FIN13 (G1016) | Threat Actor Index

53

Techniques

4

Toolsets

2

CVEs Referenced

1

KEV Entries

CISA Known Exploited

About FIN13

FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.

View MITRE record ↗

Techniques by Tactic (53)

Reconnaissance

T1589 Gather Victim Identity InformationT1590.004 Network Topology

Resource Development

T1587.001 MalwareT1588.002 Tool

Initial Access

T1078.001 Default AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing Application

Execution

T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1574.001 DLL

Persistence

T1053.005 Scheduled TaskT1078.001 Default AccountsT1098.007 Additional Local or Domain GroupsT1133 External Remote ServicesT1136.001 Local AccountT1505.003 Web ShellT1547.001 Registry Run Keys / Startup FolderT1556 Modify Authentication Process

Privilege Escalation

T1053.005 Scheduled TaskT1078.001 Default AccountsT1098.007 Additional Local or Domain GroupsT1134.003 Make and Impersonate TokenT1547.001 Registry Run Keys / Startup Folder

Stealth

T1036 MasqueradingT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1078.001 Default AccountsT1134.003 Make and Impersonate TokenT1140 Deobfuscate/Decode Files or InformationT1564.001 Hidden Files and DirectoriesT1574.001 DLL

Defence Impairment

T1556 Modify Authentication Process

Credential Access

T1003.001 LSASS MemoryT1003.002 Security Account ManagerT1003.003 NTDST1056.001 KeyloggingT1552.001 Credentials In FilesT1556 Modify Authentication Process

Discovery

T1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1069 Permission Groups DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087 Account DiscoveryT1087.002 Domain AccountT1135 Network Share Discovery

Lateral Movement

T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1021.004 SSHT1021.006 Windows Remote ManagementT1550.002 Pass the Hash

Collection

T1005 Data from Local SystemT1056.001 KeyloggingT1074.001 Local Data StagingT1560.001 Archive via Utility

Command & Control

T1071.001 Web ProtocolsT1090.001 Internal ProxyT1105 Ingress Tool TransferT1572 Protocol Tunneling

Impact

T1565 Data ManipulationT1657 Financial Theft

Toolsets (4)

🔧

Empire S0363

Tool · Linux, macOS, Windows

🔧

Impacket S0357

Tool · Linux, macOS, Windows

🔧

Mimikatz S0002

Tool · Windows

🔧

certutil S0160

Tool · Windows

CVEs Referenced (2 · 1 CISA KEV)

CVE-2014-7169View full details on NVDKEV

CVE-2016-6662View full details on NVD

References & Reports (2)

↑