The hacker who humiliated spyware makers and was never caught

Over the past few decades, many mysterious hackers have captured the public’s imagination, but none quite like Phineas Fisher. A decade after his most famous hack, Phineas remains, by most accounts, the most prolific and public hacker He was never arrested.

As part of our series on the biggest cybersecurity mysteries of all time, we delve into the mystery of Phineas, the hacktivist who hacked the makers of controversial spyware FinFisher and Hacking team. The latter, an Italian startup, was among the first to turn government spyware into a viable global business, paving the way for spyware makers like Israel’s NSO Group. Phineas hack against Hacking Team It eventually led to the startup’s demise years later.

Aside from Anonymous, an amorphous mix of hacktivists with a mixed record of mostly sensational hacks designed to garner publicity rather than make a real impact, Phineas is perhaps the most famous hacktivist in history. Their story is made up of impressive breakthroughs and countless unanswered questions.

Who is Phineas Fisher?

Hackers are called various names such as anarchist, cybercriminal, hacktivist, and vigilante, and he said they “use a lot of different names” for different hacking adventures.

The hacks we know of were significant enough to turn Phineas into a legend among hackers. A well-known security researcher once wrote on Twitter: “I would love to meet Phineas Fisher so I could buy a three-Michelin-starred seven-course dinner somewhere and listen to them explain how they turned Hacking Team upside down like a gym sock.” So there is A song about them.

Phineas first appeared in August 2014, when they announced it Gamma group breakthroughmakers of the FinFisher spyware — hence the nickname. They posted the hack via a cheekily named Twitter account @GammaGroupPRand leakage of stolen data including mobile spyware, product manuals and price lists. The damage was limited, and Operation FinFisher continued. Phineas published a posthumous statement that was a leftist manifesto, then disappeared.

A year later, they came back strong, Hacking hacking teamAnother spyware maker. They took practically everything: more than 400 gigabytes including source code, tens of thousands of internal emails, confidential contracts, and customer lists. The leak allowed journalists to uncover scandals in Ecuador, Mexico and Panama. Years later, Hacking Team CEO David Vincenzetti was forced to sell his company for one euro. For some former employees, Phineas’s breakthrough was the beginning of the end.

Phineas continued hacking a file Mossos d’Esquadra Federationthe police force of Catalonia, publishes the autopsy and 39-minute tutorial video – Consistent with their stated anti-police ideals. they The next victim It was the ruling party of authoritarian Turkish President Recep Tayyip Erdogan, a hack driven by solidarity with Rojava, a leftist autonomous region in northern and eastern Syria against which Türkiye had been fighting.

Phineas’s last known victim was a branch of the Cayman National Bank on the Isle of Man, a self-governing island between England and Ireland. The breakout hinted at a different side of Phineas. “I’m looking for illegal ways to make money in order to free up my time so I can do something useful with it. Once I discovered it, I started scaling it and making more money than I needed and donating the extra,” Finneas said in a message. interview With activist Freddy Martinez. (Phineas donated at least $10,000 in Bitcoin to Rojava.)

Phineas kept the hack – which occurred in 2016 – quiet for three years afterward before announcing the Hacktivist Bug Bounty Program, a initiative To reward hacktivists who expose illegal and unethical activities of companies. When Cayman National Bank certain The hack, it claimed, “was among a number of banks targeted.” Phineas confirmed that they had hacked into many banks for years.

This was their last public appearance. Their Twitter and Reddit accounts were deleted long ago, leaving no trace online. FinFisher never contacted law enforcement, according to a former employee at the company. The Italian authorities’ investigation into the Hacking Team hack has concluded Without finding any evidence Pointing out Phineas’s true identity. What I can say, from my own reports, is that Phineas is alive and well, and they have been in contact with me for the past two years.

So who is Phineas Fisher? If we take their claims seriously, they are hacktivists with anarchist ideals, but they are also cybercriminals. Could they instead be a fabricated figure controlled by a spy agency — Russia, for example, which has a history of inventing hacktivists to muddy the waters after its own hacks? Phineas has denied being a Russian spy, and it is not clear why Moscow would pursue all of Phineas’ chosen targets.

Their origins are equally mysterious. Phineas name-dropped Spanish-speaking anarchists, wrote the hacker team posthumously in Spanish, and followed several Latin American leftist accounts on Twitter. They told me that their first language was neither English nor Spanish, even though they acknowledged living in a Spanish-speaking country. It’s all worth taking with a grain of salt. “Everything I say that contains clues about my identity is half-trolling,” Phineas once told me. “I’m used to telling misinformation.”

It is also possible that the Phineas figure was circulated between 2014 and 2019 and used by different individuals. But there’s no evidence of that, and after 10 years of conversations, my gut says Phineas is actually the hacker they claim he is.