Over the past few decades, several mysterious hackers have captured the public’s imagination, but none like Phineas Fisher. A decade after his most famous hack, Phineas remains, by most accounts, the most prolific and public hacker. never been caught.
As part of our series on The biggest mysteries of cybersecurity. of all time, we are delving into the enigma of Phineas, the hacktivist who hacked controversial spyware makers. FinFisher and Hacking Team. The latter, an Italian startup, was one of the first to turn government spyware into a viable global business, paving the way for spyware makers like Israeli group NSO. Phineas’ trick against Hacking Team ultimately led to the startup’s demise years later.
Aside from Anonymous, an amorphous amalgam of hacktivists with a mixed track record of tricks mostly designed to gain publicity rather than have any real impact, Phineas is perhaps the best-known hacktivist in history. His story is made up of impressive tricks and endless unanswered questions.
Who is Phineas Fisher?
Variously called an anarchist, cybercriminal, hacktivist and vigilante, the hacker has said he “uses a lot of different names” for different hacking adventures.
The hacks we know about were big enough to make Phineas a legend among hackers. “I’d like to meet Phineas Fisher so I can treat them to a seven-course, three-Michelin-star dinner somewhere and listen to them explain how they turned Hacking Team inside out like a gym sock,” a well-known security researcher once wrote on Twitter. There is even a song about them.
Phineas first emerged in August 2014, when they announced that they had Gamma Group hackedthe creators of the FinFisher spyware, where the nickname comes from. They posted the trick through a Twitter account cheekily named @GammaGroupPRleaking stolen data, including mobile spyware, product manuals and a price list. The damage was limited and FinFisher moved on. Phineas published an autopsy that served as a leftist manifesto and then disappeared.
A year later, they came back strong, hacking teamanother spyware maker. They took virtually everything: more than 400 gigabytes, including source code, tens of thousands of internal emails, confidential contracts and customer lists. The leak allowed journalists to reveal scandals in Ecuador, Mexico and Panama. Years later, Hacking Team CEO David Vincenzetti was forced to sell his company for one euro. For some former employees, the Phineas hack was the beginning of the end.
Phineas went on to hack the union of the Mossos d’Esquadrawhich is the police of Catalonia, publishing an autopsy and a 39 minute video tutorial – consistent with his stated anti-police ideals. His next victim was the ruling party of Turkey’s authoritarian president Recep Tayyip Erdoğan, a hack motivated by solidarity with Rojava, a left-wing autonomous region in northern and eastern Syria that Turkey was fighting.
Phineas’ last known victim was the Cayman National Bank branch on the Isle of Man, a self-governing island between England and Ireland. The trick hinted at a different side of Phineas. “I’m looking for illegal ways to make money to free up my time so I can do something useful with it. Once I had that figured out, I started expanding it and making more money than I need and giving away the extra,” Phineas said in a interview with activist Freddy Martínez. (Phineas donated at least $10,000 in Bitcoin to Rojava.)
Phineas kept the hack, which occurred in 2016, quiet for three years afterward before announcing the “Bug Bounty Hacktivist Program,” a initiative reward hacktivists who expose companies’ illegal and unethical activities. When the Cayman National Bank confirmed After the attack, he stated that “he was among several banks attacked.” Phineas confirmed that they had been hacking into various banks for years.
That was his last public appearance. His Twitter and Reddit accounts were deleted long ago, leaving no trace online. FinFisher never contacted police, according to a former company employee. The investigation by the Italian authorities into the Hacking Team hack ends without finding any evidence pointing to Phineas’ true identity. What I can say, based on my own reports, is that Phineas is alive and well; They have been in contact with me in recent years.
So who is Phineas Fisher? Taking their claims at face value, they are hacktivists with anarchist ideals, but also cybercriminals. Could they instead be a fabricated person controlled by a spy agency (Russia, for example, which has a history of inventing hacktivists to muddy the waters after its own attacks)? Phineas has denied being a Russian spy and it is unclear why Moscow would go after all of Phineas’ chosen targets.
Its origins are equally murky. Phineas named Spanish-speaking anarchists, wrote the Hacking Team’s autopsy in Spanish, and followed numerous Latin American leftist accounts on Twitter. They told me that their first language is neither English nor Spanish, although they have acknowledged that they live in a Spanish-speaking country. It’s worth taking everything with a grain of salt. “Everything I say that contains clues to my identity is half-trolling,” Phineas once told me. “I have a habit of saying wrong information.”
It’s also possible that Phineas’ persona passed between 2014 and 2019 and was used by different people. But there’s no evidence of that, and after 10 years of conversations, my gut says that Phineas is really the hacktivist he claims to be.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.
