Read more . BUSINESS INSIGHTS . Deep dive into a FIN8 attack – A forensic investigation . During a recent investigation, our researchers encountered a new version of the BADHATCH malware used by the well-known threat actor, FIN8. We previously reported that FIN8 was working on a new version of the BADHATCH malware - and this recent attack supports our findings and conclusions. The objective of this blog post is to provide insights into an attempted attack by FIN8 on one of our customers, and how we worked with the customer to thwart the attack before it could fully develop. They engaged in lateral movement by using the WMIC utility for remote code execution (a built-in Windows tool). WMIC (wmic.exe) was used to create a remote command prompt instance (cmd.exe), which then executed the PowerShell code. The PowerShell command created two variables and attempted to download and execute the payload from one of FIN8’s Command and Control (C&C) servers. While this service is legitimate and widely used, the malware abused it in an attempt at evading detection when connecting to C&C servers. To achieve persistency, they used WMI Event Subscription with a few different WMI objects. The decrypted script is used to select a .NET binary based on the architecture type (x86 or x64), create WMI objects used for persistence (described later) and create a WMI event trigger. The first object (root\cimv2\Win32_Base64Class) has a property Prop that contains the code of the payload. This is used to store the payload in the WMI object