Wingbird

Description

Wingbird is a backdoor that appears to be a version of commercial software FinFisher. It is reportedly used to attack individual computers instead of networks. It was used by NEODYMIUM in a May 2016 campaign.

Names

Name
Wingbird

Category

Malware

Type

• Backdoor
• Info stealer

Information

• http://download.microsoft.com/download/E/B/0/EB0F50CC-989C-4B66-B7F6-68CD3DC90DE3/Microsoft_Security_Intelligence_Report_Volume_21_English.pdf
• http://www.finfisher.com/FinFisher/index.html
• https://cloudblogs.microsoft.com/microsoftsecure/2018/03/01/finfisher-exposed-a-researchers-tale-of-defeating-traps-tricks-and-complex-virtual-machines/
• https://securelist.com/blackoasis-apt-and-new-targeted-attacks-leveraging-zero-day-exploit/82732/
• https://www.fireeye.com/blog/threat-research/2017/09/zero-day-used-to-distribute-finspy.html

Mitre Attack

• https://attack.mitre.org/software/S0176/

Other Information

Uuid

de3054dc-0e37-4268-976d-c928ddfaabb5

Last Card Change

2022-12-30