Loading threat actor…
FIN10 is a threat actor tracked as FIN10. In the provided content, FIN10 is described using PowerShell and Windows command shell activity, scheduled tasks, Meterpreter, and RDP during intrusions. Observed behaviors include executing malicious .bat files containing PowerShell commands; using PowerShell for execution; using PowerShell Empire to establish persistence; adding a Run key via the Registry option in PowerShell Empire; establishing persistence with S4U tasks and the Scheduled Task option in PowerShell Empire; using Meterpreter to enumerate users on remote systems; relying on publicly available software to gain footholds and establish persistence in victim environments; using RDP for lateral movement within victim environments; and using batch scripts and scheduled tasks to delete critical system files. The content also maps FIN10 to PowerShell execution (T1059.001) and Windows Command Shell execution (T1059.003).
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
4 malware families attributed to this actor across reporting.
1 CVE this actor has used in observed campaigns. 1 of them exploited in the wild.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
Listed as a threat actor associated with Azure Active Directory account takeover, persistence, privilege escalation, and related cloud-focused post-compromise activity detected via PowerShell module installation.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.