FIN13
- ID
- G1016
- Associated names
- Elephant Beetle
- Source
- attack.mitre.org
- MITRE last modified
- 1 Aug 2026
FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.[1][2]
Techniques used (53)
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1005 Data from Local System
- T1016 System Network Configuration Discovery
- T1016.001 Internet Connection Discovery
- T1021.001 Remote Desktop Protocol
- T1021.002 SMB/Windows Admin Shares
- T1021.004 SSH
- T1021.006 Windows Remote Management
- T1036 Masquerading
- T1036.004 Masquerade Task or Service
- T1036.005 Match Legitimate Resource Name or Location
- T1046 Network Service Discovery
- T1047 Windows Management Instrumentation
- T1049 System Network Connections Discovery
- T1053.005 Scheduled Task
- T1056.001 Keylogging
- T1059.001 PowerShell
- T1059.003 Windows Command Shell
- T1059.005 Visual Basic
- T1069 Permission Groups Discovery
- T1071.001 Web Protocols
- T1074.001 Local Data Staging
- T1078.001 Default Accounts
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1087 Account Discovery
- T1087.002 Domain Account
- T1090.001 Internal Proxy
- T1098.007 Additional Local or Domain Groups
- T1105 Ingress Tool Transfer
- T1133 External Remote Services
- T1134.003 Make and Impersonate Token
- T1135 Network Share Discovery
- T1136.001 Local Account
- T1140 Deobfuscate/Decode Files or Information
- T1190 Exploit Public-Facing Application
- T1505.003 Web Shell
- T1547.001 Registry Run Keys / Startup Folder
- T1550.002 Pass the Hash
- T1552.001 Credentials In Files
- T1556 Modify Authentication Process
- T1560.001 Archive via Utility
- T1564.001 Hidden Files and Directories
- T1565 Data Manipulation
- T1572 Protocol Tunneling
- T1574.001 DLL
- T1587.001 Malware
- T1588.002 Tool
- T1589 Gather Victim Identity Information
- T1590.004 Network Topology
- T1657 Financial Theft