Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
11
techniques
1
software
10,261
corpus matches
profile
FIN10 is a financially motivated threat group that has targeted organizations in North America since at least 2013 through 2016. The group uses stolen data exfiltrated from victims to extort organizations.
techniques
11 attributed · most-instrumented first
software
1 malware & tools attributed
Empire
S0363
read this carefully
10,261 corpus matches is not attribution
That count is indicators which exhibit techniques FIN10 is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
File Deletion
stealth
showing 30 of 10,261