FIN13
FIN13, also referred to as Elephant Beetle, is a financially motivated threat actor. Sygnia reported that Elephant Beetle has been active for at least two years and primarily targets finance and commerce organizations in Latin America, stealing millions of dollars by injecting fraudulent transactions into normal financial activity. Sygnia assessed that Elephant Beetle resembles the group tracked by Mandiant as FIN13, and noted strong ties to Spanish-speaking Latin America, especially Mexico, based on tooling language, infrastructure, and victimology. The group primarily targets Java-based web applications and servers, especially IBM WebSphere and Oracle WebLogic, often on Linux systems. Reported initial access and foothold methods include exploitation of known vulnerabilities such as CVE-2017-1000486, CVE-2015-7450, CVE-2010-5326, and EDB-ID-24963, abuse of default credentials on web management interfaces, deployment of open-source and custom web shells including JspSpy, reGeorg, MiniWebCmdShell, and Vonloesch Jsp File Browser 1.2, and malicious WAR deployments masquerading as legitimate packages such as wsexample.war, wsexamples.war, examples.war, and exampl3s.war. FIN13 has also used HTTP requests to chain multiple web shells and to contact actor-controlled C2 servers prior to exfiltrating stolen data. Observed tradecraft includes file and directory discovery using dir; creation of hidden files and folders in /tmp on Linux and use of attrib.exe to hide gathered host information; use of temporary folders such as C:\Windows\Temp and /tmp prior to exfiltration; host and network reconnaissance using systeminfo, fsutil, fsinfo, nslookup, ipconfig, and PowerShell commands to obtain DNS data; account discovery using GetUserSPNs.vbs and querySpn.vbs to identify accounts associated with Service Principal Names and query SPNs in the domain; credential access by browsing local files on compromised machines for administrative credentials; and collection of stolen credentials, point-of-sale data, and ATM data before exfiltration. For execution and lateral movement, FIN13 has leveraged PowerShell, Windows Command Shell, xp_cmdshell, WMI, SMB, and SQL-server-centric access paths. Reporting states the group used web shells, SQL web shells, custom Java SQL tooling, sqlcmd.exe, modified WmiExec.vbs, and Invoke-SMBExec.ps1, and attempted to use xp_cmdshell on internal MS-SQL servers for remote command execution. Publicly available tools observed in FIN13 operations include Mimikatz, Impacket, PWdump7, ProcDump, Nmap, and Incognito v2. FIN13 has also used certutil to decode Base64-encoded custom malware. Persistence reported for FIN13 includes Windows Registry Run keys, specifically HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\hosts. Sygnia also reported persistence through web shells, malicious WAR files, and creation of local MS-SQL accounts with sysadmin privileges.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
58 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
19 malware families attributed to this actor across reporting.
14 additional families tracked in Mallory.
Associated vulnerabilities
13 CVEs this actor has used in observed campaigns. 13 of them exploited in the wild.
SAP NetWeaver Invoker Servlet Exploit (CVE-2010-5326) The Invoker Servlet on SAP NetWeaver Application Server Java platforms, possibly before 7.3, does not require authentication, which allows remote attackers to execute arbitrary code via an HTTP or HTTPS request, as exploited in the wild in 2013 through 2016, aka a Detour attack.
This detection identifies instances where Windows Explorer.exe spawns PowerShell or cmd.exe processes, particularly focusing on executions initiated by LNK files. This behavior is associated with the ZDI-CAN-25373 Windows shortcut zero-day vulnerability, where specially crafted LNK files are used to trigger malicious code execution through cmd.exe or powershell.exe. This technique has been actively exploited by multiple APT groups in targeted attacks through both HTTP and SMB delivery methods.
FIN13 has used IISCrack.dll as a side-loading technique to load a malicious version of httpodbc.dll on old IIS Servers (CVE-2001-0507).
FIN13 has exploited known vulnerabilities such as ... CVE-2015-7450 (WebSphere Application Server SOAP Deserialization Exploit) ... to gain initial access.
FIN13 has exploited known vulnerabilities such as CVE-2017-1000486 (Primefaces Application Expression Language Injection) ... to gain initial access.
8 more CVEs tied to this actor tracked in Mallory.
Observables
127 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
20 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Listed as an associated threat actor in the detection annotation for exploitation of the public-facing PTC Windchill vulnerability CVE-2026-4681.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection.
Listed as a threat actor associated with the PowerShell P/Invoke process injection API chain detection and related ATT&CK techniques.
Listed as a threat actor associated with PowerShell execution behavior relevant to this detection analytic.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.