The hacker who insulted spyware creators and was never caught

Several mysterious hackers have captured the public imagination over the past few decades, but none has been as accomplished as Phineas Fisher. Ten years after his most famous hack, Phineas remains by most accounts the most active and public hacker who has never been caught.

As part of our series on the biggest cybersecurity mysteries in history, we’re delving into the mystery of controversial spyware maker FinFisher and Phineas, the hacktivist who hacked Hacking Team. The latter, an Italian startup, was one of the first companies to turn government spyware into a viable global business, paving the way for spyware manufacturers like Israel’s NSO Group. Phineas’ hacking of Hacking Team ultimately led to the startup’s demise a few years later.

Outside of Anonymous, an amorphous collection of hacktivists with a mixed record of mostly stunt hacks designed to gather publicity rather than have real impact, Phineas is probably the best-known hacktivist of all time. Their stories are filled with impressive hacks and endless unanswered questions.

Who is Phineas Fisher?

The hacker, who goes by many names including anarchist, cybercriminal, hacktivist and vigilante, said he “goes by many different names” for his various hacking activities.

The hack, as we know, was large enough to make Phineas a legend among hackers. “I’d like to meet Phineas Fisher and hear him explain why he bought us a three-Michelin-star seven-course dinner somewhere and turned our hacking team inside out like gym socks,” one prominent security researcher wrote on Twitter. There’s even a song about them.

Phineas first appeared in August 2014 when it announced that it had hacked FinFisher spyware maker Gamma Group. This is where the nickname comes from. They disclosed the hack through a Twitter account called Shameless. @GammaGroupPRIt leaks stolen data including mobile spyware, product manuals, price lists, etc. Damage was limited and FinFisher continued. Phineas published a post mortem that doubled as a leftist manifesto and then disappeared.

A year later they came back with a bang, hacking another spyware manufacturer, Hacking Team. They took almost everything over 400GB, including source code, tens of thousands of internal emails, confidentiality agreements, and customer lists. The leak allowed journalists to expose scandals in Ecuador, Mexico, and Panama. A few years later, David Vincenzetti, CEO of Hacking Team, had to sell his company for 1 euro. For some former employees, Phineas’ hack was the beginning of the end.

Phineas went on to hack the Mossos d’Esquadra federation, the Catalan police force, posting a post-mortem investigation and a 39-minute long tutorial video. This is consistent with the anti-police ideals they stated. Their next victim was Turkey’s authoritarian President Recep Tayyip Erdoğan’s ruling party, a hack motivated by solidarity with Rojava, the left-wing autonomous region in northern and eastern Syria that Turkey is fighting against.

Phineas’ last victim was a Cayman National Bank branch on the Isle of Man, a self-governing island between Britain and Ireland. The hack hinted at a different side to Phineas. “I look for illegal ways to make money so that I can free up my time to do useful things. Once I figured it out, I scaled it up, making more money than I needed and started donating the extra money,” Phineas said in an interview with activist Freddie Martinez. (Phineas donated at least $10,000 in Bitcoin to Rojava.)

After keeping a hack that occurred in 2016 quiet three years later, Phineas announced the “Hacktivist Bug Bounty Program,” a plan to reward hacktivists who expose the company’s illegal and unethical activities. Cayman National Bank confirmed the hack, claiming “multiple banks were targeted.” Phineas confirmed that they have been hacking several banks for years.

That was their last public appearance. Their Twitter and Reddit accounts have long since been deleted, leaving no trace online. FinFisher has never contacted law enforcement, according to former company employees. Italian authorities’ investigation into the Hacking Team hack ended without any evidence pointing to Phineas’ real identity. According to my own reports, Phineas is alive and well. They have been in contact with me for the past few years.

So who is Phineas Fisher? If you take their claims at face value, they are also hacktivists and cybercriminals with anarchistic ideals. Could they instead be manipulated figures controlled by spy agencies? Russia, for example, has a history of inventing hacktivists to muddy the waters after its own hacks. Phineas has denied being a Russian spy, and it is unclear why Moscow would pursue any target of Phineas’ choosing.

Their origins are equally murky. Phineas named Spanish-speaking anarchists, wrote in Spanish after the Hacking Team, and followed numerous Latin American left-wing accounts on Twitter. They acknowledged living in a Spanish-speaking country but said their native language was neither English nor Spanish. It’s worth taking with a grain of salt. “Anything you say that contains a clue about my identity is half trolling,” Phineas said. “I have a habit of giving incorrect information.”

The Phineas persona may have been passed around and used by other individuals between 2014 and 2019. But there is no evidence for that, and after 10 years of talking, my gut tells me that Phineas is the real hacktivist they claim.