WOLF_SPIDER__2014__rpt-fin4.pdf

FIN4 is a financially driven threat actor targeting insiders with access to confidential market information, primarily in healthcare and pharmaceutical companies. The group conducts credential theft via spearphishing using VBA macros and fake Outlook login pages, exploits hijacked email threads to access private communications, and focuses on ongoing M&A-related information across more than 100 organizations, supported by documented infrastructure, campaign codes, and recommended defense measures.