D
CyberUnattributed

FIN13

Cybercriminal groupTrackedPending verification

Also known as: Elephant Beetle

CyberUNK
Identification silhouette. Not drawn to scale between entries.
Fact cardConfidence · Source
System
TypeCybercriminal group
Alternative designationsElephant Beetle
ProliferationOrigin country only
Active since2016At least 2016Med[1]
MITRE ATT&CK IDG1016High[1]
Capabilities
ATT&CK techniques used53ATT&CK v20.1High[1]
Malware and toolscertutil, Empire, Impacket, Mimikatz4 malware and tool entries linked in ATT&CKHigh[1]
Attribution and activity
Attributed sponsorFinancially motivated groupMed[1]
TargetsFIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016.Med[1]
Notes
FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII. Description adapted from MITRE ATT&CK®, © The MITRE Corporation, used under the ATT&CK Terms of Use.
Summary

FIN13 is a financially motivated cyber threat group that has targeted the financial, retail, and hospitality industries in Mexico and Latin America, as early as 2016. FIN13 achieves its objectives by stealing intellectual property, financial data, mergers and acquisition information, or PII.

Draft entry. Values come from the cited public sources and are awaiting editor verification.
CompareJSON
Operators
Sources
  1. FIN13, Group G1016, MITRE ATT&CK
    Published/updated 2026-07-31 · Tier 2 · checked 2026-11-08
Change log
  • 2026-11-08 Entry created from MITRE ATT&CK Enterprise v20.1 (group G1016)