group

FIN5 G0053

Created: 16 January 2018
Last modified: 31 July 2026
Alias: FIN5

FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. [1] [2] [3]

Techniques35th pct

Tactics66th pct

Tools & malware67th pct

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing G0053

Reach is how much of ATT&CK this group touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 176 ATT&CK groups only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID
	Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations	Generic	test	image_load	windows	Sysmon	Execution Command and Scripting Interpreter	-	high	X__Junior (Nextron Systems)	2023-07-11	—	799a5f48-0ac1-4e0f-9152-71d137d48c2a
	Detects accounts that are created or deleted by non-approved users.	Placeholder	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1'	2022-08-11	2023-12-15	c98184ba-4a27-4e10-b7b7-da48e71f4d25
	Detects when an account was created and deleted in a short period of time.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', MikeDuddington, '@dudders1', Tim Shelton	2022-08-11	2022-08-18	6f583da0-3a90-4566-a4ed-83c09fe18bbf
	Identifies user account which has been locked because the user tried to sign in too many times with an incorrect user ID or password.	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Credential Access Brute Force	-	medium	AlertIQ	2021-10-10	2022-12-25	2b7d6fc0-71ac-4cf7-8ed1-b5788ee5257a
	This method uses uncommon error codes on failed logons to determine suspicious activity and tampering with accounts that have been disabled or somehow restricted.	Generic	test	authentication	windows	WinEventLog Security	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Florian Roth (Nextron Systems)	2017-02-19	2025-10-17	9eb99343-d336-4020-a3cd-67f3819e68ee
	Detects usage of the "Get-AdComputer" to enumerate Computers or properties within Active Directory.	Generic	test	ps_script	windows	PowerShell	Discovery Account Discovery Domain Account Discovery Remote System Discovery	-	low	frack113	2022-03-17	2023-07-08	36bed6b2-e9a0-4fff-beeb-413a92b86138
	Identifies that users were active from an IP address that has been identified as an anonymous proxy IP address.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	be4d9c86-d702-4030-b52e-c7859110e5e8
	Detects usage of winget to add a new insecure (http) download source. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-04-17	—	81a0ecb5-0a41-4ba1-b2ba-c944eb92bfa2
	Detects usage of winget to add new additional download sources	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-04-17	—	05ebafc8-7aa2-4bcd-a269-2aec93f9e842
	Detects usage of winget to add new potentially suspicious download sources	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-04-17	2023-12-04	c15a46a0-07d4-4c87-b4b6-89207835a83b
	Detects the deletion of the "Zone.Identifier" ADS. (...)	Hunting	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	low	frack113	2023-09-04	—	7eac0a16-5832-4e81-865f-0268a6d19e4b
	Detects the deletion of the "Zone.Identifier" ADS by an uncommon process. (...)	Generic	test	file_delete	windows	Sysmon	Stealth Indicator Removal File Deletion	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-09-04	2025-07-04	3109530e-ab47-4cc6-a953-cac5ebcc93ae
	Device code flow is an OAuth 2.0 protocol flow specifically for input constrained devices and is not used in all environments. (...)	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-01	—	248649b7-d64f-46f0-9fb2-a52774166fb5
	Resource owner password credentials (ROPC) should be avoided if at all possible as this requires the user to expose their current password credentials to the application directly. (...)	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mark Morowczynski '@markmorow', Bailey Bercik '@baileybercik'	2022-06-01	—	55695bc0-c8cf-461f-a379-2535f563c854
Splunk	The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Resource Development Compromise Accounts Cloud Accounts	-	medium	Patrick Bareiss, Splunk	2022-08-07	2026-05-13	d15e9bd9-ef64-4d84-bc04-f62955a9fee8
Splunk	The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Discovery Cloud Infrastructure Discovery	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	726959fe-316d-445c-a584-fa187d64e295
Splunk	The following analytic detects updates to the SAML provider in AWS. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Patrick Bareiss, Splunk	2022-10-04	2026-05-13	635c26cc-0fd1-4098-8ec9-824bf9544b11
	Detects spawning of suspicious child processes by Atlassian Confluence server which may indicate suc (...)	Emerging	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter Initial Access Exploit Public-Facing Application	CVE-2022-26134	high	Nasreddine Bencherchali (Nextron Systems)	2022-06-03	—	7fb14105-530e-4e2e-8cfb-99f7d8700b66
