Several mysterious hackers have captured the public's imagination over the past few decades, but none quite like Phineas Fisher. Ten years after their most famous hack, Phineas remains, by most accounts, the most prolific public hacker to ever be caught.
As part of our series on the biggest cybersecurity mysteries of all time, we delve into the mystery of Phineas, the hacktivist who hacked controversial spyware maker FinFisher and Hacking Team. The latter is an Italian startup that was one of the first to turn government spyware into a viable global business, paving the way for spyware makers such as Israel's NSO Group. Phineas' hacking of Hacking Team ultimately led to the startup's demise several years later.
Phineas is perhaps the most famous hacktivist in history, aside from Anonymous, an amorphous collection of hacktivists with a varied track record of mostly stunt hacking designed to garner publicity rather than actual influence. Their story is made up of impressive hacks and endless unanswered questions.
Who is Phineas Fisher?
The hacker, who has been variously referred to as anarchist, cybercriminal, hacktivist and vigilante, said he “uses many different names” for different hacking activities.
The hack as we know it was large enough to make Phineas a legend among hackers. “I would love to meet Phineas Fisher, buy him a 3-Michelin-starred 7-course dinner somewhere, and hear him explain how they turned Hacking Team inside out like a gym sock,” one prominent security researcher once wrote on Twitter. There are also songs about them.
Phineas first appeared in August 2014, announcing that he had hacked Gamma Group, the maker of the FinFisher spyware. This is the origin of this nickname. They announced the hack through a Twitter account cheekily called: @GammaGroupPRmobile spyware, product manuals, price lists, and other stolen data is leaked. The damage was limited, so Finfisher continued. Phineas published a posthumous report that doubled as a leftist manifesto, and then disappeared.
A year later, they came back with flying colors and hacked another spyware maker, Hacking Team. They took virtually everything, including more than 400 gigabytes of source code, tens of thousands of internal emails, confidential contracts, and customer lists. This leak allowed journalists to expose scandals in Ecuador, Mexico, and Panama. A few years later, Hacking Team CEO David Vincenzetti was forced to sell the company for 1 euro. For some former employees, Phineas' hack was the beginning of the end.
Phineas also hacked the Mossos d'Esquadra union, the Catalan police force, and released a post-mortem and a 39-minute tutorial video. This is consistent with their anti-police ideals. The next victim was Turkey's authoritarian President Recep Tayyip Erdoğan's ruling party, in a hack motivated by solidarity with Rojava, the left-wing autonomous region in northern and eastern Syria, with which Turkey had been an enemy.
Phineas' last known victim was at a branch of the Cayman National Bank on the Isle of Man, a self-governing island between England and Ireland. This hack suggested another side of Phineas. “I'm looking for illegal ways to make money so that I can free up my time and do something useful. Once I knew that, I started expanding my business, making more money than I needed, and donating the extra stuff,” Finneas said in an interview with activist Freddy Martinez. (Phineas donated at least $10,000 in Bitcoin to Rojava.)
Finneas announced the Hacktivist Bug Bounty Program, an initiative to reward hacktivists who silenced the 2016 hacking scandal for three years and then exposed companies' illegal and unethical activities. When Cayman National Bank acknowledged the hack, it claimed it was “among a number of banks targeted.” Phineas admitted that they had hacked multiple banks over the years.
That was their last public appearance. Their Twitter and Reddit accounts have long since been deleted, leaving no trace online. A former company employee said Mr. Finfischer never contacted law enforcement. The Italian authorities' investigation into Hacking Team's hack ended without finding any evidence pointing to Phineas' true identity. From my own reports, Phineas is alive and well and has been in contact with me over the last few years.
So who is Phineas Fisher? If we take their claims at face value, they are hacktivists with anarchist ideals as well as cyber criminals. Rather, are they fabricated figures controlled by spy agencies—Russia says it has a history of fabricating hacktivist names to muddy the waters after its own hacks? Phineas denies being a Russian spy, and it is unclear why the Russians would go after all of the targets Phineas chooses.
Their origins are similarly obscure. Phineas named Spanish-speaking anarchists, wrote hacking team after-action reports in Spanish, and followed numerous left-wing accounts in Latin America on Twitter. They told me that their first language was neither English nor Spanish, although they acknowledged that they lived in a Spanish-speaking country. Everything is worth taking with a grain of salt. “Everything I say that contains clues as to my identity is semi-trolling,” Phineas once told me. “I have a habit of giving false information.”
It's also possible that the Phineas persona was passed down between 2014 and 2019 and used by different people. But there's no evidence of that, and after 10 years of conversations, my gut feeling is that Phineas is really the hacktivist they claim to be.
ASCII art from a post-mortem compromised by Phineas' hacking team. (Image: TechCrunch)Image credit: TechCrunch /
If you buy through links in our articles, we may earn a small commission. This does not affect editorial independence.