FIN4
FIN4 is a Romania-attributed cybercrime syndicate with a financial motive, tracked by Brandefense. It targets 3 sectors, including Finance and Healthcare, in the United States. It uses 15 MITRE ATT&CK techniques.
- WOLF SPIDER
- G0085
- Origin
- Romania
- Techniques
- 15
- Exploited CVEs
- No CVE data
- First seen
- Jan 1, 2013
- Last seen
- Dec 5, 2014
- Record updated
Who They Target.
About FIN4.
FIN4 is a financially-motivated threat group that has targeted confidential information related to the public financial market, particularly regarding healthcare and pharmaceutical companies, since at least 2013. FIN4 is unique in that they do not infect victims with typical persistent malware, but rather they focus on capturing credentials authorized to access email and other non-public correspondence.
Last updated Sep 19, 2026. Compiled by Brandefense technologies from structured threat intelligence and reviewed by Brandefense analysts. Techniques follow the MITRE ATT&CK framework.