FIN13

Overview

FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.

Naming & attribution

FIN13 is tracked under 2 names across the industry. It uses 53 documented ATT&CK techniques — more than 84% of the 174 groups tracked here.

Distinctive techniques

Techniques this group uses that are rare across the other 173 tracked groups — these carry more signal than the near-universal ones.

• T1556 Modify Authentication Process — used by 1 of 174 groups
• T1565 Data Manipulation — used by 1 of 174 groups
• T1134.003 Make and Impersonate Token — used by 2 of 174 groups
• T1087 Account Discovery — used by 3 of 174 groups

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• menuPass China — 24 shared techniques (32% overlap)
• APT41 China — 32 shared techniques (31% overlap)
• APT39 Iran — 24 shared techniques (29% overlap)
• Ke3chang China — 22 shared techniques (29% overlap)
• Fox Kitten Iran — 21 shared techniques (29% overlap)
• Magic Hound Iran — 29 shared techniques (28% overlap)

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 53 techniques across 13 tactics

Tools & malware (4)

Impacket · Mimikatz · Empire · certutil

Reporting (2)

• FIN13: A Cybercriminal Threat Actor Focused on Mexico — Ta, V., et al
• TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION — Sygnia Incident Response Team