Skip to content
skopnix
Section B · Adversaries · Dossier
← Adversaries

File · FIN5 · Unknown · misp-galaxy + mitre-attack · refreshed 2026-10-06

FIN5

  • G0053

MITRE G0053 ↗

FIN5 — ATT&CK roseFI

attack rose · 11 techniques across 9 tactics

Analyst brief

misp-galaxy + mitre-attack

FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.

Kill chain

MITRE ATT&CK Enterprise · tap a technique

11 techniques · 9 of 15 tactics

  1. Resource development

    1 technique

  2. Execution

    1 technique

  3. Persistence

    1 technique

  4. Stealth

    2 techniques

  5. Defense impairment

    1 technique

  6. Credential access

    1 technique

  7. Discovery

    1 technique

  8. Collection

    2 techniques

  9. Command and control

    1 technique

select a technique

Arsenal

2 malware · 4 tools
Malware
Malware · 2ATT&CK
FLIPSIDES0173 ↗
RawPOSS0169 ↗
Tools
Tools · 4ATT&CK
Windows Credential EditorS0005 ↗
PsExecS0029 ↗
pwdumpS0006 ↗
SDeleteS0195 ↗

as stated by MITRE ATT&CK · “shared by” counts roster dossiers citing the same S-id

Take it with you

keyless · no signup

References

5 sources
  1. 1.darkreading.com/analytics/prolific-cybercrime-gang-favors-legit-login-…
  2. 2.attack.mitre.org/groups/G0053
  3. 3.attack.mitre.org/groups/G0053
  4. 4.www2.fireeye.com/WBNR-Are-you-ready-to-respond.html
  5. 5.youtube.com/watch?v=fevGZs0EQu8

Track FIN5 on the wire.

This dossier is already data: the keyless actor API and a STIX 2.1 bundle. Mentions on the wire reach Telegram and RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.