ATT&CK

Threat actorsMITRE ATT&CK intrusion sets Malware & toolsSoftware families & tooling TechniquesTactics & techniques

ReportsPublished APT reporting SourcesEvery feed behind the archive

Developers

JSON APIFree CORS-enabled endpoints MCP serverModel Context Protocol access Source codeThis project on GitHub

Loading the archive…

Open Threat Intel Archive

Indicators are treated as facts and kept with their source_vendor, source URL, and dates; every feed is credited and redistribution-restricted feeds are flagged, not dropped. ATT&CK content is © MITRE, used under its terms. See NOTICE. The archive reports intelligence; it does not editorialize threat.

Indicators Actors Sources API GitHub

Open Threat Intel Archive

← Threat actors

G1016threat actor

FIN13

a.k.a. Elephant Beetle

FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.

MITRE ATT&CK ↗

Linked entities · 24

usesS0357Impacket usesT1587.001Malware usesT1078.001Default Accounts usesT1572Protocol Tunneling usesT1021.006Windows Remote Management usesT1133External Remote Services usesT1087.002Domain Account usesT1046Network Service Discovery usesT1505.003Web Shell usesT1082System Information Discovery usesT1016System Network Configuration Disc…usesT1090.001Internal Proxy usesT1565Data Manipulation usesT1059.001PowerShell usesT1053.005Scheduled Task usesT1136.001Local Account usesT1003.002Security Account Manager usesT1003.003NTDS usesT1190Exploit Public-Facing Application usesT1589Gather Victim Identity Information usesT1036.004Masquerade Task or Service usesT1021.002SMB/Windows Admin Shares usesT1003.001LSASS Memory usesT1564.001Hidden Files and Directories