

   Malpedia library date FireEye fromORKLCCS '25 data

   The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Hacking The Street? Fin4 Likely Playing The Market

5. 30 November 2014

   rpt-fin4.pdf

   file creation date fromORKL

   Archived copy on ORKL Detailsfor rpt-fin4.pdf

Newest first. Details opens the report in Explore.