- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Russia(high confidence)
- Motivation
- Financial crime; Financial gain
- Seen
- 2016–2026
- Status
- Active
- ATT&CK
- G1016 · 53 techniques
- Sources
- 9 sources carry it
- Identifier
- GINC-APT-0088 · fin13
RussiaWhat it is
FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- CrowdStrike
- Squab Spider
- Other names
- Elephant Beetle, TG2003
Attribution
Each attribution is a claim: who makes it, and to whom. Western and Eastern sources are kept apart, as they often disagree.
Western sources
- MISP Galaxy (CFR tagging)Russia
- ThreatActor.info (Malpedia et al.)Russia · high
Targets
- Countries
- Mexico
- Sectors
- Financial
Tools
The tools and malware families the sources tie to it.
- BLUEAGAVE
- BUSTEDPIPE
- Back Orifice
- Back Orifice 2000
- Backdoor.Oldrea
- CLOSEWATCH
- Cobalt Strike
- Cyber Eye RAT
- CyberGate
- DRAWSTRING
- Empire
- GetUserSPNS.vbs
- GoBot2
- HOTLANE
- Impacket
- JSPRAT
- JSPSPY
- LATCHKEY
- MAILSLOT
- Mimikatz
- MiniWebCmdShell
- NIGHTJAR
- PORTHOLE
- PowerSploit
- ProcDump
- SHELLSWEEP
- SIXPACK
- SPINOFF
- SWEARJAR
- Tiny SHell
- certutil
- jsp File browser
- nmap
- reGeorg
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de