FIN5

MISP
Type:
Unknown
Country:
Unknown
First seen:
Unknown
Details:

FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.

MITRE ATT&CK: View on MITRE
Techniques Used (11)
ID ATT&CK Tactics
T1018 Remote System Discovery -
T1059 Command and Scripting Interpreter -
T1070.001 Clear Windows Event Logs -
T1070.004 File Deletion -
T1074.001 Local Data Staging -
T1078 Valid Accounts -
T1090.002 External Proxy -
T1110 Brute Force -
T1119 Automated Collection -
T1133 External Remote Services -
T1588.002 Tool -
References (2)
Aliases (105)
G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053 G0053
Related Malware (6)
FLIPSIDE
other
PsExec
tool
pwdump
tool
RawPOS
other
SDelete
tool
Windows Credential Editor
tool
Metadata
ID: 232
Created: 13/01/2026 17:48
Updated: 07/03/2026 04:00