Several mysterious hackers have captured the public’s imagination over the past few decades, but none quite like Phineas Fisher. Ten years after his most famous hack, Phineas remains, by most accounts, the most prolific and public hacker. never caught.
As part of our series the biggest secrets of cyber security We explore the mystery of Phineas, the hacktivist hacking controversial spyware makers. FinFisher and Hacking Team. The latter, an Italian startup, was one of the first companies to turn government spyware into a viable global business, paving the way for spyware makers like Israel’s NSO Group. Phineas’s hack against Hacking Team eventually led to the destruction of the startup years later.
Aside from Anonymous, an amorphous collective of hacktivists with a mixed track record of mostly stunt hacks designed to garner publicity rather than actually make an impact, Phineas is perhaps the most famous hacktivist in history. Their story is one of impressive hacks and endless unanswered questions.
Who is Phineas Fisher?
The hacker, variously called anarchist, cybercriminal, hacktivist and vigilante, said they “use many different names” for their various hacking escapades.
The hacks we know about were great enough to make Phineas a legend among hackers. “I’d like to meet Phineas Fisher so I could buy them a seven-course, three-Michelin-star dinner and listen to them explain how they turned Hacking Team inside out like gym socks,” the famous security researcher once tweeted. There is even a song about them.
Phineas first appeared in August 2014 when they announced their possession Gamma Group has been hackedMakers of the FinFisher spyware – that’s where the nickname comes from. They publicized the hack via a slyly named Twitter account @GammaGroupPRleaking stolen data, including mobile spyware, product manuals and price lists. The damage was limited and FinFisher continued. Phineas published a post-mortem that doubled as a leftist manifesto, which then disappeared.
A year later they came back with a bang, hacking Hacking Teamanother spyware maker. They took practically everything: more than 400 gigabytes, including source code, tens of thousands of internal emails, confidential contracts and customer lists. The leak allowed journalists to reveal scandals in Ecuador, Mexico and Panama. Years later, Hacking Team CEO David Vincenzetti was forced to sell his company for one euro. For some former employees, Phineas’ hack was the beginning of the end.
Phineas continued to hack Mossos d’Esquadra unitCatalonia’s police force, a post-mortem publication and a 39 minute training video — consistent with their professed anti-police ideals. Theirs the next victim The attack was carried out in solidarity with Rojava, a left-wing autonomy in the north and east of Syria, which is the ruling party of Turkey’s authoritarian president, Recep Tayyip Erdogan.
Phineas’ last known victim was a branch of the National Bank of Cayman on the Isle of Man, a self-governing island between England and Ireland. Hack pointed out a different side of Phineas. “I’ve been looking for illegal ways to make money to free up my time so I can do something useful with it. Once I realized that, I started expanding and making more money than I needed and giving away extra money,” Phineas said. interview with activist Freddy Martinez. (Phineas at least forgave $10,000 Bitcoin to Rojava.)
Phineas kept the 2016 hack quiet before announcing the Hacktivist Bug Bounty Program three years later. initiative reward hackers who expose illegal and unethical activities of companies. Time National Bank of Cayman confirmed Hack claimed it was “among a number of banks targeted”. Phineas confirmed that they have broken into several banks over the years.
This was their last public appearance. Their Twitter and Reddit accounts have long since been deleted, leaving no trace online. According to a former company employee, FinFisher has never contacted law enforcement. The Italian authorities’ investigation into the Hacking Team hack has ended without finding any evidence It hints at Phineas’ true identity. I can tell from my own report that Phineas is alive and well – they have been contacting me for the past few years.
So who is Phineas Fisher? Taking their claims at face value, they are a hacktivist with anarchist ideals, as well as a cybercriminal. Could they instead be a fictitious persona run by a spy agency—say, Russia, which invents hacktivists to muddy the waters after its own hacks? Phineas denied being a Russian spy, and it is unclear why Moscow went after all of Phineas’ chosen targets.
Their origins are equally obscure. Phineas named Spanish-speaking anarchists, posthumously wrote Hacking Team in Spanish, and followed numerous Latin American left-wing accounts on Twitter. They told me that their first language was neither English nor Spanish, although they admitted to living in a Spanish-speaking country. All of this should be taken with a grain of salt. Phineas once told me, “Anything I say that contains clues about my identity is semi-trolling.” “I am in the habit of saying disinformation.”
It is also possible that the Phineas persona was transferred between 2014 and 2019 and used by different individuals. But there is no proof of this, and after 10 years of conversations, my gut tells me that Phineas really is the hacktivist they claim to be.
When you purchase through links in our articles, we may earn a small commission. This does not affect our editorial independence.
