Início / Grupos de ameaça / FIN13
FIN13 G1016
Também conhecido como: Elephant Beetle
Atualizado na fonte em 31/07/2026 · Ver no MITRE ATT&CK
4
CVEs associadas
66
Técnicas
4
Malwares e ferramentas
FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.
Vulnerabilidades exploradas
CVEs citadas pelo MITRE ATT&CK para este grupo, com o trecho da fonte. Fichas ainda não publicadas aqui aparecem sem link.
“FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.”
CVE-2015-7450
Crítica · 9.8
KEV IBM WebSphere Application Server and Server Hypervisor Edition Code Injection.
“FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.”
“FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection), CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit), CVE-2010-5326 (SAP NewWeaver Invoker Servlet Exploit), and EDB-ID-24963 (SAP NetWeaver ConfigServlet Remote Code Execution) to gain initial access.”
CVE-2001-0507 ainda não publicada aqui
“FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).”
Técnicas por tática
Reconhecimento
T1589 Gather Victim Identity InformationT1590.004 Network Topology Desenvolvimento de recursos
T1587.001 MalwareT1588.002 Tool Acesso inicial
T1078.001 Default AccountsT1133 External Remote ServicesT1190 Exploit Public-Facing Application Execução
T1047 Windows Management InstrumentationT1053.005 Scheduled TaskT1059.001 PowerShellT1059.003 Windows Command ShellT1059.005 Visual BasicT1574.001 DLL Persistência
T1053.005 Scheduled TaskT1078.001 Default AccountsT1098.007 Additional Local or Domain GroupsT1133 External Remote ServicesT1136.001 Local AccountT1505.003 Web ShellT1547.001 Registry Run Keys / Startup FolderT1556 Modify Authentication Process Escalada de privilégios
T1053.005 Scheduled TaskT1078.001 Default AccountsT1098.007 Additional Local or Domain GroupsT1134.003 Make and Impersonate TokenT1547.001 Registry Run Keys / Startup Folder Furtividade
T1036 MasqueradingT1036.004 Masquerade Task or ServiceT1036.005 Match Legitimate Resource Name or LocationT1078.001 Default AccountsT1134.003 Make and Impersonate TokenT1140 Deobfuscate/Decode Files or InformationT1564.001 Hidden Files and DirectoriesT1574.001 DLL Comprometimento de defesas
T1556 Modify Authentication Process Acesso a credenciais
T1003.001 LSASS MemoryT1003.002 Security Account ManagerT1003.003 NTDST1056.001 KeyloggingT1552.001 Credentials In FilesT1556 Modify Authentication Process Descoberta
T1016 System Network Configuration DiscoveryT1016.001 Internet Connection DiscoveryT1046 Network Service DiscoveryT1049 System Network Connections DiscoveryT1069 Permission Groups DiscoveryT1082 System Information DiscoveryT1083 File and Directory DiscoveryT1087 Account DiscoveryT1087.002 Domain AccountT1135 Network Share Discovery Movimento lateral
T1021.001 Remote Desktop ProtocolT1021.002 SMB/Windows Admin SharesT1021.004 SSHT1021.006 Windows Remote ManagementT1550.002 Pass the Hash Coleta
T1005 Data from Local SystemT1056.001 KeyloggingT1074.001 Local Data StagingT1560.001 Archive via Utility Comando e controle
T1071.001 Web ProtocolsT1090.001 Internal ProxyT1105 Ingress Tool TransferT1572 Protocol Tunneling Impacto
T1565 Data ManipulationT1657 Financial Theft © The MITRE Corporation. Conteúdo do ATT&CK® reproduzido e distribuído com permissão da MITRE Corporation. Descrições em inglês, como na fonte.