article thumbnail

FinSpy: unseen findings

SecureList

Kaspersky has been tracking deployments of this spyware since 2011. This command wipes all the files and registry keys created by the backdoor, as well as restores the MBR and the EFI Windows Boot Manager (provided they were infected) from backups. This version was detected and researched several times up to 2018.