Trusted Design

FIN13

アクターID: G1016

· MITRE Pageへのリンク

脅威アクターの詳細

FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.(Citation: Mandiant FIN13 Aug 2022)(Citation: Sygnia Elephant Beetle Jan 2022)

脅威アクターの別名・別称

FIN13
Elephant Beetle

利用した攻撃手法

• T1053.005 - Scheduled Task
• T1560.001 - Archive via Utility
• T1047 - Windows Management Instrumentation
• T1596.003 - Digital Certificates
• T1123 - Audio Capture
• T1099 - Timestomp
• T1560.003 - Archive via Custom Method
• T1584.008 - Network Devices
• T1116 - Code Signing
• T1218.013 - Mavinject
• T1606.002 - SAML Tokens
• T1587.001 - Malware
• T1165 - Startup Items
• T1089 - Disabling Security Tools
• T1007 - System Service Discovery
• T1553.002 - Code Signing
• T1120 - Peripheral Device Discovery
• T1584.003 - Virtual Private Server
• T1059.010 - AutoHotKey & AutoIT
• T1536 - Revert Cloud Instance
• T1140 - Deobfuscate/Decode Files or Information
• T1558 - Steal or Forge Kerberos Tickets
• T1032 - Standard Cryptographic Protocol
• T1062 - Hypervisor
• T1547.005 - Security Support Provider
• T1555.003 - Credentials from Web Browsers
• T1155 - AppleScript
• T1564.013 - Bind Mounts
• T1583.004 - Server
• T1546.005 - Trap
• T1590.006 - Network Security Appliances
• T1144 - Gatekeeper Bypass
• T1219.001 - IDE Tunneling
• T1588.001 - Malware
• T1055.004 - Asynchronous Procedure Call
• T1051 - Shared Webroot
• T1552.003 - Shell History
• T1134.001 - Token Impersonation/Theft
• T1497.002 - User Activity Based Checks
• T1679 - Selective Exclusion
• T1199 - Trusted Relationship
• T1053.006 - Systemd Timers
• T1591.004 - Identify Roles
• T1556.005 - Reversible Encryption
• T1027.010 - Command Obfuscation
• T1209 - Time Providers
• T1668 - Exclusive Control
• T1547.013 - XDG Autostart Entries
• T1622 - Debugger Evasion
• T1105 - Ingress Tool Transfer
• T1548.006 - TCC Manipulation
• T1686.001 - Cloud Firewall
• T1569.002 - Service Execution

関連するCVE (攻撃手法に関連)

