FIN13

Names and who uses them

• FIN13Our name
• Elephant BeetleMITRE ATT&CK

Targets

Sectors: Healthcare, Finance, Retail, Hospitality

Regions: Latin America

Known techniques

• T1003.001LSASS Memory
• T1003.002Security Account Manager
• T1003.003NTDS
• T1005Data from Local System
• T1016System Network Configuration Discovery
• T1016.001Internet Connection Discovery
• T1021.001Remote Desktop Protocol
• T1021.002SMB/Windows Admin Shares
• T1021.004SSH
• T1021.006Windows Remote Management
• T1036Masquerading
• T1036.004Masquerade Task or Service
• T1036.005Match Legitimate Resource Name or Location
• T1046Network Service Discovery
• T1047Windows Management Instrumentation
• T1049System Network Connections Discovery
• T1053.005Scheduled Task
• T1056.001Keylogging
• T1059.001PowerShell
• T1059.003Windows Command Shell
• T1059.005Visual Basic
• T1069Permission Groups Discovery
• T1071.001Web Protocols
• T1074.001Local Data Staging
• T1078.001Default Accounts
• T1082System Information Discovery
• T1083File and Directory Discovery
• T1087Account Discovery
• T1087.002Domain Account
• T1090.001Internal Proxy
• T1098.007Additional Local or Domain Groups
• T1105Ingress Tool Transfer
• T1133External Remote Services
• T1134.003Make and Impersonate Token
• T1135Network Share Discovery
• T1136.001Local Account
• T1140Deobfuscate/Decode Files or Information
• T1190Exploit Public-Facing Application
• T1505.003Web Shell
• T1547.001Registry Run Keys / Startup Folder

Malware and tools used