Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · FIN10 · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

FIN10

  • G0051

MITRE G0051 ↗

FIN10 — ATT&CK roseFI

attack rose · 11 techniques across 6 tactics

Analyst brief

misp-galaxy + mitre-attack

FireEye has observed multiple targeted intrusions occurring in North America — predominately in Canada — dating back to at least 2013 and continuing through at least 2016, in which the attacker(s) have compromised organizations’ networks and sought to monetize this illicit access by exfiltrating sensitive data and extorting victim organizations. In some cases, when the extortion demand was not met, the attacker(s) destroyed production Windows systems by deleting critical operating system files and then shutting down the impacted systems. Based on near parallel TTPs used by the attacker(s) across these targeted intrusions, we believe these clusters of activity are linked to a single, previously unobserved actor or group that we have dubbed FIN10.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

11 techniques · 6 of 15 tactics

  1. Resource development

    1 technique

  2. Execution

    3 techniques

  3. Persistence

    1 technique

  4. Stealth

    3 techniques

  5. Discovery

    1 technique

  6. Lateral movement

    2 techniques

select a technique

Arsenal

1 tools
Tools
Tools · 1ATT&CK
EmpireS0363 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

4 sources
  1. 1.www2.fireeye.com/rs/848-DID-242/images/rpt-fin10.pdf
  2. 2.attack.mitre.org/groups/G0051
  3. 3.attack.mitre.org/groups/G0051
  4. 4.services.google.com/fh/files/misc/rpt-fin-10-anatomy-of-a-cyber-en.pdf

Track FIN10 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.