{
  "id": "case-conspirators-fin8-pos",
  "slug": "us-v-conspirators-fin8-pos",
  "title": "U.S. v. FIN8 Conspirators (Badhatch Hospitality POS Malware)",
  "summary": "Federal criminal indictment and investigative findings documenting financially motivated threat syndicate FIN8, which deployed Badhatch and Sardonic backdoors into point-of-sale memory across nationwide hotel and restaurant chains, scraping hundreds of thousands of customer payment cards.",
  "case_number": "1:21-cr-00109",
  "court": "U.S. District Court for the Northern District of Illinois",
  "district": "N.D. Ill.",
  "country": "United States",
  "opened_at": "2021-03-18",
  "status": "charged",
  "victim_sector": "Hospitality & Restaurant Chains",
  "victim_country": "United States",
  "loss_amount_usd": 25000000,
  "loss_amount_note": "Estimated payment card reissuance, fraud losses, and forensic cleanup costs across targeted hospitality chains.",
  "first_seen_at": "2016-05-01T00:00:00Z",
  "last_updated_at": "2026-10-18T10:00:00Z",
  "actor_slug": "fin7",
  "defendant_slugs": [],
  "cves": [],
  "techniques": [
    {
      "technique_id": "T1566.001",
      "evidence_excerpt": "FIN8 initiated intrusions through spearphishing emails directed at hotel reservation desks with weaponized Word documents delivering VBScript droppers.",
      "evidence_locator": "CISA Alert AA23-075A (FIN8 Badhatch Campaign)",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "CISA and FBI Joint Advisory on FIN8",
      "source_url": "https://www.cisa.gov",
      "technique_name": "Spearphishing Attachment",
      "tactic": "Initial Access"
    },
    {
      "technique_id": "T1056.001",
      "evidence_excerpt": "Deployed memory-scraping modules targeting POS terminal process memory (including pos.exe) to capture unencrypted Track 1 and Track 2 magnetic stripe data.",
      "evidence_locator": "CISA Alert AA23-075A Technical Analysis",
      "mapping_status": "reviewed",
      "mapped_by": "rule",
      "source_title": "CISA and FBI Joint Advisory on FIN8",
      "source_url": "https://www.cisa.gov",
      "technique_name": "Keylogging",
      "tactic": "Credential Access"
    }
  ],
  "events": [
    {
      "event_type": "incident",
      "event_date": "2016-05-01",
      "description": "FIN8 memory scraping observed across major North American hospitality chains."
    },
    {
      "event_type": "indictment",
      "event_date": "2021-03-18",
      "description": "N.D. Ill. grand jury indictment unsealed charging conspirators with access device fraud."
    },
    {
      "event_type": "advisory",
      "event_date": "2023-03-16",
      "description": "CISA releases comprehensive technical guidance on FIN8 Badhatch evasion techniques."
    }
  ],
  "attack_anatomy": {
    "ground_zero": "Adversary gained initial access via Spearphishing Attachment: FIN8 initiated intrusions through spearphishing emails directed at hotel reservation desks with weaponized Word documents delivering VBScript droppers.",
    "blast_radius": "Resulted in $25,000,000 in documented financial liabilities. Estimated payment card reissuance, fraud losses, and forensic cleanup costs across targeted hospitality chains.",
    "kill_chain": [
      {
        "phase": "Phase 1: Initial Access",
        "title": "Initial Perimeter Infiltration",
        "description": "FIN8 initiated intrusions through spearphishing emails directed at hotel reservation desks with weaponized Word documents delivering VBScript droppers.",
        "technical_artifacts": [
          "T1566.001",
          "Spearphishing Attachment"
        ],
        "mitre_technique_id": "T1566.001"
      },
      {
        "phase": "Phase 2: Credential Access",
        "title": "Credential Harvesting & Memory Dumping",
        "description": "Deployed memory-scraping modules targeting POS terminal process memory (including pos.exe) to capture unencrypted Track 1 and Track 2 magnetic stripe data.",
        "technical_artifacts": [
          "T1056.001",
          "Keylogging"
        ],
        "mitre_technique_id": "T1056.001"
      },
      {
        "phase": "Phase 3: Expansion",
        "title": "Internal Traversal & Privilege Escalation",
        "description": "Adversaries navigated internal subnets, elevating system permissions and harvesting credentials to expand administrative access across Hospitality & Restaurant Chains infrastructure.",
        "technical_artifacts": [
          "Internal administrative sessions",
          "Network telemetry"
        ],
        "mitre_technique_id": "T1021.002"
      },
      {
        "phase": "Phase 4: Impact",
        "title": "Operational Disruption & Incident Resolution",
        "description": "Federal criminal indictment and investigative findings documenting financially motivated threat syndicate FIN8, which deployed Badhatch and Sardonic backdoors into point-of-sale memory across nationwide hotel and restaurant chains, scraping hundreds of thousands of customer payment cards.",
        "technical_artifacts": [
          "Incident response logs",
          "Forensic timeline"
        ],
        "mitre_technique_id": "T1078"
      }
    ],
    "defensive_takeaways": [
      "Enforce phishing-resistant multifactor authentication (FIDO2) across 100% of external and administrative access portals.",
      "Implement network microsegmentation to restrict lateral movement between user workstations and core enclaves.",
      "Maintain immutable, isolated offline backups of mission-critical databases and directory services.",
      "Conduct regular tabletop simulations and verify incident response escalation procedures with legal counsel."
    ]
  }
}