Home / Threat actors / FIN5
FIN5 G0053
Updated at source on Jul 31, 2026 · View on MITRE ATT&CK
0
associated CVEs
15
Techniques
6
Malware and tools
FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.
Exploited vulnerabilities
CVEs cited by MITRE ATT&CK for this group, with the source excerpt. Records not yet published here appear without a link.
ATT&CK does not cite CVEs for this group.
Techniques by tactic
Resource Development
T1588.002 Tool Initial Access
T1078 Valid AccountsT1133 External Remote Services Execution
T1059 Command and Scripting Interpreter Persistence
T1078 Valid AccountsT1133 External Remote Services Privilege Escalation
T1078 Valid Accounts Stealth
T1070.004 File DeletionT1078 Valid Accounts Defense Impairment
T1685.005 Clear Windows Event Logs Credential Access
T1110 Brute Force Discovery
T1018 Remote System Discovery Collection
T1074.001 Local Data StagingT1119 Automated Collection Command and Control
T1090.002 External Proxy © The MITRE Corporation. ATT&CK® content reproduced and distributed with the permission of The MITRE Corporation.