FIN13

Overview

FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.

Capabilities

• Exploitation of public-facing / client applications — ATT&CK T1190

TTPs — 53 techniques across 13 tactics

Tools & malware (4)

Impacket · Mimikatz · Empire · certutil

Reporting (2)

• FIN13: A Cybercriminal Threat Actor Focused on Mexico — Ta, V., et al
• TG2003: ELEPHANT BEETLE UNCOVERING AN ORGANIZED FINANCIAL-THEFT OPERATION — Sygnia Incident Response Team