FIN13
MITRE ATT&CK: G1016 View on attack.mitre.org
Aliases: Elephant Beetle, TG2003, FIN13
- First seen
- 2016-01-01 00:00:00
- Origin
- RU
- Primary motivation
- financial-gain
- Sophistication
- expert
- Resource level
- organization
- Actor type
- criminal
- Profile updated
- 2026-07-07 12:00:48
Targeted industries: financial-services retail-and-hospitality
Targeted regions: country_code:mx country_code:br
Context
FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.
Detection coverage
- 15 YARA rules
- 985 Sigma rules
Malware & tools used
- Malware (attack-pattern)
- Default Accounts (attack-pattern)
- Protocol Tunneling (attack-pattern)
- Windows Remote Management (attack-pattern)
- External Remote Services (attack-pattern)
- Domain Account (attack-pattern)
- Network Service Discovery (attack-pattern)
- Web Shell (attack-pattern)
- System Information Discovery (attack-pattern)
- System Network Configuration Discovery (attack-pattern)
- Internal Proxy (attack-pattern)
- Data Manipulation (attack-pattern)
- PowerShell (attack-pattern)
- Scheduled Task (attack-pattern)
- Local Account (attack-pattern)
- Security Account Manager (attack-pattern)
- NTDS (attack-pattern)
- Exploit Public-Facing Application (attack-pattern)
- Gather Victim Identity Information (attack-pattern)
- Masquerade Task or Service (attack-pattern)
- SMB/Windows Admin Shares (attack-pattern)
- LSASS Memory (attack-pattern)
- Hidden Files and Directories (attack-pattern)
- Credentials In Files (attack-pattern)
- Financial Theft (attack-pattern)
Reports & references
- Mandiant — Fin13 Cybercriminal Mexico (report)
- blog.sygnia.co — Elephant Beetle An Organized Financial Theft Operation (report)
- f.hubspotusercontent30.net — Sygnia %20Elephant%20Beetle Jan2022 (report)
- netwitness.com — Fin13 Elephant Beetle Netwitness (report)
- MITRE ATT&CK — G1016 (report)
- web.archive.org — Sygnia %20Elephant%20Beetle Jan2022 (report)
- Mandiant — Fin13 Cybercriminal Mexico (report)