\n<\/p>\n
Over the last few decades, several mysterious hackers have captured the public\u2019s imagination, but none quite like Phineas Fisher. A decade after their most famous hack, Phineas remains, by most accounts, the most prolific and public hacker never to\u00a0have been caught<\/a>.\u00a0<\/p>\n As part of our series on\u00a0the biggest cybersecurity mysteries<\/a> of all time, \u00a0we\u2019re delving into the enigma of Phineas, the hacktivist\u00a0who hacked controversial spyware makers\u00a0FinFisher<\/a> and Hacking Team<\/a>. The latter, an Italian startup, was among the first to turn government\u00a0spyware into a viable global business, paving the way for spyware makers such as the Israeli NSO Group.\u00a0Phineas\u2019 hack against Hacking Team eventually led to the startup\u2019s demise years later<\/a>.<\/p>\n Apart from Anonymous, an amorphous amalgam of hacktivists with a mixed\u00a0track record\u00a0of mostly stunt hacks designed to gather publicity rather than have real impact, Phineas is\u00a0perhaps the\u00a0most well-known hacktivist in history. Their story is made of impressive hacks and endless unanswered questions.\u00a0\u00a0<\/p>\n Variously called an anarchist, a cybercriminal, a hacktivist, and a vigilante, the hacker has said they \u201cuse a lot of different names\u201d for different hacking escapades.\u00a0<\/p>\n The hacks we know about were big enough to turn Phineas into a legend among hackers. \u201cI would like to meet Phineas Fisher so that I could buy them a seven-course, three-Michelin-star dinner somewhere and listen to them explain how they turned Hacking Team inside out like a gym sock,\u201d a well-known security researcher once wrote on Twitter.\u00a0There\u2019s\u00a0even a\u00a0song about them<\/a>.\u00a0<\/p>\n Phineas first\u00a0emerged\u00a0in August 2014, when they announced they had\u00a0hacked Gamma Group<\/a>, the makers of the\u00a0FinFisher\u00a0spyware \u2014 which is where the nickname comes from. They publicized the hack via a Twitter account\u00a0cheekily\u00a0called\u00a0@GammaGroupPR<\/a>, leaking stolen data including mobile spyware, product manuals, and a price list. The damage was limited, and\u00a0FinFisher\u00a0carried on. Phineas published a\u00a0post-mortem\u00a0that doubled as a leftist manifesto, then vanished.\u00a0<\/p>\n A year later, they came back with a bang,\u00a0hacking\u00a0Hacking\u00a0Team<\/a>, another spyware maker. They took\u00a0practically everything: more than 400 gigabytes including source code, tens of thousands of internal emails, confidential contracts, and customer lists. The leak allowed journalists to reveal scandals in Ecuador, Mexico, and Panama. Years later, Hacking Team\u2019s CEO David Vincenzetti was forced to sell his company for one euro. For some former employees, Phineas\u2019 hack was the\u00a0beginning of the end.\u00a0<\/p>\n Phineas went on to hack the\u00a0union of the\u00a0Mossos\u00a0d\u2019Esquadra<\/a>, which is the police force of Catalonia, publishing a\u00a0post-mortem\u00a0and a\u00a039-minute tutorial video<\/a>\u00a0\u2014 consistent with their stated anti-police ideals.\u00a0Their\u00a0next victim<\/a>\u00a0was the ruling party of\u00a0Turkey\u2019s\u00a0authoritarian president Recep Tayyip Erdo\u011fan, a hack motivated by solidarity with Rojava, a leftist autonomous region in northern and eastern Syria that\u00a0Turkey\u00a0was fighting against.\u00a0<\/p>\n Phineas\u2019 last known victim was Cayman National Bank\u2019s branch in the Isle of Man, a self-governing island between England and Ireland. The hack hinted at a different side of\u00a0Phineas. \u201cI look for illegal ways to make money in order to free my time so I can do something useful with it. Once I had that figured out, I started scaling it up and making more money than I need and giving the extra away,\u201d Phineas said in\u00a0an\u00a0interview<\/a>\u00a0with activist Freddy Martinez. (Phineas donated at least\u00a0$10,000 in Bitcoin to\u00a0Rojava<\/a>.)\u00a0<\/p>\n Phineas kept the hack \u2014 which happened in 2016 \u2014 quiet for three years later before announcing the \u201cHacktivist Bug Bounty Program,\u201d an\u00a0initiative<\/a>\u00a0to reward hacktivists who expose companies\u2019 illegal and unethical activities.\u00a0When Cayman National Bank\u00a0confirmed<\/a>\u00a0the hack, it claimed it \u201cwas amongst a number of banks targeted.\u201d\u00a0Phineas confirmed they had been hacking several banks for years.\u00a0<\/p>\n That was their last public appearance.\u00a0Their Twitter and Reddit accounts have long since been deleted, leaving no online trail. FinFisher\u00a0never contacted law enforcement, according to a former company employee. The Italian authorities\u2019 investigation into the Hacking Team hack ended\u00a0without finding any evidence<\/a>\u00a0pointing to Phineas\u2019 real identity. What I can say, from my own reporting, is that Phineas\u00a0is\u00a0alive and well \u2014 they have been in contact with me within the last couple of years.\u00a0<\/p>\n So who is Phineas Fisher? Taking their claims at face value, they\u2019re a hacktivist with anarchist ideals, but also a cybercriminal. Could they instead be a fabricated persona controlled by a spy agency \u2014 Russia, say, which has a history of inventing hacktivists to muddy the waters after its own hacks? Phineas has denied being a Russian spy, and\u00a0it\u2019s\u00a0unclear why Moscow would go after all of Phineas\u2019 chosen targets.\u00a0<\/p>\n Their origins are equally murky. Phineas has name-dropped Spanish-speaking anarchists, wrote the Hacking Team post-mortem in Spanish, and followed\u00a0numerous\u00a0Latin American leftist accounts on Twitter. They told me their first language is neither English nor Spanish, though they have acknowledged living in a Spanish-speaking country.\u00a0It\u2019s\u00a0all worth taking with a grain of salt. \u201cEverything I say that contains clues about my identity is half trolling,\u201d Phineas once told me. \u201cI\u2019m in the habit of saying misinformation.\u201d\u00a0<\/p>\n It\u2019s\u00a0also possible that the Phineas persona was passed around between 2014 and 2019 and used by different individuals. But there is no evidence of that, and after 10 years of conversations, my gut says Phineas truly\u00a0is\u00a0the\u00a0hacktivist\u00a0they claim to be.\u00a0<\/p>\n When you purchase through links in our articles, we may earn a small commission<\/a>. This doesn\u2019t affect our editorial independence.<\/em><\/p>\nWho is Phineas\u00a0Fisher?<\/strong>\u00a0<\/h2>\n