{
  "id": "fin5",
  "name": "FIN5",
  "aliases": [],
  "domain": "cyber",
  "country": "UNK",
  "category": "Cybercriminal group",
  "status": "tracked",
  "fielded": null,
  "operators": [],
  "summary": "FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries.",
  "specs": [
    {
      "k": "sponsor",
      "v": "Financially motivated group; members likely Russian-speaking",
      "src": [
        "mitre-g0053"
      ],
      "conf": "medium"
    },
    {
      "k": "active_since",
      "v": 2008,
      "src": [
        "mitre-g0053"
      ],
      "conf": "medium",
      "note": "At least 2008"
    },
    {
      "k": "attack_id",
      "v": "G0053",
      "src": [
        "mitre-g0053"
      ],
      "conf": "high"
    },
    {
      "k": "targets",
      "v": "FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information.",
      "src": [
        "mitre-g0053"
      ],
      "conf": "medium"
    },
    {
      "k": "techniques_count",
      "v": 11,
      "src": [
        "mitre-g0053"
      ],
      "conf": "high",
      "note": "ATT&CK v20.1"
    },
    {
      "k": "software",
      "v": "FLIPSIDE, PsExec, pwdump, RawPOS, SDelete, Windows Credential Editor",
      "src": [
        "mitre-g0053"
      ],
      "conf": "high",
      "note": "6 malware and tool entries linked in ATT&CK"
    }
  ],
  "payloads": [],
  "variants": [],
  "art": "cyber",
  "image": null,
  "verified": null,
  "notes": "FIN5 is a financially motivated threat group that has targeted personally identifiable information and payment card information. The group has been active since at least 2008 and has targeted the restaurant, gaming, and hotel industries. The group is made up of actors who likely speak Russian. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.",
  "changelog": [
    {
      "date": "2026-11-08",
      "change": "Entry created from MITRE ATT&CK Enterprise v20.1 (group G0053)"
    }
  ],
  "url": "https://www.defensepedia.com/systems/fin5.html",
  "sources": {
    "mitre-g0053": {
      "title": "FIN5, Group G0053",
      "publisher": "MITRE ATT&CK",
      "url": "https://attack.mitre.org/groups/G0053/",
      "published": "2026-07-31",
      "tier": 2,
      "checked": "2026-11-08"
    }
  }
}