	Identifies two sign-ins originating from geographically distant locations, where at least one of the locations may also be atypical for the user, given past behavior.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	1a41023f-1e70-4026-921a-4d9341a9038e
	Detect when authentications to important application(s) only required single-factor authentication	Placeholder	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	MikeDuddington, '@dudders1'	2022-07-28	2026-05-08	f272fb46-25f2-422c-b667-45837994980f
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	ps_script	windows	PowerShell	Collection Automated Collection	-	medium	frack113	2021-07-28	2022-12-25	c1dda054-d638-4c16-afc8-53e007f3fbc5
	Once established within a system or network, an adversary may use automated techniques for collecting internal data.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Automated Collection Credential Access Unsecured Credentials Credentials In Files	-	medium	frack113	2021-07-28	2022-11-11	f576a613-2392-4067-9d1a-9345fb58d8d1
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	The following analytic identifies access denied error when attempting to invoke AWS Bedrock models. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Lateral Movement Use Alternate Authentication Material Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Bhavin Patel, Splunk	2025-03-25	2026-05-13	c53a8e62-f741-11ee-9f6e-acde48001122
	Detects failed AWS console login attempts due to authentication failures. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force	-	medium	Ivan Saakov, Nasreddine Bencherchali	2025-10-19	—	6393e346-1977-46ef-8987-ad414a145fad
Splunk	The following analytic detects the resetting of the master user password for an Amazon RDS DB instance. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Resource Development Compromise Accounts Cloud Accounts	-	medium	Gowthamaraj Rajendran, Splunk	2022-08-07	2026-05-13	6153c5ea-ed30-4878-81e6-21ecdb198189
Splunk	The following analytic identifies anomalous GetObject API activity in AWS, indicating potential data exfiltration attempts. (...)	Anomaly	stable	cloud_audit	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	e4384bbf-5835-4831-8d85-694de6ad2cc6
Splunk	The following analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-24	2026-05-13	04455dd3-ced7-480f-b8e6-5469b99e98e2
Splunk	The following analytic detects the creation of an AWS DataSync task, which could indicate potential data exfiltration. (...)	Generic	stable	scheduled_job	-	AWS CloudTrail · AWS	Collection Automated Collection	-	medium	Bhavin Patel, Splunk	2023-04-10	2026-05-13	05c4b09f-ea28-4c7c-a7aa-a246f665c8a2
Splunk	The following analytic detects multiple failed attempts to assume an AWS IAM role, indicating a potential brute force attack. (...)	Generic	stable	cloud_audit	-	AWS CloudTrail · AWS	Credential Access Brute Force Discovery Cloud Infrastructure Discovery	-	medium	Michael Haag, Splunk	2021-04-06	2026-05-13	f19e09b0-9308-11eb-b7ec-acde48001122
	Detects the import of SSH key pairs into AWS EC2, which may indicate an attacker attempting to gain unauthorized access to instances. (...)	Generic	experimental	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Ivan Saakov	2024-12-19	—	92f84194-8d9a-4ee0-8699-c30bfac59780
	Detects when an user creates or invokes a lambda function.	Unsupported	unsupported	cloud_audit	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Austin Songer @austinsonger	2021-10-03	2023-03-24	d914951b-52c8-485f-875e-86abab710c0b
Splunk	The following analytic detects updates to the SAML provider in AWS. (...)	Generic	stable	account_management	-	AWS CloudTrail · AWS	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Rod Soto, Splunk	2021-01-26	2026-05-13	2f0604c6-6030-11eb-ae93-0242ac130002
	Identifies when suspicious SAML activity has occurred in AWS. (...)	Generic	test	cloud_audit	-	AWS CloudTrail · AWS	Privilege Escalation Abuse Elevation Control Mechanism Lateral Movement Use Alternate Authentication Material Application Access Token Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer	2021-09-22	2022-12-18	f43f5d2f-3f2a-4cc8-b1af-81fde7dbaf0e
Splunk	The following analytic detects unusual authentication activity in Azure AD, specifically when a single user account has over 8 authentication attempts using 3+ unique application IDs and 5+ unique user agents within a short period. (...)	Anomaly	stable	authentication	-	Microsoft 365	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Mauricio Velazco, Splunk	2023-11-16	2026-05-13	5d8bb1f0-f65a-4b4e-af2e-fcdb88276314
