FIN5

Overview

FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.

Naming & attribution

FIN5 is tracked under 1 names across the industry. It uses 11 documented ATT&CK techniques — more than 32% of the 174 groups tracked here. Activity attributed since at least 2008.

Closest groups by technique overlap

Computed from shared ATT&CK techniques. Overlap is not attribution — distinct actors converge on the same tradecraft — but a high share is a useful pivot.

• Play — 6 shared techniques (19% overlap)
• GALLIUM China — 6 shared techniques (17% overlap)
• Dragonfly Russia — 9 shared techniques (16% overlap)
• FIN10 — 3 shared techniques (16% overlap)
• Silence — 5 shared techniques (15% overlap)
• APT18 China — 3 shared techniques (15% overlap)

TTPs — 11 techniques across 9 tactics

Tools & malware (6)

Windows Credential Editor · PsExec · FLIPSIDE · pwdump · SDelete · RawPOS

Reporting (3)

• Are you Ready to Respond? (Webinar) — Scavella, T. and Rifki, A
• Attacking the Hospitality and Gaming Industries: Tracking an Attacker Around the World in 7 Years — Bromiley, M. and Lewis, P
• Prolific Cybercrime Gang Favors Legit Login Credentials — Higgins, K