Home / Threat actors / FIN13
FIN13 G1016
Also known as: Elephant Beetle
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
4
associated CVEs
66
Techniques
4
Malware and tools
FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
“FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.”
CVE-2015-7450
Critical · 9.8
KEV IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
“FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.”
“FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.”
CVE-2001-0507 not published here yet
“FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).”
Techniques by tactic
Reconnaissance
T1589 Gather Victim Identity InformationT1590.004 Network Topology Resource Development
T1587.001 MalwareT1588.002 Tool Initial Access
T1078.001 Default AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing Application Execution
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1574.001 DLL Persistence
T1053.005 Scheduled TaskT1078.001 Default AccountsT1098.007 Additional Local or Domain GroupsT1133 External Remote ServicesT1136.001 Local AccountT1505.003 Web ShellT1547.001 Registry Run Keys / Startup FolderT1556 Modify Authentication Process Privilege Escalation
T1053.005 Scheduled TaskT1078.001 Default AccountsT1098.007 Additional Local or Domain GroupsT1134.003 Make and Impersonate TokenT1547.001 Registry Run Keys / Startup Folder Stealth
T1036 MasqueradingT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1078.001 Default AccountsT1134.003 Make and Impersonate TokenT1140 Deobfuscate/Decode Files or InformationT1564.001 Hidden Files and DirectoriesT1574.001 DLL Defense Impairment
T1556 Modify Authentication Process Credential Access
T1003.001 LSASS MemoryT1003.002 Security Account ManagerT1003.003 NTDST1056.001 KeyloggingT1552.001 Credentials In FilesT1556 Modify Authentication Process Discovery
T1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1069 Permission Groups DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087 Account DiscoveryT1087.002 Domain AccountT1135 Network Share Discovery Lateral Movement
T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1021.004 SSHT1021.006 Windows Remote ManagementT1550.002 Pass the Hash Collection
T1005 Data from Local SystemT1056.001 KeyloggingT1074.001 Local Data StagingT1560.001 Archive via Utility Command and Control
T1071.001 Web ProtocolsT1090.001 Internal ProxyT1105 Ingress Tool TransferT1572 Protocol Tunneling Impact
T1565 Data ManipulationT1657 Financial Theft © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.