G1016 · 53 ATT&CK techniques · 0 correlated reports

FIN13

Aliases: Elephant Beetle

FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.

Open interactive actor investigation

ATT&CK techniques

T1587.001
Malware T1078.001
Default Accounts T1572
Protocol Tunneling T1021.006
Windows Remote Management T1133
External Remote Services T1087.002
Domain Account T1046
Network Service Discovery T1505.003
Web Shell T1082
System Information Discovery T1016
System Network Configuration Discovery T1090.001
Internal Proxy T1565
Data Manipulation T1059.001
PowerShell T1053.005
Scheduled Task T1136.001
Local Account T1003.002
Security Account Manager T1003.003
NTDS T1190
Exploit Public-Facing Application T1589
Gather Victim Identity Information T1036.004
Masquerade Task or Service T1021.002
SMB/Windows Admin Shares T1003.001
LSASS Memory T1564.001
Hidden Files and Directories T1552.001
Credentials In Files T1657
Financial Theft T1588.002
Tool T1134.003
Make and Impersonate Token T1105
Ingress Tool Transfer T1071.001
Web Protocols T1550.002
Pass the Hash T1059.003
Windows Command Shell T1547.001
Registry Run Keys / Startup Folder T1016.001
Internet Connection Discovery T1036
Masquerading T1059.005
Visual Basic T1098.007
Additional Local or Domain Groups T1574.002
DLL Side-Loading T1021.001
Remote Desktop Protocol T1590.004
Network Topology T1135
Network Share Discovery T1560.001
Archive via Utility T1140
Deobfuscate/Decode Files or Information T1556
Modify Authentication Process T1047
Windows Management Instrumentation T1021.004
SSH T1074.001
Local Data Staging T1056.001
Keylogging T1036.005
Match Legitimate Name or Location T1049
System Network Connections Discovery T1083
File and Directory Discovery T1005
Data from Local System T1069
Permission Groups Discovery T1087
Account Discovery

Correlated CTI and IR reports

Continue the investigation

Interactive ThreatMapper ThreatMapper documentation CTI Analyst Field Manual Israel Threat Actors CTI Anomaly Detection Atlas ITDR Handbook 1200km Medium research