• CVE-2015-4495 (T1051)
• CVE-2015-5749 (T1051)
• CVE-2016-1898 (T1051)
• CVE-2016-1897 (T1051)
• CVE-2015-7261 (T1051)
• CVE-2015-6036 (T1051)
• CVE-2015-7262 (T1051)
• CVE-2015-0932 (T1051)
• CVE-2010-3081 (T1209)
• CVE-2017-16929 (T1051)
• CVE-2025-31125 (T1051)
• CVE-2025-68645 (T1209)
• CVE-2014-4114 (T1027.010)
• CVE-2017-0143 (T1027.010)
• CVE-2025-55182 (T1055.004)
• CVE-2023-1389 (T1668)
• CVE-2025-13928 (T1055.004)
• CVE-2025-24893 (T1668)
• CVE-2025-34026 (T1055.004)
• CVE-2025-55184 (T1055.004)
• CVE-2015-5119 (T1219.001)
• CVE-2015-5122 (T1219.001)
• CVE-2015-1427 (T1555.003)
• CVE-2015-1770 (T1622)
• CVE-2012-1856 (T1548.006)
• CVE-2015-2545 (T1051)
• CVE-2015-2546 (T1219.001)
• CVE-2014-6332 (T1027.010)
• CVE-2015-3785 (T1219.001)
• CVE-2015-5897 (T1219.001)
• CVE-2015-7645 (T1051)
• CVE-2017-0199 (T1622)
• CVE-2017-12149 (T1584.008)
• CVE-2015-3043 (T1219.001)
• CVE-2015-3090 (T1219.001)
• CVE-2015-3113 (T1219.001)
• CVE-2015-2590 (T1219.001)
• CVE-2015-2424 (T1219.001)
• CVE-2015-0097 (T1027.010)
• CVE-2012-0158 (T1548.006)
• CVE-2014-1761 (T1140)
• CVE-2015-2502 (T1219.001)
• CVE-2014-6271 (T1209)
• CVE-2013-2094 (T1140)
• CVE-2014-4113 (T1219.001)
• CVE-2015-8562 (T1584.008)
• CVE-2015-7808 (T1584.008)
• CVE-2012-1889 (T1584.008)
• CVE-2016-1990 (T1219.001)
• CVE-2016-1991 (T1051)
• CVE-2016-1010 (T1219.001)
• CVE-2016-0984 (T1219.001)
• CVE-2016-1001 (T1219.001)
• CVE-2016-0998 (T1219.001)
• CVE-2015-1641 (T1219.001)
• CVE-2015-1701 (T1219.001)
• CVE-2015-0313 (T1219.001)
• CVE-2015-0359 (T1219.001)
• CVE-2014-0329 (T1668)
• CVE-2015-5130 (T1219.001)
• CVE-2015-5134 (T1219.001)
• CVE-2015-5539 (T1219.001)
• CVE-2015-5557 (T1219.001)
• CVE-2015-5563 (T1219.001)
• CVE-2015-5559 (T1219.001)
• CVE-2015-5540 (T1219.001)
• CVE-2015-5561 (T1219.001)
• CVE-2015-5551 (T1219.001)
• CVE-2015-5564 (T1219.001)
• CVE-2015-5565 (T1219.001)
• CVE-2015-5550 (T1219.001)
• CVE-2015-5566 (T1219.001)
• CVE-2015-5127 (T1219.001)
• CVE-2015-5556 (T1219.001)
• CVE-2015-3628 (T1219.001)
• CVE-2015-2852 (T1219.001)
• CVE-2015-2854 (T1219.001)
• CVE-2015-2853 (T1219.001)
• CVE-2015-7755 (T1686.001)
• CVE-2012-4969 (T1591.004)
• CVE-2016-1287 (T1055.004)
• CVE-2015-6585 (T1051)
• CVE-2015-6022 (T1051)
• CVE-2015-8286 (T1140)
• CVE-2015-8287 (T1590.006)
• CVE-2016-1562 (T1606.002)
• CVE-2016-2342 (T1209)
• CVE-2016-2343 (T1584.008)
• CVE-2017-0263 (T1219.001)
• CVE-2016-6532 (T1686.001)
• CVE-2016-9494 (T1140)
• CVE-2016-9496 (T1668)
• CVE-2016-9495 (T1584.008)
• CVE-2017-3212 (T1584.008)
• CVE-2025-61882 (T1584.008)
• CVE-2015-0311 (T1219.001)
• CVE-2012-3213 (T1219.001)
• CVE-2012-4792 (T1547.013)
• CVE-2012-1258 (T1668)
• CVE-2015-0336 (T1219.001)
• CVE-2014-3153 (T1219.001)
• CVE-2014-4322 (T1219.001)
• CVE-2015-3105 (T1219.001)
• CVE-2014-0497 (T1219.001)
• CVE-2014-8361 (T1556.005)
• CVE-2017-17215 (T1219.001)
• CVE-2013-0074 (T1219.001)
• CVE-2012-0507 (T1219.001)
• CVE-2013-2551 (T1219.001)
• CVE-2014-0569 (T1219.001)
• CVE-2014-0515 (T1219.001)
• CVE-2015-0310 (T1053.006)
• CVE-2012-4681 (T1588.001)
• CVE-2014-1776 (T1219.001)
• CVE-2012-1876 (T1219.001)
• CVE-2015-0071 (T1219.001)
• CVE-2015-1761 (T1219.001)
• CVE-2014-8440 (T1219.001)
• CVE-2013-3660 (T1055.004)
• CVE-2010-0806 (T1547.013)
• CVE-2014-4148 (T1219.001)
• CVE-2011-3402 (T1219.001)
• CVE-2010-2883 (T1209)
• CVE-2014-7247 (T1051)
• CVE-2013-2678 (T1051)
• CVE-2010-0738 (T1584.008)
• CVE-2015-2426 (T1219.001)
• CVE-2008-1436 (T1686.001)
• CVE-2010-0232 (T1219.001)
• CVE-2010-4398 (T1668)
• CVE-2014-3393 (T1055.004)
• CVE-2012-6422 (T1055.004)
• CVE-2013-2595 (T1555.003)
• CVE-2014-3897 (T1219.001)
• CVE-2015-2387 (T1219.001)
• CVE-2011-1255 (T1548.006)
• CVE-2011-0611 (T1591.004)
• CVE-2013-5990 (T1219.001)
• CVE-2016-0189 (T1027.010)
• CVE-2017-7255 (T1584.008)
• CVE-2026-0723 (T1219.001)
• CVE-2026-20127 (T1686.001)
• CVE-2013-2465 (T1219.001)
• CVE-2013-7331 (T1569.002)
• CVE-2016-4117 (T1219.001)
• CVE-2013-3906 (T1140)
• CVE-2014-6352 (T1027.010)
• CVE-2016-1019 (T1219.001)
• CVE-2017-0261 (T1027.010)
• CVE-2017-0262 (T1027.010)
• CVE-2012-0056 (T1055.004)
• CVE-2010-3333 (T1209)
• CVE-2015-3636 (T1055.004)
• CVE-2013-6282 (T1219.001)
• CVE-2014-8439 (T1209)
• CVE-2014-0556 (T1219.001)
• CVE-2015-5560 (T1219.001)
• CVE-2012-2539 (T1055.004)
• CVE-2014-9163 (T1209)
• CVE-2012-1723 (T1219.001)
• CVE-2010-1297 (T1591.004)
• CVE-2010-2884 (T1591.004)
• CVE-2013-0634 (T1140)
• CVE-2015-4902 (T1219.001)
• CVE-2025-55183 (T1219.001)
• CVE-2015-0016 (T1051)
• CVE-2015-2360 (T1219.001)
• CVE-2025-54313 (T1051)
• CVE-2015-3456 (T1590.006)
• CVE-2012-0611 (T1055.004)
• CVE-2014-0322 (T1027.010)
• CVE-2011-3544 (T1219.001)
• CVE-2010-0188 (T1591.004)
• CVE-2015-0057 (T1219.001)
• CVE-2014-6324 (T1219.001)
• CVE-2014-2273 (T1219.001)
• CVE-2009-3129 (T1209)
• CVE-2010-2572 (T1219.001)
• CVE-2017-8570 (T1027.010)
• CVE-2015-2419 (T1219.001)
• CVE-2017-0001 (T1219.001)
• CVE-2025-66478 (T1219.001)
• CVE-2015-5477 (T1668)
• CVE-2015-6034 (T1051)
• CVE-2013-0641 (T1591.004)
• CVE-2013-0640 (T1591.004)
• CVE-2010-1553 (T1209)
• CVE-2014-7911 (T1668)

Actor – Pulse グラフ

---

← 脅威アクター一覧に戻る