Over the previous few many years, a number of mysterious hackers have captured the general public’s creativeness, however none fairly like Phineas Fisher. A decade after their most well-known hack, Phineas stays, by most accounts, essentially the most prolific and public hacker never to have been caught.
As a part of our collection on the biggest cybersecurity mysteries of all time, we’re delving into the enigma of Phineas, the hacktivist who hacked controversial adware makers FinFisher and Hacking Team. The latter, an Italian startup, was among the many first to show authorities adware right into a viable world enterprise, paving the way in which for adware makers such because the Israeli NSO Group. Phineas’ hack towards Hacking Group eventually led to the startup’s demise years later.
Aside from Nameless, an amorphous amalgam of hacktivists with a combined observe file of largely stunt hacks designed to collect publicity moderately than have actual affect, Phineas is maybe the most well-known hacktivist in historical past. Their story is product of spectacular hacks and limitless unanswered questions.
Who’s Phineas Fisher?
Variously referred to as an anarchist, a cybercriminal, a hacktivist, and a vigilante, the hacker has mentioned they “use lots of totally different names” for various hacking escapades.
The hacks we learn about have been large enough to show Phineas right into a legend amongst hackers. “I want to meet Phineas Fisher in order that I may purchase them a seven-course, three-Michelin-star dinner someplace and hearken to them clarify how they turned Hacking Group inside out like a gymnasium sock,” a well known safety researcher as soon as wrote on Twitter. There’s even a song about them.
Phineas first emerged in August 2014, once they introduced they’d hacked Gamma Group, the makers of the FinFisher adware — which is the place the nickname comes from. They publicized the hack by way of a Twitter account cheekily referred to as @GammaGroupPR, leaking stolen knowledge together with cell adware, product manuals, and a worth checklist. The harm was restricted, and FinFisher carried on. Phineas printed a autopsy that doubled as a leftist manifesto, then vanished.
A 12 months later, they got here again with a bang, hacking Hacking Team, one other adware maker. They took virtually every part: greater than 400 gigabytes together with supply code, tens of 1000’s of inner emails, confidential contracts, and buyer lists. The leak allowed journalists to disclose scandals in Ecuador, Mexico, and Panama. Years later, Hacking Group’s CEO David Vincenzetti was compelled to promote his firm for one euro. For some former workers, Phineas’ hack was the starting of the top.
Phineas went on to hack the union of the Mossos d’Esquadra, which is the police power of Catalonia, publishing a autopsy and a 39-minute tutorial video — in line with their acknowledged anti-police beliefs. Their next victim was the ruling social gathering of Turkey’s authoritarian president Recep Tayyip Erdoğan, a hack motivated by solidarity with Rojava, a leftist autonomous area in northern and japanese Syria that Turkey was preventing towards.
Phineas’ final identified sufferer was Cayman Nationwide Financial institution’s department within the Isle of Man, a self-governing island between England and Eire. The hack hinted at a distinct aspect of Phineas. “I search for unlawful methods to make cash so as to free my time so I can do one thing helpful with it. As soon as I had that found out, I began scaling it up and making extra money than I would like and giving the additional away,” Phineas mentioned in an interview with activist Freddy Martinez. (Phineas donated not less than $10,000 in Bitcoin to Rojava.)
Phineas saved the hack — which occurred in 2016 — quiet for 3 years later earlier than saying the “Hacktivist Bug Bounty Program,” an initiative to reward hacktivists who expose firms’ unlawful and unethical actions. When Cayman Nationwide Financial institution confirmed the hack, it claimed it “was amongst various banks focused.” Phineas confirmed they’d been hacking a number of banks for years.
That was their final public look. Their Twitter and Reddit accounts have lengthy since been deleted, leaving no on-line path. FinFisher by no means contacted legislation enforcement, in keeping with a former firm worker. The Italian authorities’ investigation into the Hacking Group hack ended without finding any evidence pointing to Phineas’ actual identification. What I can say, from my very own reporting, is that Phineas is alive and effectively — they’ve been in touch with me throughout the final couple of years.
So who’s Phineas Fisher? Taking their claims at face worth, they’re a hacktivist with anarchist beliefs, but additionally a cybercriminal. May they as a substitute be a fabricated persona managed by a spy company — Russia, say, which has a historical past of inventing hacktivists to muddy the waters after its personal hacks? Phineas has denied being a Russian spy, and it’s unclear why Moscow would go in any case of Phineas’ chosen targets.
Their origins are equally murky. Phineas has name-dropped Spanish-speaking anarchists, wrote the Hacking Group autopsy in Spanish, and adopted quite a few Latin American leftist accounts on Twitter. They informed me their first language is neither English nor Spanish, although they’ve acknowledged dwelling in a Spanish-speaking nation. It’s all value taking with a grain of salt. “The whole lot I say that incorporates clues about my identification is half trolling,” Phineas as soon as informed me. “I’m within the behavior of claiming misinformation.”
It’s additionally doable that the Phineas persona was handed round between 2014 and 2019 and utilized by totally different people. However there isn’t any proof of that, and after 10 years of conversations, my intestine says Phineas actually is the hacktivist they declare to be.
If you buy by way of hyperlinks in our articles, we may earn a small commission. This doesn’t have an effect on our editorial independence.
