FinFisher.Botnet

Description

This indicates that a system might be infected by FinFisher Botnet.
FinFisher, also known as FINSPY is a surveillance malware that targets Windows platform. The malware often infects computers through malicious Word documents, exploiting vulnerabilities such as CVE-2017-0199 and CVE-2017-8759. All botnet signatures from FortiOS 5.6 onwards are under IPS, and have their default action set to "Block".

Affected Products

Any unprotected Windows system is vulnerable.

Impact

System Compromise: Remote attackers can gain control of vulnerable systems.

Recommended Actions

If required, the signature's action can be set to "Block".
Please use Anti-Virus software to scan and clean the infected computer.

References

https://en.wikipedia.org/wiki/FinFisher https://community.rapid7.com/community/infosec/blog/2012/08/08/finfisher https://citizenlab.org/2012/07/from-bahrain-with-love-finfishers-spy-kit-exposed/