Phineas Fisher: the hacker who humiliated spyware makers and was never caught

In a series of pieces on the biggest mysteries in the world of cybersecurity, TechCrunch revisits the story of Phineas Fisher — a figure who has been called an anarchist, a cybercriminal, a hacktivist and a self-appointed avenger by turns. The hacker himself admits to using many names for different operations, and that almost any hint about his identity is “half trolling.” By his own account, he is used to spreading disinformation.

The breaches that became legend

Phineas first made himself known in August 2014 by hacking Gamma Group — maker of the FinFisher spyware, from which the pseudonym is derived. Through the ironic @GammaGroupPR account, he posted the stolen data: mobile spyware, manuals and a price list, then published a breakdown of the attack that read more like a leftist manifesto, and vanished.

A year later came a far more devastating blow — against the Italian firm Hacking Team, one of the first companies to turn state spyware into a global business and to pave the way for players like Israel's NSO Group. Phineas carried off practically everything: more than 400 gigabytes of data, including source code, tens of thousands of internal emails, contracts and client lists. The leak allowed journalists to uncover scandals in Ecuador, Mexico and Panama, and Hacking Team's CEO was ultimately forced to sell the company for one euro. For some former employees, the breach marked the beginning of the end.

Next came the union of the Catalan police, the Mossos d'Esquadra (with a breakdown of the attack and a 39-minute instructional video), the ruling party of Recep Tayyip Erdoğan in Turkey — in solidarity with the leftist autonomous region of Rojava — and, finally, the Isle of Man branch of Cayman National Bank.

The other side

The last known breach exposed a different facet of Phineas. “I look for illegal ways to make money so I can free up my time and do something useful,” he told the activist Freddy Martinez, admitting that he earns more than he needs and gives away the surplus. He donated at least $10,000 in bitcoin to Rojava. In 2019, after three years of silence about the attack on the bank, Phineas announced the “Hacktivist Bug Bounty Program” — a rewards scheme for those who expose companies' illegal activities.

With that, the public appearances stopped. The Twitter and Reddit accounts were deleted long ago. FinFisher, according to a former employee, never went to the police, and the Italian authorities' investigation into the Hacking Team case ended without a single lead on the hacker's true identity.

So who is he

The article's author claims that Phineas is alive and well — they have corresponded over the past couple of years. The hacker's origins remain murky: he mentioned Spanish-speaking anarchists, wrote his Hacking Team breakdown in Spanish and followed Latin American leftist accounts, yet insisted that his native language was neither English nor Spanish. There is a theory that the name Phineas conceals a fictional persona created by an intelligence agency — a Russian one, say, known for inventing fictitious hacktivists — but he himself denies this, and it is unclear why Moscow would need every target he chose. After ten years of correspondence, the author is inclined to believe that Phineas is exactly who he says he is.

Source: TechCrunch