MITRE ATT&CKgroup

G0053 FIN5

Published 2018-01-16 Modified 2026-07-31 Official page ↗
Domain
enterprise
Version
1.2
Created
2018-01-16

Description

FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.

Related

Uses · MITRE ATT&CK (17)

  • T1685.005 Clear Windows Event Logs sub-technique
  • T1588.002 Tool sub-technique
  • T1090.002 External Proxy sub-technique
  • T1074.001 Local Data Staging sub-technique
  • T1070.004 File Deletion sub-technique
  • S0195 SDelete software (tool)
  • S0169 RawPOS software (malware)
  • S0173 FLIPSIDE software (malware)
  • S0005 Windows Credential Editor software (tool)
  • S0006 pwdump software (tool)
  • S0029 PsExec software (tool)
  • T1018 Remote System Discovery technique
  • T1059 Command and Scripting Interpreter technique
  • T1078 Valid Accounts technique
  • T1110 Brute Force technique
  • T1119 Automated Collection technique
  • T1133 External Remote Services technique

References