Molerats__2015__Mapping_FinFisher_s_Continuing_Proliferation.pdf
ID: 9d47b8c1-4516-438d-8bc0-5b6d5e9e899d
STIX ID: report--9d47b8c1-4516-438d-8bc0-5b6d5e9e899d
Threat Score
88/100
Uploaded: 2026-08-19
Published Date: 2026-02-13
Last Modified Date: 2026-02-13
Created by: dogesec
TLP:CLEAR
ADMIRALTY:B2
PAP:CLEAR
...
...
Citizen Lab presents technical scanning and analysis showing widespread, active deployments of the FinFisher (FinSpy) spyware: they describe a fingerprint-based zmap scan that located ~135 servers, methods to unmask FinSpy master servers hidden behind anonymizing relays, attribution linking masters to government entities across 32 countries (with 10 entities named), and concrete indicators (IP addresses, domains, SHA256 hashes) and TTPs including FinFly Web landing pages and weaponized Word documents used to deliver implants.