Skip to main content
Meet us at Black Hat USA 2026— Las Vegas, August 1–6Book a Meeting
Mallory
19 malware familiesExploits CVEs in the wild

FIN13

Also known asElephant BeetleFIN13

FIN13, also referred to as Elephant Beetle, is a financially motivated threat actor. Sygnia reported that Elephant Beetle has been active for at least two years and primarily targets finance and commerce organizations in Latin America, stealing millions of dollars by injecting fraudulent transactions into normal financial activity. Sygnia assessed that Elephant Beetle resembles the group tracked by Mandiant as FIN13, and noted strong ties to Spanish-speaking Latin America, especially Mexico, based on tooling language, infrastructure, and victimology. The group primarily targets Java-based web applications and servers, especially IBM WebSphere and Oracle WebLogic, often on Linux systems. Reported initial access and foothold methods include exploitation of known vulnerabilities such as CVE-2017-1000486, CVE-2015-7450, CVE-2010-5326, and EDB-ID-24963, abuse of default credentials on web management interfaces, deployment of open-source and custom web shells including JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2, and malicious WAR deployments masquerading as legitimate packages such as wsexample.war, wsexamples.war, examples.war, and exampl3s.war. FIN13 has also used HTTP requests to chain multiple web shells and to contact actor-controlled C2 servers prior to exfiltrating stolen data. Observed tradecraft includes file and directory discovery using dir; creation of hidden files and folders in /tmp on Linux and use of attrib.exe to hide gathered host information; use of temporary folders such as C:\Windows\Temp and /tmp prior to exfiltration; host and network reconnaissance using systeminfo, fsutil, fsinfo, nslookup, ipconfig, and PowerShell commands to obtain DNS data; account discovery using GetUserSPNs.vbs and querySpn.vbs to identify accounts associated with Service Principal Names and query SPNs in the domain; credential access by browsing local files on compromised machines for administrative credentials; and collection of stolen credentials, point-of-sale data, and ATM data before exfiltration. For execution and lateral movement, FIN13 has leveraged PowerShell, Windows Command Shell, xp_cmdshell, WMI, SMB, and SQL-server-centric access paths. Reporting states the group used web shells, SQL web shells, custom Java SQL tooling, sqlcmd.exe, modified WmiExec.vbs, and Invoke-SMBExec.ps1, and attempted to use xp_cmdshell on internal MS-SQL servers for remote command execution. Publicly available tools observed in FIN13 operations include Mimikatz, Impacket, PWdump7, ProcDump, Nmap, and Incognito v2. FIN13 has also used certutil to decode Base64-encoded custom malware. Persistence reported for FIN13 includes Windows Registry Run keys, specifically HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hosts. Sygnia also reported persistence through web shells, malicious WAR files, and creation of local MS-SQL accounts with sysadmin privileges.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

