FIN13
Also reported as Elephant Beetle and TG2003. Linked to Russia by two sources.
Reports per quarter
Techniques seen in the last two years
- T1003 1 report reports only
- T1003.001 1 report in ATT&CK
- T1007 1 report reports only
- T1012 1 report reports only
- T1016 1 report in ATT&CK
- T1018 1 report reports only
- T1021 1 report reports only
- T1021.001 1 report in ATT&CK
- T1021.002 1 report in ATT&CK
- T1027 1 report reports only
Show all 95 techniques Show fewer
- T1027.002 1 report reports only
- T1027.005 1 report reports only
- T1033 1 report reports only
- T1039 1 report reports only
- T1040 1 report reports only
- T1046 1 report in ATT&CK
- T1047 1 report in ATT&CK
- T1049 1 report in ATT&CK
- T1053 1 report reports only
- T1053.005 1 report in ATT&CK
- T1055 1 report reports only
- T1057 1 report reports only
- T1059 1 report reports only
- T1059.001 1 report in ATT&CK
- T1059.003 1 report in ATT&CK
- T1059.005 1 report in ATT&CK
- T1059.007 1 report reports only
- T1069 1 report in ATT&CK
- T1069.001 1 report reports only
- T1069.002 1 report reports only
- T1070 1 report reports only
- T1070.004 1 report reports only
- T1071 1 report reports only
- T1071.001 1 report in ATT&CK
- T1071.003 1 report reports only
- T1071.004 1 report reports only
- T1074 1 report reports only
- T1074.001 1 report in ATT&CK
- T1074.002 1 report reports only
- T1082 1 report in ATT&CK
- T1083 1 report in ATT&CK
- T1087 1 report in ATT&CK
- T1087.002 1 report in ATT&CK
- T1090 1 report reports only
- T1095 1 report reports only
- T1105 1 report in ATT&CK
- T1112 1 report reports only
- T1132 1 report reports only
- T1132.001 1 report reports only
- T1134 1 report reports only
- T1135 1 report in ATT&CK
- T1136 1 report reports only
- T1140 1 report in ATT&CK
- T1190 1 report in ATT&CK
- T1213 1 report reports only
- T1489 1 report reports only
- T1497 1 report reports only
- T1505 1 report reports only
- T1505.003 1 report in ATT&CK
- T1518 1 report reports only
- T1518.001 1 report reports only
- T1529 1 report reports only
- T1543 1 report reports only
- T1543.003 1 report reports only
- T1546 1 report reports only
- T1546.007 1 report reports only
- T1547 1 report reports only
- T1547.001 1 report in ATT&CK
- T1550 1 report reports only
- T1550.002 1 report in ATT&CK
- T1552 1 report reports only
- T1553 1 report reports only
- T1553.002 1 report reports only
- T1559 1 report reports only
- T1560 1 report reports only
- T1560.001 1 report in ATT&CK
- T1560.002 1 report reports only
- T1564 1 report reports only
- T1564.003 1 report reports only
- T1567 1 report reports only
- T1569 1 report reports only
- T1569.002 1 report reports only
- T1572 1 report in ATT&CK
- T1573 1 report reports only
- T1573.002 1 report reports only
- T1574 1 report reports only
- T1574.011 1 report reports only
- T1583 1 report reports only
- T1583.003 1 report reports only
- T1587 1 report reports only
- T1587.003 1 report reports only
- T1588 1 report reports only
- T1588.003 1 report reports only
- T1608 1 report reports only
- T1608.003 1 report reports only
Counts come from technique IDs in the actor's report text. “Reports only” means reports name the technique but MITRE ATT&CK® does not list it for this actor.
Also listed by ATT&CK
CVEs named in reports
- CVE-2001-0507
- CVE-2008-2463
- CVE-2010-5326 KEV
- CVE-2015-7450 KEV
- CVE-2017-0144 KEV ransomware
- CVE-2017-1000486 KEV
- CVE-2019-0604 KEV ransomware
- CVE-2019-18935 KEV ransomware
- CVE-2019-2729
- CVE-2021-31207 KEV ransomware
- CVE-2021-34473 KEV ransomware
- CVE-2021-34523 KEV ransomware
Show all 30 CVEs Show fewer
- CVE-2021-44228 KEV ransomware
- CVE-2022-1388 KEV ransomware
- CVE-2022-21587 KEV ransomware
- CVE-2022-21919 KEV
- CVE-2022-22954 KEV ransomware
- CVE-2022-22960 KEV
- CVE-2022-22972
- CVE-2022-30190 KEV ransomware
- CVE-2022-47986 KEV ransomware
- CVE-2023-0669 KEV ransomware
- CVE-2023-20198 KEV
- CVE-2023-2868 KEV
- CVE-2023-34362 KEV ransomware
- CVE-2023-3519 KEV ransomware
- CVE-2023-42793 KEV ransomware
- CVE-2023-46805 KEV ransomware
- CVE-2023-4966 KEV ransomware
- CVE-2024-21887 KEV ransomware
KEV marks a CVE in CISA's Known Exploited Vulnerabilities Catalog, and “ransomware” marks one that the catalog records as used in ransomware campaigns.
Reports
-
Elephant Beetle - Threat Group Cards: A Threat Actor Encyclopedia
The title opens a link whose publisher is not confirmed. Archived copy on ORKL Detailsfor Elephant Beetle - Threat Group Cards: A Threat Actor Encyclopedia
-
Archived copy on ORKL Detailsfor Sygnia-%20Elephant%20Beetle_Jan2022.pdf?__hstc=147695848.3e8f1a482c8f8d4531507747318e660b.1680005306711.1680005306711.1680005306711.1&__hssc=147695848.1.1680005306711&__hsfp=3000179024&hsCtaTracking=189ec409-ae2d-4909-8bf1-62dcdd694372%7Cca91d317-8f10-4a38-9f80-367f551ad64d
-
FIN13_ A Cybercriminal Threat Actor Focused on Mexico _ Mandiant
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor FIN13_ A Cybercriminal Threat Actor Focused on Mexico _ Mandiant
-
Elephant Beetle- Uncovering an Organized Financial-Theft Operation
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor Elephant Beetle- Uncovering an Organized Financial-Theft Operation
Show all 13 reports Show fewer
-
Sygnia- Elephant Beetle_Jan2022
The title opens CyberMonitor archive on GitHub, not the publisher’s page. Archived copy on ORKL Detailsfor Sygnia- Elephant Beetle_Jan2022
-
FIN13- A Cybercriminal Threat Actor Focused on Mexico
The title opens Mirror on VX-Underground, not the publisher’s page. Archived copy on ORKL Detailsfor FIN13- A Cybercriminal Threat Actor Focused on Mexico
Newest first. Details opens the report in Explore.