	Indicates user activity that is unusual for the user or consistent with known attack patterns.	Generic	test	-	-	Azure Risk Detection · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-07	—	a2cb56ff-4f46-437a-a0fa-ffa4d1303cba
	Identifies when an user or application modified the federation settings on the domain.	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer	2021-09-06	2022-06-08	352a54e1-74ba-4929-9d47-8193d67aba1e
	Identifies when an admission controller is executed in Azure Kubernetes. (...)	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Credential Access Unsecured Credentials Container API Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer @austinsonger	2021-11-25	2022-12-18	a61a3c56-4ce2-4351-a079-88ae4cbd2b58
	Detects a successful login to the Microsoft Intune Company Portal which could allow bypassing Conditional Access Policies and InTune device trust using a tool like TokenSmith.	Generic	experimental	-	-	Audit · Microsoft 365	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Josh Nickels, Marius Rothenbücher	2025-01-08	—	13f2d3f5-6497-44a7-bf5f-dc13ffafe5dc
	Identifies when a new cloudshell is created inside of Azure portal.	Generic	test	cloud_audit	-	Azure Activity Logs · Azure	Execution Command and Scripting Interpreter	-	medium	Austin Songer	2021-09-21	2022-08-23	72af37e2-ec32-47dc-992b-bc288a2708cb
	Detects when a user has been elevated to manage all Azure Subscriptions. (...)	Generic	test	cloud_audit	-	Azure Audit Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	high	Austin Songer @austinsonger	2021-11-26	2026-09-26	ca9bf243-465e-494a-9e54-bf9fc239057d
	Detects when there is a interruption in the authentication process.	Generic	test	authentication	-	Azure Sign-in Logs · Azure	Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Austin Songer @austinsonger	2021-11-26	2022-12-18	8366030e-7216-476b-9927-271d79f13cf3
	Detects backup catalog deletions	Generic	test	-	windows	WinEventLog Application	Stealth Indicator Removal File Deletion	-	medium	Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection)	2017-05-12	2022-12-25	9703792d-fd9a-456d-a672-ff92efe4806a
	Detects user authentication failure events. (...)	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts Cloud Accounts	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	70ed1d26-0050-4b38-a599-92c53d57d45a
	Detects SSH user login access failures. (...)	Generic	test	cloud_audit	-	Bitbucket Audit · Bitbucket	Credential Access Brute Force Lateral Movement Remote Services SSH	-	medium	Muhammad Faisal (@faisalusuf)	2024-02-25	—	d3f90469-fb05-42ce-b67d-0fded91bbef3
	detects BPFDoor .lock and .pid files access in temporary file storage facility	Generic	test	file_event	linux	Linux Auditd	Execution Command and Scripting Interpreter Execution Native API	-	high	Rafal Piasecki	2022-08-10	2026-03-30	808146b2-9332-4d78-9416-d7e47012d83d
	Detects the use of the "capsh" utility to invoke a shell.	Generic	test	process_creation	linux	Sysmon	Execution Command and Scripting Interpreter	-	high	Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)	2024-09-02	—	db1ac3be-f606-4e3a-89e0-9607cbe6b98a
	Detects patterns found in process executions cause by China Chopper like tiny (ASPX) webshells	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Discovery Remote System Discovery Persistence Server Software Component Web Shell Discovery System Owner/User Discovery	CVE-2022-41040 CVE-2022-41082	high	Florian Roth (Nextron Systems), MSTI (query)	2022-10-01	—	fa3c117a-bc0d-416e-a31b-0c0e80653efb
	Detects BGP failures which may be indicative of brute force attacks to manipulate routing	Generic	test	-	-	BGP · Cisco	Credential Access, Collection Adversary-in-the-Middle Credential Access Brute Force Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	low	Tim Brown	2023-01-09	2023-01-23	56fa3cd6-f8d6-4520-a8c7-607292971886
	Find information about network devices that is not stored in config files	Generic	test	authentication	-	Cisco AAA · Cisco	Discovery File and Directory Discovery Discovery Password Policy Discovery Discovery Process Discovery Discovery Remote System Discovery Discovery System Information Discovery Discovery System Network Configuration Discovery Discovery System Network Connections Discovery Discovery System Owner/User Discovery Discovery System Time Discovery	-	low	Austin Clark	2019-08-12	2023-01-04	9705a6a1-6db6-4a16-a987-15b7151e299b

Title

Description

FIN5 G0053

FIN5 G0053

FIN5 MITRE reference G0053

Standing G0053

Reach

Coverage

FIN5 detections G0053