The FIN8 threat organization has begun to shift their modus operandi to include ransomware attacks from several malware families. FIN8, also tracked as Syssphinx, is a well-established financially motivated cybercriminal operation that has been active since early 2016, often targeting retail, insurance, hospitality, technology, financial and chemical outlets. Often employing social engineering and spearphishing as their delivery tactics, FIN8 actors deploy customized malware onto their target’s machine to harvest system information, execute commands, and prepare second-stage malware. Recently, security researchers have observed FIN8 actors using multiple ransomware families in recent attacks including “Ragnar Locker” ransomware from Viking Spider, the “White Rabbit” ransomware, and the “Noberus” ransomware variant often employed by ALPHV/BlackCat. Specific cases in which these ransomwares were deployed go back to June 2021, where FIN8 deployed Ragnar Locker ransomware on a compromised entity within a United States financial institution. More recent FIN8 attacks include deployment of the White Rabbit ransomware on an unclassified entity in early 2022, followed by a Noberus ransomware deployment in late 2022. FIN8 threat actors continue to not only evolve their malware arsenal but continue to change tactics to broaden their attack capabilities. CTIX continues to monitor threat actor activity worldwide and will provide additional updates accordingly.