- Category
- Criminal · Financially motivated: ransomware, fraud and theft.
- Origin
- Unknown
- Motivation
- Financial crime
- Seen
- 2008–2026
- Status
- Active
- ATT&CK
- G0053 · 11 techniques
- Sources
- 8 sources carry it
- Identifier
- GINC-APT-0123 · fin5
What it is
FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.
Names
The names each vendor, agency and source gives it. Naming differs by who tracks the actor, so one group carries many.
- MITRE ATT&CK
- G0053
Targets
- Sectors
- Gaming, Hospitality
Tools
The tools and malware families the sources tie to it.
- Cyber Eye RAT
- CyberGate
- DarkRat
- FLIPSIDE
- PsExec
- RawPOS
- SDelete
- Windows Credential Editor
- Windows Credentials Editor
- pwdump
Sources
- MITRE ATT&CK attack.mitre.org
- ETDA Threat Group Card apt.etda.or.th
- Malpedia malpedia.caad.fkie.fraunhofer.de