← All Threat Actors
Threat Actor Profile

FIN5

G0053
▲ High Threat
FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.
Origin

Known TTPs

External Proxy
File Deletion
Local Data Staging
Command and Scripting Interpreter
Remote System Discovery
Automated Collection
Brute Force
Clear Windows Event Logs
Tool
External Remote Services
Valid Accounts

External Resources

CISA Advisories ↗

Related Intelligence

Hacking the mainframe…

LINK COPIED TO CLIPBOARD