FIN5 is a financially motivated cybercrime group targeting restaurant, gaming, and hotel industries for payment card data.
FIN5 (also tracked as G0053) is a financially motivated cybercrime group active since at least 2008, likely composed of Russian-speaking actors. It primarily targets the restaurant, gaming, and hotel industries to steal personally identifiable information (PII) and payment card data. Key TTPs include Credential Access via Brute Force, persistence through External Remote Services, deploying point-of-sale malware like RawPOS and FLIPSIDE, and anti-forensic measures such as File Deletion (SDelete) and clearing Windows Event Logs. Defenders should focus on enforcing strong password policies, monitoring for suspicious PsExec usage, and detecting the sudden clearing of Windows Event Logs on critical assets.
FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.
Monitor network requests to third-party sources for obtaining tools and identify unusual patterns.
Monitor usage of Command and Scripting Interpreters and detect anomalous script execution.
Monitor access to External Remote Services and identify unauthorized access.
Monitor File Deletion and Valid Accounts activity, identify anomalous patterns, and take necessary actions.
Monitor authentication failures to detect Brute Force attacks.
Monitor network scans and system queries to detect Remote System Discovery.
Monitor Local Data Staging and Automated Collection activities, identify unauthorized access to sensitive data.
Detect and monitor suspicious network traffic via External Proxy.
Detect clearing of Windows Event Logs and take necessary actions to prevent it.
The FIN5 group primarily targets the restaurant, gaming, and hotel industries.
The group uses the SDelete tool for file deletion and clears the Windows Event Logs to cover tracks.
Every claim on this page is drawn from the cited source (MISP Galaxy, MITRE ATT&CK, ransomware.live) — no attribution is invented.