FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.12
- Mandiant FIN13 Aug 2022
- Sygnia Elephant Beetle Jan 2022
断言与引用
每条断言来自写入方；provenance 是写入方声称，不是本目录的复核结论。有效期按引用年份读取。
| predicate | object | 有效期 | 置信 | 证据 |
|---|---|---|---|---|
| uses_technique | tech_t1587.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1078.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1572 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.006 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1133 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1046 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1505.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1082 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1090.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1565 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1053.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1136.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1190 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1589 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1003.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1564.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1552.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1657 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1588.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1134.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1105 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1071.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1550.002 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.003 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1547.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1016.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1059.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1098.007 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1574.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1590.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1135 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1560.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1140 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1556 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1047 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1021.004 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1074.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1056.001 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1036.005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1049 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1083 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1005 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1069 | 2023 → … | 100 | src_mitre_attck_enterprise |
| uses_technique | tech_t1087 | 2023 → … | 100 | src_mitre_attck_enterprise |
技术使用
| ATT&CK | 技术 | platforms |
|---|---|---|
| T1003.001 | LSASS Memory | — |
| T1003.002 | Security Account Manager | — |
| T1003.003 | NTDS | — |
| T1005 | Data from Local System | — |
| T1016 | System Network Configuration Discovery | — |
| T1016.001 | Internet Connection Discovery | — |
| T1021.001 | Remote Desktop Protocol | — |
| T1021.002 | SMB/Windows Admin Shares | — |
| T1021.004 | SSH | — |
| T1021.006 | Windows Remote Management | — |
| T1036 | Masquerading | — |
| T1036.004 | Masquerade Task or Service | — |
| T1036.005 | Match Legitimate Resource Name or Location | — |
| T1046 | Network Service Discovery | — |
| T1047 | Windows Management Instrumentation | — |
| T1049 | System Network Connections Discovery | — |
| T1053.005 | Scheduled Task | — |
| T1056.001 | Keylogging | — |
| T1059.001 | PowerShell | — |
| T1059.003 | Windows Command Shell | — |
| T1059.005 | Visual Basic | — |
| T1069 | Permission Groups Discovery | — |
| T1071.001 | Web Protocols | — |
| T1074.001 | Local Data Staging | — |
| T1078.001 | Default Accounts | — |
| T1082 | System Information Discovery | — |
| T1083 | File and Directory Discovery | — |
| T1087 | Account Discovery | — |
| T1087.002 | Domain Account | — |
| T1090.001 | Internal Proxy | — |
| T1098.007 | Additional Local or Domain Groups | — |
| T1105 | Ingress Tool Transfer | — |
| T1133 | External Remote Services | — |
| T1134.003 | Make and Impersonate Token | — |
| T1135 | Network Share Discovery | — |
| T1136.001 | Local Account | — |
| T1140 | Deobfuscate/Decode Files or Information | — |
| T1190 | Exploit Public-Facing Application | — |
| T1505.003 | Web Shell | — |
| T1547.001 | Registry Run Keys / Startup Folder | — |
| T1550.002 | Pass the Hash | — |
| T1552.001 | Credentials In Files | — |
| T1556 | Modify Authentication Process | — |
| T1560.001 | Archive via Utility | — |
| T1564.001 | Hidden Files and Directories | — |
| T1565 | Data Manipulation | — |
| T1572 | Protocol Tunneling | — |
| T1574.001 | DLL | — |
| T1587.001 | Malware | — |
| T1588.002 | Tool | — |
| T1589 | Gather Victim Identity Information | — |
| T1590.004 | Network Topology | — |
| T1657 | Financial Theft | — |
别名
Elephant Beetle · FIN13
读取与复核
记录自动入库·未人工复核。置信度是写入方给出的 0–100 值，置信带按 ≥80 / 50–79 / <50 划为高 / 中 / 低；四条信任轴（合成、生命周期、置信带、佐证源数）分开呈现，不合并为单一信任分。