That is, until one day they discovered a website in Burmese that contained the infected installers and samples of FinFisher for Android, helping to identify they were Trojanized with the same spyware. Its Windows implants were detected and researched several times up to 2018 when FinFisher appeared to have gone under the radar.Īfter that, Kaspersky solutions detected suspicious installers of legitimate applications such as TeamViewer, VLC Media Player, and WinRAR, which contained malicious code that could not be connected to any known malware. It is capable of gathering various credentials, file listings, and deleted files, as well as various documents, live streaming or recording data, and gaining access to a webcam and microphone. The findings suggest a high emphasis on defense evasion, making FinFisher one of the hardest-to-detect spywares to date.įinFisher, also known as FinSpy or Wingbird, is a surveillance tool, which Kaspersky has been tracking since 2011. The research, which took eight months to complete, uncovers four-layer obfuscation and advanced anti-analysis measures employed by the spyware’s developers, as well as the employment of a UEFI bootkit to infect victims.
Kaspersky researchers presented a comprehensive investigation into all the recent updates introduced into FinSpy spyware for Windows, Mac OS, Linux, and its installers.
