FIN5

FIN5 is a financially motivated threat actor tracked as FIN5. In the provided content, FIN5 is associated with automated collection, command and scripting activity, use of proxying for access maintenance, use of legitimate administrative and dual-use tools, and anti-forensic cleanup. Specifically, FIN5 scanned processes across victim systems in an environment and used automated scripts to retrieve the results. The group maintained access in victim environments by using FLIPSIDE to create a proxy for a backup RDP tunnel. FIN5 scripts saved memory dump data into a specific directory on compromised hosts. FIN5 also used SDelete to clean up the environment and attempt to prevent detection. The content states FIN5 obtained and used a customized version of PsExec, and also used pwdump, SDelete, Windows Credential Editor, and the open-source tool Essential NetTools to map networks and build a list of targets. The content also associates FIN5 with ATT&CK techniques including T1059 Command and Scripting Interpreter, T1119 Automated Collection, T1129 Shared Modules, T1190 Exploit Public-Facing Application, T1505.003 Web Shell, and T1611 Escape to Host, but the supporting behavioral details directly described for FIN5 in the content are process scanning via scripts, memory-dump handling, proxy-backed RDP persistence, network mapping, and cleanup with SDelete. No additional aliases or sub-groups beyond FIN5 are provided in the content.