FIN13

Also known as TG2003, Elephant Beetle

0mentions, 7 days

0mentions, 30 days

nonelast mentioned

Since 2017, Mandiant has been tracking FIN13, an industrious and versatile financially motivated threat actor conducting long-term intrusions in Mexico with an activity timeframe stretching back as early as 2016. Although their operations continue through the present day, in many ways FIN13's intrusions are like a time capsule of traditional financial cybercrime from days past. Instead of today's prevalent smash-and-grab ransomware groups, FIN13 takes their time to gather information to perform fraudulent money transfers. Rather than relying heavily on attack frameworks such as Cobalt Strike, the majority of FIN13 intrusions involve heavy use of custom passive backdoors and tools to lurk in environments for the long haul.

CVEs in recent coverage

No CVEs named alongside this actor in the last 90 days.

Recent victims

No leak-site posts on record for this group.

ATT&CK techniques

T1003.001 LSASS Memory T1003.002 Security Account Manager T1003.003 NTDS T1005 Data from Local System T1016 System Network Configuration Discovery T1016.001 Internet Connection Discovery T1021.001 Remote Desktop Protocol T1021.002 SMB/Windows Admin Shares T1021.004 SSH T1021.006 Windows Remote Management T1036 Masquerading T1036.004 Masquerade Task or Service T1036.005 Match Legitimate Resource Name or Location T1046 Network Service Discovery T1047 Windows Management Instrumentation T1049 System Network Connections Discovery T1053.005 Scheduled Task T1056.001 Keylogging T1059.001 PowerShell T1059.003 Windows Command Shell T1059.005 Visual Basic T1069 Permission Groups Discovery T1071.001 Web Protocols T1074.001 Local Data Staging T1078.001 Default Accounts T1082 System Information Discovery T1083 File and Directory Discovery T1087 Account Discovery T1087.002 Domain Account T1090.001 Internal Proxy T1098.007 Additional Local or Domain Groups T1105 Ingress Tool Transfer T1133 External Remote Services T1134.003 Make and Impersonate Token T1135 Network Share Discovery T1136.001 Local Account T1140 Deobfuscate/Decode Files or Information T1190 Exploit Public-Facing Application T1505.003 Web Shell T1547.001 Registry Run Keys / Startup Folder T1550.002 Pass the Hash T1552.001 Credentials In Files T1556 Modify Authentication Process T1560.001 Archive via Utility T1564.001 Hidden Files and Directories T1565 Data Manipulation T1572 Protocol Tunneling T1574.001 DLL T1587.001 Malware T1588.002 Tool T1589 Gather Victim Identity Information T1590.004 Network Topology T1657 Financial Theft

Recent activity

No posts or advisories have named this actor recently.

References

From the MISP threat-actor galaxy, MITRE ATT&CK and RansomLook (CC BY 4.0). Activity is any post or advisory Watch Floor collected that names the actor or one of its aliases.