FIN5
FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.
- ATT&CK ID
- G0053
- Techniques
- 11
- Tools
- 6
Techniques
Resource Development
Initial Access
Valid AccountsExternal Remote Services
Execution
Command and Scripting Interpreter
Persistence
Valid AccountsExternal Remote Services
Privilege Escalation
Stealth
Indicator RemovalValid Accounts
Defense Impairment
Credential Access
Discovery
Collection
Data StagedAutomated Collection
Command and Control
Software
FLIPSIDE · PsExec · RawPOS · SDelete · Windows Credential Editor · pwdump