Skip to content

FIN13

IntrusionSet · ATTACK:enterprise:G1016

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:G1016",
  "title": "FIN13",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G1016",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--fd66436e-4d33-450e-ac4c-f7810f1c85f4",
  "external_id": "G1016",
  "domain": "enterprise",
  "created": "2023-07-27T15:24:02.162Z",
  "modified": "2026-07-31T18:48:29.757Z",
  "version": "1.0",
  "aliases": [
    "FIN13",
    "Elephant Beetle"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Elephant Beetle"
    },
    {
      "source_name": "Sygnia Elephant Beetle Jan 2022",
      "url": "https://web.archive.org/web/20220105132433/https://f.hubspotusercontent30.net/hubfs/8776530/Sygnia-%20Elephant%20Beetle_Jan2022.pdf"
    },
    {
      "source_name": "Mandiant FIN13 Aug 2022",
      "url": "https://www.mandiant.com/resources/blog/fin13-cybercriminal-mexico"
    }
  ]
}

Explicit source assertions (57)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:S0357

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--055b4a0f-99aa-4d61-9aa4-a48fff427eb3

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1587.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--09e3c20a-eb8a-4731-9d9b-39f08cc2ecc7

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1078.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0afa86ee-1253-4f15-87a8-abb46422313b

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1572

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0d357a8d-c053-44f0-8777-0e8f8f7bc9a8

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1021.006

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0f9b73b7-734d-4ceb-8a93-776652626c73

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1133

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10c4c857-59e6-4168-b2af-96b6609bdc76

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1087.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--16510fcf-70a0-4da5-9b80-f4772abca436

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1046

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a37062f-9174-47b3-8c1f-2e32db19db1e

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ddb50ab-4c8e-41e6-ba3f-d7718c66f0d5

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1082

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3114ebc8-7dc2-4ee7-8aad-5b764f27a6d8

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1016

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3438e84b-4e73-434a-a699-15289a09d64c

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1090.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--37e781a4-8ac2-49c9-956d-2c78a5cef3df

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1565

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a75d307-2fde-412e-b01e-8cb0e157e762

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3b02e08d-f6fe-4d7b-907d-e8c6534f9a98

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1053.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ca53c3c-ec7d-4453-a80f-2f3306358a2f

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1136.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4248d8aa-eec4-4fd3-9707-ca1ed85bf5c5

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1003.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--427594ef-614a-4e8e-a6ac-abccc0645ada

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1003.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--47f8da55-c38f-4cec-b1c6-241ecb3dd8b8

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1190

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f5f1da9-9396-4b66-a67b-c08470924882

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1589

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56547ce9-04bc-4540-8865-69082bac4e63

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1036.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5c6b16c7-9977-4d40-b0df-75eecf350298

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5d5bda78-ea1a-4e73-b663-6105b77728bb

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1003.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60077740-36a0-4fd6-8c07-0694143b722e

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1564.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6523c653-4f85-425c-a891-6df522e8c841

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:S0002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6736036b-1b05-4857-aded-75a7d42a8be2

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1552.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--68e9977d-a765-45ad-91e9-42db7af8f990

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1657

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6affc901-7028-46ea-8d85-0e7d05ca9467

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1588.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--72b81f9e-8760-4d46-9ed3-4b91b12f6299

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1134.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--76b2e00d-78bb-4aea-a787-46289b8540ef

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1105

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--779b1ed2-5ff6-408d-837e-571bbc4ecc4a

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:S0363

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--830ebcfb-58a9-4a11-b319-ca49ce7bfe1b

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1071.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--860147c4-3eb8-4909-8a02-081e67347ba7

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:S0160

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a16836c-ad80-4c4f-8c4a-cfc639450a5a

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1550.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a86cd72-8386-4c75-8362-7b9020add12b

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1059.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8d24d635-bc2e-48a2-87a0-01d8e10c62f2

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1547.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9992c76b-149d-4842-80b5-dbd37f0369be

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1016.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4a03850-ad3e-4599-af58-5aa67c63fb93

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1036

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a53879ca-2185-42ea-84de-823878fb871d

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1059.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a759cca5-d8f2-4704-88c1-df76a1a1625e

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1098.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a94e85d8-62a1-43a2-8443-245bf61ec115

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1574.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a9830f35-1ffa-46a3-b061-07148dd09753

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1021.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--aa2e1086-00f6-45f3-9159-72f2cfd50001

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1590.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b79256c4-9067-44ed-8e96-8b11a4c348e8

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1135

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c31ccdbd-e501-41cb-98d9-46cdff9be1c0

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1560.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--cf401927-62cc-4b10-99c1-c48841054e1e

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1140

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7702458-8b9d-49e8-a494-b5d87681f2c5

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1556

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df6b68c8-17b5-45b9-8ad1-908c89074531

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e75c948b-7ce8-4872-a3c4-4a2b01828418

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1021.004

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e76f8463-45ca-489b-86e8-ee854c2a0f71

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1074.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eb63ea0a-1d2d-4d6a-9006-a60dacc035da

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1056.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee3648f7-1066-4a85-9652-2ce54fc7964a

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1036.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f5ce003c-c220-4c19-a45f-b2e2a6e924e2

Sygnia Elephant Beetle Jan 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1049

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f6b88216-8142-4151-af2b-31257a3c2857

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1083

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f97798e2-ec1a-4cad-ab07-f61ef6cb8f78

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc5cf1ea-f46f-4527-a8b5-7317c4e61dee

Sygnia Elephant Beetle Jan 2022 · Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1069

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fcddadbd-d32b-4cc6-afd4-de3c8629f260

Mandiant FIN13 Aug 2022

ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1087

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff16c592-9eae-4c27-97a5-444e148883cd

Mandiant FIN13 Aug 2022

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.