Skip to main content
Mallory
3 malware familiesExploits CVEs in the wild

FIN5

Also known asFIN5

FIN5 is a financially motivated threat actor tracked as FIN5. In the provided content, FIN5 is described conducting post-compromise activity in victim environments including scanning processes across victim systems and using automated scripts to retrieve the results. The group maintained access by using FLIPSIDE to create a proxy for a backup RDP tunnel. FIN5 used SDelete to clean up the environment and attempt to prevent detection, and also cleared event logs on victim systems. The content states that FIN5 obtained and used a customized version of PsExec and also used pwdump, Windows Credential Editor, Essential NetTools for network mapping and target list building, and GET2 Penetrator to search for remote login and hard-coded credentials. The content also notes that FIN5 scripts saved memory dump data into a specific directory on hosts in the victim environment. No additional aliases or sub-groups beyond FIN5 are directly supported by the provided content.

Share:
Are they targeting you?

Know when an actor pivots toward your sector

Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.

MITRE ATT&CK

Tradecraft

30 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.

12 of 15 tactics40 techniques×N= number of intelligence reports citing this technique
MITRE ATT&CK
TA0043
Reconnaissance
1 technique
T1595
Active Scanning
TA0042
Resource Development
2 techniques
T1586
Compromise Accounts
T1586.003
Cloud Accounts
T1588
Obtain Capabilities
T1588.002×4
Tool
TA0001
Initial Access
4 techniques
T1078×7
Valid Accounts
T1133×9
External Remote Services
T1190×8
Exploit Public-Facing Application
T1566
Phishing
T1566.001×2
Spearphishing Attachment
T1566.002×2
Spearphishing Link
TA0002
Execution
3 techniques
T1059×15
Command and Scripting Interpreter
T1129×2
Shared Modules
T1203
Exploitation for Client Execution
TA0003
Persistence
4 techniques
T1078×7
Valid Accounts
T1098
Account Manipulation
T1133×9
External Remote Services
T1505
Server Software Component
T1505.003
Web Shell
TA0004
Privilege Escalation
3 techniques
T1068
Exploitation for Privilege Escalation
T1078×7
Valid Accounts
T1098
Account Manipulation
TA0005
Stealth
2 techniques
T1070×3
Indicator Removal
T1070.001×2
Clear Windows Event Logs
T1070.004×11
File Deletion
T1078×7
Valid Accounts
TA0006
Credential Access
2 techniques
T1003×2
OS Credential Dumping
T1110×5
Brute Force
TA0007
Discovery
5 techniques
T1018×6
Remote System Discovery
T1046
Network Service Discovery
T1057×3
Process Discovery
T1082
System Information Discovery
T1580×2
Cloud Infrastructure Discovery
TA0008
Lateral Movement
1 technique
T1021
Remote Services
T1021.002
SMB/Windows Admin Shares
T1021.005
VNC
TA0009
Collection
2 techniques
T1074
Data Staged
T1119×4
Automated Collection
TA0011
Command and Control
1 technique
T1090
Proxy
T1090.003
Multi-hop Proxy
WEAPONIZED

Associated vulnerabilities

7 CVEs this actor has used in observed campaigns. 7 of them exploited in the wild.

CVE-2021-31207Post-auth arbitrary file write in Microsoft Exchange Server (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2021-34473ProxyShell pre-auth SSRF/authentication bypass in Microsoft Exchange AutodiscoverIn the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2021-34523Microsoft Exchange PowerShell Backend Elevation of Privilege (ProxyShell)In the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

CVE-2022-26134Atlassian Confluence Server and Data Center OGNL Injection RCEIn the wildEvidence1

The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence... This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise.

CVE-2022-41040ProxyNotShell SSRF in Microsoft Exchange ServerIn the wildEvidence1

This analytic identifies potential exploitation attempts of ProxyShell (CVE-2021-34473, CVE-2021-34523, CVE-2021-31207) and ProxyNotShell (CVE-2022-41040, CVE-2022-41082) vulnerabilities in Microsoft Exchange Server.

2 more CVEs tied to this actor tracked in Mallory.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: sector and geo overlap with your footprint, the IOCs they’re burning right now, detection coverage, and what to do next.
Target overlap

Match sector + geo + tech-stack targeting against your real footprint.

Tradecraft mapping30

Every observed MITRE ATT&CK technique, grouped by tactic.

Malware arsenal3

Families this actor is known to deploy, with IOCs and behavior.

Exploited CVEs7

CVEs this actor has used in known campaigns.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Observables

Domains, IPs, and hashes tied to this actor, refreshed continuously.