FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.12
- Mandiant FIN13 Aug 2022
- Sygnia Elephant Beetle Jan 2022
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| also_known_as | FIN13 | — → … | 100 | src_mitre_attck_enterprise |
| also_known_as | Elephant Beetle | — → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1587.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1565 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1134.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087 | 2023 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1016.001 | Internet Connection Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1021.004 | SSH | — |
| T1021.006 | Windows Remote Management | — |
| T1036 | Masquerading | — |
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.001 | Keylogging | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1069 | Permission Groups Discovery | — |
| T1071.001 | Web Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1078.001 | Default Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087 | Account Discovery | — |
| T1087.002 | Domain Account | — |
| T1090.001 | Internal Proxy | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1105 | Ingress Tool Transfer | — |
| T1133 | External Remote Services | — |
| T1134.003 | Make and Impersonate Token | — |
| T1135 | Network Share Discovery | — |
| T1136.001 | Local Account | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1505.003 | Web Shell | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1550.002 | Pass the Hash | — |
| T1552.001 | Credentials In Files | — |
| T1556 | Modify Authentication Process | — |
| T1560.001 | Archive via Utility | — |
| T1564.001 | Hidden Files and Directories | — |
| T1565 | Data Manipulation | — |
| T1572 | Protocol Tunneling | — |
| T1574.001 | DLL | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1589 | Gather Victim Identity Information | — |
| T1590.004 | Network Topology | — |
| T1657 | Financial Theft | — |
Aliases
Elephant Beetle · FIN13
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.