AdversaryGraph public intelligence page
This page is part of Threat Matrix, the public browser workspace for the main AdversaryGraph platform. Use it for ATT&CK pivots, actor and technique context, similarity leads, detection coverage review, and analyst-ready investigation paths.
Validation disclaimer: TTP overlap, actor similarity, generated summaries, and coverage findings are investigation leads, not attribution proof or operational validation without analyst review.
Main AdversaryGraph project Documentation Malware Analysis GitHub
FIN5
Aliases: FIN5
[FIN5](https://attack.mitre.org/groups/G0053) is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. (Citation: FireEye Respond Webinar July 2017) (Citation: Mandiant FIN5 GrrCON Oct 2016) (Citation: DarkReading FireEye FIN5 Oct 2015)
Open interactive actor investigation
ATT&CK techniques
Correlated CTI and IR reports
Continue the investigation
Attack tools, simulations and detection rules
Follow explicit source relationships into the reference modules. Linked procedures and detectors are not claims of live validation or actor attribution.
- Windows Credential Editor tool reference — Explicit actor uses software relationship in pinned ATT&CK
- pwdump tool reference — Explicit actor uses software relationship in pinned ATT&CK
- PsExec tool reference — Explicit actor uses software relationship in pinned ATT&CK
- SDelete tool reference — Explicit actor uses software relationship in pinned ATT&CK
- T1018 Remote System Discovery simulation — Exact active technique ID
- T1018 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1059 Command and Scripting Interpreter simulation — Exact active technique ID
- T1059 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1070.004 File Deletion simulation — Exact active technique ID
- T1070.004 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1074.001 Local Data Staging simulation — Exact active technique ID
- T1074.001 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1078 Valid Accounts simulation — Exact active technique ID
- T1078 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1090.002 External Proxy simulation — Exact active technique ID
- T1090.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1110 Brute Force simulation — Exact active technique ID
- T1110 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1119 Automated Collection simulation — Exact active technique ID
- T1119 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1133 External Remote Services simulation — Exact active technique ID
- T1133 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1588.002 Tool simulation — Exact active technique ID
- T1588.002 detection rules — Exact active technique ID; not actor-specific detector coverage
- T1685.005 Clear Windows Event Logs simulation — Exact active technique ID
- T1685.005 detection rules — Exact active technique ID; not actor-specific detector coverage
Cyber Knowledge routes
These contextual routes explain behaviors associated with this ATT&CK group record. They support learning and investigation planning; they do not add attribution evidence.
Blue Team & Defensive Security · explicit-idWeb, API, mobile, and application reconnaissance
OSINT & Reconnaissance · explicit-nameModule 4 — Collection Sources
Cyber Threat Intelligence (CTI) · explicit-nameModule 9 — AI-assisted offensive security and MCP
Red Team & Offensive Security · topic-matchEmbedded, firmware, hardware, and update-chain research
Vulnerability Research & Exploit Development · topic-matchModule 3 — Telemetry and logging architecture
Blue Team & Defensive Security · topic-matchModule 7 — Endpoint defense and EDR
Blue Team & Defensive Security · topic-matchRequirements, ownership, inventory, and data flow
Secure Code & Application Security · topic-matchScripts, documents, shortcuts, and fileless chains
Malware Analysis & Reverse Engineering · topic-matchAgents, tools, plugins, browsers, and MCP security
AI Security · topic-matchAI security foundations and threat landscape
AI Security · topic-matchTraining data, ingestion, retrieval, RAG, and knowledge integrity
AI Security · topic-match