FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. 1 2 3
- FireEye Respond Webinar July 2017
- Mandiant FIN5 GrrCON Oct 2016
- DarkReading FireEye FIN5 Oct 2015
Claims and citations
Every claim comes from a writer; provenance is the writer's assertion, not a review verdict from this directory. Validity reads by citation year.
| predicate | object | Valid | Conf. | Evidence |
|---|---|---|---|---|
| uses_technique | tech_t1090.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1070.004 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1018 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1119 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1110 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1685.005 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2018 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078 | 2018 → … | 100 | src_mitre_attck_enterprise |
Technique use
| ATT&CK | Technique | platforms |
|---|---|---|
| T1018 | Remote System Discovery | — |
| T1059 | Command and Scripting Interpreter | — |
| T1070.004 | File Deletion | — |
| T1074.001 | Local Data Staging | — |
| T1078 | Valid Accounts | — |
| T1090.002 | External Proxy | — |
| T1110 | Brute Force | — |
| T1119 | Automated Collection | — |
| T1133 | External Remote Services | — |
| T1588.002 | Tool | — |
| T1685.005 | Clear Windows Event Logs | — |
Aliases
FIN5
Reading and review
Records are auto-ingested and not human-reviewed. Confidence is the writer's 0–100 value; bands split at ≥80 / 50–79 / <50 into high / medium / low. The four trust axes (synthetic, lifecycle, band, source count) stay separate and never merge into one score.