Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · FIN13 · Unknown · assessed origin Russia · misp-galaxy + mitre-attack · refreshed 2026-10-06

FIN13

  • TG2003
  • Elephant Beetle

MITRE G1016 ↗

FIN13 — ATT&CK roseFI

attack rose · 53 techniques across 13 tactics

What changed

ledger · newest first
  1. —todaynew CVE5 new CVEs: CVE-2001-0507, CVE-2010-5326, CVE-2015-7450, CVE-2017-1000486, CVE-2019-2729

Analyst brief

misp-galaxy + mitre-attack

Since 2017, Mandiant has been tracking FIN13, an industrious and versatile financially motivated threat actor conducting long-term intrusions in Mexico with an activity timeframe stretching back as early as 2016. Although their operations continue through the present day, in many ways FIN13's intrusions are like a time capsule of traditional financial cybercrime from days past. Instead of today's prevalent smash-and-grab ransomware groups, FIN13 takes their time to gather information to perform fraudulent money transfers. Rather than relying heavily on attack frameworks such as Cobalt Strike, the majority of FIN13 intrusions involve heavy use of custom passive backdoors and tools to lurk in environments for the long haul.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

53 techniques · 13 of 15 tactics

  1. Reconnaissance

    2 techniques

  2. Resource development

    2 techniques

  3. Initial access

    1 technique

  4. Execution

    5 techniques

  5. Persistence

    5 techniques

  6. Stealth

    8 techniques

  7. Defense impairment

    1 technique

  8. Credential access

    4 techniques

  9. Discovery

    10 techniques

  10. Lateral movement

    5 techniques

  11. Collection

    4 techniques

  12. Command and control

    4 techniques

  13. Impact

    2 techniques

select a technique

Arsenal

4 tools
Tools
Tools · 4ATT&CK
ImpacketS0357 ↗
MimikatzS0002 ↗
EmpireS0363 ↗
certutilS0160 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

CVEs cited sources tie to FIN13

none on KEV
  1. CVE-2015-74502026-10-17
    1. “• WebSphere Application Server SOAP Exploit (CVE-2015-7450)”

      attributed by a report · named nearby · source: netwitness.com ↗ · 2026-10-17

    2. “CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit)”

      cited as exploiting · named nearby · source: attack.mitre.org ↗ · 2026-10-17

  2. CVE-2010-53262026-10-17
    1. “• SAP NetWeaver Invoker Servlet Exploit (CVE-2010-5326)”

      attributed by a report · named nearby · source: netwitness.com ↗ · 2026-10-17

    2. “CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.”

      cited as exploiting · named nearby · source: attack.mitre.org ↗ · 2026-10-17

  3. CVE-2019-27292026-10-17
    1. “In one of our cases the exploit used was targeting Oracle WebLogic Server Deserialization RCE (CVE-2019-2729)”

      cited as exploiting · named nearby · source: netwitness.com ↗ · 2026-10-17

  4. CVE-2001-05072026-10-17
    1. “FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

    2. “For local privilege escalation, the group was observed using IISCrack.dll,15 which is a DLL side-loading technique for loading a malicious version of httpodbc.dll on old IIS servers (CVE-2001-0507)16.”

      cited as exploiting · named nearby · source: f.hubspotusercontent30.net ↗ · 2026-10-17

  5. CVE-2017-10004862026-10-17
    1. “FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection)”

      cited as exploiting · source: attack.mitre.org ↗ · 2026-10-17

Each line is what a source says, quoted, with the source linked under it. A citation is a source's claim, not our confirmation: read the source before you act on it.

Take it with you

keyless · no signup

References

7 sources
  1. 1.mandiant.com/resources/fin13-cybercriminal-mexico
  2. 2.blog.sygnia.co/elephant-beetle-an-organized-financial-theft-operation
  3. 3.f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf
  4. 4.netwitness.com/wp-content/uploads/FIN13-Elephant-Beetle-NetWitness.pdf
  5. 5.attack.mitre.org/groups/G1016
  6. 6.web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/…
  7. 7.mandiant.com/resources/blog/fin13-cybercriminal-mexico

Track FIN13 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.