Loading threat actor…
FIN13 is a financially motivated cybercriminal threat actor associated with prolonged intrusions and financial theft. Its activity overlaps with the Elephant Beetle cluster, designated TG2003, which targets finance and commerce organizations primarily in Latin America. The attackers establish durable access, spend months studying financial applications and transaction workflows, and introduce numerous small fraudulent transactions designed to resemble legitimate business activity. These operations have accumulated millions of dollars in theft. The associated activity favors legacy Java-based applications and web servers, including WebSphere, WebLogic, and SAP NetWeaver. Initial access relies on known application vulnerabilities and default administrative credentials. The attackers deploy web shells and malicious WAR applications, establish backdoors, and tunnel traffic to reach internal systems. FIN13 has obtained administrative credentials from local files and concealed files and directories on compromised Linux and Windows systems. Additional techniques documented in the associated Elephant Beetle activity include credential dumping, recovery of reversibly encoded application passwords, SQL Server command execution, privileged database accounts, and lateral movement through SMB and WMI. Operational concealment includes disguising web shells as legitimate application resources, using victim-specific artifact names, hiding collected information, and encoding payloads and communications. The attackers use custom tools alongside publicly available utilities for reconnaissance, scanning, remote execution, file transfer, and credential collection. Persistence through web applications and database accounts supports extended access to financial systems.
Who, where, and from where this actor operates. Pulled from open-source reporting and Mallory's analyst review.
Sectors the actor has been observed targeting.
Geographies tied to known operations.
Attributed origin per open-source reporting.
131 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt.
24 malware families Mallory has associated with this actor across public reporting.
19 additional families tracked in Mallory.
13 CVEs Mallory has associated with this actor across public reporting. 13 of them are exploited in the wild (not necessarily by this actor).
7 more CVEs tied to this actor tracked in Mallory.
127 indicators attributed to this actor. Values are masked here and available in full in Mallory.
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.