58 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

13 of 15 tactics84 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0042
Resource Development
2 techniques
T1588
Obtain Capabilities
T1588.002
Tool
T1608
Stage Capabilities
T1608.001
Upload Malware
T1608.002
Upload Tool
TA0001
Initial Access
3 techniques
T1078
Valid Accounts
T1078.001×2
Default Accounts
T1190×3
Exploit Public-Facing Application
T1566
Phishing
TA0002
Execution
3 techniques
T1047×2
Windows Management Instrumentation
T1053
Scheduled Task/Job
T1053.005×3
Scheduled Task
T1059
Command and Scripting Interpreter
T1059.001×6
PowerShell
T1059.003×5
Windows Command Shell
T1059.004
Unix Shell
T1059.005
Visual Basic
T1059.006
Python
T1059.007×2
JavaScript
TA0003
Persistence
6 techniques
T1053
Scheduled Task/Job
T1053.005×3
Scheduled Task
T1078
Valid Accounts
T1078.001×2
Default Accounts
T1112
Modify Registry
T1136
Create Account
T1505
Server Software Component
T1505.001
SQL Stored Procedures
T1505.003×3
Web Shell
T1547
Boot or Logon Autostart Execution
T1547.001×3
Registry Run Keys / Startup Folder
T1547.009
Shortcut Modification
TA0004
Privilege Escalation
4 techniques
T1053
Scheduled Task/Job
T1053.005×3
Scheduled Task
T1078
Valid Accounts
T1078.001×2
Default Accounts
T1134
Access Token Manipulation
T1547
Boot or Logon Autostart Execution
T1547.001×3
Registry Run Keys / Startup Folder
T1547.009
Shortcut Modification
TA0005
Stealth
6 techniques
T1036×2
Masquerading
T1036.003
Rename Legitimate Utilities
T1036.005
Match Legitimate Resource Name or Location
T1078
Valid Accounts
T1078.001×2
Default Accounts
T1134
Access Token Manipulation
T1140×3
Deobfuscate/Decode Files or Information
T1218
System Binary Proxy Execution
T1218.010×2
Regsvr32
T1564
Hide Artifacts
T1564.001×2
Hidden Files and Directories
T1564.006
Run Virtual Instance
TA0112
Defense Impairment
2 techniques
T1112
Modify Registry
T1222
File and Directory Permissions Modification
TA0006
Credential Access
4 techniques
T1003×3
OS Credential Dumping
T1003.001
LSASS Memory
T1003.002
Security Account Manager
T1187
Forced Authentication
T1552
Unsecured Credentials
T1552.001
Credentials In Files
T1555
Credentials from Password Stores
TA0007
Discovery
7 techniques
T1012
Query Registry
T1016
System Network Configuration Discovery
T1046×3
Network Service Discovery
T1082
System Information Discovery
T1083
File and Directory Discovery
T1087
Account Discovery
T1087.002×2
Domain Account
T1135
Network Share Discovery
TA0008
Lateral Movement
2 techniques
T1021
Remote Services
T1021.001
Remote Desktop Protocol
T1021.002
SMB/Windows Admin Shares
T1021.003
Distributed Component Object Model
T1570
Lateral Tool Transfer
TA0009
Collection
3 techniques
T1005×3
Data from Local System
T1074
Data Staged
T1560
Archive Collected Data
T1560.001
Archive via Utility
TA0011
Command and Control
4 techniques
T1071
Application Layer Protocol
T1071.001×3
Web Protocols
T1090
Proxy
T1090.001
Internal Proxy
T1105
Ingress Tool Transfer
T1572
Protocol Tunneling
TA0010
Exfiltration
1 technique
T1041
Exfiltration Over C2 Channel
ARSENAL

Associated malware families

19 malware families attributed to this actor across reporting.

14 additional families tracked in Mallory.

WEAPONIZED

Associated vulnerabilities

13 CVEs this actor has used in observed campaigns. 13 of them exploited in the wild.

CVE-2010-5326SAP NetWeaver Invoker Servlet Unauthenticated Remote Code ExecutionIn the wildEvidence2

SAP NetWeaver Invoker Servlet Exploit (CVE-2010-5326) The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a Detour attack.

CVE-2025-9491Microsoft Windows LNK File UI Misrepresentation Remote Code Execution VulnerabilityIn the wildEvidence2

This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.

CVE-2001-0507Privilege escalation in Microsoft IIS 5.0 via relative-path system file loadingIn the wildEvidence1

FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).

CVE-2015-7450IBM WebSphere SOAP Deserialization RCEIn the wildEvidence1

FIN13 has exploited known vulnerabilities such as ... CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit) ... to gain initial access.

CVE-2017-1000486PrimeFaces 5.x Application Expression Language Injection RCEIn the wildEvidence1

FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection) ... to gain initial access.

8 more CVEs tied to this actor tracked in Mallory.

IOCS

Observables

127 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.

IOC values are gated. View more in Mallory for domains, IPs, hashes, and other artifacts, or pipe them straight into your SIEM.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping58

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal19

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs13

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables127

Domains, IPs, and hashes tied to this actor, refreshed continuously.