FIN5
- ID
- G0053
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. [1] [2] [3]
Techniques used (11)
- T1018 Remote System Discovery
- T1059 Command and Scripting Interpreter
- T1070.004 File Deletion
- T1074.001 Local Data Staging
- T1078 Valid Accounts
- T1090.002 External Proxy
- T1110 Brute Force
- T1119 Automated Collection
- T1133 External Remote Services
- T1588.002 Tool
- T1685.005 Clear Windows Event Logs