Opening Forensia workspaceacquiring
Loading the current evidence view. Navigation and account controls remain available.
Loading recent evidenceacquiring
Threat actors
Loading the current evidence view. Navigation and account controls remain available.
11
techniques
6
software
8,600
corpus matches
profile
FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian.
techniques
11 attributed · most-instrumented first
software
6 malware & tools attributed
Windows Credential Editor
S0005
pwdump
S0006
PsExec
S0029
RawPOS
S0169
FLIPSIDE
S0173
SDelete
S0195
read this carefully
8,600 corpus matches is not attribution
That count is indicators which exhibit techniques FIN5 is known to use. Many unrelated operators use the same techniques. Treat it as a shared-technique signal for hunting, never as first-party attribution to this group.
indicators exhibiting these techniques
Top by severity: each resolves to its own verdict.
showing 30 of 8,600